How to validate Keycloak webhook request? #16102

shpindler · 2022-12-20T12:49:45Z

shpindler
Dec 20, 2022

I've already asked this on StackOverflow, but maybe here it'll be more noticable.

I'm implementing an endpoint to receive events from Keycloak using a webhook, but I don't know how to validate this request.

I see that the request contains a header "X-Keycloak-Signature". Also, I set a WEBHOOK_SECRET. It seems I somehow need to generate this signature from the request and the secret and then compare them. So it looks like this:

import os
import hashlib

from flask import abort, request


def validate_keycloak_signature(f):

    def wrapper(self, *args, **kwargs):
        secret = os.getenv("WEBHOOK_SECRET")
        method = request.method
        uri = request.url
        body = request.get_data(as_text=True)
        smub = secret + method + uri + body
        h = hashlib.sha256(smub.encode("utf-8")).hexdigest()
        signature = request.headers.get("X-Keycloak-Signature")
        if h != signature:
            return abort(403)
        return f(self, *args, **kwargs)
    
    return wrapper

However, I don't know the algorithm. Here, I tried this one:

Create a string that concatenates together the following: Client secret + http method + URI + request body (if present)
Create a SHA-256 hash of the resulting string.
Compare the hash value to the signature. If they're equal then this request has passed validation.

But it doesn't work. Does anybody has any ideas?

Answered by shpindler

Dec 21, 2022

I realized that this signature is generated not by Keycloak itself, but by Phasetwo which provides a webhook plugin for me.

So that I just looked into its code and found out the algorithm.

That is how to generate signature to validate it:

def validate_keycloak_signature(f):
    ...
        secret = os.getenv("WEBHOOK_SECRET")
        body = request.data
        control_signature = hmac.new(
            key=bytes(secret, "utf-8"),
            msg=body,
            digestmod=hashlib.sha256
        ).hexdigest()
    ...

View full answer

shpindler · 2022-12-21T08:02:53Z

shpindler
Dec 21, 2022
Author

I realized that this signature is generated not by Keycloak itself, but by Phasetwo which provides a webhook plugin for me.

So that I just looked into its code and found out the algorithm.

That is how to generate signature to validate it:

def validate_keycloak_signature(f):
    ...
        secret = os.getenv("WEBHOOK_SECRET")
        body = request.data
        control_signature = hmac.new(
            key=bytes(secret, "utf-8"),
            msg=body,
            digestmod=hashlib.sha256
        ).hexdigest()
    ...

0 replies

Navigation Menu

Repository navigation

How to validate Keycloak webhook request? #16102

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Replies: 1 comment

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

How to validate Keycloak webhook request? #16102

Uh oh!

Uh oh!

shpindler Dec 20, 2022

Replies: 1 comment

Uh oh!

shpindler Dec 21, 2022 Author

shpindler
Dec 20, 2022

shpindler
Dec 21, 2022
Author