[KEYCLOAK-8580] Add Nginx certificate lookup provider
This commit is contained in:
MICHEL Arnault (UA 2118)
Marek Posolda
parent
60a8267576
commit
ab8789739f
5 changed files with 410 additions and 1 deletions
|
|
@ -40,7 +40,7 @@ public abstract class AbstractClientCertificateFromHttpHeadersLookup implements
|
|||
|
||||
protected final String sslClientCertHttpHeader;
|
||||
protected final String sslCertChainHttpHeaderPrefix;
|
||||
private final int certificateChainLength;
|
||||
protected final int certificateChainLength;
|
||||
|
||||
public AbstractClientCertificateFromHttpHeadersLookup(String sslCientCertHttpHeader,
|
||||
String sslCertChainHttpHeaderPrefix,
|
||||
|
|
|
|||
|
|
@ -0,0 +1,360 @@
|
|||
/*
|
||||
* Copyright 2017 Analytical Graphics, Inc. and/or its affiliates
|
||||
* and other contributors as indicated by the @author tags.
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
*/
|
||||
|
||||
package org.keycloak.services.x509;
|
||||
|
||||
import java.io.UnsupportedEncodingException;
|
||||
import java.security.GeneralSecurityException;
|
||||
import java.security.InvalidAlgorithmParameterException;
|
||||
import java.security.InvalidKeyException;
|
||||
import java.security.KeyStore;
|
||||
import java.security.KeyStoreException;
|
||||
import java.security.NoSuchAlgorithmException;
|
||||
import java.security.NoSuchProviderException;
|
||||
import java.security.PublicKey;
|
||||
import java.security.SignatureException;
|
||||
import java.security.cert.CertPath;
|
||||
import java.security.cert.CertPathBuilder;
|
||||
import java.security.cert.CertPathBuilderException;
|
||||
import java.security.cert.CertStore;
|
||||
import java.security.cert.Certificate;
|
||||
import java.security.cert.CertificateException;
|
||||
import java.security.cert.CollectionCertStoreParameters;
|
||||
import java.security.cert.PKIXBuilderParameters;
|
||||
import java.security.cert.TrustAnchor;
|
||||
import java.security.cert.X509CertSelector;
|
||||
import java.security.cert.X509Certificate;
|
||||
import java.util.ArrayList;
|
||||
import java.util.Enumeration;
|
||||
import java.util.HashSet;
|
||||
import java.util.List;
|
||||
import java.util.Set;
|
||||
|
||||
import org.jboss.logging.Logger;
|
||||
import org.jboss.logging.Logger.Level;
|
||||
import org.jboss.resteasy.spi.HttpRequest;
|
||||
import org.keycloak.common.util.PemException;
|
||||
import org.keycloak.common.util.PemUtils;
|
||||
import org.keycloak.models.KeycloakSession;
|
||||
import org.keycloak.models.KeycloakSessionFactory;
|
||||
import org.keycloak.truststore.TruststoreProvider;
|
||||
import org.keycloak.truststore.TruststoreProviderFactory;
|
||||
|
||||
/**
|
||||
* The NGINX Provider extract end user X.509 certificate send during TLS mutual authentication,
|
||||
* and forwarded in an http header.
|
||||
*
|
||||
* NGINX configuration must have :
|
||||
* <code>
|
||||
* server {
|
||||
* ...
|
||||
* ssl_client_certificate path-to-my-trustyed-cas-for client auth.pem;
|
||||
* ssl_verify_client on|optional_no_ca;
|
||||
* ssl_verify_depth 2;
|
||||
* ...
|
||||
* location / {
|
||||
* ...
|
||||
* sproxy_set_header ssl-client-cert $ssl_client_escaped_cert;
|
||||
* ...
|
||||
* }
|
||||
* </code>
|
||||
*
|
||||
* Note that $ssl_client_cert is deprecated, use only $ssl_client_escaped_cert with this implementation
|
||||
*
|
||||
* @author <a href="mailto:arnault.michel@toad-consulting.com">Arnault MICHEL</a>
|
||||
* @version $Revision: 1 $
|
||||
* @since 10/09/2018
|
||||
*/
|
||||
|
||||
public class NginxProxySslClientCertificateLookup extends AbstractClientCertificateFromHttpHeadersLookup {
|
||||
|
||||
private static final Logger log = Logger.getLogger(NginxProxySslClientCertificateLookup.class);
|
||||
|
||||
private static KeyStore truststore = null;
|
||||
private static Set<X509Certificate> trustedRootCerts = null;
|
||||
private static Set<X509Certificate> intermediateCerts = null;
|
||||
|
||||
|
||||
public NginxProxySslClientCertificateLookup(String sslCientCertHttpHeader,
|
||||
String sslCertChainHttpHeaderPrefix,
|
||||
int certificateChainLength,
|
||||
KeycloakSession kcsession) {
|
||||
super(sslCientCertHttpHeader, sslCertChainHttpHeaderPrefix, certificateChainLength);
|
||||
|
||||
if (!loadKeycloakTrustStore(kcsession)) {
|
||||
log.warn("Keycloak Truststore is null or empty, but it's needed to rebuild client certificate chain with nginx Keycloak Provider");
|
||||
log.warn(" see Keycloak documentation here : https://www.keycloak.org/docs/latest/server_installation/index.html#_truststore");
|
||||
}
|
||||
log.debug(" Keycloak truststore loaded for NGINX client certificate provider.");
|
||||
}
|
||||
|
||||
/**
|
||||
* Removing PEM Headers and end of lines
|
||||
* @param pem
|
||||
* @return
|
||||
*/
|
||||
private static String removeBeginEnd(String pem) {
|
||||
pem = pem.replace("-----BEGIN CERTIFICATE-----", "");
|
||||
pem = pem.replace("-----END CERTIFICATE-----", "");
|
||||
pem = pem.replace("\r\n", "");
|
||||
pem = pem.replace("\n", "");
|
||||
return pem.trim();
|
||||
}
|
||||
|
||||
/**
|
||||
* Decoding end user certificate, including URL decodeding due to ssl_client_escaped_cert nginx variable.
|
||||
*/
|
||||
@Override
|
||||
protected X509Certificate decodeCertificateFromPem(String pem) throws PemException {
|
||||
|
||||
if (pem == null) {
|
||||
log.info("End user TLS Certificate is NULL! ");
|
||||
return null;
|
||||
}
|
||||
try {
|
||||
pem = java.net.URLDecoder.decode(pem, "UTF-8");
|
||||
} catch (UnsupportedEncodingException e) {
|
||||
log.error("Cannot URL decode the end user TLS Certificate : " + pem,e);
|
||||
}
|
||||
|
||||
if (pem.startsWith("-----BEGIN CERTIFICATE-----")) {
|
||||
pem = removeBeginEnd(pem);
|
||||
}
|
||||
|
||||
return PemUtils.decodeCertificate(pem);
|
||||
}
|
||||
|
||||
@Override
|
||||
public X509Certificate[] getCertificateChain(HttpRequest httpRequest) throws GeneralSecurityException {
|
||||
List<X509Certificate> chain = new ArrayList<>();
|
||||
|
||||
// Get the client certificate
|
||||
X509Certificate clientCert = getCertificateFromHttpHeader(httpRequest, sslClientCertHttpHeader);
|
||||
log.debugf("End user certificate found : DN=[%s] SerialNumber=[%s]", clientCert.getSubjectDN().toString(), clientCert.getSerialNumber().toString() );
|
||||
|
||||
if (clientCert != null) {
|
||||
|
||||
// Rebuilding the end user certificate chain using Keycloak Truststore
|
||||
X509Certificate[] certChain = buildChain(clientCert);
|
||||
for (X509Certificate cacert : certChain) {
|
||||
chain.add(cacert);
|
||||
log.debugf("Rebuilded user cert chain DN : %s", cacert.getSubjectDN().toString() );
|
||||
}
|
||||
}
|
||||
return chain.toArray(new X509Certificate[0]);
|
||||
}
|
||||
|
||||
/**
|
||||
* As NGINX cannot actually send the CA Chain in http header,
|
||||
* @param end_user_auth_cert
|
||||
* @return
|
||||
*/
|
||||
public X509Certificate[] buildChain(X509Certificate end_user_auth_cert) {
|
||||
|
||||
String javasecuritydebugoriginalsettings = setJVMDebuggingForCertPathBuilder();
|
||||
|
||||
X509Certificate[] user_cert_chain = null;
|
||||
|
||||
try {
|
||||
|
||||
// No truststore : no way!
|
||||
if (truststore == null) {
|
||||
log.warn("Keycloak Truststore is null, but it is required !");
|
||||
log.warn(" see https://www.keycloak.org/docs/latest/server_installation/index.html#_truststore");
|
||||
return null;
|
||||
}
|
||||
|
||||
// Create the selector that specifies the starting certificate
|
||||
X509CertSelector selector = new X509CertSelector();
|
||||
selector.setCertificate(end_user_auth_cert);
|
||||
|
||||
// Create the trust anchors (set of root CA certificates)
|
||||
Set<TrustAnchor> trustAnchors = new HashSet<TrustAnchor>();
|
||||
for (X509Certificate trustedRootCert : trustedRootCerts) {
|
||||
trustAnchors.add(new TrustAnchor(trustedRootCert, null));
|
||||
}
|
||||
// Configure the PKIX certificate builder algorithm parameters
|
||||
PKIXBuilderParameters pkixParams = new PKIXBuilderParameters( trustAnchors, selector);
|
||||
|
||||
// Disable CRL checks, as it's possibly done after depending on Keycloak settings
|
||||
pkixParams.setRevocationEnabled(false);
|
||||
pkixParams.setExplicitPolicyRequired(false);
|
||||
pkixParams.setAnyPolicyInhibited(false);
|
||||
pkixParams.setPolicyQualifiersRejected(false);
|
||||
pkixParams.setMaxPathLength(certificateChainLength);
|
||||
|
||||
// Adding the list of intermediate certificates + end user certificate
|
||||
intermediateCerts.add(end_user_auth_cert);
|
||||
CollectionCertStoreParameters intermediateCA_userCert = new CollectionCertStoreParameters(intermediateCerts);
|
||||
CertStore intermediateCertStore = CertStore.getInstance("Collection", intermediateCA_userCert, "BC");
|
||||
pkixParams.addCertStore(intermediateCertStore);
|
||||
|
||||
// Build and verify the certification chain (revocation status excluded)
|
||||
CertPathBuilder certPathBuilder = CertPathBuilder.getInstance("PKIX","BC");
|
||||
CertPath certPath = certPathBuilder.build(pkixParams).getCertPath();
|
||||
log.debug("Certification path building OK, and contains " + certPath.getCertificates().size() + " X509 Certificates");
|
||||
|
||||
//Remove end user certificate
|
||||
intermediateCerts.remove(end_user_auth_cert);
|
||||
|
||||
user_cert_chain = convertCertPathtoX509CertArray( certPath );
|
||||
|
||||
} catch (NoSuchAlgorithmException e) {
|
||||
log.error(e.getLocalizedMessage(),e);
|
||||
} catch (CertPathBuilderException e) {
|
||||
if ( log.isEnabled(Level.TRACE) )
|
||||
log.debug(e.getLocalizedMessage(),e);
|
||||
else
|
||||
log.warn(e.getLocalizedMessage());
|
||||
} catch (InvalidAlgorithmParameterException e) {
|
||||
log.error(e.getLocalizedMessage(),e);
|
||||
} catch (NoSuchProviderException e) {
|
||||
log.error(e.getLocalizedMessage(),e);
|
||||
}
|
||||
|
||||
//Reset java security debug property to original value
|
||||
if (javasecuritydebugoriginalsettings!=null)
|
||||
System.setProperty("java.security.debug",javasecuritydebugoriginalsettings);
|
||||
|
||||
//Remove end user certificate
|
||||
intermediateCerts.remove(end_user_auth_cert);
|
||||
|
||||
return null;
|
||||
}
|
||||
|
||||
/**
|
||||
* Add setting JVM system properties for helping debugging CertPathBuilder
|
||||
* only if the trace log level is enabled.
|
||||
*
|
||||
* @return the original value of system property java.security.debug
|
||||
*/
|
||||
private String setJVMDebuggingForCertPathBuilder() {
|
||||
|
||||
String origjvmsecdebprop = null;
|
||||
if ( log.isEnabled(Level.TRACE) ) {
|
||||
origjvmsecdebprop = System.getProperty("java.security.debug");
|
||||
if (origjvmsecdebprop.indexOf("certpath") == -1) {
|
||||
if (origjvmsecdebprop.length() == 0)
|
||||
System.setProperty("java.security.debug","certpath");
|
||||
else
|
||||
System.setProperty("java.security.debug",origjvmsecdebprop + ",certpath");
|
||||
}
|
||||
|
||||
}
|
||||
return origjvmsecdebprop;
|
||||
|
||||
}
|
||||
|
||||
public X509Certificate[] convertCertPathtoX509CertArray( CertPath certPath ) {
|
||||
|
||||
X509Certificate[] x509certchain = null;
|
||||
|
||||
if (certPath!=null) {
|
||||
List<X509Certificate> trustedX509Chain = new ArrayList<X509Certificate>();
|
||||
for (Certificate certificate : certPath.getCertificates() )
|
||||
if ( certificate instanceof X509Certificate )
|
||||
trustedX509Chain.add((X509Certificate)certificate);
|
||||
x509certchain = trustedX509Chain.toArray(new X509Certificate[0]);
|
||||
}
|
||||
|
||||
return x509certchain;
|
||||
|
||||
}
|
||||
|
||||
public boolean loadKeycloakTrustStore(KeycloakSession kcsession) {
|
||||
|
||||
boolean isTSLoaded = false;
|
||||
KeycloakSessionFactory factory = kcsession.getKeycloakSessionFactory();
|
||||
TruststoreProviderFactory truststoreFactory = (TruststoreProviderFactory) factory.getProviderFactory(TruststoreProvider.class, "file");
|
||||
|
||||
TruststoreProvider provider = truststoreFactory.create(kcsession);
|
||||
if ( ! (provider != null && provider.getTruststore() == null ) ) {
|
||||
truststore = provider.getTruststore();
|
||||
readTruststore();
|
||||
|
||||
isTSLoaded = true;
|
||||
}
|
||||
|
||||
return isTSLoaded;
|
||||
}
|
||||
|
||||
/**
|
||||
* Get all certificates from Keycloak Truststore, and classify them in two lists : root CAs and intermediates CAs
|
||||
*/
|
||||
private void readTruststore() {
|
||||
|
||||
//Reading truststore aliases & certificates
|
||||
Enumeration enumeration;
|
||||
trustedRootCerts = new HashSet<X509Certificate>();
|
||||
intermediateCerts = new HashSet<X509Certificate>();
|
||||
try {
|
||||
|
||||
enumeration = truststore.aliases();
|
||||
|
||||
while(enumeration.hasMoreElements()) {
|
||||
|
||||
String alias = (String)enumeration.nextElement();
|
||||
Certificate certificate = truststore.getCertificate(alias);
|
||||
|
||||
if (certificate instanceof X509Certificate) {
|
||||
X509Certificate cax509cert = (X509Certificate) certificate;
|
||||
if (isSelfSigned(cax509cert)) {
|
||||
trustedRootCerts.add(cax509cert);
|
||||
log.debug("Adding certificate from trustore as trsusted root CA (alias : "+alias + " | Subject DN : " + ((X509Certificate) certificate).getSubjectDN() +")");
|
||||
} else {
|
||||
intermediateCerts.add(cax509cert);
|
||||
log.debug("Adding certificate from trustore as intermediate CA (alias : "+alias + " | Subject DN : " + ((X509Certificate) certificate).getSubjectDN() +")");
|
||||
}
|
||||
} else
|
||||
log.warn("Skipping certificate in "+ alias + " because it's not an X509Certificate");
|
||||
|
||||
}
|
||||
} catch (KeyStoreException e) {
|
||||
log.error("Error while reading Keycloak truststore "+e.getMessage(),e);
|
||||
} catch (CertificateException e) {
|
||||
log.error("Error while reading Keycloak truststore "+e.getMessage(),e);
|
||||
} catch (NoSuchAlgorithmException e) {
|
||||
log.error("Error while reading Keycloak truststore "+e.getMessage(),e);
|
||||
} catch (NoSuchProviderException e) {
|
||||
log.error("Error while reading Keycloak truststore "+e.getMessage(),e);
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Checks whether given X.509 certificate is self-signed.
|
||||
*/
|
||||
public boolean isSelfSigned(X509Certificate cert)
|
||||
throws CertificateException, NoSuchAlgorithmException,
|
||||
NoSuchProviderException {
|
||||
try {
|
||||
// Try to verify certificate signature with its own public key
|
||||
PublicKey key = cert.getPublicKey();
|
||||
cert.verify(key);
|
||||
log.trace("certificate " + cert.getSubjectDN() + " detected as root CA");
|
||||
return true;
|
||||
} catch (SignatureException sigEx) {
|
||||
// Invalid signature --> not self-signed
|
||||
log.trace("certificate have a bad signature : " + sigEx.getMessage(),sigEx);
|
||||
} catch (InvalidKeyException keyEx) {
|
||||
// Invalid key --> not self-signed
|
||||
log.trace("certificate " + cert.getSubjectDN() + " detected as intermediate CA");
|
||||
}
|
||||
return false;
|
||||
}
|
||||
|
||||
}
|
||||
|
|
@ -0,0 +1,42 @@
|
|||
package org.keycloak.services.x509;
|
||||
/*
|
||||
* Copyright 2017 Analytical Graphics, Inc. and/or its affiliates
|
||||
* and other contributors as indicated by the @author tags.
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
*/
|
||||
|
||||
import org.keycloak.models.KeycloakSession;
|
||||
|
||||
/**
|
||||
* @author <a href="mailto:arnault.michel@toad-consulting.com">Arnault MICHEL</a>
|
||||
* @version $Revision: 1 $
|
||||
* @since 10/09/2018
|
||||
*/
|
||||
|
||||
public class NginxProxySslClientCertificateLookupFactory extends AbstractClientCertificateFromHttpHeadersLookupFactory {
|
||||
|
||||
private final static String PROVIDER = "nginx";
|
||||
|
||||
@Override
|
||||
public X509ClientCertificateLookup create(KeycloakSession session) {
|
||||
return new NginxProxySslClientCertificateLookup(sslClientCertHttpHeader,
|
||||
sslChainHttpHeaderPrefix, certificateChainLength, session);
|
||||
}
|
||||
|
||||
@Override
|
||||
public String getId() {
|
||||
return PROVIDER;
|
||||
}
|
||||
}
|
||||
|
|
@ -19,3 +19,4 @@
|
|||
org.keycloak.services.x509.DefaultClientCertificateLookupFactory
|
||||
org.keycloak.services.x509.HaProxySslClientCertificateLookupFactory
|
||||
org.keycloak.services.x509.ApacheProxySslClientCertificateLookupFactory
|
||||
org.keycloak.services.x509.NginxProxySslClientCertificateLookupFactory
|
||||
|
|
|
|||
|
|
@ -174,6 +174,12 @@
|
|||
"sslClientCert": "x-ssl-client-cert",
|
||||
"sslCertChainPrefix": "x-ssl-client-cert-chain",
|
||||
"certificateChainLength": 1
|
||||
},
|
||||
"nginx": {
|
||||
"enabled": true,
|
||||
"sslClientCert": "x-ssl-client-cert",
|
||||
"sslCertChainPrefix": "x-ssl-client-cert-chain",
|
||||
"certificateChainLength": 1
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
|
|||
Loading…
Reference in a new issue