Repository navigation
What is the point of the flow step "Conditional OTP Form" #52987
|
In base keycloak, there is an execution/step you can add called "Conditional OTP Form" Why is this here? I thought that's the whole point of Conditions in sub flows. And if it's here for OTP, why doesn't WebAuthn have it's own Conditional version? Like "Conditional WebAuthn Authenticator" |
Replies: 1 comment 1 reply
|
The first applicable decision wins. This is more specific than placing an ordinary OTP execution inside a conditional subflow: the latter gates a group of executions using the flow's condition authenticators, rather than supplying that bundled, ordered OTP policy. For WebAuthn, the compositional approach is a conditional subflow containing the appropriate WebAuthn execution. There doesn't need to be a conditional variant of every authenticator for that to work. The authentication-flow examples include a conditional 2FA subflow with OTP, WebAuthn and recovery codes as alternatives. One policy distinction matters: I can't speak to the historical reason for the naming/asymmetry, but the two mechanisms aren't identical in behavior. |
|
Alright thanks! |
Conditional OTP Formcombines an OTP authenticator with its own decision policy. Its implementation checks, in order:skip/force).The first applicable decision wins. This is more specific than placing an ordinary OTP execution inside a conditional subflow: the latter gates a group of executions using the flow's condition authenticators, rather than supplying that bundled, ordered OTP policy.
For WebAuthn, the compositional approach is a conditional subflow containing the appropriate WebAuthn execution. There doesn't need to be a conditional variant of every authenticator for that to…