I was thinking that we would create abstract support for SMS support for Keycloak. We would define a simple Provider interface for sending text messages. We would not provide anything out of the box for now. We would require users to implement their own SMS provider and plug it in. Basically, we'd have an SMS OTP Authenticator for both the browser login and reset-credentials flows. Keycloak would just send an SMS with a one-time secret code that you have to enter in. We also would implement a validate mobile number required action too. I don't think any of this would take very long (a day or two?) once I get the reset-credential pluggable-flow support done. Later on, maybe its something we could integrate with Aerogear UPS out of the box? -- Bill Burke JBoss, a division of Red Hat http://bill.burkecentral.com _______________________________________________ keycloak-dev mailing list keycloak-dev(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/keycloak-dev

From: "Bill Burke" <bburke(a)redhat.com&gt; To: keycloak-dev(a)lists.jboss.org Sent: Sunday, 16 August, 2015 12:05:30 AM Subject: [keycloak-dev] Abstract SMS support I was thinking that we would create abstract support for SMS support for Keycloak. We would define a simple Provider interface for sending text messages. We would not provide anything out of the box for now. We would require users to implement their own SMS provider and plug it in. Basically, we'd have an SMS OTP Authenticator for both the browser login and reset-credentials flows. Keycloak would just send an SMS with a one-time secret code that you have to enter in. We also would implement a validate mobile number required action too. I don't think any of this would take very long (a day or two?) once I get the reset-credential pluggable-flow support done.

Later on, maybe its something we could integrate with Aerogear UPS out of the box?

-- Bill Burke JBoss, a division of Red Hat http://bill.burkecentral.com _______________________________________________ keycloak-dev mailing list keycloak-dev(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/keycloak-dev

From: "Thomas Raehalme" <thomas.raehalme(a)aitiofinland.com&gt; To: "Stian Thorgersen" <stian(a)redhat.com&gt; Cc: "Bill Burke" <bburke(a)redhat.com&gt;, "keycloak-dev" <keycloak-dev(a)lists.jboss.org&gt; Sent: Monday, 17 August, 2015 11:29:34 AM Subject: Re: [keycloak-dev] Abstract SMS support On Mon, Aug 17, 2015 at 12:18 PM, Stian Thorgersen <stian(a)redhat.com&gt; wrote: > > However it might be a good idea to include a generic HTTP/REST > implementation > > which you could configure through the admin interface to deliver SMS > > messages to any service supporting HTTP? I'm pretty sure this would > satisfy > > most users. > > Not sure how that would work. AFAIK SMS providers have their own > proprietary rest endpoints as well as authentication mechanisms so I don't > see how we could create a generic implementation. > > You would need to implement a template mechanism where the Keycloak data (for example the recipient number and message text) is provided as keywords, and the admin defines the template utilizing those keywords. It would be a good idea to allow choosing between POST and GET. For example Twilio supports a simple HTTP POST operation to delivery SMS messages through their API: https://www.twilio.com/docs/api/rest/sending-messages Many operators and service providers use a similar mechanism. Often the authentication is just a simple token which needs to be included in the request. Best regards, Thomas

From: "Thomas Raehalme" <thomas.raehalme(a)aitiofinland.com&gt; To: "Stian Thorgersen" <stian(a)redhat.com&gt; Cc: "Bill Burke" <bburke(a)redhat.com&gt;, "keycloak-dev" <keycloak-dev(a)lists.jboss.org&gt; Sent: Monday, 17 August, 2015 11:39:27 AM Subject: Re: [keycloak-dev] Abstract SMS support On Mon, Aug 17, 2015 at 12:35 PM, Stian Thorgersen <stian(a)redhat.com&gt; wrote: > I'm not convinced about this approach, I think it would end up being > complex and we'd continuously get request on tweaking it to support other > providers. > > Having a simple Java interface with something like (just a quick mock, not > the suggested interface): > > SMSProvider: > > * Status sendMessage(String message, String phoneNumber) > > Would be fairly easy for users to implement and would work for all > services. > Sure, the interface would be simple to implement, but nevertheless it requires a customization to the install and Keycloak no longer works out-of-the-box. I'm not saying the interface should not be there, but that it would be great to also have a simple HTTP implementation available.

Best regards, Thomas

On Mon, Aug 17, 2015 at 12:35 PM, Stian Thorgersen <stian(a)redhat.com <mailto:stian@redhat.com>> wrote: I'm not convinced about this approach, I think it would end up being complex and we'd continuously get request on tweaking it to support other providers. Having a simple Java interface with something like (just a quick mock, not the suggested interface): SMSProvider: * Status sendMessage(String message, String phoneNumber) Would be fairly easy for users to implement and would work for all services. Sure, the interface would be simple to implement, but nevertheless it requires a customization to the install and Keycloak no longer works out-of-the-box. I'm not saying the interface should not be there, but that it would be great to also have a simple HTTP implementation available.

Sure, the interface would be simple to implement, but nevertheless it > requires a customization to the install and Keycloak no longer works > out-of-the-box. > > I'm not saying the interface should not be there, but that it would be > great to also have a simple HTTP implementation available. > > From what I've researched, most of these simple services you have to pay for. There's an OSS SMS proxy and library you can integrate and test. But that's it.