[keycloak-dev] Adaptive risk login

Hello group, I just add a look at a nice feature from Forge Rock AM called: "Adaptive risk login". "Adaptive Risk authentication allows OpenAM to determine the risk of a particular authentication, and decide whether additional authentication steps are required due to the risk." "The Adaptive Risk module has a risk threshold that is set manually, and by default is set to 1 . There are a variety of different authentication risks which are each given a score. If the value of the score meets or exceeds the risk threshold, then the authentication fails." - Risk Threshold exceeded - if inherent risk for a particular (client login) exceeds theshold - Failed Authentications - if user had failed authentications recently raise risk - IP Address Range - ip IP not in IP range raise risk - IP Address History - if IP not in IP address history raise risk - Known cookie - if a certain cookie + value not present raise risk - Device cookie - if not a known or trusted device raise risk - Time since last login - if last login > x days raise risk - Profile attribute - if a profile (user) attribute is set raise risk - GeoLocation - if IP geolocation based on http://www.maxmind.com/app/country is not from a certain area raise risk - RequestHeader - if certain request header is not present raise risk These checks can be combined / inverted which provides one with a flexible system to specify rules. I think a functionality like that would be great addition to Keycloak. Some of this functionality is already partially possible with Keycloak but only for some authenticators. Would be great to have more general support in that regard. Cheers, Thomas