Keycloak: Custom Authentication Flows

Keycloak is a highly customizable Identity and Access Management solution. You can build very complex authentication flows using reach SPI for Java and JavaScript.
In this video, I'm showing you how to write a simple IP-based authenticator which will either force or skip MFA OTP authentication based on the user IP address. If the user is signing in from a trusted network the MFA OTP is skipped, otherwise, MFA OTP is always forced.
Source code is available on GitHub: github.com/lukaszbudnik/keycl...
To find out more about Keycloak check out my Keycloak playlist: • Deploying Keycloak clu...

[@PatRoam]

Thank you! Very informative and presented in such a way that is easily understood.

[@ukaszbudnik9618]

You're welcome! Thanks for the feedback!

[@lucas-vm6iy]

Thanks for the explanation, helped me to get my authenticator configured.

[@ukaszbudnik9618]

Great to hear!

[@chrischen3627]

Thank you, this video content has been very helpful to me.

[@user-wd4lj7fm3q]

Thank you! It is all I need!

[@lz8029]

This is a helpful example!

[@ukaszbudnik9618]

You're welcome!

[@normannhliziyo1357]

Thank you so much. Great tutorial

[@ukaszbudnik9618]

Glad it was helpful!

[@ilpassogiau]

Thanks for making this video, it's really well done. I wonder if you know how to make Kyecloak return SAML response with the error status, because context.failure() generates an internal exception

[@albertoponce3159]

Very very nice and useful. Thanks

[@ukaszbudnik9618]

Thank you too!

[@crypto_sync2392]

Really informative video.. Thank you . Can u add a detailed video on identity brokering , similar to social logins.

[@ukaszbudnik9618]

Identity Brokering is authenticating with external identity providers and I have a video for that her: kzbin.info/www/bejne/hmnPoXhvo7uSidk Social providers in Keycloak are just wrappers around a general OpenID Connect.

[@amazinggracechoirkabugaoff7176]

i thank the helpfull video you are providing

[@ukaszbudnik9618]

You're welcome!

[@mraplunge]

Łukasz Budnik, in previous videos you showed how to deploy keycloak to k8s. How do you add this extension to deployed keycloak instance in k8s ?

[@ukaszbudnik9618]

You can customize Keycloak by extending the original Docker image. Create your own Dockerfile - add what you need, build it, upload to container registry, and then use it in your deployment files.

[@viveksingh-hv2ph]

Is there a Javascript way to achieve the same as you mentioned instead of Java?

[@SilasAugustoprogrammer]

in the keycloak documentation it says it's possible, but so far I haven't found an example that helps me with this. If you know anything, let me know

[@ukaszbudnik9618]

Augusto is correct, you can also use JavaScript, more on this in Keycloak documentation: www.keycloak.org/docs/latest/server_development/#_script_providers

[@amazinggracechoirkabugaoff7176]

i had an issue in keycloak config specifically, would you mind to give help plz!

[@ukaszbudnik9618]

hey, I have many viewers and I'm not be able to review all issues posted in comments (especially if they have no details). Keycloak has a very vibrant community, please reach out to: www.keycloak.org/community

[@alexD-th6zy]

hi Lukasz, if i want to change the login page to be restful api, is it possible?

[@ukaszbudnik9618]

hi Alex, in theory you can implement your own login (handle all requests and errors, etc) - but that's a lot of work and I never done it. Why not use themes to customise UI/UX? You can implement your own theme so that the login page will look and feel the same just like your application. I show how to use themes in this video: kzbin.info/www/bejne/d36TiYljhrmHbLs or check out the documentation: www.keycloak.org/docs/latest/server_development/#_themes. thanks, Łukasz

[@alexD-th6zy]

Hi,@@ukaszbudnik9618 thank you so much for the reply. our requirement is we need to use authorization code as our flow, but in our case, the flow actually is under apps rather than web page. seems Oauth2 per se doesn't require this flow to be within Browser base? but keycloak restrict it to browser base? Do you know why or anything i misunderstood.

[@AhamedIfham]

Would this custom authenticator be called up if the user is invalid in the first place? (Garbage name for the userID)

[@ukaszbudnik9618]

No, because I marked them all as required. The first required authenticator to fail, fails the whole authentication flow.

[@abhishekgaming6761]

Sir can you please help to solve if i need to allow olny specific ip range instead of single ip

[@ukaszbudnik9618]

You need to make 2 changes: 1) in config property set an IP range instead of a single IP - no changes required in the code because it's still a string 2) update IPAuthenticator.java and implement checking IP ranges, for example using this open-source project github.com/seancfoley/IPAddress (add it as. dependency to pom.xml) Good luck!

[@manishsingh6117]

Can you create an example (keycloak inbuilt flows) with the below 2 types in 1 flow FormActionFactory / FormAction AuthenticatorFactory / Authenticator Example: Required Alternative Disabled Conditional Identity Provider Redirector(azuread-oidc) X Registration X Registration-1 X Registration User Creation X Idea is that for some specific user attempt IDP redirector if user not present call contect.attempted() than go with the normal user creation. IDP redirector is of Type Authenticator and Registeration-1 (registration-page-form) authenticator type Registration User Creation (registration-user-creation) FormAction type all flows execution are inbuilt.

[@ukaszbudnik9618]

I think it would be a good exercise for you to try it out yourself. You have a pretty good and detailed description of what you want to build :)

[@akhlaquealam3205]

How we can create custom authentication to show account is locked, contact to administrator?

[@ukaszbudnik9618]

You can adapt custom authentication flow for this. You could use LoginFormsProvider and call setError() method with a custom error message. Mind that this gives away some extra information to a potential attacker. A similar thread is mentioned in the official Keycloak ticket here: issues.redhat.com/browse/KEYCLOAK-8013

[@ThanhBui-99]

hi, now i add apache common library in project but it says Uncaught server error: java.lang.NoClassDefFoundError: can you help me

[@ukaszbudnik9618]

When you add additional libraries make sure to add them to pom.xml

[@sergiogomez189]

hi thank you, can you to exṕlain CIBA (Client-Initiated Backchannel Authentication Flow) with an example using Keycloak and spring boot please

[@ukaszbudnik9618]

CIBA is very well covered here: github.com/keycloak/keycloak-community/blob/main/design/client-initiated-backchannel-authentication-flow.md and regarding your request about Spring Boot example here is the official Keycloak documentation on Spring Boot adapter: www.keycloak.org/docs/latest/securing_apps/#_spring_boot_adapter

[@praneethkumart459]

Thank you for the Informative Video. How can i write the Custom "Reset Credentials" flow. Keycloak provides "Forgot Password" functionality. It is working. By clicking this, I entered email and a link is sent to my email. On clicking the link I can reset my password. After successful password reset, i want to execute additional functionality (lets say example: print the updated password in server). I don't want use EventListeners. How can i add additional execution to "Reset Credentials" flow?

[@ukaszbudnik9618]

Honestly, I never had to extend the "Reset Credentials" flow. But this would work like any other authentication flow in Keycloak. Copy the original flow, add another step to it, and update the "Bindings". But I would make one thing clear: this is not a good security practice to print updated passwords in the server... If the user forgets the password they can always reset it, no need to make any additional copies (if that's the reason for printing them). To me, printing updated passwords in the server, may violate security and privacy laws.

[@c.quangbui8613]

Very usefull video. By the way I use Keycloak server and authen with grant_type = authorization_code. I have API (Spring boot) get-token-by-code with input is authorizationCode + redirectUrl to authen that user and generate token for User by call /realms/{realm-id}/protocol/openid-connect/token from Keycloak Server Everything works fine but my problem is before return token for client I need to do something: I need get username from authorizationCode or somethingelse to get renew user info by call API to other. After User have renew, I will call /realms/{realm-id}/protocol/openid-connect/token from Keycloak Server to get Token --> Every Info User have updated and new User info insight token is new --> Done my problem. So how I can do it. Any Idea plz help me

[@mohamedhamada-rl2hz]

Thank you I want to ask how can I redirect condtional to a custom ftl after sussesful login, I tried this // Response challenge=context.form().setAttribute("fullname", user.getFirstName() + " " + user.getLastName()) // .createForm("test.ftl"); // context.forceChallenge(challenge); but when I reload the page again it back to SMS authentiaction page which is the previous page

[@ukaszbudnik9618]

I never had to do similar thing in Keycloak and I don't know the answer to your problem. You may reach out to www.keycloak.org/community for some help too. If you find the solution, please remember to post an update here!