diff --git a/docbook/reference/en/en-US/master.xml b/docbook/reference/en/en-US/master.xml
index 29a49a7bb6..7a798f8fcb 100755
--- a/docbook/reference/en/en-US/master.xml
+++ b/docbook/reference/en/en-US/master.xml
@@ -46,6 +46,7 @@
+
]>
@@ -140,6 +141,7 @@ This one is short
&Proxy;
&CustomAttributes;
&ProtocolMappers;
+ &AuthSPI;
&Migration;
diff --git a/docbook/reference/en/en-US/modules/auth-spi.xml b/docbook/reference/en/en-US/modules/auth-spi.xml
index 54bd36d179..05e7f4235e 100755
--- a/docbook/reference/en/en-US/modules/auth-spi.xml
+++ b/docbook/reference/en/en-US/modules/auth-spi.xml
@@ -74,7 +74,453 @@
+
+ Required Action
+
+
+ After authentication completes, the user might have one or more one-time actions he must
+ complete before he is allowed to login. The user might be required to set up an OTP token
+ generator or reset an expired password or even accept a Terms and Conditions document.
+
+
+
+
+ Algorithm Overview
+
+ Let's talk about how this all works for browser login. Let's assume the following flows, executions and sub flows.
+
+
+
+
+ In the top level of the form we have 3 executions of which all are alternatively required. This means that
+ if any of these are successful, then the others do not have to execute. The Username/Password form is not executed
+ if there is an SSO Cookie set or a successful Kerberos login. Let's walk through the steps from when a client
+ first redirects to keycloak to authenticate the user.
+
+
+
+ The OpenID Connect or SAML protocol provider unpacks relevent data, verifies the client and any signatures.
+ It creates a ClientSessionModel. It looks up what the browser flow should be, then starts executing the flow.
+
+
+
+
+ The flow looks at the cookie execution and sees that it is an alternative. It loads the cookie provider.
+ It checks to see if the cookie provider requires that a user already be associated with the client session.
+ Cookie provider does not require a user. If it did, the flow would abort and the user would see an error screen.
+ Cookie provider then executes. Its purpose is to see if there is an SSO cookie set. If there is one set, it is validated
+ and the UserSessionModel is verified and associated with the ClientSessionModel. The Cookie provider returns a
+ success() status if the SSO cookie exists and is validated. Since the cookie provider returned success and each execution
+ at this level of the flow is ALTERNATIVE, no other execution is executed and this results in a successful login.
+ If there is no SSO cookie, the cookie provider returns with a status of attempted(). This means there was no error condition,
+ but no success either. The provider tried, but the request just wasn't set up to handle this authenticator.
+
+
+
+
+ Next the flow looks at the Kerberos execution. This is also an alternative. The kerberos provider also does not
+ require a user to be already set up and associated with the ClientSessionModel so this provider is executed.
+ Kerberos uses the SPNEGO browser protocol. This requires a series of challenge/responses between the server and client
+ exchanging negotiation headers. The kerberos provider does not see any negotiate header, so it assumes that this is the
+ first interaction between the server and client. It therefore creates an HTTP challenge response to the client and sets a
+ forceChallenge() status. A forceChallenge() means that this HTTP response cannot be ignored by the flow and must be returned to the
+ client. If instead the provider returned a challenge() status, the flow would hold the challenge response until all other alternatives
+ are attempted. So, in this initial phase, the flow would stop and the challenge response would be sent back to the browser. If the browser
+ then responds with a successful negotiate header, the provider associates the user with the ClientSession and the flow ends because
+ the rest of the executions on this level of the flow are all alternatives. Otherwise, again, the kerberos provider
+ sets an attempted() status and the flow continues.
+
+
+
+
+ The next execution is a subflow called Forms. The executions for this subflow are loaded and
+ the same processing logic occurs
+
+
+
+
+ The first execution in the Forms subflow is the UsernamePassword provider. This provider also does not require for a user
+ to already be associated with the flow. This provider creates challenge HTTP response and sets its status to challenge().
+ This execution is required, so the flow honors this challenge and sends the HTTP response back to the browser. This
+ response is a rendering of the Username/Password HTML page. The user enters in their username and password and clicks submit.
+ This HTTP request is directed to the UsernamePassword provider. If the user entered an invalid username or password, a new
+ challenge response is created and a status of failureChallenge() is set for this execution. A failureChallenge() means that
+ there is a challenge, but that the flow should log this as an error in the error log. This error log can be used to lock accounts
+ or IP Addresses that have had too many login failures. If the username and password is valid, the provider associated the
+ UserModel with the ClientSessionModel and returns a status of success()
+
+
+
+
+ The next execution is the OTP Form. This provider requires that a user has been associated with the flow. This requirement is satisfied
+ because the UsernamePassword provider already associated the user with the flow. Since a user is required for this provider, the provider
+ is also asked if the user is configured to use this provider. If user is not configured, and this execution is required, then the flow will
+ then set up a required action that the user must perform after authentication is complete. For OTP, this means the OTP setup page.
+ If the execution was optional, then this execution is skipped.
+
+
+
+
+ After the flow is complete, the authentication processor creates a UserSEssionModel and associates it with the ClientSEssionModel.
+ It then checks to see if the user is required to complete any required actions before logging in.
+
+
+
+
+ First, each required action's evaluateTriggers() method is called. This allows the required action provider to figure out if
+ there is some state that might trigger the action to be fired. For example, if your realm has a password expiration policy,
+ it might be triggered by this method.
+
+
+
+
+ Each required action associated with the user that has its requiredActionChallenge() method called. Here the provider
+ sets up an HTTP response which renders the page for the required action. This is done by setting a challenge status.
+
+
+
+
+ If the required action is ultimately successful, then the required action is removed from the user's require actions list.
+
+
+
+
+ After all required actions have been resolved, the user is finally logged in.
+
+
+
+
+
+
+ Authenticator SPI Walk Through
+
+ In this section, we'll take a look at the Authenticator interface. For this, we are going to implement an authenticator
+ that requires that a user enter in the answer to a secret question like "What is your mother's maiden name?". This example
+ is fully implemented and contained in the examples/providers/authenticator directory of the demo distribution of Keycloak.
+
+
+ The classes you must implement are the org.keycloak.authentication.AuthenticatorFactory and Authenticator interfaces. The Authenticator
+ interface defines the logic. The AuthenticatorFactory is responsible for creating instances of an Authenticator. They both extend
+ a more generic Provider and ProviderFactory set of interfaces that other Keycloak components like User Federation do.
+
+
+ Packaging Classes and Deployment
+
+ You will package your classes within a single jar. This jar must contain a file named org.keycloak.authentication.AuthenticatorFactory
+ and must be contained in the META-INF/services/ directory of your jar. This file must list the fully qualified classname
+ of each AuthenticatorFactory implementation you have in the jar. For example:
+
+ org.keycloak.examples.authenticator.SecretQuestionAuthenticatorFactory
+ org.keycloak.examples.authenticator.AnotherProviderFactory
+
+
+
+ This services/ file is used by Keycloak to scan the providers it has to load into the system.
+
+
+ To deploy this jar, just copy it to the standalone/configuration/providers directory.
+
+
+
+ Implementing an Authenticator
+
+ When implementing the Authenticator interface, the first method that needs to be implemented is the
+ requiresUser() method. For our example, this method must return true as we need to validate the secret question
+ associated with the user. A provider like kerberos would return false from this method as it can
+ resolve a user from the negotiate header. This example however is validating a specific credential of a specific
+ user.
+
+
+ The next method to implement is the configuredFor() method. This method is responsible for determining if the
+ user is configured for this particular authenticator. For this example, we need to check of the answer to the
+ secret question is been set up by the user or not. In our case we are storing this information, hashed, within
+ a UserCredentialValueModel within the UserModel (just like passwords are stored). Here's how we do this
+ very simple check:
+
+ @Override
+ public boolean configuredFor(KeycloakSession session, RealmModel realm, UserModel user) {
+ return session.users().configuredForCredentialType("secret_question", realm, user);
+ }
+
+
+
+ The configuredForCredentialType() call queries the user to see if it supports that credential type.
+
+
+ The next method to implement on the Authenticator is setRequiredActions(). If configuredFor() returns fales
+ and our example authenticator is required within the flow, this method will be called. It is response for
+ registering any required actions that must be performed by the user. In our example, we need to register
+ a required action that will force the user to set up the answer to the secret question. We will implement
+ this required action provider later in this chapter. Here is the implementation of the setRequiredActions()
+ method.
+
+ @Override
+ public void setRequiredActions(KeycloakSession session, RealmModel realm, UserModel user) {
+ user.addRequiredAction("SECRET_QUESTION_CONFIG");
+ }
+
+
+
+ Now we are getting into the meat of the Authenticator implementation. The next method to implement is
+ authenticate(). This is the initial method the flow invokes when the execution is first visited. What we
+ want is that if a user has answered the secret question already on their browser's machine, that the
+ user doesn't have to answer the question again. Basically making that machine "trusted". The authenticate()
+ method isn't responsible for processing the secret question form. Its sole purpose is to render the page
+ or to continue the flow.
+
+ @Override
+ public void authenticate(AuthenticationFlowContext context) {
+ if (hasCookie(context)) {
+ context.success();
+ return;
+ }
+ Response challenge = loginForm(context).createForm("secret_question.ftl");
+ context.challenge(challenge);
+ }
+
+
+
+ If the hasCookie() method checks to see if there is already a cookie set on the browser which indicates
+ that the secret question has already been answered. If that returns true, we just mark this execution's
+ status as SUCCESS using the AuthenticationFlowContext.success() method and returning from the authentication()
+ method.
+
+
+ If the hasCookie() method returns false, we must return a response that renders the secret question HTML
+ form. AuthenticationFlowContext has a form() method that initializes a Freemarker page builder with appropriate base information needed
+ to build the form. This page builder is called org.keycloak.login.LoginFormsProvider.
+ the LoginFormsProvider.createForm() method loads a Freemarker template file from your login theme. Additionally
+ you can call the LoginFormsProvider.setAttribute() method if you want to pass additional information to the
+ Freemarker template. We'll go over this later.
+
+
+ Calling LoginFormsProvider.createForm() returns a JAX-RS Response object. We then call AuthenticationFlowContext.challenge()
+ passing in this response. This sets the status of the execution as CHALLENGE and if the execution is Required, this
+ JAX-RS Response object will be sent to the browser.
+
+
+ So, the HTML page asking for the answer to a secret question is displayed to the user and the user
+ enteres in the answer and clicks submit. The action URL of the HTML form will send an HTTP request to the
+ flow. The flow will end up invoking the action() method of our Authenticator implementation.
+
+ @Override
+ public void action(AuthenticationFlowContext context) {
+ boolean validated = validateAnswer(context);
+ if (!validated) {
+ Response challenge = context.form()
+ .setError("badSecret")
+ .createForm("secret-question.ftl");
+ context.failureChallenge(AuthenticationFlowError.INVALID_CREDENTIALS, challenge);
+ return;
+ }
+ setCookie(context);
+ context.success();
+ }
+
+
+
+
+
+ If the answer is not valid, we rebuild the HTML Form with an additional error message. We then call
+ AuthenticationFlowContext.failureChallenge() passing in the reason for the value and the JAX-RS response.
+ failureChallenge() works the same as challenge(), but it also records the failure so it can be analyzed
+ by any attack detection service.
+
+
+ If validation is successful, then we set a cookie to remember that the secret question has been answered
+ and we call AuthenticationFlowContext.success().
+
+
+ The last thing I want to go over is the setCookie() method. This is an example of providing configuration
+ for the Authenticator. In this case we want the max age of the cookie to be configurable.
+
+ protected void setCookie(AuthenticationFlowContext context) {
+ AuthenticatorConfigModel config = context.getAuthenticatorConfig();
+ int maxCookieAge = 60 * 60 * 24 * 30; // 30 days
+ if (config != null) {
+ maxCookieAge = Integer.valueOf(config.getConfig().get("cookie.max.age"));
+
+ }
+ ... set the cookie ...
+ }
+
+
+
+
+ We obtain an AuthenticatorConfigModel from the AuthenticationFlowContext.getAuthenticatorConfig() method.
+ If configuration exists we pull the max age config out of it. We will see how we can define what should
+ be configured when we talk about the AuthenticatorFactory implementation. The config values can be
+ defined within the admin console if you set up config definitions in your AuthenticatorFactory implementation.
+
+
+
+ Implementing an AuthenticatorFactory
+
+ The next step in this process is to implement an AuthenticatorFactory. This factory is responsible
+ for instantiating an Authenticator. It also provides deployment and configuration metadata about
+ the Authenticator.
+
+
+ The getId() method is just the unique name of the component. The create() methods should also
+ be self explanatory. The create(KeycloakSession) method will actually never be called. It is just
+ an artifact of the more generic ProviderFactory interface.
+
+public class SecretQuestionAuthenticatorFactory implements AuthenticatorFactory, ConfigurableAuthenticatorFactory {
+
+ public static final String PROVIDER_ID = "secret-question-authenticator";
+ private static final SecretQuestionAuthenticator SINGLETON = new SecretQuestionAuthenticator();
+
+ @Override
+ public String getId() {
+ return PROVIDER_ID;
+ }
+
+ @Override
+ public Authenticator create() {
+ return SINGLETON;
+ }
+
+ @Override
+ public Authenticator create(KeycloakSession session) {
+ return SINGLETON;
+ }
+
+
+
+
+ The next thing the factory is responsible for is specify the allowed requirement switches. While there
+ are four different requirement types: ALTERNATIVE, REQUIRED, OPTIONAL, DISABLED, AuthenticatorFactory
+ implementations can limit which requirement options are shown in the admin console when defining
+ a flow. In our example, we're going to limit our requirement options to REQUIRED and DISABLED.
+
+ private static AuthenticationExecutionModel.Requirement[] REQUIREMENT_CHOICES = {
+ AuthenticationExecutionModel.Requirement.REQUIRED,
+ AuthenticationExecutionModel.Requirement.DISABLED
+ };
+ @Override
+ public AuthenticationExecutionModel.Requirement[] getRequirementChoices() {
+ return REQUIREMENT_CHOICES;
+ }
+
+
+
+ The AuthenticatorFactory.isUserSetupAllowed() is a flag that tells the flow manager whether or not
+ Authenticator.setRequiredActions() method will be called. If an Authenticator is not configured for a user,
+ the flow manager checks isUserSetupAllowed(). If it is false, then the flow aborts with an error. If it
+ returns true, then the flow manager will invoke Authenticator.setRequiredActions().
+
+ @Override
+ public boolean isUserSetupAllowed() {
+ return true;
+ }
+
+
+
+ The next few methods define how the Authenticator can be configured. The isConfigurable() method
+ is a flag which specifies to the admin console on whether the Authenticator can be configured within
+ a flow. The getConfigProperties() method returns a list of ProviderConfigProperty objects. These
+ objects define a specific configuration attribute.
+ getConfigProperties() {
+ return configProperties;
+ }
+
+ private static final List configProperties = new ArrayList();
+
+ static {
+ ProviderConfigProperty property;
+ property = new ProviderConfigProperty();
+ property.setName("cookie.max.age");
+ property.setLabel("Cookie Max Age");
+ property.setType(ProviderConfigProperty.STRING_TYPE);
+ property.setHelpText("Max age in seconds of the SECRET_QUESTION_COOKIE.");
+ configProperties.add(property);
+ }
+]]>
+
+
+ Each ProviderConfigProperty defines the name of the config property. This is the key used in the config
+ map stored in AuthenticatorConfigModel. The label defines how the config option will be displayed in the
+ admin console. The type defines if it is a String, Boolean, or other type. The admin console
+ will display different UI inputs depending on the type. The help text is what will be shown in the
+ tooltip for the config attribute in the admin console. Read the javadoc of ProviderConfigProperty
+ for more detail.
+
+
+ The rest of the methods are for the admin console. getHelpText() is the tooltip text that will be
+ shown when you are picking the Authenticator you want to bind to an execution. getDisplayType()
+ is what text that will be shown in the admin console when listing the Authenticator. getReferenceCategory()
+ is just a category the Authenticator belongs to.
+
+
+
+ Adding Authenticator Form
+
+ Keycloak comes with a Freemarker theme and template engine. The createForm()
+ method you called within authenticate() of your Authenticator class, builds an HTML page from a file within
+ your login them: secret-question.ftl. This file should be placed in the login theme with all the other
+ .ftl files you see for login.
+
+
+ Let's take a bigger look at secret-question.ftl Here's a small code snippet:
+
+
+
+
+
+
+
+
+
+
+
+]]>
+
+
+ Any piece of text enclosed in ${} corresponds to an attribute or template funtion.
+ If you see the form's action, you see it points to ${url.loginAction}. This value
+ is automatically generated when you invoke the AuthenticationFlowContext.form() method. You can also obtain
+ this value by calling the AuthenticationFlowContext.getActionURL() method in Java code.
+
+
+ You'll also see ${properties.someValue}. These correspond to properties defined
+ in your theme.properties file of our theme. ${msg("someValue")} corresponds to the
+ internationalized message bundles (.properties files) included with the login theme messages/ directory.
+ If you're just using english, you can just add the value of the loginSecretQuestion
+ value. This should be the question you want to ask the user.
+
+
+ When you call AuthenticationFlowContext.form() this gives you a LoginFormsProvider instance. If you called,
+ LoginFormsProvider.setAttribute("foo", "bar"), the value of "foo" would be available
+ for reference in your form as ${foo}. The value of an attribute can be any Java
+ bean as well.
+
+
+
+ Adding Authenticator to a Flow
+
+ Adding an Authenticator to a flow must be done in the admin console.
+ If you go to the Authentication menu item and go to the Flow tab, you will be able to view the currently
+ defined flows. You cannot modify an built in flows, so, to add the Authenticator we've created you
+ have to copy an existing flow or create your own. I'm hoping the UI is intuitive enough so that you
+ can figure out for yourself how to create a flow and add the Authenticator.
+
+
+ After you've created your flow, you have to bind it to the login action you want to bind it to. If you go
+ to the Authentication menu and go to the Bindings tab you will see options to bind a flow to
+ the browser, registration, or direct grant flow.
+
+
+
\ No newline at end of file
diff --git a/examples/providers/authenticator/secret-question.ftl b/examples/providers/authenticator/secret-question.ftl
new file mode 100755
index 0000000000..b69c5206a2
--- /dev/null
+++ b/examples/providers/authenticator/secret-question.ftl
@@ -0,0 +1,34 @@
+<#import "template.ftl" as layout>
+<@layout.registrationLayout; section>
+ <#if section = "title">
+ ${msg("loginTitle",realm.name)}
+ <#elseif section = "header">
+ ${msg("loginTitleHtml",realm.name)}
+ <#elseif section = "form">
+
+
+
\ No newline at end of file
diff --git a/examples/providers/authenticator/src/main/java/org/keycloak/examples/authenticator/SecretQuestionAuthenticator.java b/examples/providers/authenticator/src/main/java/org/keycloak/examples/authenticator/SecretQuestionAuthenticator.java
index 8e60d9b99c..1f4a8aaa00 100755
--- a/examples/providers/authenticator/src/main/java/org/keycloak/examples/authenticator/SecretQuestionAuthenticator.java
+++ b/examples/providers/authenticator/src/main/java/org/keycloak/examples/authenticator/SecretQuestionAuthenticator.java
@@ -2,13 +2,15 @@ package org.keycloak.examples.authenticator;
import org.keycloak.authentication.AuthenticationFlowContext;
import org.keycloak.authentication.AuthenticationFlowError;
-import org.keycloak.authentication.AbstractFormAuthenticator;
+import org.keycloak.authentication.Authenticator;
+import org.keycloak.models.AuthenticatorConfigModel;
import org.keycloak.models.KeycloakSession;
import org.keycloak.models.RealmModel;
import org.keycloak.models.UserCredentialValueModel;
import org.keycloak.models.UserModel;
-import org.keycloak.models.utils.CredentialValidation;
+import org.keycloak.services.util.CookieHelper;
+import javax.ws.rs.core.Cookie;
import javax.ws.rs.core.MultivaluedMap;
import javax.ws.rs.core.Response;
@@ -16,25 +18,56 @@ import javax.ws.rs.core.Response;
* @author Bill Burke
* @version $Revision: 1 $
*/
-public class SecretQuestionAuthenticator extends AbstractFormAuthenticator {
+public class SecretQuestionAuthenticator implements Authenticator {
public static final String CREDENTIAL_TYPE = "secret_question";
+ protected boolean hasCookie(AuthenticationFlowContext context) {
+ Cookie cookie = context.getHttpRequest().getHttpHeaders().getCookies().get("SECRET_QUESTION_ANSWERED");
+ return cookie != null;
+ }
+
@Override
public void authenticate(AuthenticationFlowContext context) {
- Response challenge = loginForm(context).createForm("secret_question.ftl");
+ if (hasCookie(context)) {
+ context.success();
+ return;
+ }
+ Response challenge = context.form().createForm("secret_question.ftl");
context.challenge(challenge);
}
@Override
public void action(AuthenticationFlowContext context) {
- MultivaluedMap formData = context.getHttpRequest().getDecodedFormParameters();
- String secret = formData.getFirst("secret");
- if (secret == null || secret.trim().equals("")) {
- badSecret(context);
+ boolean validated = validateAnswer(context);
+ if (!validated) {
+ Response challenge = context.form()
+ .setError("badSecret")
+ .createForm("secret-question.ftl");
+ context.failureChallenge(AuthenticationFlowError.INVALID_CREDENTIALS, challenge);
return;
}
+ setCookie(context);
+ context.success();
+ }
+ protected void setCookie(AuthenticationFlowContext context) {
+ AuthenticatorConfigModel config = context.getAuthenticatorConfig();
+ int maxCookieAge = 60 * 60 * 24 * 30; // 30 days
+ if (config != null) {
+ maxCookieAge = Integer.valueOf(config.getConfig().get("cookie.max.age"));
+
+ }
+ CookieHelper.addCookie("SECRET_QUESTION_ANSWERED", "true",
+ context.getUriInfo().getBaseUri().getPath() + "/realms/" + context.getRealm().getName(),
+ null, null,
+ maxCookieAge,
+ true, true);
+ }
+
+ protected boolean validateAnswer(AuthenticationFlowContext context) {
+ MultivaluedMap formData = context.getHttpRequest().getDecodedFormParameters();
+ String secret = formData.getFirst("secret_answer");
UserCredentialValueModel cred = null;
for (UserCredentialValueModel model : context.getUser().getCredentialsDirectly()) {
if (model.getType().equals(CREDENTIAL_TYPE)) {
@@ -42,25 +75,8 @@ public class SecretQuestionAuthenticator extends AbstractFormAuthenticator {
break;
}
}
- if (cred == null) {
- badSecret(context);
- return;
- }
- boolean validated = CredentialValidation.validateHashedCredential(context.getRealm(), context.getUser(), secret, cred);
- if (!validated) {
- badSecret(context);
- return;
- }
-
- context.success();
- }
-
- private void badSecret(AuthenticationFlowContext context) {
- Response challenge = loginForm(context)
- .setError("badSecret")
- .createForm("secret_question.ftl");
- context.failureChallenge(AuthenticationFlowError.INVALID_CREDENTIALS, challenge);
+ return cred.getValue().equals(secret);
}
@Override
@@ -75,6 +91,11 @@ public class SecretQuestionAuthenticator extends AbstractFormAuthenticator {
@Override
public void setRequiredActions(KeycloakSession session, RealmModel realm, UserModel user) {
- user.addRequiredAction(CREDENTIAL_TYPE + "_CONFIG");
+ user.addRequiredAction(SecretQuestionRequiredAction.PROVIDER_ID);
+ }
+
+ @Override
+ public void close() {
+
}
}
diff --git a/examples/providers/authenticator/src/main/java/org/keycloak/examples/authenticator/SecretQuestionAuthenticatorFactory.java b/examples/providers/authenticator/src/main/java/org/keycloak/examples/authenticator/SecretQuestionAuthenticatorFactory.java
index 09a83da758..09be4c1747 100755
--- a/examples/providers/authenticator/src/main/java/org/keycloak/examples/authenticator/SecretQuestionAuthenticatorFactory.java
+++ b/examples/providers/authenticator/src/main/java/org/keycloak/examples/authenticator/SecretQuestionAuthenticatorFactory.java
@@ -21,6 +21,11 @@ public class SecretQuestionAuthenticatorFactory implements AuthenticatorFactory,
public static final String PROVIDER_ID = "secret-question-authenticator";
private static final SecretQuestionAuthenticator SINGLETON = new SecretQuestionAuthenticator();
+ @Override
+ public String getId() {
+ return PROVIDER_ID;
+ }
+
@Override
public Authenticator create() {
return SINGLETON;
@@ -31,21 +36,6 @@ public class SecretQuestionAuthenticatorFactory implements AuthenticatorFactory,
return SINGLETON;
}
- @Override
- public String getDisplayType() {
- return "Secret Question";
- }
-
- @Override
- public String getReferenceCategory() {
- return "Secret Question";
- }
-
- @Override
- public boolean isConfigurable() {
- return true;
- }
-
private static AuthenticationExecutionModel.Requirement[] REQUIREMENT_CHOICES = {
AuthenticationExecutionModel.Requirement.REQUIRED,
AuthenticationExecutionModel.Requirement.DISABLED
@@ -61,8 +51,13 @@ public class SecretQuestionAuthenticatorFactory implements AuthenticatorFactory,
}
@Override
- public String getHelpText() {
- return "A secret question that a user has to answer. i.e. What is your mother's maiden name.";
+ public boolean isConfigurable() {
+ return true;
+ }
+
+ @Override
+ public List getConfigProperties() {
+ return configProperties;
}
private static final List configProperties = new ArrayList();
@@ -70,17 +65,27 @@ public class SecretQuestionAuthenticatorFactory implements AuthenticatorFactory,
static {
ProviderConfigProperty property;
property = new ProviderConfigProperty();
- property.setName("remember_machine");
- property.setLabel("Remember machine");
- property.setType(ProviderConfigProperty.BOOLEAN_TYPE);
- property.setHelpText("If set to true, a checkbox will appear when entering in secret on whether the user wants keycloak to remember the machine. If the user wants to remember, then a persistent cookie is set, and the user will not have to enter in their secret again.");
+ property.setName("cookie.max.age");
+ property.setLabel("Cookie Max Age");
+ property.setType(ProviderConfigProperty.STRING_TYPE);
+ property.setHelpText("Max age in seconds of the SECRET_QUESTION_COOKIE.");
configProperties.add(property);
}
@Override
- public List getConfigProperties() {
- return configProperties;
+ public String getHelpText() {
+ return "A secret question that a user has to answer. i.e. What is your mother's maiden name.";
+ }
+
+ @Override
+ public String getDisplayType() {
+ return "Secret Question";
+ }
+
+ @Override
+ public String getReferenceCategory() {
+ return "Secret Question";
}
@Override
@@ -98,8 +103,5 @@ public class SecretQuestionAuthenticatorFactory implements AuthenticatorFactory,
}
- @Override
- public String getId() {
- return PROVIDER_ID;
- }
+
}
diff --git a/examples/providers/authenticator/src/main/java/org/keycloak/examples/authenticator/SecretQuestionRequiredAction.java b/examples/providers/authenticator/src/main/java/org/keycloak/examples/authenticator/SecretQuestionRequiredAction.java
new file mode 100755
index 0000000000..6644b8e2df
--- /dev/null
+++ b/examples/providers/authenticator/src/main/java/org/keycloak/examples/authenticator/SecretQuestionRequiredAction.java
@@ -0,0 +1,47 @@
+package org.keycloak.examples.authenticator;
+
+import org.keycloak.authentication.RequiredActionContext;
+import org.keycloak.authentication.RequiredActionProvider;
+import org.keycloak.models.UserCredentialValueModel;
+
+import javax.ws.rs.core.Response;
+
+/**
+ * @author Bill Burke
+ * @version $Revision: 1 $
+ */
+public class SecretQuestionRequiredAction implements RequiredActionProvider {
+ public static final String PROVIDER_ID = "secret_question_config";
+
+ @Override
+ public void evaluateTriggers(RequiredActionContext context) {
+
+ }
+
+ @Override
+ public void requiredActionChallenge(RequiredActionContext context) {
+ Response challenge = context.form().createForm("secret_question_config.ftl");
+ context.challenge(challenge);
+
+ }
+
+ @Override
+ public void processAction(RequiredActionContext context) {
+ String answer = (context.getHttpRequest().getDecodedFormParameters().getFirst("answer"));
+ UserCredentialValueModel model = new UserCredentialValueModel();
+ model.setValue(answer);
+ model.setType(SecretQuestionAuthenticator.CREDENTIAL_TYPE);
+ context.getUser().updateCredentialDirectly(model);
+ context.success();
+ }
+
+ @Override
+ public String getProviderId() {
+ return PROVIDER_ID;
+ }
+
+ @Override
+ public void close() {
+
+ }
+}
diff --git a/examples/providers/authenticator/src/main/java/org/keycloak/examples/authenticator/SecretQuestionRequiredActionFactory.java b/examples/providers/authenticator/src/main/java/org/keycloak/examples/authenticator/SecretQuestionRequiredActionFactory.java
new file mode 100755
index 0000000000..ff699e27ef
--- /dev/null
+++ b/examples/providers/authenticator/src/main/java/org/keycloak/examples/authenticator/SecretQuestionRequiredActionFactory.java
@@ -0,0 +1,48 @@
+package org.keycloak.examples.authenticator;
+
+import org.keycloak.Config;
+import org.keycloak.authentication.RequiredActionFactory;
+import org.keycloak.authentication.RequiredActionProvider;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.KeycloakSessionFactory;
+
+/**
+ * @author Bill Burke
+ * @version $Revision: 1 $
+ */
+public class SecretQuestionRequiredActionFactory implements RequiredActionFactory {
+
+ private static final SecretQuestionRequiredAction SINGLETON = new SecretQuestionRequiredAction();
+
+ @Override
+ public RequiredActionProvider create(KeycloakSession session) {
+ return SINGLETON;
+ }
+
+
+ @Override
+ public String getId() {
+ return SecretQuestionRequiredAction.PROVIDER_ID;
+ }
+
+ @Override
+ public String getDisplayText() {
+ return "Secret Question";
+ }
+
+ @Override
+ public void init(Config.Scope config) {
+
+ }
+
+ @Override
+ public void postInit(KeycloakSessionFactory factory) {
+
+ }
+
+ @Override
+ public void close() {
+
+ }
+
+}
diff --git a/forms/common-themes/src/main/resources/theme/base/login/login-totp.ftl b/forms/common-themes/src/main/resources/theme/base/login/login-totp.ftl
index b085eeb540..e472fff1ff 100755
--- a/forms/common-themes/src/main/resources/theme/base/login/login-totp.ftl
+++ b/forms/common-themes/src/main/resources/theme/base/login/login-totp.ftl
@@ -6,9 +6,6 @@
${msg("loginTitleHtml",realm.name)}
<#elseif section = "form">