Authenticating Users

In the previous chapters, you learned how to manage users. You also walked through examples that involved users authenticating in Keycloak. By now, you should be aware of how easy it is to set up Keycloak to promptly authenticate your users, but there is much more to authentication than just using a login page and asking users for passwords.

Keycloak has a set of well-defined flows representing how end users and clients – the actors – interact with the server when authenticating to a realm. For end users, these flows usually involve using the browser as an intermediary, and for clients, the steps are based on backchannel requests to the token endpoint.

As you learned in the previous chapters, the end users authenticating to a realm are presented with a login page. From this page, users can start different interactive flows with the server in order to:

• Self-register to the realm
• Authenticate
• Reset their password
...

Technical requirements

Before we begin, create a myrealm realm and a user called alice in this realm.

In the next few sections, we will be using the Keycloak account console to authenticate alice using the different authentication strategies.

Check out the following link to see the Code in Action video: https://packt.link/iuHcj.

Understanding authentication flows

An authentication flow is driven by a set of sequential steps or executions that are grouped together to define how users and clients are authenticated.

Keycloak is very flexible in terms of how to arrange executions in an authentication flow definition. By default, realms are created with built-in definitions that cover the most common steps to securely authenticate end users and clients, which you can change or extend at any time to address your own authentication requirements.

To understand this better, let’s look at the available authentication flow definitions for the myrealm realm. For that, open the administration console and click on the Authentication link in the left-hand side menu:

Figure 11.1: Authentication flow definitions

On this page, you have a list of all the available flow definitions and how they are bound with the different flows supported by Keycloak. The flow to which a definition is bound is indicated...

Using passwords

In the previous chapters, you were basically using passwords to authenticate users. You were also quickly introduced to how to set up passwords when managing users. In this section, we are going to look closer at how password-based authentication works and how passwords are managed.

We are not going to cover how users authenticate using passwords here because you are already familiar with that, but we will cover additional details around this form of authentication.

Password-based authentication is probably one of the most popular methods for authenticating users. It is easy to implement and is what most end users are used to when they need to authenticate to a system. However, the simplicity of this credential type has some disadvantages and weaknesses, all of which we will cover later in this section.

To help us overcome some of the disadvantages of password-based authentication, Keycloak relies on common best practices to make sure passwords...

Using OTPs

As an additional layer of security, Keycloak allows you to use a second factor – or evidence – when authenticating users. In addition to providing a password – something users know – users are obligated to provide secondary evidence about their identity – something they have – which can be a code or a security key in their possession.

An OTP is probably one of the most common ways to enable 2FA for user accounts. It is relatively easy to use and adds an additional layer of security when you’re authenticating users.

Although it’s a useful method for 2FA, OTPs have some disadvantages. They rely on a shared key between the server and users and do not provide the best usability for end users, while still being open to common attacks such as phishing or scams. As we are going to see later, Keycloak helps you overcome these limitations by using a security device as a second factor using WebAuthn.

Keycloak makes...

Using Web Authentication (WebAuthn)

The WebAuthn protocol aims to improve the security and usability of authenticating users over the internet. For that, it provides additional capabilities for server and security devices to communicate with each other – using the browser as an intermediary – to authenticate users using a cryptography protocol.

WebAuthn is based on asymmetric keys – a private-public key pair – to securely register users’ devices and authenticate them in a system. There is no shared key between devices and the server, only a public key. By acting as an intermediary between security devices and the server, WebAuthn makes it possible to use these devices for 2FA or MFA using biometrics, or to seamlessly authenticate users without any explicit credentials other than their security devices: a concept also known as username-less and password-less authentication.

When used for 2FA, WebAuthn is a more secure method than OTPs because...

Using strong authentication

Strong authentication is a term that’s widely used nowadays. What it means depends on the context where it is used. In general, strong authentication is about employing either 2FA or MFA to authenticate users.

As you learned in the previous sections, Keycloak provides the necessary capabilities to enable either 2FA or MFA for a realm. If your requirements for strong authentication only include the use of 2FA, you are good to go with either an OTP or a security device when you’re using WebAuthn.

However, MFA is probably the strongest form of authentication you can get, where biometric authorization is a key aspect of securely identifying and authenticating the user. In this case, you should consider using WebAuthn and setting up security devices to verify the identity of the user – using fingerprint scanning, for instance – to make sure the user using the device is indeed the user trying to authenticate.

Strong authentication...

Summary

In this chapter, you were provided with more details on how to authenticate users in Keycloak. First, you were introduced to authentication flows and how they play an important role in defining how users – as well as clients – authenticate to a realm. You were presented with the main authentication methods supported by Keycloak and how to configure them to promptly authenticate users, as well as how to combine them to support 2FA and MFA. Finally, you were briefly introduced to strong authentication and how Keycloak can help you employ secure authentication methods for a realm.

By leveraging the information in this chapter, you should now be able to customize Keycloak to authenticate users according to your needs and use different authentication methods.

In the next chapter, you are going to look at session management and how it correlates with authentication.

Questions

1. How do I change the look and feel of the pages shown in this chapter?

2. I cannot follow the WebAuthn examples and register a security device. What am I missing?

Further reading

• Keycloak authentication documentation: https://www.keycloak.org/docs/latest/server_admin/#configuring-authentication_server_administration_guide
• Keycloak required actions: https://www.keycloak.org/docs/latest/server_admin/#con-required-actions_server_administration_guide
• Keycloak login page settings: https://www.keycloak.org/docs/latest/server_admin/#controlling-login-options
• Keycloak account console: https://www.keycloak.org/docs/latest/server_admin/#_account-service
• Keycloak step-up authentication documentation: https://www.keycloak.org/docs/latest/server_admin/#_step-up-flow
• WebAuthn: https://webauthn.io/

Join our community on Discord

Join our community’s Discord space for discussions with the authors and other readers:

https://packt.link/SecNet