libre.sh/keycloak-scim
3
0
Fork 0
Code Issues 15 Pull requests Releases 1 Packages Activity Actions

Merge pull request #41 from mposolda/backport

Browse source 
KEYCLOAK-3564 Docs for key rotation on OIDC clients and identity prov…
This commit is contained in:
Marek Posolda 2016-10-04 19:10:02 +02:00 committed by GitHub
commit 997e1d7aad
2 changed files with 24 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
topics/clients/oidc/confidential.adoc
View file

@ -38,4 +38,11 @@ image:../../../{{book.images}}/import-client-cert.png[]
There are multiple formats you can import from, just choose the archive format you have the certificate stored in, There are multiple formats you can import from, just choose the archive format you have the certificate stored in,
select the file, and click the `Import` button. select the file, and click the `Import` button.
Finally note that you don't even need to import certificate if you choose to `Use JWKS URL` . In that case, you can provide the URL where
client publishes it's public key in https://self-issued.info/docs/draft-ietf-jose-json-web-key.html[JWK] format. This is flexible because when
client changes it's keys, {{book.project.name}} will automatically download them without need to re-import anything on {{book.project.name}} side.
If you use client secured by {{book.project.name}} adapter, you can configure the JWKS URL like https://myhost.com/myapp/k_jwks assuming that https://myhost.com/myapp is the
root URL of your client application. See {{book.developerguide.link}}[{{book.developerguide.name}}] for additional details.

17
topics/identity-broker/oidc.adoc
View file

@ -49,6 +49,23 @@ You must define the OpenID Connection configuration options as well. They basic
|Prompt |Prompt
|Another optional switch. This is the prompt parameter defined by the OIDC specification. Through it you can force re-authentication and other options. See the specification for |Another optional switch. This is the prompt parameter defined by the OIDC specification. Through it you can force re-authentication and other options. See the specification for
more details more details
|Validate Signatures
|Another optional switch. This is to specify if {{book.project.name}} will verify the signatures on the external ID Token signed by this Identity provider. If this is on,
the {{book.project.name}} will need to know the public key of the external OIDC identity provider. See below for how to setup it.
|Use JWKS URL
|Applicable just `Validate Signatures` is on. If the switch is on, then identity provider public keys will be downloaded from given JWKS URL.
This allows great flexibility because new keys will be always re-downloaded again when identity provider generates new keypair. If the switch is off,
then public key (or certificate) from the {{book.project.name}} DB is used, so when identity provider keypair changes, you always need to import new key to the {{book.project.name}} DB as well.
|JWKS URL
|URL where identity provider keys in JWK format are stored. See https://self-issued.info/docs/draft-ietf-jose-json-web-key.html[JWK specification] for more details.
If you use external {{book.project.name}} identity provider, then you can use URL like http://broker-keycloak:8180/auth/realms/test/protocol/openid-connect/certs assuming your brokered
{{book.project.name}} is running on http://broker-keycloak:8180 and it's realm is `test` .
|Validating Public Key
|Applicable if `Use JWKS URL` is off. Here is the public key in PEM format that must be used to verify external IDP signatures.
|=== |===
You can also import all this configuration data by providing a URL or file that points to OpenID Provider Metadata (see OIDC Discovery specification). You can also import all this configuration data by providing a URL or file that points to OpenID Provider Metadata (see OIDC Discovery specification).