libre.sh/keycloak-scim
3
0
Fork 0
Code Issues 15 Pull requests Releases 1 Packages Activity Actions

KEYCLOAK-16450 X509 Direct Grant Auth does not verify certificate timestamp validity

Browse source
This commit is contained in:
Luca Leonardo Scorcia 2021-05-20 12:27:53 -04:00 committed by Hynek Mlnařík
parent 4b2c20c871
commit 478319348b
2 changed files with 44 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
services/src/main/java/org/keycloak/authentication/authenticators/x509/ValidateX509CertificateUsername.java
View file

@ -75,7 +75,8 @@ public class ValidateX509CertificateUsername extends AbstractX509ClientCertifica
CertificateValidator validator = builder.build(certs); CertificateValidator validator = builder.build(certs);
validator.checkRevocationStatus() validator.checkRevocationStatus()
.validateKeyUsage() .validateKeyUsage()
.validateExtendedKeyUsage(); .validateExtendedKeyUsage()
.validateTimestamps();
} catch(Exception e) { } catch(Exception e) {
logger.error(e.getMessage(), e); logger.error(e.getMessage(), e);
// TODO use specific locale to load error messages // TODO use specific locale to load error messages

42
testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/x509/X509DirectGrantTest.java
View file

@ -244,6 +244,48 @@ public class X509DirectGrantTest extends AbstractX509AuthenticationTest {
} }
@Test
public void loginCertificateNotExpired() throws Exception {
X509AuthenticatorConfigModel config =
new X509AuthenticatorConfigModel()
.setCertValidationEnabled(true)
.setConfirmationPageAllowed(true)
.setMappingSourceType(SUBJECTDN_EMAIL)
.setUserIdentityMapperType(USERNAME_EMAIL);
AuthenticatorConfigRepresentation cfg = newConfig("x509-directgrant-config", config.getConfig());
String cfgId = createConfig(directGrantExecution.getId(), cfg);
Assert.assertNotNull(cfgId);
oauth.clientId("resource-owner");
OAuthClient.AccessTokenResponse response = oauth.doGrantAccessTokenRequest("secret", "", "", null);
assertEquals(200, response.getStatusCode());
}
@Test
public void loginCertificateExpired() throws Exception {
X509AuthenticatorConfigModel config =
new X509AuthenticatorConfigModel()
.setCertValidationEnabled(true)
.setConfirmationPageAllowed(true)
.setMappingSourceType(SUBJECTDN_EMAIL)
.setUserIdentityMapperType(USERNAME_EMAIL);
AuthenticatorConfigRepresentation cfg = newConfig("x509-directgrant-config", config.getConfig());
String cfgId = createConfig(directGrantExecution.getId(), cfg);
Assert.assertNotNull(cfgId);
setTimeOffset(50 * 365 * 24 * 60 * 60);
oauth.clientId("resource-owner");
OAuthClient.AccessTokenResponse response = oauth.doGrantAccessTokenRequest("secret", "", "", null);
setTimeOffset(0);
assertEquals(401, response.getStatusCode());
assertEquals("invalid_request", response.getError());
Assert.assertThat(response.getErrorDescription(), containsString("has expired on:"));
}
private void loginForceTemporaryAccountLock() throws Exception { private void loginForceTemporaryAccountLock() throws Exception {
X509AuthenticatorConfigModel config = new X509AuthenticatorConfigModel() X509AuthenticatorConfigModel config = new X509AuthenticatorConfigModel()
.setMappingSourceType(ISSUERDN) .setMappingSourceType(ISSUERDN)