Repository navigation
Is it possible to set up an authentication flow that will allow a user to either provide a username/passwork or an X.509 certificate #39472
Replies: 1 comment
|
I created the following that seems to be able to accomplish the goal. I created an authentication flow with the following steps:
The user in a browser enters our application URL which redirects to Keycloak. Because of the X509 mutual TLS configuration, if there is a cert in the browser Keycloak will prompt the user to select a cert or Cancel as part of the mutual TLS configuration. If the user selects a cert, he is then presented with a dialog allowing him to enter a username/password (which he likely will not enter) or Try Another Method. If he selects Try Another Method, he is presented with an option on how he wants to log in which includes an option to use a X509 cert. When he selects to use a X509 cernt, Keycloak will match the cert selected during the mutual TLS with an internal user. If found, Keycloak will present the Found DN and allow the user to Continue. |
Uh oh!
There was an error while loading. Please reload this page.
I wanted to create a Keycloak authentication flow which will bring up a login dialog that allows a user to either enter a username/password or select a PKI certificate. But perhaps that is not possible. Perhaps the setup for handling X.509 certificates occurs in the initial handshaking between the client and Keycloak such that a user must select the X.509 certificate before such a login dialog can be presented. Is that right?
All reactions