Repository navigation
Support reading base32 encoded OTP secret - #21117
Conversation
|
Thanks a lot @pedroigor, you've made my organization's migration to Keycloak much easier 👍 |
|
@pedroigor I added secret key base32 to table:credential and it didn't work. Or is there a need for any special additional formats? |
|
@namsudtho I think you need to also specify the encoding when adding a BASE32 encoded OTP: OTPCredentialModel otpCredentialModel = OTPCredentialModel.createTOTP(
otpSecret, // TOTP Secret
6, // Digits
30, // Period
"HmacSHA1", // Algorithm
OTPCredentialModel.SecretEncoding.BASE32.name() // Encoding
); |
|
@angelomelonas @pedroigor Can you please advise me if my organization is using base32 encoded secret otp? |
|
@namsudtho the secret value itself you add in Keycloak should not be encoded in base32 (like you have done in row 1 in the screenshot above). The value in row 2 should work. However, when you are adding the value, you need to specify the encoding as in my code snippet above (using the I think that last part might be what is missing from your row 2 |
|
@angelomelonas Thank you very much. You know, it took me a long time to find a solution for this. |
|
@namsudtho you are very welcome! |
|
@angelomelonas I'm migrating TOTP secret from firebase to Keycloak. Credential table look like this I have added the secret data and secret encoding in credentials data. But, it is not validating the code during authentication process. Am I missing something? Can you help please? |
|
@HimanshiNagpal02 how did you add the secret to Keycloak? If you did it via the Keycloak Admin Client, be sure to set the type like this: instead of this: |
|
@angelomelonas It worked. Thanks much! |
Closes #9434
Closes #11561
secretEncodingmetadata to the credential metadata to force the server to properly decode secrets before validating/generating OTPs.b32) secret encoding