Authentication by "magic link"

Configuring the server
1

Hello Keycloak community,

I would like to authenticate users through a verification email. So that’s pretty much like a password reset flow, but without the password-resetting bit. :wink: I think it’s what Slack’s or Medium’s “magic link” login does.

Expected scenario for the user:

  1. User accesses authorization endpoint from client as usual.
  2. Keycloak shows a form with only an email input. User enters their email address.
  3. Keycloak sends an email with a verification link (I suppose some type of action token).
  4. User gets the email and clicks the action token link.
  5. Keycloak validates the request, creates a session for the user and redirects back to the client.

This is pretty much what the “reset-credentials” form does. However, the reset-credentials action seems to invalidate the grant code, so when the client tries to exchange it for an access token it gets the following error (for good reason):

{
  "error_description": "Malformed auth code.", 
  "error": "invalid_grant"
}

I tried to create a new authenticator execution for the Browser Flow, but no action seems to do that.

Thanks for your help.

Login by http request with custom credentials
2

There is a good start to an authenticator that does this (written by one of the Keycloak authors): keycloak-experimental/magic-link at master · stianst/keycloak-experimental · GitHub

2 Likes
3

Another implementation: GitHub - richardjkendall/login-with-email: A Keycloak SPI which implements a 'magic-link'

2 Likes
4

Thanks a lot @xgp! Do we know why that authenticator isn’t included upstream?

5

There’s a big ecosystem of extensions to Keycloak that never make it upstream. I can’t speak for the Keycloak developers, but I’d say they’ve done a great job of building a rock-solid base that solves a set of core problems, while allowing mechanisms of extension that enable to the implementing developer to solve most use cases out there. Thinks like magic link, SMS authenticator, etc. seem to fall outside of their core goals.

1 Like
6

Thanks again for the nice information on every new response.

Is there such a repository of community extensions? If there isn’t, would you share a few that you know of? And do you think we should build an informal list? Something like a community wiki page of extensions.

7

I am not aware of such a repository. However, @thomasdarimont maintains a great list of resources here:

3 Likes
8

And another implementation: Magic Link login: Authenticator and Resource