# Force 2FA for social IdP : does not work with a post-login flow

**URL:** <https://forum.keycloak.org/t/force-2fa-for-social-idp-does-not-work-with-a-post-login-flow/9148>\
**Category:** Configuring the server\
**Tags:** authentication, identity-brokering\
**Created:** [May 20, 2021, 7:36am UTC](https://forum.keycloak.org/t/force-2fa-for-social-idp-does-not-work-with-a-post-login-flow/9148 "2021-05-20T07:36:37Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![semangard](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/semangard/32/1922_2.png) [@semangard](https://forum.keycloak.org/u/semangard)\
**Post date:** [May 20, 2021, 7:36am UTC](https://forum.keycloak.org/t/force-2fa-for-social-idp-does-not-work-with-a-post-login-flow/9148/1 "2021-05-20T07:36:37Z")

</div>

Hello,

We would like to use Google or Microsoft IdP.  
That works fine.  
BUT we would like also to force 2FA while getting authenticated thanks to these social IdP.

→ How to correctly proceed ?

We tried to configure a post-login flow like this:

 ![image](https://global.discourse-cdn.com/free1/uploads/keycloak/original/2X/b/b8564f834e4b872214039fb85597360b8f34bae2.png)

BUT we got the error below ==\> Why ?

 ![image](https://global.discourse-cdn.com/free1/uploads/keycloak/original/2X/7/7e4546a713b27006949fd21256d9857726fd0682.jpeg)

---

<div class="post-metadata">

**Author:** ![semangard](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/semangard/32/1922_2.png) [@semangard](https://forum.keycloak.org/u/semangard)\
**Post date:** [May 20, 2021, 7:38am UTC](https://forum.keycloak.org/t/force-2fa-for-social-idp-does-not-work-with-a-post-login-flow/9148/2 "2021-05-20T07:38:03Z")

</div>

(context : KeyCloak 11.0.3 - docker image)

---

<div class="post-metadata">

**Author:** ![semangard](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/semangard/32/1922_2.png) [@semangard](https://forum.keycloak.org/u/semangard)\
**Post date:** [May 21, 2021, 7:30am UTC](https://forum.keycloak.org/t/force-2fa-for-social-idp-does-not-work-with-a-post-login-flow/9148/3 "2021-05-21T07:30:42Z")

</div>

A workarround is just to keep the OTP form without any condition

 ![image](https://global.discourse-cdn.com/free1/uploads/keycloak/original/2X/8/82650427036f7c30c8826b97627d4daaa504bac6.png)

---

<div class="post-metadata">

**Author:** ![ThomasAunvik](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/thomasaunvik/32/2867_2.png) [@ThomasAunvik](https://forum.keycloak.org/u/ThomasAunvik)\
**Post date:** [May 21, 2021, 12:10pm UTC](https://forum.keycloak.org/t/force-2fa-for-social-idp-does-not-work-with-a-post-login-flow/9148/4 "2021-05-21T12:10:02Z")

</div>

You could try using a Conditional OTP Form.

Create a Role, add a " Identity Provider Mapper" to the identity providers and the mapper set to “Hardcoded Role” and select the created role.

In the config of the Conditional OTP Form you add the new role to “Force OTP for Role”.

In your setup, i guess it could be set up as the top level, and set to Required, if it doesn’t have it, it would skip it, unless you set “Fallback OTP handling” to other than skip.

---

<div class="post-metadata">

**Author:** ![semangard](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/semangard/32/1922_2.png) [@semangard](https://forum.keycloak.org/u/semangard)\
**Post date:** [May 21, 2021, 12:35pm UTC](https://forum.keycloak.org/t/force-2fa-for-social-idp-does-not-work-with-a-post-login-flow/9148/5 "2021-05-21T12:35:03Z")

</div>

Yes it works also

 ![image](https://global.discourse-cdn.com/free1/uploads/keycloak/original/2X/4/4c42bf3d54a34c7d8b37520f7a0686771bbe450b.png)  
 ![image](https://global.discourse-cdn.com/free1/uploads/keycloak/original/2X/c/c9b190bd5a97ca4197860aeaf1b5893ff7ddf919.png)