3

I am evaluating Keycloak for one of our systems where 2FA with TOTPs would be a requirement. I am trying to figure out if there is a way to register a new Authenticator app via the Admin REST API, so our user's wouldn't need to interact with the Keycloak provided account page.

I've spent some time with the reference documentation but got no luck. Is there something I am missing? Is omitting the Keycloak provided UIs a preferred way to use this service?

Thanks!

Adam Berkecz
  • 73
  • 1
  • 7

2 Answers2

2

The short answer to this specific question is "no", as has already been said in Jan's answer.

However, for those that are interested, I've added a detailed answer around what you can and can't do regarding attempting to roll-you-own around the OTP device setup in Keycloak as the answer to this similar question: Keycloak - Multi/2FA Factor - OTP - QR Code - Custom Login Screen - Rest API.

The focus there is more around setting up OTP devices using your own application pages instead of Keycloak's, but someone who has found this page looking for information might find it useful.

MattC
  • 671
  • 1
  • 6
  • 15
0

No, you can't use API for that. You need user UI interaction.

I can't imagine how you will be able to distribute TOTP credentials to the user device. Maybe some high profile enterprise environments (Android Enterprise, ...) can force it, but it won't be very common use case.

Jan Garaj
  • 25,598
  • 3
  • 38
  • 59
  • Thank you for your answer! The basic idea was to register the TOTP device through our own customer-facing profile page (and its underlying service which communicates with the Keycloak API). – Adam Berkecz Jan 14 '20 at 08:04
  • 1
    Thanks for the answer, but I do not think this answers the question (probably a misunderstanding) and I don't get why it was accepted. @AdamBerkecz was not asking for some backend automation without user interaction. He was asking for a way to build a custom OTP setup page (outside of keycloak's UI) which the users would use to actively register their authenticator apps. For this solution, we would need access to some Keycloak API that allows registration of authentication apps. – Thomas Dec 02 '20 at 02:35