Repository navigation
Replies: 8 comments 10 replies
|
@yordis It'd be great to have the "Magic link" authentication method included in Keycloak as it'd be also suitable for 2FA. IMHO, it's a step forward and it can be also useful for adaptive MFA. It's very similar to the Keycloak reset credential approach, where the email is sent to the user with a token, so there might be only a few custom changes in order to accomplish the goal. It can be also very useful with the Trusted devices feature in the future as it could be used as the complete passwordless approach. @mposolda WDYT? |
|
Such authentication is already possible via action tokens. A custom implementation of action token is in keycloak quickstarts. Note that in that quickstart, invocation of external application is shown, but that one is not necessary at all, leading to the "magic link" functionality. |
|
Oh, that's nice. Thanks for that. It'd be good to include it among the other authenticators and extend our possibilities. We'd just need to have more opinions on this. |
|
Here's the updated Keycloak Quickstart link. I haven't tried it myself for passwordless auth though, have you @mabartos ? |
|
@codespearhead Nope, I haven't. I'm not sure what's the process behind promoting stuff from quickstarts to the main codebase, but I'd suggest creating an RFE in this repository. It would be good to express all the requirements, explain the motivation around the promotion, and what value it might bring to Keycloak. Additionally, it'd be great if users would react to the RFE to show it's the thing the community wants. |
|
Please check code given in below link. You can use keycloak for OTP validation as primary login. Many portal want either user can login with username/password or can do login by entering registered mobile number and enter received OTP on portal to login. Valid token needs to be generated by calling keycloak API. This plugin serve the purpose of both user can login with either password or OTP. OOTB keycloak does not provide this feature, instead it provide 2F OTP authenticator with well-known OTP application. |
|
Hi, I would like to have an OTP sent by email, as a second auth factor, so if I understand, Also, please note that the various links in the answers are currently broken... Regards |
|
Hi, @MGLL thank you for the link, I already know that extension, but its license does not permit its use :( https://github.com/p2-inc/keycloak-magic-link/blob/main/COPYING So it seems that we are currently missing a true open source plugin for it. Regards |
@FStefanni This is incorrect. The license permits broad use. You are more than welcome to use it for a commercial purpose. I think there is some confusion about the Elastic v2 license. The brief history there is that AWS and others starting selling hosting of Elasticsearch when it was ASL 2.0. In a move to keep Elasticsearch open source, but to prohibit cloud providers and resellers from selling hosting of the product itself, they changed their license to what eventually became Elastic v2. Since then, many companies who are both building open source tools, and extending existing tools, have adopted such a license approach (e.g. CockroachDB, MongoDB, Neo4j, Confluent, etc.). Their licenses restrict cloud providers and other resellers from offering their software as a service without purchasing a commercial license. Phase Two (the author of the That does not mean that you can't "use it for a commercial purpose" or "its license does not permit its use". These statements are incorrect and misleading. If you are using it for any use case that does not constitute providing the software itself as a service, then that use is permitted. Some examples:
We are trying to encourage the use of our extensions, while prohibiting their use by competitors. |
|
Hi, @xgp thank you for the clarification. It was not clear to me. Regards |
The distinction between "paid SaaS service" and "host Keycloak as a service" is not clear to me. Where can such a license be acquired? I see an offering "Enterprise Keycloak Support Packages" on phasetwo.io, is this the "commercial license"? |
|
If you compete with anyone on that list (Phase Two, Cloud-IAM, Bare.id, Elestio, etc.) then you need to contact us (support@phasetwo.io) for a commercial license. There is no information on the website regarding software licenses for our competitors. |
|
@FStefanni maybe you can edit the original question with this answer |
|
Hi, Using email as 2FA is really a bad idea security wise. It's not really a second factor. If user email got compromised, the attacher can reset the password using the email, and send the OTP/magic link to the email and gain full access to the account. NIST recommends against it. |
Magic Link Passwordless AuthenticationIt seems the discussion got sidetracked by focusing on "email" and "SMS" for MFA, which serve a different use case than magic links. Mabartos' suggestion seems to be on the right track, though it hasn't been implemented yet. If you're interested in this feature, feel free to share your use case here and upvote it by adding a ⬆️ to the discussion’s description. SMS and Email for MFAThis question has been asked several times before. You can find previous discussions by searching for “sms” or “email” in the GitHub search bar of the Keycloak repository [3][4]. Currently, there is no official support for using email or phone numbers for authentication in Keycloak. Therefore, any issues you encounter with third-party solutions should be reported in their respective repositories, not here. If you're interested in this feature, feel free to share your use case here [5], and upvote it by adding a ⬆️ to the discussion’s description after reading this answer carefully [6]. [1] https://docs.github.com/en/issues/tracking-your-work-with-issues/administering-issues/closing-an-issue |
|
Is there any discussions held about making p2-inc/keycloak-magic-link part of the native Keycloak offering? |
Uh oh!
There was an error while loading. Please reload this page.
Description
Jira Ticket: https://issues.redhat.com/browse/KEYCLOAK-17578
As an admin user,
I would like to add passwordless authentication to my authentication and registration. Such authentication will send a magic link and/or code to an email and/or SMS that I can use to authenticate
Reference:
Discussion
No response
Motivation
No response
Details
No response
All reactions