Repository navigation
Missing recovery_code parameter in openid-connect auth flow
#42081
Unanswered
that-ambuj
asked this question in
Q&A
Replies: 0 comments
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
We're planning to add a 2FA feature via TOTP authenticator apps alongside recovery codes.
Currently, we're using a custom UI for authentication along with the openid-connect protocol with
passwordgrant for email/password login andauthorization_codegrant for oauth login.Since keycloak doesn't provide it's own REST APIs to programmatically configure and verify TOTP authentication codes, we're planning to use this extension https://github.com/medihause/keycloak-totp-api to expose the APIs and connect our custom frontend and allow our users to configure their TOTP in an authenticator app of their choice. For login, we're going to check if the user needs to provide a totp and add it as a
totpparameter to the existing openid-connect requests like so:(not sure how to make it work for oauth/
grant_type=authorization_coderequests)For recovery codes(added in version 26.3.0), we're planning to extend the aforementioned extension to similarly expose REST endpoints and allow setting up recovery codes as a backup option. but the issue is that there's no
recovery_codeparameter that can be used as an alternative to theotpparameter. Is there some way to tackle this situation?All reactions