Username, Password, AND optional OTP on the login page

hanthor · June 21, 2025, 6:04pm

I am wondering if it is possible to implement a login page with the OTP field on the front page. Like how Fedora has theirs:

xgp · June 22, 2025, 3:59pm

You could implement a custom Authenticator to do a similar thing.

We’ve got an Email OTP Authenticator that sends an OTP to the user’s email after the user is identified (either with username or username and password). That might help you get started.

Can you help me understand how the user got the OTP without identifying themselves? I’m not familiar with the Fedora login flow.

hanthor · June 22, 2025, 4:30pm

Yes it would really be a TOTP. it would be in a authenticator app and password manager. Password managers could fill in all three at once and you can click login

xgp · June 22, 2025, 5:46pm

Then you should look at the Authenticators for username/password and otp. You can probably combine those into one custom that will allow you to do both at the same time.

github.com/keycloak/keycloak

services/src/main/java/org/keycloak/authentication/authenticators/browser/UsernamePasswordForm.java

main

/*
 * Copyright 2016 Red Hat, Inc. and/or its affiliates
 * and other contributors as indicated by the @author tags.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 * http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

package org.keycloak.authentication.authenticators.browser;

import org.keycloak.WebAuthnConstants;

This file has been truncated. show original

github.com/keycloak/keycloak

services/src/main/java/org/keycloak/authentication/authenticators/browser/OTPFormAuthenticator.java

main

/*
 * Copyright 2016 Red Hat, Inc. and/or its affiliates
 * and other contributors as indicated by the @author tags.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 * http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

package org.keycloak.authentication.authenticators.browser;

import org.keycloak.authentication.AuthenticationFlowContext;

This file has been truncated. show original

embesozzi · June 22, 2025, 8:03pm

As xgp was saying, customization makes it possible.

Nevertheless, the recommendation is to follow the Identify-First approach. This means the first step is user identification, followed by the appropriate authentication step. It no longer makes sense to do everything at once in the first step.

hanthor · June 23, 2025, 4:15pm

Turned out they are using LDAP for TOTP and just need the oto concatenated to the password. Here’s what I made for anyone else looking: GitHub - hanthor/almalinux-keycloak-theme

Topic		Replies	Views
Want to create OTP based login (without 2FA) Getting advice authentication	1	685	March 3, 2022
Register user with OTP and set password after that Getting advice	0	216	March 3, 2024
How to work with REST API for registering/signing-in users using phone/OTP from another web page? Tips and tricks authentication , oidc	9	922	April 30, 2024
OTP after authentication Getting advice	1	798	July 16, 2021
Display "Try another way" after login, not the first otp Configuring the server authentication	4	649	January 6, 2025

Username, Password, AND optional OTP on the login page

Related topics