Search code examples
javaauthenticationkeycloakjboss-wildfly-11

How to bypass username/password authentication with mobile/OTP for Keycloak


How to bypass username/password authentication with mobile number/OTP (sent via SMS) for Keycloak


Solution

  • You have to implement custom authentication flow (see Admin Console -> Authentication -> Flows). Your flow should include two branches: one for login/password, and second for SMS/OTP. For every subflow you should implement dedicated Authenticator SPI with Conditional requirement. From client side your applications should supply some data (e.g. additional http param) that will be used by Conditional Authenticators to make a decision about routing through authentication flow.

    Detailed guideline for authentication flow development

    Authenticator development docs

    P.S. I'm not familiar with latest keycloak version, maybe there are already exists some facilities for your goal.