X509 Auth via NginxProxySslClientCertificateLookup #14556

isrjo · 2022-09-23T07:16:35Z

isrjo
Sep 23, 2022

Greetings.
I'm trying to get an x509-auth to work where the clientcertificate is passed backward to keycloak from my nginx proxy-server.
I belive I have done everything according to the documentation and still I can't get it working.

Keycloak is unable to match the incoming client-certificate against my truststore

2022-09-23 06:14:29,512 DEBUG [org.keycloak.services.x509.NginxProxySslClientCertificateLookup] (executor-thread-0)  Loading Keycloak truststore ...
2022-09-23 06:14:29,512 DEBUG [org.keycloak.services.x509.NginxProxySslClientCertificateLookup] (executor-thread-0) Keycloak truststore loaded for NGINX x509cert-lookup provider.
2022-09-23 06:14:29,520 DEBUG [org.keycloak.services.x509.AbstractClientCertificateFromHttpHeadersLookup] (executor-thread-0) Found a valid x.509 certificate in "SSL-CLIENT-CERT" HTTP header
2022-09-23 06:14:29,525 DEBUG [org.keycloak.services.x509.NginxProxySslClientCertificateLookup] (executor-thread-0) End user certificate found : Subject DN=[CN=isrjo,GIVENNAME=Jonas,SURNAME=Israelsson,OU=HQ,O=Elementary AB]  SerialNumber=[1436973074]
2022-09-23 06:14:29,546 WARN  [org.keycloak.services.x509.NginxProxySslClientCertificateLookup] (executor-thread-0) No issuer certificate for certificate in certification path found.
2022-09-23 06:14:29,546 INFO  [org.keycloak.services.x509.NginxProxySslClientCertificateLookup] (executor-thread-0) Impossible to rebuild end user cert chain : client certificate authentication will fail.
2022-09-23 06:14:29,546 WARN  [org.keycloak.services] (executor-thread-0) [X509ClientCertificateAuthenticator:authenticate] x509 Client Certificate Authentication configuration is not available.

I have doubblechecked the chain

$ cat ../Downloads/ElementaryUserCertificationAuthority.pem > chain.pem 
$ cat ../Downloads/ElementaryRootCertificationAuthority.pem >> chain.pem 
isrjo@apan:~/cert> openssl verify -CAfile chain.pem isrjo.pem                             
isrjo.pem: OK

I have doubblechecked the content of my truststore

$ openssl x509 -in ../Downloads/ElementaryRootCertificationAuthority.pem -fingerprint -sha256
SHA256 Fingerprint=2C:DB:4B:74:E3:07:32:16:8A:73:7F:99:23:D8:5E:7A:99:81:B0:6D:11:C0:EB:52:7F:0F:44:BA:33:4D:3F:B5

$ openssl x509 -in ../Downloads/ElementaryUserCertificationAuthority.pem -fingerprint -sha256
SHA256 Fingerprint=38:33:F7:DB:34:46:5B:8A:E1:00:2D:A1:54:88:08:CB:65:C0:8E:09:D7:F1:CB:11:B9:E3:56:69:6D:E4:19:8F

$ keytool -list -keystore truststore.jks
rootca, 23 Sep 2022, trustedCertEntry, 
Certificate fingerprint (SHA-256): 2C:DB:4B:74:E3:07:32:16:8A:73:7F:99:23:D8:5E:7A:99:81:B0:6D:11:C0:EB:52:7F:0F:44:BA:33:4D:3F:B5
userca, 23 Sep 2022, trustedCertEntry, 
Certificate fingerprint (SHA-256): 38:33:F7:DB:34:46:5B:8A:E1:00:2D:A1:54:88:08:CB:65:C0:8E:09:D7:F1:CB:11:B9:E3:56:69:6D:E4:19:8F

I have veryfied keycloak does load the truststore

2022-09-23 06:10:32,472 DEBUG [org.keycloak.truststore.FileTruststoreProviderFactory] (main) Trusted root CA found in trustore : alias : rootca | Subject DN : CN=Elementary Root Certification Authority, O=Elementary, C=SE
2022-09-23 06:10:32,478 DEBUG [org.keycloak.truststore.FileTruststoreProviderFactory] (main) Intermediate CA found in trustore : alias : userca | Subject DN : CN=Elementary User Certification Authority

And yet it fails to match.

Running image quay.io/keycloak/keycloak:19.0.2 in Kubernetes with the following startargs

      containers:
        - name: keycloak
          args: [
           "start",
           "--hostname-strict=false",
           "--spi-x509cert-lookup-provider=nginx",
           "--spi-x509cert-lookup-nginx-ssl-client-cert=SSL-CLIENT-CERT",
           "--spi-truststore-file-file=/truststore/truststore.jks",
           "--spi-truststore-file-password=xxxxxxx",
           "--spi-truststore-file-hostname-verification-policy=ANY",
           "--log-level=DEBUG"
          ]

in this environement

      containers:
      - name: keycloak
        env:
          - name: KC_DB
            value: "mariadb"
          - name: KC_DB_URL
            value: "jdbc:mysql://db01/keycloak_stage"
          - name: KC_DB_USERNAME
            value: "kstageUser"
          - name: KC_DB_PASSWORD
            value: "xxxxx"
          - name: KEYCLOAK_ADMIN
            value: "admin"
          - name: KEYCLOAK_ADMIN_PASSWORD
            value: "xxxxx"
          - name: KC_HTTPS_CERTIFICATE_FILE
            value: "/tls/tls.crt"
          - name: KC_HTTPS_CERTIFICATE_KEY_FILE
            value: "/tls/tls.key"
          - name: KC_HTTP_ENABLED
            value: "true"
          - name: KC_PROXY
            value: "reencrypt"

Anyone see what I am missing ?

Navigation Menu

Repository navigation

X509 Auth via NginxProxySslClientCertificateLookup #14556

Uh oh!

{{title}}

Uh oh!

Replies: 0 comments

Select a reply

Uh oh!

X509 Auth via NginxProxySslClientCertificateLookup #14556

Uh oh!

isrjo Sep 23, 2022

Replies: 0 comments

isrjo
Sep 23, 2022