Repository navigation
add configuration option to automatically add recovery codes action - #41849
Conversation
230355c to
5778ebd
Compare
|
Thank you for the PR, this looks good to me. Can you please add a test? |
|
Is there already an existing test for the UpdateTotp action? I didn't find any. If yes, can you give me a pointer? |
|
@dasniko - there are |
|
Thanks. I'll have a look. Maybe this takes some time, as I'm on vacations... |
…fter otp configuration closes keycloak#41836 Signed-off-by: Niko Köbler <niko@n-k.de>
|
@dasniko - thank you for the PR. I tested it manually and this is what I found:
There is a similar logic in the account console to show the credential types depending on what is enabled in the authentication flows. So I updated the logic and the docs. Please let me know if you agree with the latest changes. |
|
@ahus1, thanks for the review and the enhancements. I'm fine with these changes. At the same time I know that people will have problems to understand these dependencies, no matter if the check is implemented or not. So, also only my enhancement would cause problems, as people won't understand that they have to enable the credential usage at multiple places. Even me, although I work nearly every day with it, I mostly forget about it in the first run, then, wenn it doesn't work like I expect it, I remember to do some additional settings... |
|
Sorry if my comment lead to some confusion. |
|
I did some experiments to see if I can show an extended warning message when someone enables it and the preconditions are not met. While experiencing some bugs around that, I then considered it problematic for any automatic provisioning tool as it would then depend on the order of resources created, which would be a nuisance for everyone involved. So I decided to keep it as is. Another thought I had was that the functionality we have here now needs to be added to all other second factors, so that they can also trigger recovery codes. Thinking about that, it might then be good to invert this, so to have once central piece that listens for those second factors to be created, and then adds that required action. Let's take this as a follow-up thought where it needs to be added as well, and merge this one for now. If you think it should be added in other places as well, please create a follow-up issue and corresponding pull requests. |
|
FYI @keycloak/core-clients |
after otp configuration
closes #41836