Authentication · Multi-Factor Auth
A second factor that users actually enrol in
We design and roll out Keycloak MFA across your applications — authenticator apps, security keys and step-up rules built from authentication flows, so stronger checks land where the risk is and nowhere else.
- TOTP / HOTP & WebAuthn
- Step-up via acr & Level of Authentication
- Runs on upstream Keycloak 26.x
Standards & integrations
- TOTP (RFC 6238)
- HOTP (RFC 4226)
- WebAuthn / FIDO2
- OIDC acr_values
- Authenticator apps
Overview
MFA is a policy decision, not a checkbox
Turning on OTP for everyone is easy. Getting people through enrolment, recovering lost devices and asking for a second factor only when it matters is the hard part. In Keycloak that behaviour lives in authentication flows, conditions and required actions — and a flow built carelessly can lock users out or quietly skip the check. We design those flows, test every path and document how your support team handles a lost authenticator.
What we deliver
- MFA policy by user group, application and action
- Authentication flows and conditions configured as code
- OTP and WebAuthn policies tuned and documented
- Step-up mapping from acr values to levels of authentication
- Enrolment, recovery and lost-device runbook for support
- Custom authenticator SPI for SMS or email OTP, where required
Capabilities
What Multi-Factor Auth covers
Configured, tested and documented on upstream Keycloak — then handed over or operated by us.
Authenticator-app OTP
TOTP or HOTP with algorithm, digits and look-ahead set in the OTP policy, working with FreeOTP, Google Authenticator, Microsoft Authenticator and similar apps.
Security keys as a second factor
WebAuthn policy configured for hardware keys and platform authenticators, with attestation and user-verification settings matched to your risk profile.
Step-up when it matters
Map acr values to levels of authentication so an application can ask for a stronger login before a payment, an admin action or a data export — without forcing it on every sign-in.
Conditional flows
Require a second factor by role or user attribute, or give a specific client its own flow through flow overrides, so admins and contractors get stricter rules than everyday users.
Enrolment and recovery
Required actions walk users through setting up OTP or a security key at next login, and recovery codes give them a way back in when a phone goes missing.
SMS, email and push via SPI
Where you need factors Keycloak doesn't ship, we build and maintain a custom authenticator SPI against your SMS, email or push provider.
How it works
From first call to production
Decide who needs what
We map user groups, applications and sensitive actions to the factors and assurance levels each one needs, and agree how exceptions are handled.
Build and test the flows
Authentication flows, conditions, OTP and WebAuthn policies are defined as code and tested for enrolment, login, step-up, lost-device and lockout paths in staging.
Roll out in stages
MFA is switched on group by group through required actions, with clear user messaging and a support runbook ready before the first user is prompted.
Use cases
Where teams put it to work
Admin and privileged access
Operators, finance and support staff present a security key or OTP code, while regular users keep a lighter login.
Step-up for sensitive actions
Customers browse with a normal session and are asked for a second factor only when changing payout details or exporting data.
Answering security reviews
When a customer asks whether you enforce MFA, point to a documented, tested policy defined in code instead of a setting someone once clicked.
FAQ
Multi-Factor Auth questions, answered
Does Keycloak support SMS or email one-time codes?
Not as a built-in second factor. We add them through a custom authenticator SPI connected to your SMS or email provider, and generally recommend authenticator apps or security keys as the stronger default.
Can we require MFA only for some users or applications?
Yes. Conditional sub-flows can require a second factor based on role or user attribute, and individual clients can run their own authentication flow through flow overrides.
What happens when someone loses their phone?
Users with recovery codes can sign in and re-enrol themselves. Otherwise an administrator removes the lost credential and the user is prompted to set up a new one at next login — we document and test both paths.
Can an application ask for stronger authentication mid-session?
Yes. The client requests a higher acr value, Keycloak maps it to a level of authentication, runs only the additional steps needed and reports the achieved level back in the token.
Ready to roll out Multi-Factor Auth?
Walk us through your requirements on a free strategy call. We'll come back with an architecture, a delivery plan and a fixed scope.