netzbegruenung / keycloak-mfa-plugins

Keycloak plugins for MFA (enforce MFA, SMS authentication step, native app integration)
Apache License 2.0
46 stars 12 forks source link

Add required action for phone validation #20

Closed melegiul closed 2 years ago

melegiul commented 2 years ago

After phone number submission, the phone is stored in AuthenticationSessionModel and a PhoneValidationRequiredAction is triggered. Phone validation sends SMS code and finally stores users phone number after valid SMS code submission.

TODOs ~When the SMS code validation is aborted without valid code submission, the PhoneNumberRequiredAction is considered as "successful" despite of SMS Authentication could not be setup due to the missing SMS code. In this case PhoneNumberRequiredAction should be considered as failed.~

Fixes: #16 Fixes: #22 Fixes: #23

svenseeberg commented 2 years ago

Potential solution: at the beginning of step 2 create another required action for step 1. If step 2 is successful, delete the required action for step 1.

svenseeberg commented 2 years ago

@melegiul I'd suggest to merge as is and create a new issue for the static Config Alias. I already updated the README in the main branch accordingly.