9:06 p.m.
Hi all,
Some users in our realm must have setup TOTP for to access some services. Is it possible
to configure a claim to include if a second factor was used during authentication?
We could check if such a claim existed in our service, before granting access.
Thanks in advance.
Cheers
Mark
________________________________
This email is confidential and may contain information subject to legal privilege. If you
are not the intended recipient please advise us of our error by return e-mail then delete
this email and any attached files. You may not copy, disclose or use the contents in any
way. The views expressed in this email may not be those of Gallagher Group Ltd or
subsidiary companies thereof.
________________________________
11:36 a.m.
Hello Mark,
I usually offer this as an assignment for my students at Keycloak hands-ons, hope they
don't google this next time :)
Please check out this thread for the solution overview:
http://lists.jboss.org/pipermail/keycloak-user/2018-December/016676.html
The actual authenticator code might look like this:
function authenticate(context) {
var status = authenticationSession.executionStatus;
var execs = status.keySet();
for each (var e in execs) {
var auth = realm.getAuthenticationExecutionById(e).authenticator;
var s = status[e];
LOG.info(auth + " => " + s); // you will get nulls for subflows,
that's normal
if (auth == "auth-otp-form" && s == "SUCCESS")
authenticationSession.setUserSessionNote("otp", "true");
}
context.success();
}
And the mapper:
var otp = userSession.notes["otp"];
token.setotherClaims("otp", otp);
Good luck!
Dmitry Telegin
Carretti Consulting OÜ | Keycloak Consulting and Training
Sepapaja 6, Tallinn 15551, Estonia | info(a)carretti.pro
On Wed, 2019-05-29 at 02:06 +0000, Mark Sargent wrote:
Hi all,
Some users in our realm must have setup TOTP for to access some services. Is it possible
to configure a claim to include if a second factor was used during authentication?
We could check if such a claim existed in our service, before granting access.
Thanks in advance.
Cheers
Mark
________________________________
This email is confidential and may contain information subject to legal privilege. If you
are not the intended recipient please advise us of our error by return e-mail then delete
this email and any attached files. You may not copy, disclose or use the contents in any
way. The views expressed in this email may not be those of Gallagher Group Ltd or
subsidiary companies thereof.
________________________________
_______________________________________________
keycloak-user mailing list
keycloak-user(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user
9:48 p.m.
Thanks Dmitry!
________________________________
From: Dmitry Telegin <demetrio(a)carretti.pro>
Sent: Thursday, May 30, 2019 4:36 AM
To: Mark Sargent; keycloak-user(a)lists.jboss.org
Subject: Re: [keycloak-user] TOTP claim in jwt
Hello Mark,
I usually offer this as an assignment for my students at Keycloak hands-ons, hope they
don't google this next time :)
Please check out this thread for the solution overview:
http://lists.jboss.org/pipermail/keycloak-user/2018-December/016676.html
The actual authenticator code might look like this:
function authenticate(context) {
var status = authenticationSession.executionStatus;
var execs = status.keySet();
for each (var e in execs) {
var auth = realm.getAuthenticationExecutionById(e).authenticator;
var s = status[e];
LOG.info(auth + " => " + s); // you will get nulls for subflows,
that's normal
if (auth == "auth-otp-form" && s == "SUCCESS")
authenticationSession.setUserSessionNote("otp", "true");
}
context.success();
}
And the mapper:
var otp = userSession.notes["otp"];
token.setotherClaims("otp", otp);
Good luck!
Dmitry Telegin
Carretti Consulting OÜ | Keycloak Consulting and Training
Sepapaja 6, Tallinn 15551, Estonia | info(a)carretti.pro
On Wed, 2019-05-29 at 02:06 +0000, Mark Sargent wrote:
Hi all,
Some users in our realm must have setup TOTP for to access some services. Is it possible
to configure a claim to include if a second factor was used during authentication?
We could check if such a claim existed in our service, before granting access.
Thanks in advance.
Cheers
Mark
________________________________
This email is confidential and may contain information subject to legal privilege. If you
are not the intended recipient please advise us of our error by return e-mail then delete
this email and any attached files. You may not copy, disclose or use the contents in any
way. The views expressed in this email may not be those of Gallagher Group Ltd or
subsidiary companies thereof.
________________________________
_______________________________________________
keycloak-user mailing list
keycloak-user(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user
2024
days inactive
2025
days old
2 comments
2 participants
participants (2)
-
Dmitry Telegin -
Mark Sargent