Using OTPs

As an additional layer of security, Keycloak allows you to use a second factor – or evidence – when authenticating users. In addition to providing a password – something users know – users are obligated to provide secondary evidence about their identity – something they have – which can be a code or a security key in their possession.

An OTP is probably one of the most common ways to enable 2FA for user accounts. It is relatively easy to use and adds an additional layer of security when you’re authenticating users.

Although it’s a useful method for 2FA, OTPs have some disadvantages. They rely on a shared key between the server and users and do not provide the best usability for end users, while still being open to common attacks such as phishing or scams. As we are going to see later, Keycloak helps you overcome these limitations by using a security device as a second factor using WebAuthn.

Keycloak makes...