You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Products that defend against attacks, such as various WAFs, often have mechanisms that allow security measures to be applied in stages, such as Enforcing mode and Permissive mode.
This discussion is about the idea of setting up such a Permissive mode in Keycloak client policy as well.
With the current client policy, the communication is shut out (Keycloak sends an error response) immediately when an attack is detected, so applying the client policy in a production environment carries the risk of business interruption, even if the policy has been thoroughly verified in advance in a staging environment.
As an example, if there is a Permissive mode that only outputs a warning log to the log file or only notifies somewhere and does not shut out the communication when an attack is detected, it would be possible to apply the client policy smoothly and in stages, in cooperation with a third-party RP as appropriate.
What do you think?
reacted with thumbs up emoji reacted with thumbs down emoji reacted with laugh emoji reacted with hooray emoji reacted with confused emoji reacted with heart emoji reacted with rocket emoji reacted with eyes emoji
Uh oh!
There was an error while loading. Please reload this page.
Products that defend against attacks, such as various WAFs, often have mechanisms that allow security measures to be applied in stages, such as Enforcing mode and Permissive mode.
This discussion is about the idea of setting up such a Permissive mode in Keycloak client policy as well.
With the current client policy, the communication is shut out (Keycloak sends an error response) immediately when an attack is detected, so applying the client policy in a production environment carries the risk of business interruption, even if the policy has been thoroughly verified in advance in a staging environment.
As an example, if there is a Permissive mode that only outputs a warning log to the log file or only notifies somewhere and does not shut out the communication when an attack is detected, it would be possible to apply the client policy smoothly and in stages, in cooperation with a third-party RP as appropriate.
What do you think?
All reactions