Remember me in combination with Kerberos and 2FA

Before reporting an issue

• I have searched existing issues
• I have reproduced the issue with the latest nightly release

Area

authentication

Describe the bug

We have a configuration that allows users to login via kerberos (80% of the users) or username/password. Second, we require 2FA (webauthn or OTP). The realm supports 'Remember Me' to reduce the amount of requests for username / password and 2FA.

For users who do not login via Kerbers, this flow works fine: using the remember me option in the username / password form, and entering the 2FA, the users do not have to re-authenticate if they close / reopen the browser within the idle session timeout, because the cookie is persistent. This is the desired flow: we require 1 OTP/webauthn challenge a day.

However, users with Kerberos authentication do not get the option to select 'remember me' on the username password form, but do get a Webauth / OTP prompt. If these users close and reopen the browser, they get the Webauthn/OTP prompt again: there is no option to make the session persistent. To resolve this, we added the 'remember me' option to the OTP and webauthn forms in our customized theme. However, this option does not seem to be effective / handled upon submission of the OTP and webauthn form: even with the checkbox filled, the cookie stays 'browser session only'. This results in users being prompted for a 2FA multiple times a day.

Version

22.0.1

Expected behavior

Authentication flows without username / password prompt, with 2FA enabled, should support the 'remember me' function to reduce 2FA prompts upon browser restart. The web authentication handling accepts the rememberMe form variable in other steps, like submission of OTP or webauthn

Actual behavior

The web authentication handling ignores the rememberMe form variable in case of a OTP or webauthn response.

How to Reproduce?

We have an browser authentication flow that uses:

• cookie (alternative)
• login flow + 2FA (alternative)
• • first factor flow (required)
• • • kerberos (alternative)
• • • username password form (alternative)
• • second factor (required)
• • • WebAutn (alternative)
• • • OTP (alternative)

The realm supports 'Remember Me'. Kerberos is configured.

Customize the theme to add a remember me option to the login-otp.ftl

Anything else?

No response