5 ms·

if you're using a keycloak for you authentication, you can actually enable it today! https://keycloak.ch/keycloak-tutorials/tutorial-webauthn/ https://keycloak

if you're using a keycloak for you authentication, you can actually enable it today! https://keycloak.ch/keycloak-tutorials/tutorial-webauthn/ https://keycloak.ch/keycloak-tutorials/tutorial-webauthn/ you basically just have to create a new 'browser flow' and enable this one in the realm you wish to authenticate with. It wasn't really possible to add multiple keys to the user the last time i configured it -- but according to the docs, that seems to be resolved so it probably is worth another look.

kuschku 5y ago
Sadly I haven’t managed to find a way to make keycloak prefer security keys for 2FA over TOTP. I always get the TOTP prompt first, then have to click "try another way" and select security key.
- ArchOversight 5y ago
  It depends on the order that the user registered their 2FA, since they are ordered (and an admin can move factors up/down in the admin interface). If you move the WebAuthN devices above the TOTP, Keycloak will first ask for the WebAuthN key with a button to switch back to another method (TOTP). It's slightly annoying.
  - kuschku 5y ago
    Now that’s annoying! I wish there was a way to rank them, e.g., always prefer WebAuthN if available over TOTP.
stavros 5y ago
Is that OSS SSO software? Seems pretty nifty, and I'm looking for an SSO solution for work at the moment.
- 411111111111111 5y ago
  It's pretty great, but you should be aware that the LTS version is called red hat single sign on (rh sso), and the keycloak itself updates every few months. It's usually not a deal breaker, but you should be aware if you're going to evaluate it for work
  - stavros 5y ago
    That's very useful, thank you!
- mooreds 5y ago
  @stavros, not sure if OSS is a requirement, but my current employer is in the same space. It is not open source, but there is a gratis/free as in beer edition that you can download and use commercially (for certain usage: https://fusionauth.io/license-faq#3 https://fusionauth.io/license-faq#3 ). You can grab it here: https://fusionauth.io/download https://fusionauth.io/download
  - stavros 5y ago
    Thanks, I'll evaluate that as well!

kuschku 5y ago

Sadly I haven’t managed to find a way to make keycloak prefer security keys for 2FA over TOTP. I always get the TOTP prompt first, then have to click "try another way" and select security key.

ArchOversight 5y ago
It depends on the order that the user registered their 2FA, since they are ordered (and an admin can move factors up/down in the admin interface). If you move the WebAuthN devices above the TOTP, Keycloak will first ask for the WebAuthN key with a button to switch back to another method (TOTP). It's slightly annoying.
- kuschku 5y ago
  Now that’s annoying! I wish there was a way to rank them, e.g., always prefer WebAuthN if available over TOTP.

stavros 5y ago

Is that OSS SSO software? Seems pretty nifty, and I'm looking for an SSO solution for work at the moment.

411111111111111 5y ago
It's pretty great, but you should be aware that the LTS version is called red hat single sign on (rh sso), and the keycloak itself updates every few months. It's usually not a deal breaker, but you should be aware if you're going to evaluate it for work
- stavros 5y ago
  That's very useful, thank you!
mooreds 5y ago
@stavros, not sure if OSS is a requirement, but my current employer is in the same space. It is not open source, but there is a gratis/free as in beer edition that you can download and use commercially (for certain usage: https://fusionauth.io/license-faq#3 https://fusionauth.io/license-faq#3 ). You can grab it here: https://fusionauth.io/download https://fusionauth.io/download
- stavros 5y ago
  Thanks, I'll evaluate that as well!