Repository navigation
SAML client certificates expiration check #9363
Replies: 1 comment
|
The first question is if this feature should be part of IdP. It is definitely nice to have for IdP admins, but it is not necessary feature for IdP. As an IdP admin I would like to have more checks for used SAML cert, not only expiration. Maybe also used key/cert length, e. g. I want to use only certs with 2048 bit key size (yes, 1024 bit is secure now, but it there can brute force power to break them at some point in the future). So I would implement it as cert quality check (expiration time will be just one subcheck from many cert quality checks). Email notification is also very old school. Better is to have event only and then admin can process it in own way (email notification, slack notification, ticketing system,...) Will it possible to implement this cert quality checks as user SPI modul and result will be in the client console (e. g. new column with last quality check output)? Maybe https://www.keycloak.org/docs/latest/server_development/#_extensions_jpa? |
Uh oh!
There was an error while loading. Please reload this page.
Hello,
I would like to check on each realm if there are SAML clients and for each of them I would like to check if the certificate is valid or not.
If its not valid or about to expire, I would like to send a notification by email and / or display a new event on the admin console (I don't know if it's a good use case or not).
I sent a post on Keycloak discourse group and someone told me this feature does not exist.
I used Admin REST API to do this and it works fine. But I think it would be interesting to add this feature on Keycloak admin console ... or I can do by myself but I don’t know exactly how to do this properly - if you have any resources I can read to start this feature, please tell me
Thanks for your help
Best regards
Sylvain
All reactions