Repository navigation
Replies: 3 comments 3 replies
|
I think I remember an older discussion mentioned that the order the authentication forms are presented to the user depends on the order of the credentials in the user's account. As such, if the password credential is the first, the username / password form will be presented first (disclaimer - I'm not quite sure if it also applies to the password credential, but it's unlikely it is handled differently by the selection process). You can test if the behavior changes by changing the order of the credentials in the administration page - there is even a dedicated REST API endpoint for this purpose. |
|
Thanks @darius-m |
sorry, I don't understand how this would work: Prior to authentication - who is the user who's account defines the flow? Keycloak doesn't know who is going to authenticate, does it? But I, too, would like this riddle solved. Has anyone found a solution? |
|
Hi @oculos, |
|
Thanks Martin!
But that’s not in production yet, right?
… On 24 Nov 2023, at 13:22, Martin Besozzi ***@***.***> wrote:
Hi @oculos <https://github.com/oculos>,
The best user experience is achieved with WebAuth Conditional UI <https://github.com/w3c/webauthn/wiki/Explainer:-WebAuthn-Conditional-UI> or Passkey autofill. The default “modal” experience might not be good in some cases, but utilizing the passkey with autofill (WebAuth Conditional UI) feature can significantly enhance the login process.
For more information and hands-on experience, check out the workshop that demonstrates the Passkey autofill experience and various MFA scenarios:
https://github.com/embesozzi/keycloak-workshop-stepup-mfa-biometrics
—
Reply to this email directly, view it on GitHub <#24883 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ABT2F45QPJKXAXN46A7FSWTYGCGPBAVCNFSM6AAAAAA7USSXGSVHI2DSMVQWIX3LMV43SRDJONRXK43TNFXW4Q3PNVWWK3TUHM3TMNRQGEZDA>.
You are receiving this because you were mentioned.
|
|
In relation to Keycloak, in my case, it's still in QA. However, I implemented a similar functionality in ForgeRock, and so far, I haven't encountered many problems. |
Uh oh!
There was an error while loading. Please reload this page.
Hi,
I have an authentication workflow so that I can use both webauthn or passwords to authenticate to keycloak.
However, even if WebAuthn before username/password form on my authentication flow, I still get username/password form before.
Is this a bug, or is there a way to make Webauthn offered first and make username/password available when choosing "try other ways" instead of the opposite?
All reactions