feat(message-otp): opt-in auto-create of message-otp credential at login - #2896
Open
edulix wants to merge 4 commits into
Open
feat(message-otp): opt-in auto-create of message-otp credential at login#2896edulix wants to merge 4 commits into
edulix wants to merge 4 commits into
Conversation
Add a new boolean authenticator config property "Auto-create OTP credential" (autoCreateCredentialAttribute, disabled by default). When enabled, configuredFor() auto-creates the message-otp credential for non-deferred users that have a mobile number or email configured, so imported/edited voters can use the OTP alternative without an enrollment required action and without changing voter import/edit. Deferred-user mode keeps relying on auth notes and never requires nor creates a stored credential, fixing the silent filtering of the OTP alternative that ended in a generic invalid_user_credentials error. Includes unit tests (MessageOTPAuthenticatorTest, 10 tests) and junit jupiter + mockito test dependencies for the module. Related: sequentech/meta#12616
Document the opt-in Auto-create OTP credential option: why imported voters were silently skipping the OTP sub-flow, how to wire the conditional OTP sub-flow into the browser flow, how to enable the option, what the voter sees, and how to confirm the message-otp credential was created. Screenshots were captured against a dev election event configured end to end with an email-only voter. Related: sequentech/meta#12616
|
# Conflicts: # packages/keycloak-extensions/message-otp-authenticator/pom.xml
The Auto-create OTP credential option is channel agnostic: it creates the same message-otp credential for a voter that has an email address or a mobile number, and the Message Courier setting decides how the code is delivered. The tutorial read as email only. Rename it to "Email and SMS OTP for Imported Voters", document the SMS courier and the telephone user attribute it reads, note that a single credential covers both channels, and add the dummy SMS sender log command used in the development environment. Screenshots are unchanged and still show an email-only voter, which the text now calls out.
edulix
marked this pull request as ready for review
July 30, 2026 07:32
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes sequentech/meta#12616
What
Adds an opt-in setting to the
message-otp-authenticatorKeycloak extension to auto-create themessage-otpcredential during login for non-deferred users.Why
Voters imported or edited through the admin interface get their phone/email attributes set but never receive a stored
message-otpcredential. In flows where the message OTP authenticator is an ALTERNATIVE execution (e.g. combined with passkeys),configuredFor()returnedfalsefor these users, silently filtering the OTP option out of the credential selection list and failing the flow with a genericinvalid_user_credentialserror.How
AUTO_CREATE_CREDENTIAL_ATTRIBUTEconfig key inUtils.ProviderConfigProperty"Auto-create OTP credential" inMessageOTPAuthenticatorFactory, disabled by default.MessageOTPAuthenticator.configuredFor()reworked: for non-deferred users without the stored credential, if the property is enabled and the user has a mobile number or email configured, it createsMessageOTPCredentialModel(isSetup=true)on the fly and reports configured — no enrollment required action and no voter import/edit changes needed.Testing
New
MessageOTPAuthenticatorTestwith 10 unit tests covering: default-off no-op, credential creation with mobile / email-only, no address, existing credential not duplicated, null user, deferred mode with the new property both enabled and disabled, and the factory property default value.