I am doing a Micro-services application hosted in AWS to be accessed via Amazon API Gateway by end-users from several organisations worldwide. I am hoping to use KeyCloak as User Authentication Server (2FA). Keycloak will generate a JWT token for the authenticated user and pass the JWT token to the AWS API Gateway to authorise access to the micro services.
Keycloak will be hosted in an AWS Public VPC subnet. In addition, I will have PrivacyIdea as OTP code generator and dispatcher in another subnet or maybe the same subnet in the same VPC. I will also have an Email Gateway in same or another VPC subnet.
Privacy Idea will generate the OPC codes, probably using HOTP and dispatch them via the Email gateway to the users mailbox. The user's corporate email address will be setup in PrivacyIdea. These same users will be setup up in Keycloak. My idea is that somehow the PrivacyIdea-generated and emailed OTP codes will be inputed by the users along with their login-ID and password into a Keycloak-generated login form, which will then authenticate the user.
Keycloak as authentication server and the use of Emailed OTP codes is an architectural choice that I have no room to change.
My problem is that Keycloak only directly supports Google Authenticator or FreeOTP mobile SMS or application based OTP; hence my having to introduce PrivacyIdea and an Email Gateway. Can anyone kindly provide me any technical guidance or experience on how the OTP seeding and communication of OTP codes from PrivacyIdea or OTP database sharing can be done.
Thank you.
