Repository navigation
PIV Smartcard Certificate Reprompt #44208
Unanswered
FarinazZah
asked this question in
Q&A
Replies: 0 comments
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
I am developing a custom Keycloak authenticator that detects the presence of a PIV smartcard certificate during login. The authenticator works correctly in detecting when a client certificate is presented via mutual TLS, but the goal is to allow the user to re-prompt the browser to select a certificate (i.e., restart the mTLS handshake) when the card is not initially inserted.
I am relatively new to Keycloak and would appreciate any help you can provide!
Is there any standards-compliant or browser-supported mechanism to explicitly restart the mutual TLS handshake (i.e., re-trigger the client certificate selection dialog) from application logic, without changing hostname?
Are there known Chrome flags, enterprise policies, or dev settings to disable TLS client certificate caching behavior for debugging purposes?
Is this even possible using Keycloak?
All reactions