<div dir="ltr"><br><div class="gmail_extra"><br><div class="gmail_quote">On 13 September 2016 at 16:36, Niels Bertram <span dir="ltr"><<a href="mailto:nielsbne@gmail.com" target="_blank">nielsbne@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div dir="ltr">Hi Stian,<div><br></div><div>intersting email, we were recently given advise to rotate keys periodically but at this point in time keycloak 1.9.8 does not actually implement <a href="http://openid.net/specs/openid-connect-core-1_0.html#RotateSigKeys" target="_blank">http://openid.net/<wbr>specs/openid-connect-core-1_0.<wbr>html#RotateSigKeys</a> nor are any of the client adapters able to use the jks url to retrieve pub keys rather requiring to hard code the target realm key in the public-realm-key property of the keycloak.json client configuration file.</div><div><br></div><div>Is this new feature going to implement the OpenID Connect spec sections 10.1 and 10.2 ?</div></div></blockquote><div><br></div><div>10.1 yes, we don't support encryption at the moment and this work will not include it.</div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div dir="ltr"><div><br></div><div>Also I assume this would also require changes to adapters by removing the public-realm-key property from the config file? </div></div></blockquote><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div dir="ltr"><div><br></div><div>Kind Regards,</div><div>Niels</div></div><div class="gmail_extra"><br><div class="gmail_quote"><div><div class="gmail-h5">On Tue, Sep 13, 2016 at 11:41 PM, Nalyvayko, Peter <span dir="ltr"><<a href="mailto:pnalyvayko@agi.com" target="_blank">pnalyvayko@agi.com</a>></span> wrote:<br></div></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div><div class="gmail-h5">
<div lang="EN-US">
<div>
<p class="MsoNormal"><span style="font-size:11pt;font-family:calibri,sans-serif;color:rgb(31,73,125)">Is this going to be a breaking feature or is the plan to continue supporting the current single key/realm model?
<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:calibri,sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p>
<p class="MsoNormal"><b><span style="font-size:11pt;font-family:calibri,sans-serif">From:</span></b><span style="font-size:11pt;font-family:calibri,sans-serif"> <a href="mailto:keycloak-dev-bounces@lists.jboss.org" target="_blank">keycloak-dev-bounces@lists.jbo<wbr>ss.org</a> [mailto:<a href="mailto:keycloak-dev-bounces@lists.jboss.org" target="_blank">keycloak-dev-bounces@l<wbr>ists.jboss.org</a>]
<b>On Behalf Of </b>Stian Thorgersen<br>
<b>Sent:</b> Tuesday, September 13, 2016 9:29 AM<br>
<b>To:</b> keycloak-dev <<a href="mailto:keycloak-dev@lists.jboss.org" target="_blank">keycloak-dev@lists.jboss.org</a>><br>
<b>Subject:</b> [keycloak-dev] Realm key rotation support<u></u><u></u></span></p><div><div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal">To be able to gracefully rotate the realm keys periodically a realm needs to have more than one keypair. One keypair that is active and will be used to issue new cookies and tokens. Also, one or more keypairs that are inactive that can
be used to verify old cookies and tokens.<u></u><u></u></p>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">I'm going to start work on this soon, but here's some initial thoughts:<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">* Realm keys will have a list of keypairs rather than just one. Only one can be active. There will also be an expiration time on the inactive keypairs. Once expired and inactive keypair is no longer usable.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">* There will also be an option to automatically generate a new key every N days.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">* If a session cookie is signed with an inactive pair the cookie will be refreshed so it's signed with the active keypair<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">* Token introspect endpoint will allow any token that is signed with any keypair that is not expired<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">* If a refresh token is signed with an inactive pair the new tokens (including refresh token) will be signed with the active keypair<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">* Secret used to generate client code will be linked to the keypair. I'll need a way to specify what secret it was signed with so codes are still valid even if they where signed with an old.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">This is only for login cookie and OIDC protocol. Is it even necessary to have support for multiple certificates for SAML? SAML doesn't have a token introspection or refresh of the assertions right, so not sure it's needed.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">With regards to the applications. Marek has already added support for clients to fetch new keypairs for the realm. See his email on keycloak-dev for details around that.<u></u><u></u></p>
</div>
</div>
</div></div></div>
</div>
<br></div></div>______________________________<wbr>_________________<br>
keycloak-dev mailing list<br>
<a href="mailto:keycloak-dev@lists.jboss.org" target="_blank">keycloak-dev@lists.jboss.org</a><br>
<a href="https://lists.jboss.org/mailman/listinfo/keycloak-dev" rel="noreferrer" target="_blank">https://lists.jboss.org/mailma<wbr>n/listinfo/keycloak-dev</a><br></blockquote></div><br></div>
</blockquote></div><br></div></div>