Login with phone number feature

user_9089791 0
Viewed 4503

Currently I am working on feature login with phone number, user will enter their phone number and server will send sms which contain OTP.

I have researched many days for the solution to integrate with Keycloak but still stuck on it. I saw that we need to use authenticator SPI, extend keycloak and implement code which we want.

I also have thought about using other third party to handle sms and otp stuff ( like Firebase) and then will use firebase token to exchange keycloak token but firebase is not supported provider in Keycloak therefore can't do this flow

I just want to ask is there any other ways to do this feature without extend Keycloak? or simply can we get keycloak token via API but without password

vert.x keycloak one-time-password openid-connect authentication
1 Answers

I can imagine small solutions around keycloak, which together can get what you want. Will try to explain :)

  1. Imagine phone number is user login in keycloak.
  2. Imagine password is system generated, like encoded phone number + salt; basically hash algorithm know what the password is, user don't.
  3. You use third party library, which verify user mobile number and text message user enters, and it works.
  4. You create system-user in keycloak, keep password encoded in application.properties, assign him some admin roles like create user, query user, something else you need to manage users.

And now, workflow is:

  • User enter mobile number 123, sms getting send
  • User verify sms, you know user number 123, you generate password hash1(hash2(123+salt)) (see point 2)
  • Using system-user you login to keycloak, get accessToken for system-user
  • using accessToken check if user exist, if not, create user 123 with password hash(..), assign default roles, groups
  • logout from system-user
  • login with user 123 and password hash(..), load user accessToken, build User Profile, put in to SecurityContextHolder.getContext()

If you make all small bits working, should work all together.

or just ignore me if I am wrong! Good luck !

user_10514620
Related