Keycloak: Open-source identity and access management

Re:Keycloak: Open-source identity and access management by closeparen on Wednesday April 15, 2020 @12:33PM (#22879772)

You can assign the user a temporary password so that they get prompted to enroll their credential on first login. But:

a) Because the password is assigned first, it has higher priority, so subsequent logins will prompt for password first until the admin manually changes the user's credential ordering to put the WebAuthn (passwordless) token higher. The user's credential priority overrides the order of challenges in the login flow.

b) There is no option to add or replace one of these credentials, or manage credential ordering yourself, in the end-user webapp that does profile editing / password updates.

An admin may be able to reset your account so that you get the first-login experience again and can enroll new credentials.

[ Parent | on HN ]

Re:Keycloak: Open-source identity and access management by tialaramex on Wednesday April 15, 2020 @07:38PM (#22884455)

Blergh. I guess maybe this can be both safe and effective while just being really inconvenient, but my instinct is that on the whole it's just going to be inconvenient without being safe or effective.

Nobody should have designed something like this, for WebAuthn in particular the standard is explicit about the desire for multiple tokens. Lots of the design is more complicated so as to support that capability.

[ Parent | on HN ]