<p>There is no need to push any OTP values into the keycloak database.
You can use the new privacyidea keycloak provider.</p>

<p>The user logs in with his username/password and the privacyidea-provider will take care, that the users get the email and ask in a 2nd dialog for the OTP.</p>

<p>See:
<a href="https://github.com/privacyidea/keycloak-provider" rel="nofollow noreferrer">https://github.com/privacyidea/keycloak-provider</a></p>

CC BY-SA 4.0
2019-05-25T09:17:06.717Z
Yes, thanks. I have already seen KeyCloak Provider and intend to check it out.
JOE BOY
CC BY-SA 4.0
2021-02-19T16:44:16.997Z
@JoeBoyP37 did this solution work well for you ?
Ramp
CC BY-SA 4.0
2019-05-23T17:59:19.963Z
2019-05-23T17:59:19.963Z
cornelinux
<p>I am doing a Micro-services application hosted in AWS to be accessed via Amazon API Gateway by end-users from several organisations worldwide. I am hoping to use KeyCloak as User Authentication Server (2FA). Keycloak will generate a JWT token for the authenticated user and pass the JWT token to the AWS API Gateway to authorise access to the micro services.  </p>

<p>Keycloak will be hosted in an AWS Public VPC subnet. In addition, I will have PrivacyIdea as OTP code generator and dispatcher in another subnet or maybe the same subnet in the same VPC. I will also have an Email Gateway in same or another VPC subnet. </p>

<p>Privacy Idea will generate the OPC codes, probably using HOTP and dispatch them via the Email gateway to the users mailbox. The user's corporate email address will be setup in PrivacyIdea. These same users will be setup up in Keycloak. My idea is that somehow  the PrivacyIdea-generated and emailed OTP codes will be inputed by the users along with their login-ID and password into a Keycloak-generated login form, which will then authenticate the user.</p>

<p>Keycloak as authentication server and the use of Emailed OTP codes is an architectural choice that I have no room to change.</p>

<p>My problem is that Keycloak only directly supports Google Authenticator or FreeOTP mobile SMS or application based OTP; hence my having to introduce PrivacyIdea and an Email Gateway. Can anyone kindly provide me any technical guidance or experience on how the OTP seeding and communication of OTP codes from PrivacyIdea or OTP database sharing can be done. </p>

<p>Thank you.</p>

<amazon-web-services>
KeyCloak, PrivacyIdea and Email Gateway
JOE BOY
# KeyCloak, PrivacyIdea and Email Gateway

(Asked by: username_0 on 2019-03-07)

I am doing a Micro-services application hosted in AWS to be accessed via Amazon API Gateway by end-users from several organisations worldwide. I am hoping to use KeyCloak as User Authentication Server (2FA). Keycloak will generate a JWT token for the authenticated user and pass the JWT token to the AWS API Gateway to authorise access to the micro services.

Keycloak will be hosted in an AWS Public VPC subnet. In addition, I will have PrivacyIdea as OTP code generator and dispatcher in another subnet or maybe the same subnet in the same VPC. I will also have an Email Gateway in same or another VPC subnet.

Privacy Idea will generate the OPC codes, probably using HOTP and dispatch them via the Email gateway to the users mailbox. The user's corporate email address will be setup in PrivacyIdea. These same users will be setup up in Keycloak. My idea is that somehow the PrivacyIdea-generated and emailed OTP codes will be inputed by the users along with their login-ID and password into a Keycloak-generated login form, which will then authenticate the user.

Keycloak as authentication server and the use of Emailed OTP codes is an architectural choice that I have no room to change.

My problem is that Keycloak only directly supports Google Authenticator or FreeOTP mobile SMS or application based OTP; hence my having to introduce PrivacyIdea and an Email Gateway. Can anyone kindly provide me any technical guidance or experience on how the OTP seeding and communication of OTP codes from PrivacyIdea or OTP database sharing can be done.

Thank you.

**Tags:** amazon-web-services


---

## 1 answers

### Answer by username_1 on 2019-05-23. Score: 1 | Accepted answer

There is no need to push any OTP values into the keycloak database.
You can use the new privacyidea keycloak provider.

The user logs in with his username/password and the privacyidea-provider will take care, that the users get the email and ask in a 2nd dialog for the OTP.

See:
<https://github.com/privacyidea/keycloak-provider>

> **Comments:**
> **username_0**: Yes, thanks. I have already seen KeyCloak Provider and intend to check it out.  
> **username_2**: @JoeBoyP37 did this solution work well for you ?  

---

