Require Reauthentication for Update Profile

Extending the server
1

Hello together,

I have a question regarding the Update Profile action and how to enforce reauthentication for it. I’m using Keycloak to secure my SPA. To let a user update their password or profile or delete their account, I want to redirect users to the different login actions. For instance for updating the password to http://localhost:8080/realms/myrealm/protocol/openid-connect/auth?client_id=myclient&redirect_uri=https://link-to-my-spa&response_type=code&scope=openid&kc_action=UPDATE_PASSWORD or their profile http://localhost:8080/realms/myrealm/protocol/openid-connect/auth?client_id=myclient&redirect_uri=https://link-to-my-spa&response_type=code&scope=openid&kc_action=UPDATE_PROFILE. For UPDATE_PASSWORD I can set the Maximum Authentication Age to 0 in the Keycloak settings, so a user has to reauthenticate before changing their password. This is also the case for the delete account action. However, how can I also enforce this for UPDATE_PROFILE? I’ve thought about creating a SPI for this, such as:

@AutoService(org.keycloak.authentication.requiredactions.UpdateProfile.class)
class UserEventsProvider extends UpdateProfile {
  @Override
  public int getMaxAuthAge() {
    return 0;
  }

  @Override
  public int order() {
    return 100;
  }

  @Override
  public String getId() {
    return "RESTRICTED_UPDATE_PROFILE";
  }
}

but I cant find out how to use this RESTRICTED_UPDATE_PROFILE instead of UPDATE_PROFILE. Additionally, I don’t even know if this would be the right approach to force reauthentication for profile updates. Any help would be greatly appreciated! Thank you!

Application Initiated Actions - Case Sensitivity?
2

You are on a good way.
Remove your custom getId() method and deploy it to Keycloak. Then your custom class overloads the built-in one (UpdateProfile), no need to configure anything else.
This is, because your class uses the same ID as the extended one, but a higher order.

3

Perfect, thank you very much! With your information I got it to work. In addition I also had to change the class in @AutoService from

@AutoService(org.keycloak.authentication.requiredactions.UpdateProfile.class)

to

@AutoService(org.keycloak.authentication.RequiredActionFactory.class)

Afterwards I’ve mapped the jar file into my Keycloak Docker container

-v "./restrict-update-profile-1.0-SNAPSHOT.jar":"/opt/keycloak/providers/restrict-update-profile-1.0-SNAPSHOT.jar"

And now the user has to reauthenticate before they are able to update their profile. Thanks!

1 Like