Programmatically registering & authenticating passkeys

Getting advice
,
1

Is it possible to register and authenticate passkeys programmatically ?

Does the keycloak expose any endpoint for doing this ? If not, how can i achieve this ?

2

Nothing officially, so not stable enough to build something on top of. However, If you’re interested in how it works, search the Keycloak code for WebAuthn.

1 Like
3

What exactly do you mean with that? How do you want to use passkeys?

4

what i mean is, i dont wanna use the UI provided by keycloak instead i wanna use a angular app as the FE.

when using username, password we can use the Direct grant flow and hit the url “{keycloak_address}/realms/{name}/protocol/openid-connect/token” from a spring boot app to authenticate the user.

im looking for a similar way to authenticate user from a spring boot app when using passkeys, basically i need the angular app to communicate with my spring boot application and then the spring boot will communicate with keycloak to authenticate user (maybe via a rest api call)

so when registering/authenticating passkey i need the spring boot app as my relying party

5

I’d recommend to overthink your complete approach!

“I don’t want to use the Keycloak UI” is the wrong approach when using OIDC. Using a custom login page/behavior in your app just produces a man-in-the-middle! The “Direct Grant Flow”, which is the “Resource Owner Password Credentials Grant” in OAuth2/OIDC is deprecated and MUST NOT be used! (and it will be omitted in the next version of OAuth2.1!)

And as Passkeys are bound to a domain and are being handled just by the users browser, there is no API like you expect. It’s a negotiation between the server and the client (browser) with the help of an authenticator (operating system, hardware security keys, password manager, smartphone, etc.)

Secure authentication is always about doing the proper things on the secure server, aka Keycloak, with the use of the users browser. Please, do yourself and your users a favor and read and understand the specs, before implementing “something that just somehow” works.

2 Likes
6

Hi,
I wanted to do the same thing as @svr666, do webauthn authentication via API. Because it’s easier to make and maintains real custom login page instead of keycloak theme. It’s just my point of vue, maybe I make a mistake.
I just came across your answer.
It seems like a bad idea to try make authentication by API.
However I cannot understand why there is more risk of man in the middle with the API than with the UI keycloak, both are https exchanges.
Can you give me some details about these risks please?

7

I doubt.
Complete functionality is already available, securely implemented. Look‘n‘feel can be completely adjusted to custom layouts.

OAuth2/OIDC is NOT about using an API to do things! There are good security reasons to use browser-based flows to authenticate users. Don‘t try to think to know it better. Or if, just don’t use OAuth2/OIDC.

Just in the moment a user enters its credentials somewhere else than on the secure server (aka Authorization Server in terms of OAuth2 or Identity Provider in terms of OIDC), the „elsewhere“ (you app) is the man-in-the-middle. MITM is not only about some attackers listening to the traffic…

2 Likes
8

Thanks for you answer.
So it’s really deprecated to authenticate user throught rest api ?
Even with webauthn we just send public key or signed challenge with private key, so no password transit ?
But you right, I read some thread about authenticate with rest api and pass user/password is bad practice.
I’m bit desappointed.

9

Thanks for your explanations.
I have somehow the same usecase - basically I want to use OIDC with Passkeys rather than passwords. Do you think there is a simple way to achieve that with Keycloak ?