9:34 a.m.
Hi all,
I have an application that is secured by Keycloak. I am able to login using
username/email and password. I also want to implement login via phone
number. Could anybody help me how to store the phone number for a user and
also how to use it to login the user.
3:36 a.m.
You would need to create a custom authenticator for it. Take a look at
http://keycloak.github.io/docs/userguide/html/auth_spi.html
On 30 September 2015 at 15:34, Revanth Ayalasomayajula <
revanth(a)arvindinternet.com> wrote:
Hi all,
I have an application that is secured by Keycloak. I am able to login
using username/email and password. I also want to implement login via phone
number. Could anybody help me how to store the phone number for a user and
also how to use it to login the user.
_______________________________________________
keycloak-user mailing list
keycloak-user(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user
3:45 a.m.
Hi Stian,
I have question about login through mobile devices in general,
where I would like to login via mobile number, get an OTP on my number and
use it to register/login into the system,
For the number I can follow your instructions but am looking to provide for
OTP as well (I am exploring this). It will be nice to have it out of the
box :)
Is such a option there in the Keycloak's roadmap ?
If so what is the rough timeline?
On Thu, Oct 1, 2015 at 1:06 PM, Stian Thorgersen <sthorger(a)redhat.com>
wrote:
You would need to create a custom authenticator for it. Take a look
at
http://keycloak.github.io/docs/userguide/html/auth_spi.html
On 30 September 2015 at 15:34, Revanth Ayalasomayajula <
revanth(a)arvindinternet.com> wrote:
> Hi all,
>
> I have an application that is secured by Keycloak. I am able to login
> using username/email and password. I also want to implement login via phone
> number. Could anybody help me how to store the phone number for a user and
> also how to use it to login the user.
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user(a)lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
_______________________________________________
keycloak-user mailing list
keycloak-user(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user
--
- Anunay
3:52 a.m.
Using SMS as a two factor auth mechanism is on the road-map, but not in the
near future. The idea is basically that the server creates a unique code,
sends it in SMS, and the user would then copy it back to the login screen.
Issue with it is that we first need to allow users to select what two
factor auth mechanism they want to use. They could have a hardware OTP
token for example, but as they don't have it with them they could use the
SMS code as a backup. We also have tons of other things ahead of it in the
queue.
I'm a bit curious about your use-case. You basically want a user to login
with mobile number + password, and also use a code sent over SMS as a two
factor auth? Or do you have something different in mind?
On 1 October 2015 at 09:45, Anunay Sinha <anunay.sinha(a)arvindinternet.com>
wrote:
Hi Stian,
I have question about login through mobile devices in general,
where I would like to login via mobile number, get an OTP on my number and
use it to register/login into the system,
For the number I can follow your instructions but am looking to provide
for OTP as well (I am exploring this). It will be nice to have it out of
the box :)
Is such a option there in the Keycloak's roadmap ?
If so what is the rough timeline?
On Thu, Oct 1, 2015 at 1:06 PM, Stian Thorgersen <sthorger(a)redhat.com>
wrote:
> You would need to create a custom authenticator for it. Take a look at
> http://keycloak.github.io/docs/userguide/html/auth_spi.html
>
> On 30 September 2015 at 15:34, Revanth Ayalasomayajula <
> revanth(a)arvindinternet.com> wrote:
>
>> Hi all,
>>
>> I have an application that is secured by Keycloak. I am able to login
>> using username/email and password. I also want to implement login via phone
>> number. Could anybody help me how to store the phone number for a user and
>> also how to use it to login the user.
>>
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user(a)lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user(a)lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
--
- Anunay
3:57 a.m.
User can register through a mobile number. He will be sent an OTP on his
mobile number (for verification and first time login)
Once verified and he logs in for the first time he can set his password.
Similar workflow will be used if he wants to recover his password. He will
get a OTP on his mobile that will allow him to log in and he can reset his
password thereafter.
2 Factor Authentication is not something we are looking at yet, though it
will be good to have
On Thu, Oct 1, 2015 at 1:22 PM, Stian Thorgersen <sthorger(a)redhat.com>
wrote:
Using SMS as a two factor auth mechanism is on the road-map, but not
in
the near future. The idea is basically that the server creates a unique
code, sends it in SMS, and the user would then copy it back to the login
screen. Issue with it is that we first need to allow users to select what
two factor auth mechanism they want to use. They could have a hardware OTP
token for example, but as they don't have it with them they could use the
SMS code as a backup. We also have tons of other things ahead of it in the
queue.
I'm a bit curious about your use-case. You basically want a user to login
with mobile number + password, and also use a code sent over SMS as a two
factor auth? Or do you have something different in mind?
On 1 October 2015 at 09:45, Anunay Sinha <anunay.sinha(a)arvindinternet.com>
wrote:
> Hi Stian,
> I have question about login through mobile devices in general,
> where I would like to login via mobile number, get an OTP on my number
> and use it to register/login into the system,
>
> For the number I can follow your instructions but am looking to provide
> for OTP as well (I am exploring this). It will be nice to have it out of
> the box :)
>
> Is such a option there in the Keycloak's roadmap ?
> If so what is the rough timeline?
>
> On Thu, Oct 1, 2015 at 1:06 PM, Stian Thorgersen <sthorger(a)redhat.com>
> wrote:
>
>> You would need to create a custom authenticator for it. Take a look at
>> http://keycloak.github.io/docs/userguide/html/auth_spi.html
>>
>> On 30 September 2015 at 15:34, Revanth Ayalasomayajula <
>> revanth(a)arvindinternet.com> wrote:
>>
>>> Hi all,
>>>
>>> I have an application that is secured by Keycloak. I am able to login
>>> using username/email and password. I also want to implement login via phone
>>> number. Could anybody help me how to store the phone number for a user and
>>> also how to use it to login the user.
>>>
>>> _______________________________________________
>>> keycloak-user mailing list
>>> keycloak-user(a)lists.jboss.org
>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>
>>
>>
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user(a)lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>
>
>
>
> --
> - Anunay
>
--
- Anunay
2:11 a.m.
You should be able to do this yourself using the authenticator spi. It
would be a while until we get resources to add a feature around this.
On 1 October 2015 at 09:57, Anunay Sinha <anunay.sinha(a)arvindinternet.com>
wrote:
User can register through a mobile number. He will be sent an OTP on
his
mobile number (for verification and first time login)
Once verified and he logs in for the first time he can set his password.
Similar workflow will be used if he wants to recover his password. He will
get a OTP on his mobile that will allow him to log in and he can reset his
password thereafter.
2 Factor Authentication is not something we are looking at yet, though it
will be good to have
On Thu, Oct 1, 2015 at 1:22 PM, Stian Thorgersen <sthorger(a)redhat.com>
wrote:
> Using SMS as a two factor auth mechanism is on the road-map, but not in
> the near future. The idea is basically that the server creates a unique
> code, sends it in SMS, and the user would then copy it back to the login
> screen. Issue with it is that we first need to allow users to select what
> two factor auth mechanism they want to use. They could have a hardware OTP
> token for example, but as they don't have it with them they could use the
> SMS code as a backup. We also have tons of other things ahead of it in the
> queue.
>
> I'm a bit curious about your use-case. You basically want a user to login
> with mobile number + password, and also use a code sent over SMS as a two
> factor auth? Or do you have something different in mind?
>
>
>
>
>
> On 1 October 2015 at 09:45, Anunay Sinha <anunay.sinha(a)arvindinternet.com
> > wrote:
>
>> Hi Stian,
>> I have question about login through mobile devices in general,
>> where I would like to login via mobile number, get an OTP on my number
>> and use it to register/login into the system,
>>
>> For the number I can follow your instructions but am looking to provide
>> for OTP as well (I am exploring this). It will be nice to have it out of
>> the box :)
>>
>> Is such a option there in the Keycloak's roadmap ?
>> If so what is the rough timeline?
>>
>> On Thu, Oct 1, 2015 at 1:06 PM, Stian Thorgersen <sthorger(a)redhat.com>
>> wrote:
>>
>>> You would need to create a custom authenticator for it. Take a look at
>>> http://keycloak.github.io/docs/userguide/html/auth_spi.html
>>>
>>> On 30 September 2015 at 15:34, Revanth Ayalasomayajula <
>>> revanth(a)arvindinternet.com> wrote:
>>>
>>>> Hi all,
>>>>
>>>> I have an application that is secured by Keycloak. I am able to login
>>>> using username/email and password. I also want to implement login via
phone
>>>> number. Could anybody help me how to store the phone number for a user
and
>>>> also how to use it to login the user.
>>>>
>>>> _______________________________________________
>>>> keycloak-user mailing list
>>>> keycloak-user(a)lists.jboss.org
>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>>
>>>
>>>
>>> _______________________________________________
>>> keycloak-user mailing list
>>> keycloak-user(a)lists.jboss.org
>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>
>>
>>
>>
>> --
>> - Anunay
>>
>
>
--
- Anunay
4:06 a.m.
+1 for this feature.
This use case is getting quite popular these days. Apart from the banks
that follow this procedure, you also get companies like Google that do this
as an extra step to prevent someone who has stolen your username/password
from using it to access your content.
A would like to suggest a few additional features around this requirement
for it to be more valuable.
1. Option in KeyCloak to set if the SMS should be sent for all login
attempts or only when logging in from a new device like who you get with
Google
2. A set of actions that could trigger the SMS - For example let's say I
have a banking web app and if the user logs in and does a funds transfer
above a certain limit, I should be able to from my app trigger an SMS auth.
Not sure if this is part of OAuth2 or OIDC but I have encountered quite a
few applications following this flow to prevent identify theft.
On Thu, 1 Oct 2015 at 17:52 Stian Thorgersen <sthorger(a)redhat.com> wrote:
Using SMS as a two factor auth mechanism is on the road-map, but not
in
the near future. The idea is basically that the server creates a unique
code, sends it in SMS, and the user would then copy it back to the login
screen. Issue with it is that we first need to allow users to select what
two factor auth mechanism they want to use. They could have a hardware OTP
token for example, but as they don't have it with them they could use the
SMS code as a backup. We also have tons of other things ahead of it in the
queue.
I'm a bit curious about your use-case. You basically want a user to login
with mobile number + password, and also use a code sent over SMS as a two
factor auth? Or do you have something different in mind?
On 1 October 2015 at 09:45, Anunay Sinha <anunay.sinha(a)arvindinternet.com>
wrote:
> Hi Stian,
> I have question about login through mobile devices in general,
> where I would like to login via mobile number, get an OTP on my number
> and use it to register/login into the system,
>
> For the number I can follow your instructions but am looking to provide
> for OTP as well (I am exploring this). It will be nice to have it out of
> the box :)
>
> Is such a option there in the Keycloak's roadmap ?
> If so what is the rough timeline?
>
> On Thu, Oct 1, 2015 at 1:06 PM, Stian Thorgersen <sthorger(a)redhat.com>
> wrote:
>
>> You would need to create a custom authenticator for it. Take a look at
>> http://keycloak.github.io/docs/userguide/html/auth_spi.html
>>
>> On 30 September 2015 at 15:34, Revanth Ayalasomayajula <
>> revanth(a)arvindinternet.com> wrote:
>>
>>> Hi all,
>>>
>>> I have an application that is secured by Keycloak. I am able to login
>>> using username/email and password. I also want to implement login via phone
>>> number. Could anybody help me how to store the phone number for a user and
>>> also how to use it to login the user.
>>>
>>> _______________________________________________
>>> keycloak-user mailing list
>>> keycloak-user(a)lists.jboss.org
>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>
>>
>>
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user(a)lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>
>
>
>
> --
> - Anunay
>
_______________________________________________
keycloak-user mailing list
keycloak-user(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user
2:13 a.m.
We have plans to add step up authentication. Basically the idea is that a
user can authenticate with a set of week credentials (username/password),
but when the application requires stronger authentication it would redirect
back to Keycloak which would then ask for additional authentication (otp,
sms, etc.). This is not something that's on our immediate road-map though.
On 1 October 2015 at 10:06, Travis De Silva <traviskds(a)gmail.com> wrote:
+1 for this feature.
This use case is getting quite popular these days. Apart from the banks
that follow this procedure, you also get companies like Google that do this
as an extra step to prevent someone who has stolen your username/password
from using it to access your content.
A would like to suggest a few additional features around this requirement
for it to be more valuable.
1. Option in KeyCloak to set if the SMS should be sent for all login
attempts or only when logging in from a new device like who you get with
Google
2. A set of actions that could trigger the SMS - For example let's say I
have a banking web app and if the user logs in and does a funds transfer
above a certain limit, I should be able to from my app trigger an SMS auth.
Not sure if this is part of OAuth2 or OIDC but I have encountered quite a
few applications following this flow to prevent identify theft.
On Thu, 1 Oct 2015 at 17:52 Stian Thorgersen <sthorger(a)redhat.com> wrote:
> Using SMS as a two factor auth mechanism is on the road-map, but not in
> the near future. The idea is basically that the server creates a unique
> code, sends it in SMS, and the user would then copy it back to the login
> screen. Issue with it is that we first need to allow users to select what
> two factor auth mechanism they want to use. They could have a hardware OTP
> token for example, but as they don't have it with them they could use the
> SMS code as a backup. We also have tons of other things ahead of it in the
> queue.
>
> I'm a bit curious about your use-case. You basically want a user to login
> with mobile number + password, and also use a code sent over SMS as a two
> factor auth? Or do you have something different in mind?
>
>
>
>
>
> On 1 October 2015 at 09:45, Anunay Sinha <anunay.sinha(a)arvindinternet.com
> > wrote:
>
>> Hi Stian,
>> I have question about login through mobile devices in general,
>> where I would like to login via mobile number, get an OTP on my number
>> and use it to register/login into the system,
>>
>> For the number I can follow your instructions but am looking to provide
>> for OTP as well (I am exploring this). It will be nice to have it out of
>> the box :)
>>
>> Is such a option there in the Keycloak's roadmap ?
>> If so what is the rough timeline?
>>
>> On Thu, Oct 1, 2015 at 1:06 PM, Stian Thorgersen <sthorger(a)redhat.com>
>> wrote:
>>
>>> You would need to create a custom authenticator for it. Take a look at
>>> http://keycloak.github.io/docs/userguide/html/auth_spi.html
>>>
>>> On 30 September 2015 at 15:34, Revanth Ayalasomayajula <
>>> revanth(a)arvindinternet.com> wrote:
>>>
>>>> Hi all,
>>>>
>>>> I have an application that is secured by Keycloak. I am able to login
>>>> using username/email and password. I also want to implement login via
phone
>>>> number. Could anybody help me how to store the phone number for a user
and
>>>> also how to use it to login the user.
>>>>
>>>> _______________________________________________
>>>> keycloak-user mailing list
>>>> keycloak-user(a)lists.jboss.org
>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>>
>>>
>>>
>>> _______________________________________________
>>> keycloak-user mailing list
>>> keycloak-user(a)lists.jboss.org
>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>
>>
>>
>>
>> --
>> - Anunay
>>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user(a)lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
2:22 a.m.
+1 this would be great!
On Oct 6, 2015 9:14 AM, "Stian Thorgersen" <sthorger(a)redhat.com> wrote:
We have plans to add step up authentication. Basically the idea is
that a
user can authenticate with a set of week credentials (username/password),
but when the application requires stronger authentication it would redirect
back to Keycloak which would then ask for additional authentication (otp,
sms, etc.). This is not something that's on our immediate road-map though.
On 1 October 2015 at 10:06, Travis De Silva <traviskds(a)gmail.com> wrote:
> +1 for this feature.
>
> This use case is getting quite popular these days. Apart from the banks
> that follow this procedure, you also get companies like Google that do this
> as an extra step to prevent someone who has stolen your username/password
> from using it to access your content.
>
> A would like to suggest a few additional features around this requirement
> for it to be more valuable.
>
> 1. Option in KeyCloak to set if the SMS should be sent for all login
> attempts or only when logging in from a new device like who you get with
> Google
>
> 2. A set of actions that could trigger the SMS - For example let's say I
> have a banking web app and if the user logs in and does a funds transfer
> above a certain limit, I should be able to from my app trigger an SMS auth.
> Not sure if this is part of OAuth2 or OIDC but I have encountered quite a
> few applications following this flow to prevent identify theft.
>
>
>
> On Thu, 1 Oct 2015 at 17:52 Stian Thorgersen <sthorger(a)redhat.com> wrote:
>
>> Using SMS as a two factor auth mechanism is on the road-map, but not in
>> the near future. The idea is basically that the server creates a unique
>> code, sends it in SMS, and the user would then copy it back to the login
>> screen. Issue with it is that we first need to allow users to select what
>> two factor auth mechanism they want to use. They could have a hardware OTP
>> token for example, but as they don't have it with them they could use the
>> SMS code as a backup. We also have tons of other things ahead of it in the
>> queue.
>>
>> I'm a bit curious about your use-case. You basically want a user to
>> login with mobile number + password, and also use a code sent over SMS as a
>> two factor auth? Or do you have something different in mind?
>>
>>
>>
>>
>>
>> On 1 October 2015 at 09:45, Anunay Sinha <
>> anunay.sinha(a)arvindinternet.com> wrote:
>>
>>> Hi Stian,
>>> I have question about login through mobile devices in general,
>>> where I would like to login via mobile number, get an OTP on my number
>>> and use it to register/login into the system,
>>>
>>> For the number I can follow your instructions but am looking to provide
>>> for OTP as well (I am exploring this). It will be nice to have it out of
>>> the box :)
>>>
>>> Is such a option there in the Keycloak's roadmap ?
>>> If so what is the rough timeline?
>>>
>>> On Thu, Oct 1, 2015 at 1:06 PM, Stian Thorgersen <sthorger(a)redhat.com>
>>> wrote:
>>>
>>>> You would need to create a custom authenticator for it. Take a look at
>>>> http://keycloak.github.io/docs/userguide/html/auth_spi.html
>>>>
>>>> On 30 September 2015 at 15:34, Revanth Ayalasomayajula <
>>>> revanth(a)arvindinternet.com> wrote:
>>>>
>>>>> Hi all,
>>>>>
>>>>> I have an application that is secured by Keycloak. I am able to
login
>>>>> using username/email and password. I also want to implement login via
phone
>>>>> number. Could anybody help me how to store the phone number for a
user and
>>>>> also how to use it to login the user.
>>>>>
>>>>> _______________________________________________
>>>>> keycloak-user mailing list
>>>>> keycloak-user(a)lists.jboss.org
>>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>>>
>>>>
>>>>
>>>> _______________________________________________
>>>> keycloak-user mailing list
>>>> keycloak-user(a)lists.jboss.org
>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>>
>>>
>>>
>>>
>>> --
>>> - Anunay
>>>
>>
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user(a)lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
>
_______________________________________________
keycloak-user mailing list
keycloak-user(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user
3123
days inactive
3129
days old
8 comments
5 participants
participants (5)
-
Anunay Sinha -
Revanth Ayalasomayajula -
Stian Thorgersen -
Thomas Raehalme -
Travis De Silva