Stefan Bethke
32b5f147bc
Adds a keycloak_auth_flow role that locally validates flow definitions (structure, nesting depth, known provider IDs, and a set of Keycloak authentication-flow gotchas: conditions silently ignored outside a Conditional subflow, keycloak/keycloak#29515's OTP+WebAuthn sibling bug, conditional-credential config shape/semantics, and more) before deploying them idempotently via middleware_automation.keycloak.keycloak_authentication_v2. Includes the CCCHH realm's actual "browser passkey and token" flow (the realm's real browserFlow binding, not the untouched built-in "browser" flow), exported from the live server so it's now reviewable and redeployable from this repo instead of only editable in the Keycloak admin console.
62 lines
2.6 KiB
YAML
62 lines
2.6 KiB
YAML
---
|
|
realm: ccchh
|
|
alias: browser passkey and token
|
|
description: passkey or (password and (TOTP or token))
|
|
providerId: basic-flow
|
|
authenticationExecutions:
|
|
- providerId: auth-cookie
|
|
requirement: ALTERNATIVE
|
|
- providerId: auth-spnego
|
|
requirement: DISABLED
|
|
- providerId: identity-provider-redirector
|
|
requirement: ALTERNATIVE
|
|
- subFlow: browser passkey and token browser passkey Organization
|
|
requirement: DISABLED
|
|
authenticationExecutions:
|
|
- subFlow: browser passkey and token browser passkey Browser - Conditional Organization
|
|
requirement: CONDITIONAL
|
|
authenticationExecutions:
|
|
- providerId: conditional-user-configured
|
|
requirement: REQUIRED
|
|
- providerId: organization
|
|
requirement: ALTERNATIVE
|
|
- subFlow: browser passkey and token browser passkey forms
|
|
requirement: ALTERNATIVE
|
|
authenticationExecutions:
|
|
- subFlow: browser passkey and token Passkey or Password
|
|
requirement: REQUIRED
|
|
authenticationExecutions:
|
|
- providerId: webauthn-authenticator-passwordless
|
|
requirement: ALTERNATIVE
|
|
- subFlow: browser passkey and token Password + OTP
|
|
requirement: ALTERNATIVE
|
|
authenticationExecutions:
|
|
- providerId: auth-username-password-form
|
|
requirement: REQUIRED
|
|
- subFlow: browser passkey and token Conditional OTP
|
|
requirement: CONDITIONAL
|
|
authenticationExecutions:
|
|
- providerId: conditional-credential
|
|
requirement: REQUIRED
|
|
authenticationConfig:
|
|
alias: browser passkey and token not passkey
|
|
config:
|
|
credentials: webauthn-passwordless
|
|
included: 'false'
|
|
- providerId: conditional-user-configured
|
|
requirement: REQUIRED
|
|
- providerId: auth-otp-form
|
|
requirement: REQUIRED
|
|
- subFlow: WebAuthn Authenticator if configured for the user
|
|
requirement: CONDITIONAL
|
|
authenticationExecutions:
|
|
- providerId: conditional-credential
|
|
requirement: REQUIRED
|
|
authenticationConfig:
|
|
alias: webauthn-passwordless
|
|
config:
|
|
credentials: webauthn-passwordless
|
|
- providerId: conditional-user-configured
|
|
requirement: REQUIRED
|
|
- providerId: webauthn-authenticator
|
|
requirement: REQUIRED
|