<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<p>Don't you have to get the cert chain from a servlet request
attribute? This might work.<br>
</p>
<p><br>
</p>
<p>
<meta charset="utf-8">
</p>
<pre class="lang-java prettyprint prettyprinted" style="margin: 0px 0px 1em; padding: 5px; border: 0px; font-size: 13px; width: auto; max-height: 600px; overflow: auto; font-family: Consolas, Menlo, Monaco, "Lucida Console", "Liberation Mono", "DejaVu Sans Mono", "Bitstream Vera Sans Mono", "Courier New", monospace, sans-serif; display: block; color: rgb(57, 51, 24); word-wrap: normal; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: left; text-indent: 0px; text-transform: none; widows: 1; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(239, 240, 241);"><code style="margin: 0px; padding: 0px; border: 0px; font-size: 13px; font-family: Consolas, Menlo, Monaco, "Lucida Console", "Liberation Mono", "DejaVu Sans Mono", "Bitstream Vera Sans Mono", "Courier New", monospace, sans-serif; white-space: inherit; background-color: rgb(239, 240, 241);"><span class="pln" style="margin: 0px; padding: 0px; border: 0px; font-size: 13px; color: rgb(48, 51, 54);"> HttpServletRequest httpServletRequest = ResteasyProviderFactory.getContextData(HttpServletRequest.class);
X509Certificate</span><span class="pun" style="margin: 0px; padding: 0px; border: 0px; font-size: 13px; color: rgb(48, 51, 54);">[]</span><span class="pln" style="margin: 0px; padding: 0px; border: 0px; font-size: 13px; color: rgb(48, 51, 54);"> certs </span><span class="pun" style="margin: 0px; padding: 0px; border: 0px; font-size: 13px; color: rgb(48, 51, 54);">=</span><span class="pln" style="margin: 0px; padding: 0px; border: 0px; font-size: 13px; color: rgb(48, 51, 54);"> </span><span class="pun" style="margin: 0px; padding: 0px; border: 0px; font-size: 13px; color: rgb(48, 51, 54);">(</span><span class="pln" style="margin: 0px; padding: 0px; border: 0px; font-size: 13px; color: rgb(48, 51, 54);">X509Certificate</span><span class="pun" style="margin: 0px; padding: 0px; border: 0px; font-size: 13px; color: rgb(48, 51, 54);">[])</span><span class="pln" style="margin: 0px; padding: 0px; border: 0px; font-size: 13px; color: rgb(48, 51, 54);"> httpServletRequest</span><span class="pun" style="margin: 0px; padding: 0px; border: 0px; font-size: 13px; color: rgb(48, 51, 54);">.</span><span class="pln" style="margin: 0px; padding: 0px; border: 0px; font-size: 13px; color: rgb(48, 51, 54);">getAttribute</span><span class="pun" style="margin: 0px; padding: 0px; border: 0px; font-size: 13px; color: rgb(48, 51, 54);">(</span><span class="str" style="margin: 0px; padding: 0px; border: 0px; font-size: 13px; color: rgb(125, 39, 39);">"javax.servlet.request.X509Certificate"</span><span class="pun" style="margin: 0px; padding: 0px; border: 0px; font-size: 13px; color: rgb(48, 51, 54);">);
</span><span class="pln" style="margin: 0px; padding: 0px; border: 0px; font-size: 13px; color: rgb(48, 51, 54);"> </span></code></pre>
<br class="Apple-interchange-newline">
<br>
<div class="moz-cite-prefix">On 7/7/16 10:53 AM, Filipe Lautert
wrote:<br>
</div>
<blockquote
cite="mid:CAGDdvgSJWaO7AoY4W4X0q-CXirxLL5BxB4-mEtov-0RdfAECCQ@mail.gmail.com"
type="cite">
<div dir="ltr">Hello
<div><br>
</div>
<div>short story: is there a way to get the request body sent
from the client inside an<span style="line-height:1.5"> Authenticator
(my class implements Authenticator , unsing method @Override
authenticate(context)) ? I'm trying with </span><span
style="line-height:18px">context.getHttpRequest().getInputStream()
but it is empty.</span></div>
<div>
<div><br>
</div>
<div>Full story:</div>
<div>I'm trying to build a Keycloak authenticator that reads a
client certificate and uses it to validate the user, using
as a base the SecretQuestionAuthenticator example . The
client certificate is a hard token that is read by Firefox.
To handle the certificate read part I'm usng Apache mod ssl,
with the below relevant configuration:</div>
<div><br>
</div>
<div>
<div class="inbox-inbox-OutlineElement inbox-inbox-Ltr
inbox-inbox-SCX49080288"
style="margin:0px;padding:0px;overflow:visible;clear:both;direction:ltr;line-height:normal">
<p class="inbox-inbox-Paragraph inbox-inbox-SCX49080288"
style="margin:0px;padding:0px;word-wrap:break-word;vertical-align:baseline;color:windowtext;background-color:transparent"
lang="EN-US"><span class="inbox-inbox-TextRun
inbox-inbox-SCX49080288"
style="color:windowtext;margin:0px;padding:0px;line-height:18px;background-color:transparent"
lang="EN-US"><span class="inbox-inbox-SpellingError
inbox-inbox-SCX49080288"
style="margin:0px;padding:0px;border-bottom-width:1px;border-bottom-style:solid;border-bottom-color:transparent;background-image:url("data:image/gif;base64,R0lGODlhBQAEAJECAP////8AAAAAAAAAACH5BAEAAAIALAAAAAAFAAQAAAIIlGAXCCHrTCgAOw==");background-color:inherit;background-position:0%
100%;background-repeat:repeat-x">SSLEngine</span><span
class="inbox-inbox-NormalTextRun
inbox-inbox-SCX49080288"
style="margin:0px;padding:0px;background-color:inherit"><span
class="inbox-inbox-Apple-converted-space"> </span>on</span></span><span
class="inbox-inbox-EOP inbox-inbox-SCX49080288"
style="color:windowtext;margin:0px;padding:0px;line-height:18px;background-color:transparent"> </span><br>
</p>
</div>
<div class="inbox-inbox-OutlineElement inbox-inbox-Ltr
inbox-inbox-SCX49080288"
style="margin:0px;padding:0px;overflow:visible;clear:both;direction:ltr;line-height:normal">
<p class="inbox-inbox-Paragraph inbox-inbox-SCX49080288"
style="margin:0px;padding:0px;word-wrap:break-word;vertical-align:baseline;color:windowtext;background-color:transparent"
lang="EN-US"><span
class="inbox-inbox-inbox-inbox-TextRun
inbox-inbox-inbox-inbox-SCX49080288"
style="color:windowtext;margin:0px;padding:0px;line-height:18px"
lang="EN-US"><span
class="inbox-inbox-inbox-inbox-SpellingError
inbox-inbox-inbox-inbox-SCX49080288"
style="margin:0px;padding:0px;border-bottom-width:1px;border-bottom-style:solid;border-bottom-color:transparent;background-image:url("data:image/gif;base64,R0lGODlhBQAEAJECAP////8AAAAAAAAAACH5BAEAAAIALAAAAAAFAAQAAAIIlGAXCCHrTCgAOw==");background-color:inherit;background-position:0%
100%;background-repeat:repeat-x">SSLProxyEngine</span><span
class="inbox-inbox-inbox-inbox-NormalTextRun
inbox-inbox-inbox-inbox-SCX49080288"
style="margin:0px;padding:0px;background-color:inherit"><span
class="inbox-inbox-inbox-inbox-Apple-converted-space"> </span>on</span></span><span
class="inbox-inbox-inbox-inbox-EOP
inbox-inbox-inbox-inbox-SCX49080288"
style="margin:0px;padding:0px;line-height:18px"> </span></p>
</div>
<div class="inbox-inbox-OutlineElement inbox-inbox-Ltr
inbox-inbox-SCX49080288"
style="margin:0px;padding:0px;overflow:visible;clear:both;direction:ltr;line-height:normal">
<p class="inbox-inbox-Paragraph inbox-inbox-SCX49080288"
style="margin:0px;padding:0px;word-wrap:break-word;vertical-align:baseline;color:windowtext;background-color:transparent"
lang="EN-US"><span class="inbox-inbox-TextRun
inbox-inbox-SCX49080288"
style="margin:0px;padding:0px;color:windowtext;line-height:18px"
lang="EN-US"><span class="inbox-inbox-NormalTextRun
inbox-inbox-SCX49080288"
style="margin:0px;padding:0px;background-color:inherit">
<</span><span
class="inbox-inbox-SpellingError
inbox-inbox-SCX49080288"
style="margin:0px;padding:0px;border-bottom-width:1px;border-bottom-style:solid;border-bottom-color:transparent;background-image:url("data:image/gif;base64,R0lGODlhBQAEAJECAP////8AAAAAAAAAACH5BAEAAAIALAAAAAAFAAQAAAIIlGAXCCHrTCgAOw==");background-color:inherit;background-position:0%
100%;background-repeat:repeat-x">LocationMatch</span><span
class="inbox-inbox-NormalTextRun
inbox-inbox-SCX49080288"
style="margin:0px;padding:0px;background-color:inherit"><span
class="inbox-inbox-Apple-converted-space"> </span>"/</span><span
class="inbox-inbox-SpellingError
inbox-inbox-SCX49080288"
style="margin:0px;padding:0px;border-bottom-width:1px;border-bottom-style:solid;border-bottom-color:transparent;background-image:url("data:image/gif;base64,R0lGODlhBQAEAJECAP////8AAAAAAAAAACH5BAEAAAIALAAAAAAFAAQAAAIIlGAXCCHrTCgAOw==");background-color:inherit;background-position:0%
100%;background-repeat:repeat-x">auth</span><span
class="inbox-inbox-NormalTextRun
inbox-inbox-SCX49080288"
style="margin:0px;padding:0px;background-color:inherit">"></span></span><span
class="inbox-inbox-EOP inbox-inbox-SCX49080288"
style="margin:0px;padding:0px;line-height:18px"> </span></p>
</div>
<div class="inbox-inbox-OutlineElement inbox-inbox-Ltr
inbox-inbox-SCX49080288"
style="margin:0px;padding:0px;overflow:visible;clear:both;direction:ltr;line-height:normal">
<p class="inbox-inbox-Paragraph inbox-inbox-SCX49080288"
style="margin:0px;padding:0px;word-wrap:break-word;vertical-align:baseline;color:windowtext;background-color:transparent"
lang="EN-US"><span class="inbox-inbox-TextRun
inbox-inbox-SCX49080288"
style="margin:0px;padding:0px;color:windowtext;line-height:18px"
lang="EN-US"><span class="inbox-inbox-NormalTextRun
inbox-inbox-SCX49080288"
style="margin:0px;padding:0px;background-color:inherit">
<span
class="inbox-inbox-Apple-converted-space"> </span></span><span
class="inbox-inbox-SpellingError
inbox-inbox-SCX49080288"
style="margin:0px;padding:0px;border-bottom-width:1px;border-bottom-style:solid;border-bottom-color:transparent;background-image:url("data:image/gif;base64,R0lGODlhBQAEAJECAP////8AAAAAAAAAACH5BAEAAAIALAAAAAAFAAQAAAIIlGAXCCHrTCgAOw==");background-color:inherit;background-position:0%
100%;background-repeat:repeat-x">ProxyPass</span><span
class="inbox-inbox-NormalTextRun
inbox-inbox-SCX49080288"
style="margin:0px;padding:0px;background-color:inherit"><span
class="inbox-inbox-Apple-converted-space"> </span>ajp://localhost:8010/auth</span></span><span
class="inbox-inbox-EOP inbox-inbox-SCX49080288"
style="margin:0px;padding:0px;line-height:18px"> </span></p>
</div>
<div class="inbox-inbox-OutlineElement inbox-inbox-Ltr
inbox-inbox-SCX49080288"
style="margin:0px;padding:0px;overflow:visible;clear:both;direction:ltr;line-height:normal">
<p class="inbox-inbox-Paragraph inbox-inbox-SCX49080288"
style="margin:0px;padding:0px;word-wrap:break-word;vertical-align:baseline;color:windowtext;background-color:transparent"
lang="EN-US"><span class="inbox-inbox-TextRun
inbox-inbox-SCX49080288"
style="margin:0px;padding:0px;color:windowtext;line-height:18px"
lang="EN-US"><span class="inbox-inbox-NormalTextRun
inbox-inbox-SCX49080288"
style="margin:0px;padding:0px;background-color:inherit">
<span
class="inbox-inbox-Apple-converted-space"> </span></span><span
class="inbox-inbox-SpellingError
inbox-inbox-SCX49080288"
style="margin:0px;padding:0px;border-bottom-width:1px;border-bottom-style:solid;border-bottom-color:transparent;background-image:url("data:image/gif;base64,R0lGODlhBQAEAJECAP////8AAAAAAAAAACH5BAEAAAIALAAAAAAFAAQAAAIIlGAXCCHrTCgAOw==");background-color:inherit;background-position:0%
100%;background-repeat:repeat-x">ProxyPassReverse</span><span
class="inbox-inbox-NormalTextRun
inbox-inbox-SCX49080288"
style="margin:0px;padding:0px;background-color:inherit"><span
class="inbox-inbox-Apple-converted-space"> </span>ajp://localhost:8010/auth</span></span><span
class="inbox-inbox-EOP inbox-inbox-SCX49080288"
style="margin:0px;padding:0px;line-height:18px"> </span></p>
</div>
<div class="inbox-inbox-OutlineElement inbox-inbox-Ltr
inbox-inbox-SCX49080288"
style="margin:0px;padding:0px;overflow:visible;clear:both;direction:ltr">
<p class="inbox-inbox-Paragraph inbox-inbox-SCX49080288"
style="line-height:normal;margin:0px;padding:0px;word-wrap:break-word;vertical-align:baseline;color:windowtext;background-color:transparent"
lang="EN-US"><span class="inbox-inbox-TextRun
inbox-inbox-SCX49080288"
style="margin:0px;padding:0px;color:windowtext;line-height:18px"
lang="EN-US"><span class="inbox-inbox-NormalTextRun
inbox-inbox-SCX49080288"
style="margin:0px;padding:0px;background-color:inherit">
</</span><span
class="inbox-inbox-SpellingError
inbox-inbox-SCX49080288"
style="margin:0px;padding:0px;border-bottom-width:1px;border-bottom-style:solid;border-bottom-color:transparent;background-image:url("data:image/gif;base64,R0lGODlhBQAEAJECAP////8AAAAAAAAAACH5BAEAAAIALAAAAAAFAAQAAAIIlGAXCCHrTCgAOw==");background-color:inherit;background-position:0%
100%;background-repeat:repeat-x">LocationMatch</span><span
class="inbox-inbox-NormalTextRun
inbox-inbox-SCX49080288"
style="margin:0px;padding:0px;background-color:inherit">></span></span><span
class="inbox-inbox-EOP inbox-inbox-SCX49080288"
style="margin:0px;padding:0px;line-height:18px"> </span></p>
<p class="inbox-inbox-Paragraph inbox-inbox-SCX49080288"
style="line-height:normal;margin:0px;padding:0px;word-wrap:break-word;vertical-align:baseline;color:windowtext;background-color:transparent"
lang="EN-US"><span class="inbox-inbox-EOP
inbox-inbox-SCX49080288"
style="margin:0px;padding:0px;line-height:18px"><span
class="inbox-inbox-TextRun inbox-inbox-SCX107773260"
style="margin:0px;padding:0px;color:windowtext"
lang="EN-US"><span class="inbox-inbox-SpellingError
inbox-inbox-SCX107773260"
style="margin:0px;padding:0px;border-bottom-width:1px;border-bottom-style:solid;border-bottom-color:transparent;background-image:url("data:image/gif;base64,R0lGODlhBQAEAJECAP////8AAAAAAAAAACH5BAEAAAIALAAAAAAFAAQAAAIIlGAXCCHrTCgAOw==");background-color:inherit;background-position:0%
100%;background-repeat:repeat-x">SSLOptions</span><span
class="inbox-inbox-NormalTextRun
inbox-inbox-SCX107773260"
style="margin:0px;padding:0px;background-color:inherit"><span
class="inbox-inbox-Apple-converted-space"> </span>+</span><span
class="inbox-inbox-SpellingError
inbox-inbox-SCX107773260"
style="margin:0px;padding:0px;border-bottom-width:1px;border-bottom-style:solid;border-bottom-color:transparent;background-image:url("data:image/gif;base64,R0lGODlhBQAEAJECAP////8AAAAAAAAAACH5BAEAAAIALAAAAAAFAAQAAAIIlGAXCCHrTCgAOw==");background-color:inherit;background-position:0%
100%;background-repeat:repeat-x">StdEnvVars</span><span
class="inbox-inbox-NormalTextRun
inbox-inbox-SCX107773260"
style="margin:0px;padding:0px;background-color:inherit"><span
class="inbox-inbox-Apple-converted-space"> </span>+</span><span
class="inbox-inbox-SpellingError
inbox-inbox-SCX107773260"
style="margin:0px;padding:0px;border-bottom-width:1px;border-bottom-style:solid;border-bottom-color:transparent;background-image:url("data:image/gif;base64,R0lGODlhBQAEAJECAP////8AAAAAAAAAACH5BAEAAAIALAAAAAAFAAQAAAIIlGAXCCHrTCgAOw==");background-color:inherit;background-position:0%
100%;background-repeat:repeat-x">ExportCertData</span></span><span
class="inbox-inbox-EOP inbox-inbox-SCX107773260"
style="margin:0px;padding:0px"> </span><br>
</span></p>
<p class="inbox-inbox-Paragraph inbox-inbox-SCX49080288"
style="line-height:normal;margin:0px;padding:0px;word-wrap:break-word;vertical-align:baseline;color:windowtext;background-color:transparent"
lang="EN-US"><span class="inbox-inbox-EOP
inbox-inbox-SCX49080288"
style="margin:0px;padding:0px;line-height:18px"><span
class="inbox-inbox-EOP inbox-inbox-SCX107773260"
style="margin:0px;padding:0px">... etc</span></span></p>
<p class="inbox-inbox-Paragraph inbox-inbox-SCX49080288"
style="line-height:normal;margin:0px;padding:0px;word-wrap:break-word;vertical-align:baseline;color:windowtext;background-color:transparent"
lang="EN-US"><span class="inbox-inbox-EOP
inbox-inbox-SCX49080288"
style="margin:0px;padding:0px;line-height:18px"><span
class="inbox-inbox-EOP inbox-inbox-SCX107773260"
style="margin:0px;padding:0px"><br>
</span></span></p>
<p class="inbox-inbox-Paragraph inbox-inbox-SCX49080288"
style="line-height:normal;margin:0px;padding:0px;word-wrap:break-word;vertical-align:baseline;color:windowtext;background-color:transparent"
lang="EN-US"><span class="inbox-inbox-EOP
inbox-inbox-SCX49080288"
style="margin:0px;padding:0px;line-height:18px"><span
class="inbox-inbox-EOP inbox-inbox-SCX107773260"
style="margin:0px;padding:0px">Looking at a
tcpdump/wireshark on port 8010, I can see that the
client certificate is sent on the request body to
Keycloak.</span></span></p>
<p class="inbox-inbox-Paragraph inbox-inbox-SCX49080288"
style="line-height:normal;margin:0px;padding:0px;word-wrap:break-word;vertical-align:baseline;color:windowtext;background-color:transparent"
lang="EN-US"><span class="inbox-inbox-EOP
inbox-inbox-SCX49080288"
style="margin:0px;padding:0px;line-height:18px"><span
class="inbox-inbox-EOP inbox-inbox-SCX107773260"
style="margin:0px;padding:0px"><br>
</span></span></p>
<p class="inbox-inbox-Paragraph inbox-inbox-SCX49080288"
style="margin:0px;padding:0px;word-wrap:break-word;vertical-align:baseline;background-color:transparent"
lang="EN-US"><font style="color:windowtext"><span
style="line-height:18px">So far fine, Apache
validates the certificate, extracts it and send to
Keycloak. The problem is that I'm unable to read the
request body inside my authenticator class as </span></font><span
style="color:windowtext;line-height:18px">context.getHttpRequest().getInputStream()
is empty, and as the body is the raw certificate the
method </span><span style="line-height:18px">context.getHttpRequest().getFormParameters()
method won't return me anything.</span></p>
<p class="inbox-inbox-Paragraph inbox-inbox-SCX49080288"
style="margin:0px;padding:0px;word-wrap:break-word;vertical-align:baseline;color:windowtext;background-color:transparent"
lang="EN-US"><span style="line-height:18px"><br>
</span></p>
<p class="inbox-inbox-Paragraph inbox-inbox-SCX49080288"
style="margin:0px;padding:0px;word-wrap:break-word;vertical-align:baseline;background-color:transparent"
lang="EN-US"><span style="line-height:18px">public class
SecretQuestionAuthenticator implements Authenticator {</span></p>
<p class="inbox-inbox-Paragraph inbox-inbox-SCX49080288"
style="margin:0px;padding:0px;word-wrap:break-word;vertical-align:baseline;background-color:transparent"
lang="EN-US"><span style="line-height:18px"><span class="Apple-tab-span" style="white-space:pre"> </span>@Override</span></p>
<p class="inbox-inbox-Paragraph inbox-inbox-SCX49080288"
style="margin:0px;padding:0px;word-wrap:break-word;vertical-align:baseline;background-color:transparent"
lang="EN-US"><span style="line-height:18px"><span class="Apple-tab-span" style="white-space:pre"> </span>public
void authenticate(AuthenticationFlowContext context) {</span></p>
<p class="inbox-inbox-Paragraph inbox-inbox-SCX49080288"
style="margin:0px;padding:0px;word-wrap:break-word;vertical-align:baseline;background-color:transparent"
lang="EN-US"><span style="line-height:18px"><span class="Apple-tab-span" style="white-space:pre"> </span></span><span
style="line-height:18px">System.out.println(</span><span
style="line-height:18px">context.getHttpRequest().getInputStream().available());
// prints 0</span><span class="Apple-tab-span" style="line-height:18px;white-space:pre;background-color:transparent"> </span><span
style="line-height:18px;background-color:transparent">System.out.println(getStringFromInputStream(context.getHttpRequest().getInputStream()));
//empty :(</span></p>
<p class="inbox-inbox-Paragraph inbox-inbox-SCX49080288"
style="margin:0px;padding:0px;word-wrap:break-word;vertical-align:baseline;background-color:transparent"
lang="EN-US"><span style="line-height:18px"><br>
</span></p>
<p class="inbox-inbox-Paragraph inbox-inbox-SCX49080288"
style="margin:0px;padding:0px;word-wrap:break-word;vertical-align:baseline;background-color:transparent"
lang="EN-US"><span style="line-height:18px">Any ideas of
how I can get it to work?</span></p>
<p class="inbox-inbox-Paragraph inbox-inbox-SCX49080288"
style="margin:0px;padding:0px;word-wrap:break-word;vertical-align:baseline;background-color:transparent"
lang="EN-US"><span style="line-height:18px"><br>
</span></p>
<p class="inbox-inbox-Paragraph inbox-inbox-SCX49080288"
style="margin:0px;padding:0px;word-wrap:break-word;vertical-align:baseline;background-color:transparent"
lang="EN-US"><span style="line-height:18px">Thanks</span></p>
<p class="inbox-inbox-Paragraph inbox-inbox-SCX49080288"
style="margin:0px;padding:0px;word-wrap:break-word;vertical-align:baseline;background-color:transparent"
lang="EN-US"><span style="line-height:18px"><br>
</span></p>
<p class="inbox-inbox-Paragraph inbox-inbox-SCX49080288"
style="margin:0px;padding:0px;word-wrap:break-word;vertical-align:baseline;background-color:transparent"
lang="EN-US"><span style="line-height:18px">filipe</span></p>
</div>
</div>
</div>
</div>
<div dir="ltr">-- <br>
</div>
<div data-smartmail="gmail_signature">
<div dir="ltr">filipe lautert</div>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
keycloak-user mailing list
<a class="moz-txt-link-abbreviated" href="mailto:keycloak-user@lists.jboss.org">keycloak-user@lists.jboss.org</a>
<a class="moz-txt-link-freetext" href="https://lists.jboss.org/mailman/listinfo/keycloak-user">https://lists.jboss.org/mailman/listinfo/keycloak-user</a></pre>
</blockquote>
<br>
</body>
</html>