Quarkus Keycloak client authentication using x509 #15580

tlann · 2022-11-18T23:53:22Z

tlann
Nov 18, 2022

I have been trying to figure how to get client authentication working using x509 certificates in the Quarkus version of Keycloak. @dasniko has a helpful video of doing it with the legacy version of Keycloak. I tried to follow what he and the Keycloak server admin guide suggests.

The expected behavior, based on @dasniko 's video is a certificate selection window should open up upon visiting the login url. However, only the login screen is displayed.

I have created a simple example in github to demonstrate what I'm attempting. There is a script to generate the certificates and import them into a truststore and keystore jks. The script then copies the jks files to a directory. The compose.yml file mounts the cert directory when starting Keycloak up and points Keycloak to them as a keystore and truststore. Their is also a realm export to configure things.
I have seen reports others have been able to do this. Do any of the symptoms sound familiar? Any suggestions on troubleshooting this?

thomasdarimont · 2022-12-15T00:23:05Z

thomasdarimont
Dec 15, 2022
Collaborator

Hi @tlann did you mange to solve this issue?

2 replies

thomasdarimont Dec 15, 2022
Collaborator

Just got it working with Keycloak 20.0.2:

I used the following options:

      - "--https-client-auth=request"
      - "--https-trust-store-file=/opt/keycloak/conf/truststore.p12"
      - "--https-trust-store-password=changeit"
      - "--https-protocols=TLSv1.2,TLSv1.3"

The truststore.p12 had to contain the rootCA certificate used to sign the client certs ... or the explicit list of client certs that you want to trust explicitly.

Without this, the org.keycloak.authentication.authenticators.x509.AbstractX509ClientCertificateAuthenticator#getCertificateChain always returned null, which leads to the abortion of the X509 authenticator.

The authentication flow looks like this:

The X509 Validate Username Form Authenticator config looks like this:

Login with Cert selection and confirmation

Login with Cert selection and confirmation bypass

tlann Dec 19, 2022
Author

Thank you for checking this out. The differences I see in my example that sticks out to me are https-client-auth=request and my example had require. I also didn't have https-protocols set.
We also were using a jks cert store vs a p12 one.
Thanks again

bikebaba · 2023-01-23T19:05:51Z

bikebaba
Jan 23, 2023

You said this was Keycloak 20.0.2. I'm using the same, but my GUI looks different and I cannot add the x509 flows that I did back in version 15. Anything else I need to do? Any idea?

1 reply

thomasdarimont Jan 23, 2023
Collaborator

I used the old admin-console theme in my example.

tlann · 2023-06-12T23:08:34Z

tlann
Jun 12, 2023
Author

@thomasdarimont I was wondering if you had a little more time to help. Or anyone else available. I would be willing to pay for some time to help with this issue. Whether is be a working example or something else.

As before, the code I am trying to run is here
I finally got time to work on this again and I'm still having the problem where the cert selection window doesn't pop up when I get to that page.

The https_client_auth parameter is set to request as shown. But I used an environment variable to do that as opposed to a command line parameter.

The rootCA cert is also added to the truststore as seen here.

  services:
    keycloak:
      image: quay.io/keycloak/keycloak:20.0.2
      command: [ "start-dev" ]
      environment:
        JAVA_OPTS_APPEND: "-Dcom.redhat.fips=false"
        KC_HOSTNAME_STRICT: "false"
        KEYCLOAK_ADMIN: admin
        KEYCLOAK_ADMIN_PASSWORD: admin
        KC_LOG_LEVEL: info,org.keycloak.authentication:trace
        KC_HTTPS_KEY_STORE_FILE: /genCerts/keystore.jks
        KC_HTTPS_KEY_STORE_PASSWORD: changeit
        KC_HTTPS_TRUST_STORE_FILE: /genCerts/truststore.jks
        KC_SPI_TRUSTSTORE_FILE_FILE: /genCerts/truststore.jks
        KC_SPI_TRUSTSTORE_FILE_PASSWORD: changeit
        KC_HTTPS_TRUST_STORE_PASSWORD: changeit
        KC_SPI_TRUSTSTORE_FILE_HOSTNAME_VERIFICATION_POLICY: ANY
        KC_HTTPS_CLIENT_AUTH: request
        KC_HTTPS_PROTOCOLS: TLSv1.2,TLSv1.3
        KC_FEATURES_DISABLED: admin2
        KC_FEATURES: admin
        KC_SPI_IMPORT_SINGLE_FILE_FILE: x509-realm-export.json
      ports:
        - 8080:8080
        - 8443:8443
      volumes:
        - ./genCerts:/genCerts
        - ./realm:/opt/keycloak/data/import

The x509 browser flow looks like the following

The x509-config Validate Username Form Authenticator config looks like this: looks like

I turned on debugging and get the following log messages when going to the login page . But not when I go to the account page at https://myHost:8443/realms/x509/account/

I have turned logging on for org.keycloak.authentication and I get the following messages only when I got to the username password page.

mtls-2-keycloak-1  | 2023-06-12 21:36:19,730 DEBUG [org.keycloak.authentication.AuthenticationProcessor] (executor-thread-215) AUTHENTICATE
mtls-2-keycloak-1  | 2023-06-12 21:36:19,731 DEBUG [org.keycloak.authentication.AuthenticationProcessor] (executor-thread-215) AUTHENTICATE ONLY
mtls-2-keycloak-1  | 2023-06-12 21:36:19,731 DEBUG [org.keycloak.authentication.DefaultAuthenticationFlow] (executor-thread-215) processFlow: browser x509
mtls-2-keycloak-1  | 2023-06-12 21:36:19,731 DEBUG [org.keycloak.authentication.DefaultAuthenticationFlow] (executor-thread-215) check execution: 'auth-cookie', requirement: 'ALTERNATIVE'
mtls-2-keycloak-1  | 2023-06-12 21:36:19,731 DEBUG [org.keycloak.authentication.DefaultAuthenticationFlow] (executor-thread-215) authenticator: auth-cookie
mtls-2-keycloak-1  | 2023-06-12 21:36:19,731 DEBUG [org.keycloak.authentication.AuthenticationSelectionResolver] (executor-thread-215) Going through the flow 'browser x509' for adding executions
mtls-2-keycloak-1  | 2023-06-12 21:36:19,732 DEBUG [org.keycloak.authentication.AuthenticationSelectionResolver] (executor-thread-215) Going through the flow 'browser x509 forms' for adding executions
mtls-2-keycloak-1  | 2023-06-12 21:36:19,732 DEBUG [org.keycloak.authentication.AuthenticationSelectionResolver] (executor-thread-215) Selections when trying execution 'auth-cookie' : [ authSelection - auth-cookie,  authSelection - auth-x509-client-username-form,  authSelection - auth-username-password-form]
mtls-2-keycloak-1  | 2023-06-12 21:36:19,732 DEBUG [org.keycloak.authentication.DefaultAuthenticationFlow] (executor-thread-215) invoke authenticator.authenticate: auth-cookie
mtls-2-keycloak-1  | 2023-06-12 21:36:19,732 DEBUG [org.keycloak.authentication.DefaultAuthenticationFlow] (executor-thread-215) authenticator ATTEMPTED: auth-cookie
mtls-2-keycloak-1  | 2023-06-12 21:36:19,732 TRACE [org.keycloak.authentication.DefaultAuthenticationFlow] (executor-thread-215) Set execution status: Execution: auth-cookie, status: ATTEMPTED
mtls-2-keycloak-1  | 2023-06-12 21:36:19,732 DEBUG [org.keycloak.authentication.DefaultAuthenticationFlow] (executor-thread-215) check execution: 'auth-x509-client-username-form', requirement: 'ALTERNATIVE'
mtls-2-keycloak-1  | 2023-06-12 21:36:19,732 DEBUG [org.keycloak.authentication.DefaultAuthenticationFlow] (executor-thread-215) authenticator: auth-x509-client-username-form
mtls-2-keycloak-1  | 2023-06-12 21:36:19,732 DEBUG [org.keycloak.authentication.AuthenticationSelectionResolver] (executor-thread-215) Going through the flow 'browser x509' for adding executions
mtls-2-keycloak-1  | 2023-06-12 21:36:19,732 DEBUG [org.keycloak.authentication.AuthenticationSelectionResolver] (executor-thread-215) Going through the flow 'browser x509 forms' for adding executions
mtls-2-keycloak-1  | 2023-06-12 21:36:19,732 DEBUG [org.keycloak.authentication.AuthenticationSelectionResolver] (executor-thread-215) Selections when trying execution 'auth-x509-client-username-form' : [ authSelection - auth-x509-client-username-form,  authSelection - auth-username-password-form]
mtls-2-keycloak-1  | 2023-06-12 21:36:19,733 DEBUG [org.keycloak.authentication.DefaultAuthenticationFlow] (executor-thread-215) invoke authenticator.authenticate: auth-x509-client-username-form
mtls-2-keycloak-1  | 2023-06-12 21:36:19,735 DEBUG [org.keycloak.authentication.DefaultAuthenticationFlow] (executor-thread-215) authenticator ATTEMPTED: auth-x509-client-username-form
mtls-2-keycloak-1  | 2023-06-12 21:36:19,736 TRACE [org.keycloak.authentication.DefaultAuthenticationFlow] (executor-thread-215) Set execution status: Execution: auth-x509-client-username-form, status: ATTEMPTED
mtls-2-keycloak-1  | 2023-06-12 21:36:19,736 DEBUG [org.keycloak.authentication.DefaultAuthenticationFlow] (executor-thread-215) check execution: 'browser x509 forms flow', requirement: 'ALTERNATIVE'
mtls-2-keycloak-1  | 2023-06-12 21:36:19,736 DEBUG [org.keycloak.authentication.DefaultAuthenticationFlow] (executor-thread-215) processFlow: browser x509 forms
mtls-2-keycloak-1  | 2023-06-12 21:36:19,736 DEBUG [org.keycloak.authentication.DefaultAuthenticationFlow] (executor-thread-215) check execution: 'auth-username-password-form', requirement: 'REQUIRED'
mtls-2-keycloak-1  | 2023-06-12 21:36:19,736 DEBUG [org.keycloak.authentication.DefaultAuthenticationFlow] (executor-thread-215) authenticator: auth-username-password-form
mtls-2-keycloak-1  | 2023-06-12 21:36:19,737 DEBUG [org.keycloak.authentication.AuthenticationSelectionResolver] (executor-thread-215) Going through the flow 'browser x509' for adding executions
mtls-2-keycloak-1  | 2023-06-12 21:36:19,737 DEBUG [org.keycloak.authentication.AuthenticationSelectionResolver] (executor-thread-215) Going through the flow 'browser x509 forms' for adding executions
mtls-2-keycloak-1  | 2023-06-12 21:36:19,737 DEBUG [org.keycloak.authentication.AuthenticationSelectionResolver] (executor-thread-215) Selections when trying execution 'auth-username-password-form' : [ authSelection - auth-username-password-form]
mtls-2-keycloak-1  | 2023-06-12 21:36:19,737 DEBUG [org.keycloak.authentication.DefaultAuthenticationFlow] (executor-thread-215) invoke authenticator.authenticate: auth-username-password-form
mtls-2-keycloak-1  | 2023-06-12 21:36:19,753 TRACE [org.keycloak.authentication.DefaultAuthenticationFlow] (executor-thread-215) Set execution status: Execution: auth-username-password-form, status: CHALLENGED
mtls-2-keycloak-1  | 2023-06-12 21:36:19,753 TRACE [org.keycloak.authentication.DefaultAuthenticationFlow] (executor-thread-215) Set execution status: Execution: browser x509 forms flow, status: CHALLENGED

1 reply

tlann Jun 15, 2023
Author

I figured out my issue. Certs weren't being imported properly to the keystore vs the truststore. I'm going to update my example in github so that anyone else that comes across the issue can have a working example.

Navigation Menu

Repository navigation

Quarkus Keycloak client authentication using x509 #15580

Uh oh!

{{title}}

Uh oh!

Replies: 3 comments 4 replies

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

Quarkus Keycloak client authentication using x509 #15580

Uh oh!

tlann Nov 18, 2022

Replies: 3 comments · 4 replies

Uh oh!

thomasdarimont Dec 15, 2022 Collaborator

Uh oh!

thomasdarimont Dec 15, 2022 Collaborator

Uh oh!

Uh oh!

tlann Dec 19, 2022 Author

Uh oh!

bikebaba Jan 23, 2023

Uh oh!

thomasdarimont Jan 23, 2023 Collaborator

Uh oh!

tlann Jun 12, 2023 Author

Uh oh!

tlann Jun 15, 2023 Author

tlann
Nov 18, 2022

Replies: 3 comments 4 replies

thomasdarimont
Dec 15, 2022
Collaborator

thomasdarimont Dec 15, 2022
Collaborator

tlann Dec 19, 2022
Author

bikebaba
Jan 23, 2023

thomasdarimont Jan 23, 2023
Collaborator

tlann
Jun 12, 2023
Author

tlann Jun 15, 2023
Author