Custom keycloak login flow

Getting advice
1

So, I’ve got this custom login setup going on. First off, I’m asking users for their username (required). Then, in the next step (required, but 3 alternative options), they’ve got three choices: OTP, password, or Webauthn passwordless.

Everything’s running smoothly, even made upgrades with the theme with some keyclokify action. But here’s the kicker: “Remember me” isn’t quite remembering the password like it should.

When I toggle on that feature in Realm settings, I see the checkbox on the first “username” page, and it does its thing, autofilling the username if “remember me” was clicked before. But when we hit the second page, where the password goes, it’s not autofilling.

Seems like the hiccup comes from Keycloak splitting the flow into two separate windows. Anybody run into something similar?

2

No, it shouldn’t!
“Remember” the password would mean to store the password anywhere, which is a security anti-pattern!

From the docs:

A logged-in user closing their browser destroys their session, and that user must log in again. You can set Keycloak to keep the user’s login session open if that user clicks the Remember Me checkbox upon login. This action turns the login cookie from a session-only cookie to a persistence cookie.

Once the session is timed-out or destroyed, the Remember me option doesn’t remember anything.
It works like designed, even when the “design” is not obvious sometimes.

1 Like
3

Noted, and fully understand.

Thanks!

1 Like