KEYCLOAK - 2FA with SMS based OTP text messages | Niko Köbler (@dasniko)

In this video I show you how to implement a custom #2FA solution for #Keycloak using SMS based text messages to send the #OTP.
The code used in this video is on GitHub here: github.com/dasniko/keycloak-2...
My corresponding blog post: www.n-k.de/2020/12/keycloak-2...
Read about the Keycloak Authentication SPI in the official docs, this is strongly recommended: www.keycloak.org/docs/latest/...
This is just for demo purposes and aims for ease and simplicity,. When using in production, I'll strongly recommend that you'll adjust the code to your needs and add further validation.
Don't forget to subscribe to my channel (if not already done) and give this video some thumbs up 👍 (aka "like").
Tell me about your experiences and in the comments. I'm looking forward to it! Thank YOU!
---
I'm Niko - and I'm an independant freelance software consultant, developer and trainer.
I'm here to help - you, your team and your company.
How can I support you? Just get in contact:
🌎 Website: www.n-k.de
🐦 Twitter: / dasniko
🚧 GitHub Profile: github.com/dasniko
🎥 KZbin Channel: kzbin.info?...
All things Cloud ☁️, Serverless, On-Premise, Java, JavaScript, All-End (Frontend, Backend, Fullstack Deployments), Authentication, Security 🔐, IAM, Keycloak, Containers, DevOps
Please understand that KZbin is not a good place to get support in case of errors. There are forums out there which are the right place to ask!

[@Varric95]

Great Tutorial! It helped me alot to understand keycloak more. Thank you! btw. nice video quality

[@mohamadsharifi2353]

Great explanation. It was really helpful.

[@worldcibersecurity2066]

Thanks for share! Good job Niko .

[@canaldovictormag]

Thanks for share the content about keycloak

[@kw1980-m6x]

Great content and tutorial. Thank you for sharing it

[@dasniko]

Thank you so much, Kamal! Also for your donation, this is really appreciated and shows me that not all my effort is worthless!! 👍

[@darlingtonmatongo9436]

Awesome tutorial, thanks so much.

[@trydex1]

It was very helpful. Thank you!

[@rickhernandez9976]

Good insights!

[@agguLi]

Thank's for the video. Is it possible to set a otp token period like in the keycloak otp config?

[@briankowald6465]

Thank you very much for this video. I compiled it and am attempting to get it to run. You say to copy the jar files to the /deployments folder. Do mean to copy to the providers subfolder folder in the keycloak installation folder? Where do I copy the template ftl file and the messages to?

[@dasniko]

Thank you for your positive feedback. I mean the standalone/deployments folder, like also mentioned in the docs (www.keycloak.org/docs/latest/server_development/index.html#using-the-keycloak-deployer). If you deploy your own JAR, you can put the template and message files into this jar, in the structure like in my demo repository. Or/and, you can just add them to your custom theme, if you use one, and thus overwrite the original ones from the JAR.

[@nedeevoli]

Thank you Mr. @Niko köbler for your knowledge share, My deployment was domain mode and the project was spring but the system can't show me in the list, can u help me the keyclok version is 16.1.0

[@sujitpingale2346]

Great Tutorial! Question: Custom Authentication flow will be applicable to all the users, Am I right? Is there any way to configure Different Authentication Flow for Different Users?

[@iruvuruharika9387]

Hi @dasniko, Your videos are really good. I have a requirement that i need to send otp to the user only once during registration and not every time. Can you please provide me any solution?

[@hatimchawki3995]

Thank you Mr. @Niko Köbler for this greaaat work, I just wanna ask you where i can add configs to use SNS service for SMS send. till now i'm only use simulation mode and i want move to AWS SNS Service.

[@dasniko]

Thanks. How you configure the AWS credentials is up to you. Set them as env vars or system properties and use the default provider chain from AWS. If you want to set and use the access key and secret access key in the provider config form, you‘ll have to extend the code accordingly.

[@hatimchawki3995]

​@@dasniko Thanks for your answer, does injecting access/secret key as environment variable on my docker compose will be enough ?

[@dasniko]

Yes, that way I‘m using it too

[@hatimchawki3995]

​@@dasniko Thank you very much Mr. Niko.

[@baradaranjansahoo1633]

@@hatimchawki3995 can you tell how to add environment variable for using aws sns in local without any docker configuration . please give the detail of variable name and value . Thanks

[@abdulraqeebm.3305]

I am using a newer version of keycloak 20.0.0 and I am facing issues when deploying my provider in opt/keycloak/providers Can you please tell me if there is anything to change while deploying to the newer version?

[@mahmedaa]

Great job mate. It's insightful and runs on my machine. I'd like to do the same for registration (ask customer for his mobile number and send OTP SMS to confirm the number). I've modified the code for testing to send it to a fixed phone number and changed registration flow to include SMS authenticator. However, for some reason registration flow doesn't show OTP step. Am I missing something? perhaps I need to implement different interface for registration? It would be great if you can provide directions to resolve this.

[@dasniko]

Thank you. Registration steps are a bit different to implement (different interface). Also, registration "flow" just supports one form as default, there has to be done some (dirty hacks) unconventional workarounds to achieve a real flow with various/multiple forms in registration.

[@mahmedaa]

@@dasniko Aha I see. I was thinking to use a separate external page in JS for registration and our backend to use Keycloak REST API to do the registration. My understanding is that this is less secure than Keycloak own registration page. Is this true? Do you recommend this approach?

[@dasniko]

It's always less secure if there is another application dealing with the Keycloak Admin API and therefore this app needs some admin credentials, which can be misused, etc... So, I would say it's a tradeoff between various issues. I, for myself, would not go a detour if there is a direct and secure way to do something, even if it's causing some effort to do this. Security comes with a price. But how expensive is something compared to a data breach? Security must not be a tradeoff.

[@mahmedaa]

@@dasniko Thanks. I appreciate your time and effort.

[@princechuks8553]

@@dasniko Please I will really appreciate of you can do this 2FA for me. Kindly get back so we can discuss please

[@sajjadjafari9187]

I really appreciate you for such a great tutorial. Does it work in cluster mode or I should use shared memory to save OTP value? I think with AuthenticationSessionModel I don't need to use a shared memory and if I run keycloak in cluster mode, each node has access to the OTP value . Am I right?

[@dasniko]

If your cluster is setup properly, this will work. Additionally, sticky sessions on the load-balancer are recommended for Keycloak, so cluster communication overhead will be reduced.

[@sajjadjafari9187]

@@dasniko Thank You For Your Attention.

[@sheevaa2634]

Thanks for the informative video. Do you have any video/tutorial about key cloak authentication via Email? Some of our clients are not allowed to take mobile devices in their offices and we want to have the option to enable 2FA via Email (instead of google authenticator) for them. Any tips would be greatly appreciated

[@dasniko]

It‘s pretty the same. Instead of sending the SMS, you just have to send an email. Retrieve the email provider before and send the mail though the provider.

[@sheevaa2634]

@@dasniko Thanks so much for the information, yes I have now used Keycloak features to send an email instead of SMS. Is there a way to make this configurable so that some users in the realm to use phone OTP (if they have one), and some to have email OTP? My current configuration "Browser with Email" binding would cause everyone on that same realm to require an email OTP, but we want this to be configurable - so some customers in the realm might have a phone OTP and some might have to use the email one.

[@dasniko]

You have 2 options: 1. Build the condition into the 2FA extension and decide upon some attributes or whatever if you send an SMS or an email 2. Build 2 2FA extensions, one for SMS, one for email, extend your AuthFlow in Keycloak to have a condition based on role or attribute

[@sabazahra5722]

@@sheevaa2634 Hey ! Were you able to make modifications to use Email for authentication instead of sms? What changes were required? Which Keycloak version have you used? I am trying to do the same but running into few errors. I would really appreciate your help :)

[@codecoffee8363]

Awesome, I'm new with keycloak. Do you have any tutorial for signin and sign up with otp without password? TJANKS

[@gabrielfernandessilva3707]

Comment for YT algorithm. Thanks

[@newsmunite]

Hi, I need multiple login issue. So, I wanna either with username and password login or Sms auth login. How to handle it ?

[@elhassounisoufiane5850]

Great content and tutorial. Thank you for sharing it ! I have a question for you, How i can manage the case of resending the sms ?

[@dasniko]

You have to implement it on your own, depending on your desired behavior. There's no ootb!

[@nikitakobtsev]

An excellent instruction that I could easily apply for my embedded in the spring boot application keycloak server! But how does the user data get into the keycloak other than being entered by the administrator? If my application is responsible for registering users, can I simultaneously pass the user data the keylock needs while registering user in my application?

[@dasniko]

If your users "register" in another app, you can use the admin rest api to create the user in keycloak. The admin rest api is exactly the same thing the admin ui uses under the hodd.

[@nikitakobtsev]

@@dasniko I found this feature in the documentation, thank you, appreciate it. Keylock is embedded in the application that is responsible for registration. I think they can be considered separate. Did I understand correctly that before authorizing a user using OTP (my flow consists only of it, not 2FA) I should register him in keycloak via REST API and only then authorize him, trying to get a token?

[@dasniko]

If a user is not available (registered) in Keycloak, Keycloak can‘t authenticate the user. 😉 Another option may be to implement a User Storage SPI to use the user data from your application. This way you don‘t have register the user separately, as it is just availabe due to the SPI. Look for this in the „Server developer docs“ of Keycloak.

[@dasniko]

Side note: I don‘t have experienxce with Keycloak running embedded in another application environment, as this is not officially supported. But I would also assume that despite it is embedded, it‘s a separate app.

[@nikitakobtsev]

​@@dasniko Thanks for the answer! It helped me a lot, but there were also new questions. I feel awkward, because this platform is not intended for detailed questions, but I'm not sure if I can get an answer on other sites. I would be glad if you could answer my questions. Also, if it is more convenient, then I am ready to post the questions somewhere else in accordance with all the rules. Since my last post, I've got a little better understanding of how the SPI Authenticator works and if I understood correctly, it is good practice to run all the authorization logic in Keycloak. In your example, Keycloak sends SMS and validates the code entered by the user through adapter classes for a specific SMS operator. After that, the user is considered authorized and an access token is returned to him. But in my application, entering the code is either authorization or the first stage of registering a new user if the user has not yet been registered in our application. Accordingly, at this stage it may not be necessary to obtain an authorization token. At the same time, Keycloak is responsible for working with OTP. Can keycloak handle such cases? Can I issue or not issue a token depending on the situation? Can a token be issued to a user "delayed" only after the registration procedure is completed? Moving on to the issue of registering Keycloak users, I suspected that Keycloak provides the necessary interfaces for the implementation of user providers, but then I could not find it. Thank you for pointing the right way. And from the moment I received your answer, I started to implement User Storage SPI little by little, but I ran into a problem that I need to implement the isValid method from CredentialInputValidator. With the password, everything is quite clear, we compare two passwords (or two hashes, which is more likely in a real application) and return the result. But what should we do in the case of OTP and is it generally necessary to implement this interface if we do not store information about passwords?

[@user-er7kq9ok7m]

Can you write an article - how to use keycloak and sms login as first auth factor? If it possible?

[@dasniko]

Sure I can. Will you pay me for it?

[@joseluisfernandez5981]

This is great content. Thank you so much!! I have a question, it is possible to take control of the first form (username and password)? I would like to compare these credentials by my own (credentials not being stored in Keycloak in any way, not befor or after do this comparison) and return ok or not to this form validation as a result of my own validation. Thanks in advance.

Hi @dasniko , your videos are really good. I have a question that maybe you can solve, in the flow that I am implementing I want to send the SMS only once, that is, the first time I log in. At this moment I need to fill out the form with my username and password, I send the SMS to the user and they finish the flow. But the next time I want to log in I don't want to have to receive the SMS, because the first time I logged in I already verified that the phone number is from who I expected, is it possible?

[@ehabrefaat]

How I can add extra link like (resend the code)?

[@lytuan5836]

Thank you so much. Would you tell me How to create the new env variables and get ones in my custom authenticator provider from Docker ??? my SMS provider needs some variables like secretKey and ID, and I want to get them from env variables... how can I do it??? Thanks in advanced

[@dasniko]

That's not related in any way to Keycloak. Just set env vars in Docker like every other env var and access it from Java with System.envvar(...) Where's the problem?

[@lytuan5836]

that's really easy, I totally forgot it. Thanks

[@TheDovson]

PLEASE HELP ME SOMEODY!!! My question: if I would like to use the authenticate method of SmsAuthenticator class (so I would like to call this method from an other class), then how can I get the AuthenticationFlowContext value (as it is the needed parameter of the authenticate method) ? I have looked for this info for many many hours, but I didn't find. Please somebody save my life, please!!!!! THANK YOU SO MUCH!!!!

[@nicholaswhite7351]

Hello. Is it possible in the Account Management console to have a list of client applications and have a button for each one in the list to send user's credentials to that client?

[@dasniko]

This would be highly insecure. Additionally, Keycloak does not know the users credentials in cleartext, so it can‘t send them to someone else. Doing something like that would be more than stupid!

[@nicholaswhite7351]

@@dasniko All I wanted to do is being redirected to client applications from Account Console))) It turned out easy-pizzy.

[@nicholaswhite7351]

@@dasniko Can you give me a council on how to hide some client apps from Account Console? I mean only showing clients that correspond to the user's role(s)...

[@sagarpoudel139]

Hi @Niko Köbler, Can we do similar kind of thing with direct grant flow?

[@dasniko]

Technically, nearly everything is possible. But IMHO it doesn‘t make sense to use something like 2fa with direct grant flow, which additionally is also one of the most insecure auth flows of all available.

[@sagarpoudel139]

@@dasniko We have the requirement to implement this with direct grant flow only, Can you suggest the most efficient way to do it?

[@timmy5362]

@@sagarpoudel139 Hey, did you find it out?

[@mnededeejay]

does it work on keycloak 23.0.4?

[@RajeshVerma-yr1jy]

I had implemented Custom SMS OTP(2FA) authentication Flow and working great as required, Now I have to expose the my custom SMS AuthenticationOTP flow via a Rest API to allow the user to login. how can i do this, Pls suggest.

[@dasniko]

Not at all. When using OIDC, users are ALWAYS required to authenticate at the IdP, not via an API. That‘s highly insecure, considered harmful, is a man-in-the-middle scenario and stupid.

[@ImranWateen]

Hello Niko. I have created custom authenticator in java i have compiled it into JAR file now where do i need to place that in keycloak directory so i can see it on keycloak UI Console ?

[@dasniko]

www.keycloak.org/docs/latest/server_development/index.html

[@baradaranjansahoo1633]

after turning off simulation mode , am getting internal server error after entering login and password . means its not connecting to AWS SNS , . how to add aws sns credentials ? and where to add ? kindly please do a comment regarding this . please its my sincere request don't ignore my request .

[@dasniko]

just google "AWS credentials java"

[@pappie1953]

I am getting this error on keycloak "Could not find configuration for Required Action mobile-number-ra, did you forget to register it?", what did I missed?

[@dasniko]

As my examples are EXAMPLES, you'd better have a look into the source code instead of blindly fetching something and throwing it into a server... See github.com/dasniko/keycloak-2fa-sms-authenticator/blob/4205a6c2bb1bb687df966d2906c3d3bdf3a05df2/src/main/java/dasniko/keycloak/authenticator/SmsAuthenticator.java#L108

[@adriannajera8013]

Hi, i would like to know how could i add the module to keycloak

[@dasniko]

Please consult the official documentation: www.keycloak.org/docs/latest/server_development/index.html#registering-provider-implementations

[@kopijava]

6:31 how to add sms authentication choice to keycloak?

[@ErikAlvarez-go2tj]

I'm facing the same issue. It looks like the option was removed

[@cleberdearaujo383]

Great! Is it possible to do the same for email?

[@dasniko]

yes

[@tieuoi3173]

2FA with OTP email. that's a big problem. help me pls

[@johnr9202]

Can't verify code using api?

[@piotreknuras]

Does it work with keycloak 22? I was able to compile it. Add it to keycloak and add sms to browser flow but later can't access login form any more.

[@dasniko]

It works pretty well, yes!

[@thuanngh820]

I tried but it's error. The response error was "Cannot login, credential setup required.". I use keycloak 13.0.1

[@dasniko]

Then your user doesn't have the attribute "mobile_number" set. github.com/dasniko/keycloak-2fa-sms-authenticator/blob/251d8c9ed04befa25d659603bbc7f548ba979dc0/src/main/java/dasniko/keycloak/authenticator/SmsAuthenticator.java#L103

[@thuanngh820]

I fixed and it's worked. Thank you very much!

[@qutheejanaz2998]

i want to do this for update password

[@dasniko]

well, then just do it!

[@qutheejanaz2998]

@@dasniko Means can we do this password update? will Account console allow for OTP in password update?

[@benjaminehng812]

thank you. some critic: your face sometimes hides important part of the monitor

[@MasoodMoghini]

thank you for your tutorial but something that is really annoying is great part of video consists of just your face , even after minimizing it to the corner of video I can't view much of what are you doing just because of the big face appearing on the screen corner .

[@dasniko]

Well, in that case my videos are just not for you. 🤷‍♂️ It's my style and everything important is visible or in the description linked. Also, hopefully people are not just copy&pasting things they see, but will also think about it and make own assumptions and tests.

[@xfisher2]

I have error, after login: '17:57:51,046 ERROR [org.keycloak.services.error.KeycloakErrorHandler] (default task-1) Uncaught server error: java.lang.NoClassDefFoundError: org/keycloak/common/util/SecretGenerator'

[@poutang2564]

Did you know how to solve this problem? I also have the same problem.

[@user-tw3mj5ml2j]

Hi sir, I am getting error like no such method jakarta.ws.rs.core.Response createForm(String form) while create login OTP form. Please guide me to resolve this issue