Re: [keycloak-dev] Transaction approval via OpenID Connect User Questioning API

Hi Stian, thanks for your feedback. Nice to hear that you consider the User Questioning API a fitting feature for Keycloak. For now, we will implement this feature as a plugin to get a working proof of concept. We would be happy to contribute any common code to Keycloak. Intuitively, I would start implementing the endpoints as a REST Resource. To allow for different methods of questioning (via a screen displayed by Keycloak or via our API) we would have to extract a common interface, I think.

From briefly reading the spec it looks like the client sends the request to

Viele Grüße / Best regards Felix Meißner Hanko.io – Convenient and Secure Authentication Hanko GmbH Ringstr. 19 | 24114 Kiel | Germany Email: felix.meissner(a)hanko.io Phone: +49 431 908 929 25 Am Mi., 16. Jan. 2019 um 07:58 Uhr schrieb Stian Thorgersen < sthorger(a)redhat.com&gt;: > Looks quite interesting and useful. Haven't seen much request for it > though. > > Doesn't look like it would be to much effort to implement, nor to much > burden to maintain. Have you considered how this could be implemented in > Keycloak? > > On Mon, 14 Jan 2019 at 12:49, Felix Meißner <felix.meissner(a)hanko.io&gt; > wrote: > >> Hi everyone, >> >> recently, I have been investigating how to integrate transaction approval >> in an OpenID Connect based environment. >> >> It seems to me, the OpenID Connect User Questioning API is the perfect >> match, but as far as I can see, Keycloak is currently not implementing >> this >> API, right? Also, I cannot fond any issue at JBoss regarding this feature. >> >> Are there any reasons to not implement the User Questioning API in >> Keycloak, or has there just not yet been a feature request / someone >> willing to implement this? Or are there any other ways to aquire the >> user's >> consent via Keycloak? >> >> At Hanko, we are developing a Keycloak plugin that allows to use FIDO2 as >> well as UAF and U2F devices as second or multi-factor authentication >> devices in Keycloak with help of our API. Now, we are looking for a way to >> integrate signed transactions based on FIDO in Keycloak. >> >> Thank you for your comments! >> >> Viele Grüße / Best regards >> Felix Meißner >> >> Hanko.io – Convenient and Secure Authentication >> >> Hanko GmbH >> Ringstr. 19 | 24114 Kiel | Germany >> >> Email: felix.meissner(a)hanko.io >> Phone: +49 431 908 929 25 >> _______________________________________________ >> keycloak-dev mailing list >> keycloak-dev(a)lists.jboss.org >> https://lists.jboss.org/mailman/listinfo/keycloak-dev > > _______________________________________________ keycloak-dev mailing list keycloak-dev(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/keycloak-dev