#Configure Authentication

Keycloak provides a flexible authentication framework that supports password policies, multi-factor authentication (MFA), custom authentication flows, and advanced methods such as WebAuthn and X.509 certificates.

#Password Policies

Password policies enforce credential complexity and lifecycle rules for users within a Realm.

#Configure Password Policies

1. In the Admin Console, go to Authentication > Policies > Password policy tab.
2. Click Add policy and select a policy type from the dropdown.
3. Configure the policy parameter and click Save.

#Available Password Policies

#OTP Policies

One-Time Password (OTP) provides a second authentication factor. Keycloak supports both TOTP (time-based) and HOTP (counter-based) algorithms.

#Configure OTP Policy

1. Go to Authentication > Policies > OTP policy tab.
2. Configure the following settings:

3. Click Save.

#Require OTP for All Users

To enforce OTP as a required action for all users:

1. Go to Authentication > Required actions.
2. Find Configure OTP and enable the Set as default action toggle.
3. All users will be prompted to set up OTP on their next login.

#Authentication Flows

Authentication Flows define the sequence of steps a user must complete to authenticate. Keycloak includes built-in flows and supports creating custom flows.

#Built-in Flows

#Create a Custom Authentication Flow

1. Go to Authentication > Flows tab.
2. Click the menu icon on an existing flow and select Duplicate.
3. Enter a name for the custom flow (for example, Custom Browser Flow).
4. Modify the flow by adding, removing, or reordering authentication steps:
   • Click Add step to insert an authenticator.
   • Set each step's Requirement to one of:
     • Required — must succeed.
     • Alternative — one of the alternative steps must succeed.
     • Conditional — evaluated only if the condition is met.
     • Disabled — skipped.
5. Click Save.

#Bind a Custom Flow

After creating a custom flow, bind it to a Realm:

1. Go to Authentication > Flows tab.
2. Select your custom flow.
3. Click Action > Bind flow.
4. Select the binding type (for example, Browser flow).
5. Click Save.

#WebAuthn / Passwordless Authentication

Keycloak supports the WebAuthn standard for hardware security keys, platform authenticators (fingerprint, Face ID), and fully passwordless login.

#Enable WebAuthn as a Second Factor

1. Go to Authentication > Flows tab.
2. Duplicate the Browser flow.
3. In the duplicated flow, add a WebAuthn Authenticator step after the username/password step.
4. Set the WebAuthn step requirement to Required or Alternative.
5. Bind the custom flow as the Browser flow.

#Enable Passwordless Login

1. Duplicate the Browser flow.
2. Add a WebAuthn Passwordless Authenticator step.
3. Set the username form to Alternative and the WebAuthn Passwordless step to Alternative.
4. Bind the custom flow as the Browser flow.
5. Go to Authentication > Required actions and enable Webauthn Register Passwordless.

#Configure WebAuthn Policy

1. Go to Authentication > Policies > WebAuthn policy tab (or WebAuthn Passwordless policy tab).
2. Configure:

3. Click Save.

#X.509 Client Certificate Authentication

Keycloak can authenticate users based on X.509 client certificates presented during TLS handshake.

#Enable X.509 Authentication

1. Duplicate the Browser flow.
2. Add an X.509/Validate Username Form step.
3. Configure the X.509 authenticator:

4. Bind the custom flow as the Browser flow.

#Kerberos / SPNEGO Authentication

Keycloak supports Kerberos-based single sign-on via the SPNEGO protocol, allowing users with valid Kerberos tickets to authenticate transparently.

#Enable Kerberos Authentication

1. Configure a User Federation provider (LDAP) with Kerberos integration enabled, or configure a standalone Kerberos provider.
2. Provide the Kerberos Realm name, Server Principal, and KeyTab file location.
3. Keycloak will attempt SPNEGO negotiation during browser login.

#Step-Up Authentication

Step-Up Authentication allows you to require additional authentication factors for sensitive operations, using the Authentication Context Class Reference (ACR) mechanism.

#Configure ACR-to-LoA Mapping

1. Go to Authentication > Flows tab.
2. In your browser flow, add Conditional sub-flows with conditions based on the requested Level of Assurance (LoA).
3. Go to Realm Settings > General > ACR to LoA Mapping.
4. Map ACR values to numeric LoA levels (for example, acr-loa-1 = Level 1, acr-loa-2 = Level 2).

Applications can then request specific LoA levels by including the acr_values parameter in the authorization request, and Keycloak will enforce the corresponding authentication steps.

#User Session Limits

To limit the number of concurrent sessions per user:

1. Duplicate the Browser flow.
2. Add a User session count limiter step.
3. Configure the maximum number of sessions per user.
4. Set the behavior when the limit is reached: deny the new login or terminate the oldest session.
5. Bind the custom flow as the Browser flow.