Repository navigation
Replies: 0 comments
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
{{ message }}
8000
Heading
Bold
Italic
Quote
Code
Link
Numbered list
Unordered list
Task list
Attach files
Mention
Reference
Menu
reacted with thumbs up emoji
reacted with thumbs down emoji
reacted with laugh emoji
reacted with hooray emoji
reacted with confused emoji
reacted with heart emoji
reacted with rocket emoji
reacted with eyes emoji
Uh oh!
There was an error while loading. Please reload this page.
Hi all,
I am working with the new Organizations feature in Keycloak (26.x) and I am trying to enforce OTP differently depending on the organization a user belongs to.
Use-case:
What I know so far:
In the authentication flow, OTP can be made conditional based on roles (e.g. using the “Conditional OTP” authenticator).
However, Keycloak organizations cannot currently be directly affiliated with a role or group. Organizations only support attributes.
What I have tried:
I can enforce OTP for everyone in the realm by customizing registration so that all users are put into a specific group that has the OTP role.
The problem is that this applies OTP to all organizations, even those where I do not want OTP enforced.
Question:
Is there a recommended way (or best practice) to enforce OTP conditionally based on organization attributes (e.g. OTP=true on the org) for invited users when they sign up?
Thanks in advance for any advice or patterns others have used!
All reactions