Repository navigation
|
Hello, So far we've been loving Keycloak, it brings so much value to how we manage our users. We even created a simplified control panel for our internal users. This control panel has the ability to check a client role as "enforce 2FA", and we're running into some issues there. We created an Authentication flow to enforce 2FA on certain client roles. However, after running this setup for a while, we noticed that users who have multiple roles with 2FA required, the user actually needs to fill in the same OTP code multiple times on the login form (once for each enforced role). This is an example of what our flow looks like: (flow name is The flow configs look like this: How could we modify this setup so the user only needs to fill in their OTP code once on the login frontend? Or are there any other alternatives to achieve our desired result? It needs to be 100% controllable through the Keycloak API. Thanks! |
Replies: 3 comments 1 reply
|
Solved using a realm role for 2FA and adding it as sub role to client roles |
|
We re-arranged our flows and now it's a bit better already, the first conditional is skipped if the user has a role that requires 2FA. So now if the user only has 1 OTP required client role, it only asks once. However, if the user has 2 required OTP client roles, it still asks for it twice. So slight improvement, but still not there.... This is our new setup: Anyone who has faced a similar problem and has a solution? Would really appreciate it! tl;dr we want to do client role conditional 2FA on multiple roles. |
|
I “solved” this problem by using the negate output feature of the user role condition. If you want that, the user is asked for the OTP Code once when one of the following is true:
Then you can configure the flow like this:
However, that's a messy solution, with a large potential for configuration mistakes, especially if more roles are involved. The same behavior can be achieved with the Level of Authentication Condition. The resulting flow is less messy, but let to an issue with OICD and may have other negative side effects that I do not fully understand. I think it would be best if we could somehow specify in the root flow that only the first conditional subflow that matches is executed. |
|
After fiddling with authentication flows for more time than I’m willing to admit, we decided to take an easier route. The API allows us to link a realm role as a sub role to client (composite) roles. So we simply have 1 authentication flow that has this realm role as OTP required and then we just assign this realm role to any client role that needs to be 2FA protected. In hindsight, much easier to manage through both the API and the admin console. So that’s the route we’ve gone. I’m still fully convinced that there is a combination of authentication flows which would suite our needs, maybe the one you presented could work for our use-case. But composite client roles with 1 global 2FA realm role just seems like the way to go to meet our original requirements. |
Solved using a realm role for 2FA and adding it as sub role to client roles