keycloakopenid-connecttwo-factor-authentication

Determine if Keycloak User has TOTP enabled

I have a Single-Page Web-Application authenticating against Keycloak and letting Users enable TOTP in their Keycloak-Account-Page.

However I want the Client-Application to determine after login, if the authenticated User has 2-factor-authentication/TOTP enabled or not.

Is it possible to map this (boolean) information into the Tokens or userinfo Endpoint ... I haven't found any User Property, that contains this information.

The only Place I found it, was in Admin-REST-API /auth/admin/realms/{realm}/users/{uuid}, but the Client/End-user won't and shouldn't have access there:

{
   ...
   totp: true,
   
}
Solution

  • I don't think this is possible without customization.

    You may want to add a custom protocol mapper and check for totp like this:

    keyclaokSession.userCredentialManager().isConfiguredFor(realm, user, OTPCredentialModel.TYPE)

    Here is a video that explains the first steps.