How to update a custom field when TOTP is set to True?

Extending the server
1

Hi everyone,

I am trying to update a custom user attribute whenever TOTP is enabled for a user. Specifically, I want to update a field called ‘custom_2fa_status’ to ‘ACTIVATED’ when the TOTP field is set to True. Here is my current implementation for Keycloak 24.0.2 Version:

package com.custom.keycloak;

import org.keycloak.events.Event;
import org.keycloak.events.EventType;
import org.keycloak.events.jpa.JpaEventStoreProvider;
import org.keycloak.events.admin.AdminEvent;
import org.keycloak.models.KeycloakSession;
import org.jboss.logging.Logger;
import jakarta.persistence.EntityManager;

public class CustomJpaEventListenerProvider extends JpaEventStoreProvider {

    private static final Logger LOG = Logger.getLogger(CustomJpaEventListenerProvider.class);

    public CustomJpaEventListenerProvider(KeycloakSession session, EntityManager em) {
        super(session, em);
    }

    @Override
    public void onEvent(Event event) {
        super.onEvent(event);

        if (event.getType() == EventType.UPDATE_PROFILE) {
            String userId = event.getUserId();
            String clientId = event.getClientId();
            String realmId = event.getRealmId();
            LOG.infof("User Event: User %s updated profile in realm %s with client %s", userId, realmId, clientId);
            LOG.infof("Event Type: %s", event.getType());
        }
    }

    @Override
    public void onEvent(AdminEvent adminEvent, boolean includeRepresentation) {
        super.onEvent(adminEvent, includeRepresentation);

        if (adminEvent.getOperationType() == OperationType.UPDATE) {
            String userId = adminEvent.getAuthDetails().getUserId();
            String clientId = adminEvent.getAuthDetails().getClientId();
            String realmId = adminEvent.getRealmId();
            LOG.infof("Admin Event: User %s updated something in realm %s with client %s", userId, realmId, clientId);
            LOG.infof("Operation Type: %s", adminEvent.getOperationType());
        }
    }
}

Despite this implementation, I am not receiving any logs, and I suspect that something might be wrong. I need to specifically check when TOTP is enabled and then update my custom attribute ‘custom_2fa_status’ to ‘ACTIVATED’. How can I achieve this?

Thank you for your assistance!

2

When does the totp happen? At login?

3

Hi there,
I think there is when the totp activation is done when user scan qrcode in totp form for the first time

4

Do you really needs this, or do you actually want ACR/LoA or AMR type infos in the tokens?