How to present multiple options for authentication?

Getting advice
1

As the title states, I want to be able to present the user, in the browser flow, with the ability to present the user with a username field and then the choice of WebAuthN (With the option to set up WebAuthN if not currently set up) or Password with OTP.

I have been trying to follow the documentation presented here for this exact flow (Without registering WebAuthN): Server Administration Guide

However the image in the docs is not as they state in the steps. There are items that are set as disabled in the image. Also, when I set it up this way and the user does not have WebAuthN set up but they do have OTP, the browser flow always presents the user with the OTP screen and never an option to select.

Is there a way to get around the above issue and is there a way to register WebAuthN in the same browser flow without requiring the User Action to be added?

1 Like
2

MFA option selection is (currently) not supported by Keycloak (and I doubt that it will be in near future).
This is probably a custom extension, you want to use: Add authenticator for 2FA enrollment by sventorben · Pull Request #17494 · keycloak/keycloak · GitHub

3

Ah ok. I assume you mean this plugin: Enforce MFA Authenticator
Which exists in the Keycloak MFA Plugin collection.

I also just found this but thank you @dasniko !

4

No, I didn’t mean that extension mentioned by you, I even didn’t know this. I meant the one I linked. But there are several approaches out there available…