Repository navigation
Extracting x509 subject information to user profile #30513
Replies: 2 comments 2 replies
|
I have exactly the same problem. I need to identify a specific user who executes such client authentication by the The I am really not sure if any certificate subject information can be mapped to any scope at all. |
|
@pstatham-exp @sam-hayes-org you can always use Keycloak's X509ClientCertificateLookup to access the client certificate from your custom authenticators, mappers etc. |
|
@dteleguin We are using the JS Adapter and have our Keycloak instance setup to do X509 authentication. There is information available in the certificate a user authenticates with (org/email/etc.) that we would like to get back after authentication. |
|
This is exactly what client mappers are for. If you wish to extract arbitrary data from the x509 certificate, you will need to code a custom mapper (in Java) and perform a certificate lookup from it. |
Uh oh!
There was an error while loading. Please reload this page.
I've got a basic Docker container running Keycloak and using some self signed certificates to enable x509 authentication.
I've followed instructions from:
After following the above, I am successful in getting my secured app to require x509 certificates in order to access the application.
However, when using the Javascript Adapter, I've noticed that the returned authentication instance includes no information about the x509 that was used; any information about the user comes from the identified user profile (which is done by setting the x509 authentication configuration to use Subject Email Address and Username and Email lookup).
Does Keycloak have the capability to "store" or "map" authenticated certificate attributes to the authenticated user profile?
All reactions