<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">We plan to add support for "acr" from
OIDC specification. See
<a class="moz-txt-link-freetext" href="https://issues.jboss.org/browse/KEYCLOAK-3314">https://issues.jboss.org/browse/KEYCLOAK-3314</a> . <br>
<br>
Until that, you can possibly use some workaround and add your own
authentication flow with authenticator implementations. For
example based on redirect_uri (which will be different for more
"secure" part of your application) you will allow (or not allow)
cookie authentication and for the more secure part, you will
ensure that OTP authenticator is used.<br>
<br>
Marek<br>
<br>
On 01/09/16 16:54, Steve Favez wrote:<br>
</div>
<blockquote
cite="mid:CAO71Ve=wPe3tSM-SiL_Y11uroTZBJeM-Ajw3PYc0Q0PiEmbo4w@mail.gmail.com"
type="cite">
<div dir="ltr">Dear all,
<div>I need to implement the following use case.</div>
<div><br>
</div>
<div>My web application is authenticated against a given realm
on keycloak, using a simple user / password authentication
model. But a part of my web app would require a stronger
authentication mechanism (a second factor in fact) based on
the current user.</div>
<div><br>
</div>
<div>What's the "best" solution using keycloak ? I was thinking
of two different solutions </div>
<div>1. add an attibute in my OIDC token that could be named
"level", and having an adapter that would check the level of
the token, and if not corresponding, redirect to the realm
that would ask for the second factor of authentication</div>
<div>2. Create a "2FA" realm,that would rely on the simple
authentication realm... but is it possible in the same web app
(I mean, to use two realms)</div>
<div><br>
</div>
<div>Open to any ideas</div>
<div><br>
</div>
<div>Thanks </div>
<div><br>
</div>
<div>St</div>
<div> </div>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
keycloak-user mailing list
<a class="moz-txt-link-abbreviated" href="mailto:keycloak-user@lists.jboss.org">keycloak-user@lists.jboss.org</a>
<a class="moz-txt-link-freetext" href="https://lists.jboss.org/mailman/listinfo/keycloak-user">https://lists.jboss.org/mailman/listinfo/keycloak-user</a></pre>
</blockquote>
<br>
</body>
</html>