You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Assign Webauthn token in behalf of the user
#14908
Hey fellow community, I have an pretty interesting challenge from my IT security folks.
Enforcing MFA is fine, but there is a situation when a user only has username and password and the required action to pair an MFA token. If an attacker is able to get access to an user account right in this moment he can pair a own device and has full access to this account.
The target scenario would be that a user receives an Yubikey or other Webauthn device from the IT department. This token should be assigned for the user before receiving it.
I currently have no good idea or solution how to solve this because there is no option to assign a MFA token for the user from the Backend of Keycloak.
One option could be to impersonate the users account and pair a known device in behalf of the user, but this doesn't sound like a good idea.
Do you have an suitable approach or what's your approach to mitigate this attack vector?
reacted with thumbs up emoji reacted with thumbs down emoji reacted with laugh emoji reacted with hooray emoji reacted with confused emoji reacted with heart emoji reacted with rocket emoji reacted with eyes emoji
Uh oh!
There was an error while loading. Please reload this page.
Hey fellow community, I have an pretty interesting challenge from my IT security folks.
Enforcing MFA is fine, but there is a situation when a user only has username and password and the required action to pair an MFA token. If an attacker is able to get access to an user account right in this moment he can pair a own device and has full access to this account.
The target scenario would be that a user receives an Yubikey or other Webauthn device from the IT department. This token should be assigned for the user before receiving it.
I currently have no good idea or solution how to solve this because there is no option to assign a MFA token for the user from the Backend of Keycloak.
One option could be to impersonate the users account and pair a known device in behalf of the user, but this doesn't sound like a good idea.
Do you have an suitable approach or what's your approach to mitigate this attack vector?
All reactions