Share one OTP/TOTP per user across multiple independent Keycloak instances using the same LDAP user store #42210

paoloamato2 · 2025-08-28T14:07:17Z

paoloamato2
Aug 28, 2025

Summary

We operate N independent Keycloak deployments (separate servers and databases, not clustered), all pointing to the same LDAP (our user store for username, first/last name, password, etc.).
Currently, when a user enables OTP/TOTP, each Keycloak instance stores its own OTP secret, so the same user ends up with multiple OTP enrollments—one per Keycloak. We would like each user to have a single OTP shared across all Keycloak instances.

Environment

Keycloak versions: 26.1.1
LDAP: Port389
Realms: Same realm name across instances
Setup: multiple independent Keycloak servers, each with its own database, all federating to the same LDAP

Current Behavior

OTP/TOTP is configured per Keycloak instance.
The OTP secret appears to be stored in Keycloak’s internal/federated storage (per realm/instance), not in LDAP.
Result: the same user must enroll OTP separately on each instance.

Expected / Desired Behavior

Ability for all Keycloak instances (pointing to the same LDAP user) to share one OTP secret per user, so users enroll once and can log in to any Keycloak with the same OTP.

Questions

Is there a supported way today to centralize the OTP secret so that multiple independent Keycloaks share it (e.g., storing OTP in LDAP or another external credential store)?
If not, would the project consider an enhancement to:
- Allow OTP/TOTP credentials to be stored in LDAP (configurable attribute)
Any recommended approach to achieve this with current features, and trade-offs?

Constraints / Notes

Sharing the same database or clustering the instances is not an option for us.
Security is important: if OTP is stored outside Keycloak (e.g., in LDAP), we’d need guidance on encryption/key management so all Keycloaks can decrypt/use the same secret safely.

Steps to Reproduce

Set up two independent Keycloak servers (separate DBs), both federating users from the same LDAP.
Log in as the same LDAP user on Keycloak A, enable OTP (TOTP).
Attempt to log in on Keycloak B: user is prompted to set up OTP again, resulting in a second, different OTP secret.

What We’re Looking For

Confirmation whether shared OTP across independent Keycloaks is possible today and how to configure it.
If not possible, feedback on the viability and scope of adding support (LDAP storage or pluggable credential store), and pointers to the right SPI/APIs/roadmap.

Thanks!

DomWork9 · 2025-09-05T10:52:40Z

DomWork9
Sep 5, 2025

I’m also interested in this feature and hope to get an update soon.

Thanks!

0 replies

Navigation Menu

Repository navigation

Share one OTP/TOTP per user across multiple independent Keycloak instances using the same LDAP user store #42210

Uh oh!

{{title}}

Uh oh!

Replies: 1 comment

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Select a reply

Uh oh!

Share one OTP/TOTP per user across multiple independent Keycloak instances using the same LDAP user store #42210

Uh oh!

paoloamato2 Aug 28, 2025

Summary

Environment

Current Behavior

Expected / Desired Behavior

Questions

Constraints / Notes

Steps to Reproduce

What We’re Looking For

Replies: 1 comment

Uh oh!

Uh oh!

DomWork9 Sep 5, 2025

paoloamato2
Aug 28, 2025

DomWork9
Sep 5, 2025