I am using Spring Security Oauth2 with keycloak 10 to authenticate my app users.
Can anyone tell me how to ask an authenticated user to provide his credentials again when trying to do sensitive actions on the app?
Keycloak has a parameter named prompt that must be forwarder from my app to keycloak, but I don't know how to do that.
Thanks for your help
you can create a custom Oauth2AuthorizationRequestResolver Override the public OAuth2AuthorizationRequest resolve method and include prompt. Some more detail in this doc. https://docs.spring.io/spring-security/site/docs/5.1.7.RELEASE/reference/html/jc.html
This allows you to add custom properties to the authorize request.
After I did a few tests, I can say that the resolver doesn't solve the whole problem.
To sum up my discovery, by default spring doesn't ask an authenticated request to login again. In fact, when I try to do a sensitive action, Spring allows me to go ahead because as I said, it finds that I have an active session.
Regards
