Repository navigation
Replies: 1 comment 5 replies
|
I think this is unlikely to be added simply because the LDAP protocol itself doesn't define support for TOTP. While many systems that implement LDAP build in support for TOTP, they often do so by utilising a third party provider for the TOTP secret storage/validation. This would make implementing TOTP secret synchronisation in Keycloak difficult as it would be required to support many different third party providers. Not that it's impossible, but I see this as being hard to build and have work OOTB for Keycloak. I suppose this would be the kind of functionality best built in as a Authentication/Storage SPI depending on the implementation requirements |
|
My experience is the opposite: it's not about LDAP supporting TOTP. It's about LDAP being the source of truth for TOTP secrets. It is as simple as reading an attribute with the secret and using it instead of the secret in the database. |
|
Would you mind sharing which LDAP Directory Server you are using? |
|
OpenLDAP I also use FreeIPA, but haven't seen TOTP attribute there. |
|
From what I can tell even at a OpenLDAP instance level the attribute name and format of the TOTP is not standardised let alone other directory servers. It's definitely doable to sync a TOTP secret via an LDAP attribute into Keycloak, but it seems like it would be difficult to support all configurations/directory servers for this feature. I'm not a maintainer on this project, just my 2cents. |
|
That's the thing, there's no need to hard code anything. A mapper for the secret could allow the configuration of which attribute to be imported, secret type, etc. |
Uh oh!
There was an error while loading. Please reload this page.
Some organizations might have existing TOTP configured and present in LDAP.
It would be nice if the secret could synchronizes to Keycloak so that the OTP authentication could use that instead.
All reactions