libre.sh/keycloak-scim
3
0
Fork 0
Code Issues 15 Pull requests Releases Packages Activity Actions

KEYCLOAK-17895 SecureSigningAlgorithmEnforceExecutor: Ability to auto-configure default algorithm

Browse source
This commit is contained in:
Takashi Norimatsu 2021-05-05 12:08:10 +09:00 committed by Marek Posolda
parent faab3183e0
commit b38b1eb782
4 changed files with 173 additions and 21 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

88
services/src/main/java/org/keycloak/services/clientpolicy/executor/SecureSigningAlgorithmEnforceExecutor.java
View file

@ -18,7 +18,10 @@
package org.keycloak.services.clientpolicy.executor;
import java.util.Arrays;
import java.util.HashMap;
import java.util.List;
import java.util.Map;
import java.util.Optional;
import org.jboss.logging.Logger;
@ -34,14 +37,18 @@ import org.keycloak.services.clientpolicy.context.AdminClientUpdateContext;
import org.keycloak.services.clientpolicy.context.DynamicClientRegisterContext;
import org.keycloak.services.clientpolicy.context.DynamicClientUpdateContext;
import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
import com.fasterxml.jackson.annotation.JsonProperty;
/**
* @author <a href="mailto:takashi.norimatsu.ws@hitachi.com">Takashi Norimatsu</a>
*/
public class SecureSigningAlgorithmEnforceExecutor implements ClientPolicyExecutorProvider<ClientPolicyExecutorConfiguration> {
public class SecureSigningAlgorithmEnforceExecutor implements ClientPolicyExecutorProvider<SecureSigningAlgorithmEnforceExecutor.Configuration> {
private static final Logger logger = Logger.getLogger(SecureSigningAlgorithmEnforceExecutor.class);
private final KeycloakSession session;
private Configuration configuration;
private static final List<String> sigTargets = Arrays.asList(
OIDCConfigAttributes.USER_INFO_RESPONSE_SIGNATURE_ALG,
@ -52,6 +59,8 @@ public class SecureSigningAlgorithmEnforceExecutor implements ClientPolicyExecut
private static final List<String> sigTargetsAdminRestApiOnly = Arrays.asList(
OIDCConfigAttributes.ACCESS_TOKEN_SIGNED_RESPONSE_ALG);
private static final String DEFAULT_ALGORITHM_VALUE = Algorithm.PS256;
public SecureSigningAlgorithmEnforceExecutor(KeycloakSession session) {
this.session = session;
}
@ -61,23 +70,53 @@ public class SecureSigningAlgorithmEnforceExecutor implements ClientPolicyExecut
return SecureSigningAlgorithmEnforceExecutorFactory.PROVIDER_ID;
}
@Override
public void setupConfiguration(SecureSigningAlgorithmEnforceExecutor.Configuration config) {
this.configuration = Optional.ofNullable(config).orElse(createDefaultConfiguration());
if (config.getDefaultAlgorithm() == null || !isSecureAlgorithm(config.getDefaultAlgorithm())) config.setDefaultAlgorithm(DEFAULT_ALGORITHM_VALUE);
}
@Override
public Class<Configuration> getExecutorConfigurationClass() {
return Configuration.class;
}
@JsonIgnoreProperties(ignoreUnknown = true)
public static class Configuration extends ClientPolicyExecutorConfiguration {
@JsonProperty("default-algorithm")
protected String defaultAlgorithm;
public String getDefaultAlgorithm() {
return defaultAlgorithm;
}
public void setDefaultAlgorithm(String defaultAlgorithm) {
if (isSecureAlgorithm(defaultAlgorithm)) {
this.defaultAlgorithm = defaultAlgorithm;
} else {
logger.tracev("defaultAlgorithm = {0}, fall back to {1}.", defaultAlgorithm, DEFAULT_ALGORITHM_VALUE);
this.defaultAlgorithm = DEFAULT_ALGORITHM_VALUE;
}
}
}
@Override
public void executeOnEvent(ClientPolicyContext context) throws ClientPolicyException {
switch (context.getEvent()) {
case REGISTER:
if (context instanceof AdminClientRegisterContext) {
verifySecureSigningAlgorithm(((AdminClientRegisterContext)context).getProposedClientRepresentation(), true, false);
verifyAndEnforceSecureSigningAlgorithm(((AdminClientRegisterContext)context).getProposedClientRepresentation(), true, false);
} else if (context instanceof DynamicClientRegisterContext) {
verifySecureSigningAlgorithm(((DynamicClientRegisterContext)context).getProposedClientRepresentation(), false, false);
verifyAndEnforceSecureSigningAlgorithm(((DynamicClientRegisterContext)context).getProposedClientRepresentation(), false, false);
} else {
throw new ClientPolicyException(OAuthErrorException.INVALID_REQUEST, "not allowed input format.");
}
break;
case UPDATE:
if (context instanceof AdminClientUpdateContext) {
verifySecureSigningAlgorithm(((AdminClientUpdateContext)context).getProposedClientRepresentation(), true, true);
verifyAndEnforceSecureSigningAlgorithm(((AdminClientUpdateContext)context).getProposedClientRepresentation(), true, true);
} else if (context instanceof DynamicClientUpdateContext) {
verifySecureSigningAlgorithm(((DynamicClientUpdateContext)context).getProposedClientRepresentation(), false, true);
verifyAndEnforceSecureSigningAlgorithm(((DynamicClientUpdateContext)context).getProposedClientRepresentation(), false, true);
} else {
throw new ClientPolicyException(OAuthErrorException.INVALID_REQUEST, "not allowed input format.");
}
@ -87,28 +126,45 @@ public class SecureSigningAlgorithmEnforceExecutor implements ClientPolicyExecut
}
}
private void verifySecureSigningAlgorithm(ClientRepresentation clientRep, boolean byAdminRestApi, boolean isUpdate) throws ClientPolicyException {
if (clientRep.getAttributes() == null) {
throw new ClientPolicyException(OAuthErrorException.INVALID_REQUEST, "no signature algorithm was specified.");
}
private Configuration createDefaultConfiguration() {
Configuration conf = new Configuration();
conf.setDefaultAlgorithm(DEFAULT_ALGORITHM_VALUE);
return conf;
}
private void verifyAndEnforceSecureSigningAlgorithm(ClientRepresentation clientRep, boolean byAdminRestApi, boolean isUpdate) throws ClientPolicyException {
for (String sigTarget : sigTargets) {
verifySecureSigningAlgorithm(sigTarget, clientRep.getAttributes().get(sigTarget));
verifyAndEnforceSecureSigningAlgorithm(sigTarget, clientRep);
}
// no client metadata found in RFC 7591 OAuth Dynamic Client Registration Metadata
if (byAdminRestApi) {
for (String sigTarget : sigTargetsAdminRestApiOnly) {
verifySecureSigningAlgorithm(sigTarget, clientRep.getAttributes().get(sigTarget));
verifyAndEnforceSecureSigningAlgorithm(sigTarget, clientRep);
}
}
}
private void verifySecureSigningAlgorithm(String sigTarget, String sigAlg) throws ClientPolicyException {
private void verifyAndEnforceSecureSigningAlgorithm(String sigTarget, ClientRepresentation clientRep) throws ClientPolicyException {
Map<String, String> attributes = Optional.ofNullable(clientRep.getAttributes()).orElse(new HashMap<>());
String sigAlg = attributes.get(sigTarget);
if (sigAlg == null) {
logger.tracev("Signing algorithm not specified explicitly. signature target = {0}", sigTarget);
logger.tracev("Signing algorithm not specified explicitly, signature target = {0}. set default algorithm = {1}.", sigTarget, configuration.getDefaultAlgorithm());
attributes.put(sigTarget, configuration.getDefaultAlgorithm());
clientRep.setAttributes(attributes);
return;
}
if (isSecureAlgorithm(sigAlg)) {
logger.tracev("Passed. signature target = {0}, signature algorithm = {1}", sigTarget, sigAlg);
return;
}
logger.tracev("NOT allowed signatureAlgorithm. signature target = {0}, signature algorithm = {1}", sigTarget, sigAlg);
throw new ClientPolicyException(OAuthErrorException.INVALID_REQUEST, "not allowed signature algorithm.");
}
private static boolean isSecureAlgorithm(String sigAlg) {
switch (sigAlg) {
case Algorithm.PS256:
case Algorithm.PS384:
@ -116,11 +172,9 @@ public class SecureSigningAlgorithmEnforceExecutor implements ClientPolicyExecut
case Algorithm.ES256:
case Algorithm.ES384:
case Algorithm.ES512:
logger.tracev("Passed. signature target = {0}, signature algorithm = {1}", sigTarget, sigAlg);
return;
return true;
}
logger.tracev("NOT allowed signatureAlgorithm. signature target = {0}, signature algorithm = {1}", sigTarget, sigAlg);
throw new ClientPolicyException(OAuthErrorException.INVALID_REQUEST, "not allowed signature algorithm.");
return false;
}
}

11
services/src/main/java/org/keycloak/services/clientpolicy/executor/SecureSigningAlgorithmEnforceExecutorFactory.java
View file

@ -17,10 +17,12 @@
package org.keycloak.services.clientpolicy.executor;
import java.util.Collections;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.List;
import org.keycloak.Config.Scope;
import org.keycloak.crypto.Algorithm;
import org.keycloak.models.KeycloakSession;
import org.keycloak.models.KeycloakSessionFactory;
import org.keycloak.provider.ProviderConfigProperty;
@ -32,6 +34,11 @@ public class SecureSigningAlgorithmEnforceExecutorFactory implements ClientPolic
public static final String PROVIDER_ID = "securesignalg-enforce-executor";
public static final String DEFAULT_ALGORITHM = "default-algorithm";
private static final ProviderConfigProperty DEFAULT_ALGORITHM_PROPERTY = new ProviderConfigProperty(
DEFAULT_ALGORITHM, null, null, ProviderConfigProperty.STRING_TYPE, Algorithm.PS256);
@Override
public ClientPolicyExecutorProvider create(KeycloakSession session) {
return new SecureSigningAlgorithmEnforceExecutor(session);
@ -61,7 +68,7 @@ public class SecureSigningAlgorithmEnforceExecutorFactory implements ClientPolic
@Override
public List<ProviderConfigProperty> getConfigProperties() {
return Collections.emptyList();
return new ArrayList<>(Arrays.asList(DEFAULT_ALGORITHM_PROPERTY));
}
}

14
testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/AbstractClientPoliciesTest.java
View file

@ -127,6 +127,7 @@ import org.keycloak.services.clientpolicy.executor.SecureRequestObjectExecutor;
import org.keycloak.services.clientpolicy.executor.SecureRequestObjectExecutorFactory;
import org.keycloak.services.clientpolicy.executor.SecureResponseTypeExecutorFactory;
import org.keycloak.services.clientpolicy.executor.SecureSessionEnforceExecutorFactory;
import org.keycloak.services.clientpolicy.executor.SecureSigningAlgorithmEnforceExecutor;
import org.keycloak.services.clientpolicy.executor.SecureSigningAlgorithmEnforceExecutorFactory;
import org.keycloak.services.clientpolicy.executor.SecureSigningAlgorithmForSignedJwtEnforceExecutor;
import org.keycloak.services.clientpolicy.executor.SecureSigningAlgorithmForSignedJwtEnforceExecutorFactory;
@ -685,6 +686,13 @@ public abstract class AbstractClientPoliciesTest extends AbstractKeycloakTest {
// Registration/Initial Access Token acquisition for Dynamic Client Registration
protected void restartAuthenticatedClientRegistrationSetting() throws ClientRegistrationException {
reg.close();
reg = ClientRegistration.create().url(suiteContext.getAuthServerInfo().getContextRoot() + "/auth", REALM_NAME).build();
ClientInitialAccessPresentation token = adminClient.realm(REALM_NAME).clientInitialAccess().create(new ClientInitialAccessCreatePresentation(0, 10));
reg.auth(Auth.token(token));
}
protected void authCreateClients() {
reg.auth(Auth.token(getToken("create-clients", "password")));
}
@ -873,6 +881,12 @@ public abstract class AbstractClientPoliciesTest extends AbstractKeycloakTest {
return config;
}
protected Object createSecureSigningAlgorithmEnforceExecutorConfig(String defaultAlgorithm) {
SecureSigningAlgorithmEnforceExecutor.Configuration config = new SecureSigningAlgorithmEnforceExecutor.Configuration();
config.setDefaultAlgorithm(defaultAlgorithm);
return config;
}
// Client Policies CRUD Operation
protected static class ClientPoliciesBuilder {

81
testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/ClientPoliciesTest.java
View file

@ -50,6 +50,8 @@ import org.keycloak.authentication.authenticators.client.ClientIdAndSecretAuthen
import org.keycloak.authentication.authenticators.client.JWTClientAuthenticator;
import org.keycloak.authentication.authenticators.client.JWTClientSecretAuthenticator;
import org.keycloak.authentication.authenticators.client.X509ClientAuthenticator;
import org.keycloak.client.registration.Auth;
import org.keycloak.client.registration.ClientRegistration;
import org.keycloak.client.registration.ClientRegistrationException;
import org.keycloak.common.Profile;
import org.keycloak.events.Details;
@ -65,6 +67,8 @@ import org.keycloak.protocol.oidc.OIDCLoginProtocol;
import org.keycloak.protocol.oidc.utils.OIDCResponseType;
import org.keycloak.representations.AccessToken;
import org.keycloak.representations.RefreshToken;
import org.keycloak.representations.idm.ClientInitialAccessCreatePresentation;
import org.keycloak.representations.idm.ClientInitialAccessPresentation;
import org.keycloak.representations.idm.ClientRepresentation;
import org.keycloak.representations.idm.CredentialRepresentation;
import org.keycloak.representations.idm.EventRepresentation;
@ -1118,7 +1122,6 @@ public class ClientPoliciesTest extends AbstractClientPoliciesTest {
).toString();
updatePolicies(json);
// create by Admin REST API - fail
try {
createClientByAdmin(generateSuffixedName("App-by-Admin"), (ClientRepresentation clientRep) -> {
@ -1141,6 +1144,16 @@ public class ClientPoliciesTest extends AbstractClientPoliciesTest {
clientRep.getAttributes().put(OIDCConfigAttributes.ACCESS_TOKEN_SIGNED_RESPONSE_ALG, org.keycloak.crypto.Algorithm.ES256);
});
// create by Admin REST API - success, PS256 enforced
String cAppAdmin2Id = createClientByAdmin(generateSuffixedName("App-by-Admin2"), (ClientRepresentation client2Rep) -> {
});
ClientRepresentation cRep2 = getClientByAdmin(cAppAdmin2Id);
assertEquals(org.keycloak.crypto.Algorithm.PS256, cRep2.getAttributes().get(OIDCConfigAttributes.USER_INFO_RESPONSE_SIGNATURE_ALG));
assertEquals(org.keycloak.crypto.Algorithm.PS256, cRep2.getAttributes().get(OIDCConfigAttributes.REQUEST_OBJECT_SIGNATURE_ALG));
assertEquals(org.keycloak.crypto.Algorithm.PS256, cRep2.getAttributes().get(OIDCConfigAttributes.ID_TOKEN_SIGNED_RESPONSE_ALG));
assertEquals(org.keycloak.crypto.Algorithm.PS256, cRep2.getAttributes().get(OIDCConfigAttributes.TOKEN_ENDPOINT_AUTH_SIGNING_ALG));
assertEquals(org.keycloak.crypto.Algorithm.PS256, cRep2.getAttributes().get(OIDCConfigAttributes.ACCESS_TOKEN_SIGNED_RESPONSE_ALG));
// update by Admin REST API - fail
try {
updateClientByAdmin(cAppAdminId, (ClientRepresentation clientRep) -> {
@ -1161,6 +1174,39 @@ public class ClientPoliciesTest extends AbstractClientPoliciesTest {
cRep = getClientByAdmin(cAppAdminId);
assertEquals(org.keycloak.crypto.Algorithm.PS384, cRep.getAttributes().get(OIDCConfigAttributes.ACCESS_TOKEN_SIGNED_RESPONSE_ALG));
// update profiles, ES256 enforced
json = (new ClientProfilesBuilder()).addProfile(
(new ClientProfileBuilder()).createProfile(PROFILE_NAME, "Den Forsta Profilen", Boolean.FALSE, null)
.addExecutor(SecureSigningAlgorithmEnforceExecutorFactory.PROVIDER_ID,
createSecureSigningAlgorithmEnforceExecutorConfig(org.keycloak.crypto.Algorithm.ES256))
.toRepresentation()
).toString();
updateProfiles(json);
// update by Admin REST API - success
updateClientByAdmin(cAppAdmin2Id, (ClientRepresentation client2Rep) -> {
client2Rep.getAttributes().remove(OIDCConfigAttributes.USER_INFO_RESPONSE_SIGNATURE_ALG);
client2Rep.getAttributes().remove(OIDCConfigAttributes.REQUEST_OBJECT_SIGNATURE_ALG);
client2Rep.getAttributes().remove(OIDCConfigAttributes.ID_TOKEN_SIGNED_RESPONSE_ALG);
client2Rep.getAttributes().remove(OIDCConfigAttributes.TOKEN_ENDPOINT_AUTH_SIGNING_ALG);
client2Rep.getAttributes().remove(OIDCConfigAttributes.ACCESS_TOKEN_SIGNED_RESPONSE_ALG);
});
cRep2 = getClientByAdmin(cAppAdmin2Id);
assertEquals(org.keycloak.crypto.Algorithm.ES256, cRep2.getAttributes().get(OIDCConfigAttributes.USER_INFO_RESPONSE_SIGNATURE_ALG));
assertEquals(org.keycloak.crypto.Algorithm.ES256, cRep2.getAttributes().get(OIDCConfigAttributes.REQUEST_OBJECT_SIGNATURE_ALG));
assertEquals(org.keycloak.crypto.Algorithm.ES256, cRep2.getAttributes().get(OIDCConfigAttributes.ID_TOKEN_SIGNED_RESPONSE_ALG));
assertEquals(org.keycloak.crypto.Algorithm.ES256, cRep2.getAttributes().get(OIDCConfigAttributes.TOKEN_ENDPOINT_AUTH_SIGNING_ALG));
assertEquals(org.keycloak.crypto.Algorithm.ES256, cRep2.getAttributes().get(OIDCConfigAttributes.ACCESS_TOKEN_SIGNED_RESPONSE_ALG));
// update profiles, fall back to PS256
json = (new ClientProfilesBuilder()).addProfile(
(new ClientProfileBuilder()).createProfile(PROFILE_NAME, "Den Forsta Profilen", Boolean.FALSE, null)
.addExecutor(SecureSigningAlgorithmEnforceExecutorFactory.PROVIDER_ID,
createSecureSigningAlgorithmEnforceExecutorConfig(org.keycloak.crypto.Algorithm.RS512))
.toRepresentation()
).toString();
updateProfiles(json);
// create dynamically - fail
try {
createClientByAdmin(generateSuffixedName("App-in-Dynamic"), (ClientRepresentation clientRep) -> {
@ -1181,7 +1227,6 @@ public class ClientPoliciesTest extends AbstractClientPoliciesTest {
clientRep.setTokenEndpointAuthSigningAlg(org.keycloak.crypto.Algorithm.PS256);
});
events.expect(EventType.CLIENT_REGISTER).client(cAppDynamicClientId).user(Matchers.isEmptyOrNullString()).assertEvent();
getClientDynamically(cAppDynamicClientId);
// update dynamically - fail
try {
@ -1199,6 +1244,38 @@ public class ClientPoliciesTest extends AbstractClientPoliciesTest {
clientRep.setIdTokenSignedResponseAlg(org.keycloak.crypto.Algorithm.ES384);
});
assertEquals(org.keycloak.crypto.Algorithm.ES384, getClientDynamically(cAppDynamicClientId).getIdTokenSignedResponseAlg());
// create dynamically - success, PS256 enforced
restartAuthenticatedClientRegistrationSetting();
String cAppDynamicClient2Id = createClientDynamically(generateSuffixedName("App-in-Dynamic"), (OIDCClientRepresentation client2Rep) -> {
});
OIDCClientRepresentation cAppDynamicClient2Rep = getClientDynamically(cAppDynamicClient2Id);
assertEquals(org.keycloak.crypto.Algorithm.PS256, cAppDynamicClient2Rep.getUserinfoSignedResponseAlg());
assertEquals(org.keycloak.crypto.Algorithm.PS256, cAppDynamicClient2Rep.getRequestObjectSigningAlg());
assertEquals(org.keycloak.crypto.Algorithm.PS256, cAppDynamicClient2Rep.getIdTokenSignedResponseAlg());
assertEquals(org.keycloak.crypto.Algorithm.PS256, cAppDynamicClient2Rep.getTokenEndpointAuthSigningAlg());
// update profiles, enforce ES256
json = (new ClientProfilesBuilder()).addProfile(
(new ClientProfileBuilder()).createProfile(PROFILE_NAME, "Den Forsta Profilen", Boolean.FALSE, null)
.addExecutor(SecureSigningAlgorithmEnforceExecutorFactory.PROVIDER_ID,
createSecureSigningAlgorithmEnforceExecutorConfig(org.keycloak.crypto.Algorithm.ES256))
.toRepresentation()
).toString();
updateProfiles(json);
// update dynamically - success, ES256 enforced
updateClientDynamically(cAppDynamicClient2Id, (OIDCClientRepresentation client2Rep) -> {
client2Rep.setUserinfoSignedResponseAlg(null);
client2Rep.setRequestObjectSigningAlg(null);
client2Rep.setIdTokenSignedResponseAlg(null);
client2Rep.setTokenEndpointAuthSigningAlg(null);
});
cAppDynamicClient2Rep = getClientDynamically(cAppDynamicClient2Id);
assertEquals(org.keycloak.crypto.Algorithm.ES256, cAppDynamicClient2Rep.getUserinfoSignedResponseAlg());
assertEquals(org.keycloak.crypto.Algorithm.ES256, cAppDynamicClient2Rep.getRequestObjectSigningAlg());
assertEquals(org.keycloak.crypto.Algorithm.ES256, cAppDynamicClient2Rep.getIdTokenSignedResponseAlg());
assertEquals(org.keycloak.crypto.Algorithm.ES256, cAppDynamicClient2Rep.getTokenEndpointAuthSigningAlg());
}
@Test