Enable OTP based on group membership #13167

xelita · 2022-07-18T09:55:43Z

xelita
Jul 18, 2022

Hello.

I would like to force my users to set up otp if they belong to a specific group.
I am trying to use Keycloak conditions (condition - user attribute, condition - user role, ...) but I cannot find a way to do that with groups.

Any ideas?
Thanks.

xelita · 2022-07-18T16:59:13Z

xelita
Jul 18, 2022
Author

My current "workaround" solution is:

create a role with the same name that is mapped to the group (group > roles mapping > realm roles)
copy the Browser authentication flow and add an extra condition - user role that enforces OTP usage if the user belongs to the given role.

Now, I am just wondering if it is the best solution to implement this behavior or perhaps there is an easiest way to achieve this?

Thanks

0 replies

Navigation Menu

Repository navigation

Enable OTP based on group membership #13167

Uh oh!

{{title}}

Uh oh!

Replies: 1 comment

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Select a reply

Uh oh!

Enable OTP based on group membership #13167

Uh oh!

xelita Jul 18, 2022

Replies: 1 comment

Uh oh!

Uh oh!

xelita Jul 18, 2022 Author

xelita
Jul 18, 2022

xelita
Jul 18, 2022
Author