t-otp support?

[stavoltafunzia]

Just wanted to ask if there is any plan to support t-otp 2fa. This project is really promising; before start using it was just looking for some easy-to handle 2fa method like t-otp.

[micbar]

Yes. We suggest to use keycloak which can be used with totp out of the box.

[LeePorte]

Is there a step by step guide for getting keycloak running in this way? I'm a noob with keycloak and am trying to work through both https://docs.opencloud.eu/docs/admin/configuration/authentication-and-user-management/keycloak and the keycloak admin manual at the moment.

[micbar]

TOTP is enabled by default in Keycloak.

Basically the default setup https://docs.opencloud.eu/docs/admin/getting-started/container/docker-compose/docker-compose-base

and additional https://docs.opencloud.eu/docs/admin/configuration/authentication-and-user-management/keycloak#example-docker-compose-configuration---shared-directory-mode

[r0l1]

I'd be interested in implementing TOTP (Time-based One-Time Password) authentication for this project. Before investing the time, I wanted to check if:

This feature aligns with the project's goals
You'd be open to reviewing/merging such a contribution

I'm happy to discuss the approach or open an issue first to outline the implementation plan if there's interest.
Thanks for maintaining this project!

[micbar]

@r0l1

I think we need to provide some context:

1. openCloud only runs on OIDC
2. We are bundling an OIDC provider from kopano (LibreConnect)
3. Any improvements / features in LibreConnect need to be discussed upstream

More Context

We do not put any efforts into LibreConnect because we use it for testing only. Production deployments of opencloud are mostly done with keycloak, which implements all features you can imagine. In our opencloud-compose, we are also shipping an opencloud keycloak theme.

Lightweigt Alternative

Many community users want to have a lightweight alternative. We are very much in favour of Autheliam which already implements some needed features.

There are currently some obstacles on the openCloud Client Scopes but we want to fix them.

From my POV, we should focus on authelia.

[micbar]

That is my personal opinion.

@tbsbdr For product decisions.

[tbsbdr]

what do you think would be the concrete advantages of having a lightweight alternative to keycloak?

[micbar]

I get a lot of feedback that people with 10-20 users in their home labs are seeing keycloak as overkill because of the heavy footprint.

Something lightweight and easy to maintain would be preferred. Especially if it brings MFA and more long standing FRs.

[LeePorte]

@micbar I'd agree with that, running for family type setups running keycloak does feel like a fairly big thing to be running.