KOBIL Captcha

Overview

The main task of this authenticator is to enhance security by distinguishing between genuine users and automated bots. This feature helps prevent abuse such as bot-driven attacks, spam submissions, and unauthorized access, ensuring that only human users can complete the authentication process.

Type

Protocol	OpenID Connect 1.0
HTTP method	GET
Type	Browser Flow
Endpoint	Authorization Endpoint
Flow Supported	Authorization code flow Implicit flow Hybrid flow
Response	ID Token, Access Token, Refresh Token
Response Mode	query, form_post, fragment

How to configure

To configure the authenticator, follow these steps:

1. Navigate to Authentication tab
2. Click Add step
3. Select the authenticator to proceed with the next step
4. Keep the default Settings unchanged.

By following these steps, you will be able to successfully configure the authenticator.

Parameters involved in Kobil Captcha

Parameter	Description
Alias	Name for the overall configured configurations which occurs in particular authenticator. (Example: Kobil Captcha)
Authenticator Reference	Authenticator Reference Specifies the authentication method used, such as password (pwd), one-time password(OTP). This reference is used to track authentication steps in the authentication flow.
Authenticator Reference Max Age	Authenticator Reference Max Age specifies the validity period (in seconds) for a completed authentication. Once this time expires, the user must re-authenticate using the specified method.
JSON Script	JSON to display inputs in Headless V2 theme.
JSON Error Script	JSON to display the error messages in Headless V2 theme.

Configuring Google reCAPTCHA for KOBIL CAPTCHA

To enable Google reCAPTCHA, you need to configure the CAPTCHA_SITE_KEY and CAPTCHA_SECRET_KEY in the Realm settings. Follow these steps:

1. Open a web browser and navigate to the Google reCAPTCHA page.
2. Click Get Started to begin the process.

3. Enter a name in Label to identify your reCAPTCHA.
4. Select the Challenge Type.
5. Add the Domain where the CAPTCHA will be used.

6. Click Submit to generate the Site Key and Secret Key.

7. Once generated, add the CAPTCHA_SITE_KEY and CAPTCHA_SECRET_KEY under the KOBIL tab by clicking Add Attribute.

Updating Content Security Policy for Google reCAPTCHA

Content-Security-Policy

To ensure Keycloak functions correctly when integrating CAPTCHA services from a different domain, it's necessary to configure the Content-Security-Policy. By configuring the Content Security Policy, you explicitly tell the browser to trust and allow content from the CAPTCHA provider's domain. This ensures that the CAPTCHA functions correctly within Keycloak's authentication pages.​ To ensure Google reCAPTCHA functions correctly, you must update the Content-Security-Policy parameter in the Realm settings.

1. Navigate to Realm Settings.
2. Go to Security Defenses tab.
3. Locate the Content-Security-Policy parameter field.
4. Add https://www.google.com to the frame-src directive.
5. Save the configuration.

note

To ensure Google reCAPTCHA functions correctly, you must specify the reCAPTCHA's domain in
Content-Security-Policy.​

CAPTCHA Authentication Workflow

User validation is a prerequisite for the CAPTCHA authenticator. This validation can be performed using any authenticator that can validate the user, such as the KOBIL Cookie authenticator and the KOBIL Username Password Form Authenticator.

User flow

1. KOBIL Captcha must be preceded by One-Factor Authentication (1FA). For instance: KOBIL Cookie.
2. If user is successfully authenticated into keycloak, user will be prompted with CAPTCHA.
3. The user solves the CAPTCHA, and Keycloak verifies the response with the reCAPTCHA service.
4. Upon successful CAPTCHA verification, Keycloak grants the user access to the application.