I thought we where just going to do password and OTP in a single field? On 18 July 2016 at 23:53, Bruno Oliveira <abstractj(a)redhat.com&gt; wrote: > Good morning, > > > Today to authentication against PAM with just simple username/password I > implemented UserFederationProvider and added the proper PAM login to > validCredentials[1]. This covers the most basic scenario. > > Now I would like to cover a more complex scenario like OTP and change > the flow a little bit like this: > > 1. User providers her username > 2. The next screen asks to provide how many factor our user has(For > example: OTP, password). We just don't know, PAM will tell what's next. > 3. We authenticate against it > > To see in practice against FreeIPA server, I just recorded it > for a practical example[2]. > > What would be the best approach to implement this flow? I was considering > to > move my authentication logic out of SSSD federation provider and create a > PAM > authenticator. > > Does it make sense? > > [1] - http://www.keycloak.org/docs/javadocs/org/keycloak/models/ > UserFederationProvider.html#validCredentials-org.keycloak. > models.RealmModel-org.keycloak.models.UserCredentialModel- > > [2] - https://asciinema.org/a/atwnfbu0kqfasjl65weyoiz7a > > -- > > abstractj > PGP: 0x84DC9914 > _______________________________________________ > keycloak-dev mailing list > keycloak-dev(a)lists.jboss.org > https://lists.jboss.org/mailman/listinfo/keycloak-dev >

_______________________________________________ keycloak-dev mailing list keycloak-dev(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/keycloak-dev