8000 Add conditional http request header to close #14604 by kreativmonkey · Pull Request #14605 · keycloak/keycloak · GitHub
[go: up one dir, main page]
Skip to content

Add conditional http request header to close #14604 - #14605

Closed
kreativmonkey wants to merge 1 commit into
keycloak:mainfrom
kreativmonkey:main
Closed

Add conditional http request header to close #14604#14605
kreativmonkey wants to merge 1 commit into
keycloak:mainfrom
kreativmonkey:main

Conversation

@kreativmonkey
@kreativmonkey kreativmonkey commented Sep 27, 2022
Copy link
Copy Markdown

This change will be close #14604

I added a condition to check the http request header to match on a regex string.
It is inspired by the ConditionalOTPFormAuthenticator but not limited to the OTP Form.

@kreativmonkey
kreativmonkey commented Nov 4, 2022
Copy link
Copy Markdown
Author

@stianst can you explain how to add tests to this feature? i can't find any example for that.

@thomasdarimont
thomasdarimont commented Nov 21, 2022 •
edited
Loading
Copy link
Copy Markdown
Contributor

@kreativmonkey take a look at this: org.keycloak.testsuite.forms.AllowDenyAuthenticatorTest#testDenyAccessWithNegateUserAttributeCondition

... however there seems to be no way currently to use a custom HTTP header with the webdriver.
How about the following:

Take a look at org.keycloak.testsuite.forms.DirectGrantFlowTest and create a custom direct grant flow with your conditional authenticator and use a http client to call the token endpoint with grant_type=password and without your custom http header.

@kreativmonkey
kreativmonkey commented Nov 23, 2022
Copy link
Copy Markdown
Author

Thanks for your answer, I need to figure out how to do the tests. It's much more work than writing the condition ;-)

@kreativmonkey kreativmonkey mentioned this pull request Jan 23, 2023
Closed
@kreativmonkey
kreativmonkey requested a review from a team as a code owner March 3, 2023 08:13
@kreativmonkey
kreativmonkey requested review from a team as code owners March 9, 2023 14:09
@kreativmonkey
kreativmonkey requested a review from a team March 9, 2023 14:09
@kreativmonkey
kreativmonkey force-pushed the main branch 3 times, most recently from 4497e92 to 46c7662 Compare March 10, 2023 09:15
@kreativmonkey
kreativmonkey commented Mar 10, 2023 •
edited
Loading
Copy link
Copy Markdown
Author

@stianst I have finished the implementation of tests.

At this point I would like to explain the condition again in more detail. With this authenticator it is possible to check the http header for certain entries using regex patterns. This allows for example to check if a login request comes from the company network or from external. For example, this can be used to control the query of the 2FA.

The Authenticator is a bit more flexible than just checking for IP ranges (#16453). However, the user interface is not as comfortable and the operation is not as easy.

As an example to match a specific IP range 203.0.113.0/24 you need to add the regex like: X-Forwarded-For: 203\.0\.113\.\b(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?(\.|$)). But of course, you are not limited to the X-Forwarded-For header.

@kreativmonkey
add Conditional http request header
6ab91a1 
This change will add a condition to check the http request header to match on a regex string.
It is inspired by the ConditionalOTPFormAuthenticator but not limited to the OTP Form.
@kreativmonkey
kreativmonkey commented Apr 18, 2023
Copy link
Copy Markdown
Author

is there still somthing missing?

@col-panic
col-panic commented Jun 19, 2024
Copy link
Copy Markdown

I have the following scenario: both internal and external network. If the request originates from the internal network, I add the HTTP Header IngressNetwork: internal.

Now if a login request originates from the external network (header is missing), I only want to allow it IF the user already configured its credentials including the 2FA. That is, initial password change and 2FA setting should NOT be possible if connecting from the external network.

So I guess in the Condition that User Configured is not the case, I would need a Sub flow with this conditional to check.
Do you think this can be realized with your code? If yes, I'll dig deeper! thanks

@col-panic
col-panic commented Jun 21, 2024
Copy link
Copy Markdown

Thank you for your PR - as I needed this functionality, I took the liberty to create it as a separate repository to build as keycloak-extension in https://github.com/elexis/keycloak-conditional-http-header-authenticator.

@romge
romge commented Mar 31, 2025
Copy link
Copy Markdown
Contributor

I'm also using this condition and it would be great if it could be merged into main. Thank you for your effort.

@rmartinc
rmartinc commented Apr 30, 2026
Copy link
Copy Markdown
Contributor

Sorry for the long delay, but I don't think we are interesting in this for the moment. Just add the authenticator as a custom as @col-panic is suggesting.

@rmartinc rmartinc closed this Apr 30, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@rmartinc rmartinc

Labels

team/core-authn

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Condition to check the HTTP Request header

6 participants

@kreativmonkey @thomasdarimont @col-panic @romge @rmartinc @stianst
0