Repository navigation
Is it possible to integrate Windows local login with Keycloak 2FA? #41387
Replies: 1 comment
|
Keycloak handles authentication based on open standards such as OpenID Connect, OAuth 2.0, and SAML. These standards are typically used in web-based login experiences. One of the main reasons is that authentication is delegated to the Identity Provider - usually via browser redirection - using common OAuth 2.0 flows like Authorization Code or Authorization Code + PKCE (I'm oversimplifying here, as there are other options as well). When you refer to GINA, that’s more aligned with IDM (Identity Management) solutions, where concepts like password filters were used to synchronize credentials. This is unrelated to Keycloak acting as an Identity Provider, which does not interface with Windows login mechanisms at that level. The only typical integration point between Keycloak and Windows is in web login scenarios, where Keycloak is configured to use Active Directory as an identity store. In that case, users authenticate using their AD (LDAP) credentials, possibly combined with additional factors like OTP or WebAuthn. You could also leverage other methods like Kerberos or RADIUS - again, all within the context of web-based authentication. |
Uh oh!
There was an error while loading. Please reload this page.
Hi community,
I'm exploring options to secure the local Windows login (not browser-based) using Keycloak's two-factor authentication (2FA).
My goal is to have users authenticate against Keycloak — including its 2FA mechanisms (OTP, WebAuthn, etc.) — when logging into a Windows machine, either locally or via RDP.
My questions:
Is it technically possible to integrate Windows login with Keycloak authentication flows?
Are there any known technologies (Credential Providers, RADIUS, etc.) that can achieve this without modifying GINA directly?
Do you know of any projects, modules, or plugins that implement something like this?
Any guidance, suggestions, or relevant documentation would be greatly appreciated.
Thanks in advance!
All reactions