I am new to OIDC and WebAuthn. I want to provide a progressive passwordless experience for my users. I understand that passkeys are supported by Windows/Mac/iOS/Android.
I want to configure a Keycloak client so that it can authenticate using OIDC flows. But I have two questions.
-
Which OIDC flow should I be using? I know using Implicit flow is bad. What choice do I have given I cannot use authorization grant flow as I am developing a mobile app. Opening a web view on the phone app to provide fingerprint seems odd to me.
-
How should I configure the authentication override for my Keycloak client such that the default fallback is a username and password. But if the user has a passkey, then it will default to such mechanism?