How to authenticate user using mobile number in Keycloak - authentication

Question

User has a custom attribute phoneNumber in Keycloak.
There is a default method for fetching token using username and password but would it be possible to authenticate using phoneNumber / password instead of username / password
curl \
-d "client_id=$CLIENT_ID" -d "client_secret=$CLIENT_SECRET" \
-d "username=$UNAME" -d "password=$PASSWORD" \
-d "grant_type=password" \
"$KEYCLOAKHOST/auth/realms/$REALM/protocol/openid-connect/token"
What call should I use to authenticate using a custom attribute in UserModel

Answer 1

After looking around it seems to me that you will not have that functionality provided by Keycloak out of the box. With the current Keycloak implementation it would not be feasible to use the :
curl \
-d "client_id=$CLIENT_ID" -d "client_secret=$CLIENT_SECRET" \
-d "phoneNumber=$PhoneNumber" -d "password=$PASSWORD" \
-d "grant_type=password" \
"$KEYCLOAKHOST/auth/realms/$REALM/protocol/openid-connect/token"
because neither does Keycloak itself check that the user attribute phoneNumber is a valid number nor does it check that it is a unique number. This last constrain is fundamental for obvious reasons, hence the reason why Keycloak enforces the usernames to be unique.
So you can try to extend Keycloak with that functionality, which was recently done in a production environment. Fortunately, the developer was nice enough to provide that functionality for others to implement, check this redhat blog post by the developer detailing the implementation.
However, if you only want to use the "default method for fetching " that you posted in the question, then what you can do is just say that the username itself has to be the mobile phone (similar to the WhatsApp approach), which is not as bad as it sounds because 1) Keycloak enforces that the usernames are unique, 2) Keycloak still has the fields first name and last name to identify by name the users.
Now the tricky part is to ensure that during the user registration, the user really inserts a valid phone number and not some random string. For that, you can either again extend the keycloak, and validated it there. However, if you are going this root you might as well use the feature from the RedHat blog post. Or manage the user registration with your own app, which would enforce the user to add a valid Phone Number by relying on some SMS security feature, and after the validation was performed, the app itself would register the user on Keycloak with the username field set to the user Phone Number.