Repository navigation
Replies: 2 comments 4 replies
|
I would like to fix this vulnerability by making it impossible for rogue servers to access a Keycloak server API without the server knowing who they are. I propose an x509 bind relationship between server and clients. |
|
Please read the security guide on reporting issues - https://github.com/keycloak/keycloak#reporting-security-vulnerabilities. I do not think I have met the concept of a private realm until now. Where is it described in the documentation? |
|
Hi Darian, Are you saying you have no idea on public and confidential realm? |
|
Do you mean public or confidential clients? The realm is basically the abstraction of an organization, where you define various client services, user federation, authentication flows, and so on. I do not think there is a concept of public or confidential realms. Please note that I am just a user, so some details may be unknown to me too. However, even if this is the case, someone more knowledgeable may be able to help if you provide some more details. I do not understand your scenario - how would you configure the Keycloak service and client, and what would the steps the client would take in order to take advantage of the issue you have described? What do you mean by |
Hi Darius, |
|
Hi Darius, Sorry for taking a awhile to respond. And thank you for your interest. |
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Hi,
I found a problem with the Keycloak while doing a unit in cyber security at Deakin University.
Private Realms are not accessible without the secret. Yet a problem exist when an application access a realm by pure frontend access - JavaScript, that allows a malicious redirect.
A 403 is thrown on a backend application but not for frontend.
The issue is deeper than just a wildcard issue. It is hard to believe how only one ip address per realm would meet all use cases.
I would like to fix frontend application access to keycloak by making it impossible for applications to use the API without the Keycloak server knowing who they are. I propose a x509 relationship bind between server and client.
All reactions