I'm trying to configure the KeyCloak Browser Flow to allow users requesting scope1 to use a user/password form, and users requesting scope2 to be required to use the User/password form plus an OTP. My question is two-part:
- Am I not understanding something properly - I am surprised I have to code this myself and it's not already available in Keycloak
- Will this described approach work?
I do not want to make this conditional on the user, but instead on the scope being requested. From what I can tell, to make this work I need to implement a custom ConditionalAuthenticator and then configure approximately like this, replacing the Condition - User Configured with my own implementation.
