Syncing OTP Credentials to LDAP - Feature Request #36539

sventorben · 2025-01-16T19:35:22Z

sventorben
Jan 16, 2025

Summary

I’d like to suggest a new feature: the ability to sync One-Time Password (OTP) credentials to LDAP. This could make Keycloak even more versatile, improving integration with enterprise setups and simplifying things for both admins and users. By linking OTP management with LDAP, we can make systems easier to manage and more secure.

Why We Need OTP Sync with LDAP

A lot of organizations already use LDAP as their central hub for user credentials and authentication data. But OTP credentials are handled separately in Keycloak, which feels a bit clunky. Syncing them to LDAP would mean everything is stored and managed in one place, making life simpler.
LDAP is such a key part of Keycloak’s ecosystem, but not syncing OTP credentials limits what we can do with it. Many companies use tools that depend on LDAP as the main authentication source. Having OTP credentials in LDAP would make everything work together more seamlessly.
Enterprises need reliable ways to back up and recover user credentials. If OTP credentials are synced with LDAP, admins can just use the existing LDAP backup processes. Less hassle, more resilience.
Happier Users: - Right now, managing OTP credentials separately can cause headaches during migrations, provisioning, or recovery. Syncing them to LDAP would fix this, making the whole process smoother for users.
Some industries have strict rules about managing and auditing authentication data. Syncing OTP credentials with LDAP would simplify compliance since everything is centralized and easier to track.

The Idea

Here’s what I’m proposing:

Add an option to sync OTP credentials to LDAP during user provisioning.
Make sure OTP updates (like resets or changes) are reflected in LDAP in real time.
Use secure methods to store and send OTP data to LDAP, sticking to best practices.
Let admins decide if they want to enable or disable OTP syncing, so it’s flexible.

Why this would be useful

This feature would make Keycloak even more appealing to companies with complex setups, bringing more users into the fold.
No more manual syncing or custom solutions. This would save admins time and headaches.
As MFA becomes standard everywhere, having OTP sync ensures Keycloak stays ahead of the game.

What do you think about this feature? Would it help in your use cases? Any challenges or suggestions? Let me know!

fritzongitz · 2025-01-28T09:43:17Z

fritzongitz
Jan 28, 2025

We at our company strongly support this idea. It would make switchovers to passive cluster nodes so much easier, since users would still be able to register new OTPs, which otherwise would get "lost" when switching back. User experience could be massively improved by having this feature.

0 replies

n3vu0r · 2025-03-14T10:16:30Z

n3vu0r
Mar 14, 2025

We would benefit from this feature as well. Even more if all types of credentials can be synced to LDAP. This would allow to fully regenerate a Keycloak Realm via Admin CLI without requiring backups of Keycloak's database.

0 replies

Navigation Menu

Repository navigation

Syncing OTP Credentials to LDAP - Feature Request #36539

Uh oh!

{{title}}

Uh oh!

Replies: 2 comments

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

Syncing OTP Credentials to LDAP - Feature Request #36539

Uh oh!

sventorben Jan 16, 2025

Replies: 2 comments

Uh oh!

fritzongitz Jan 28, 2025

Uh oh!

n3vu0r Mar 14, 2025

sventorben
Jan 16, 2025

fritzongitz
Jan 28, 2025

n3vu0r
Mar 14, 2025