Is this going to be a breaking feature or is the plan to continue supporting the current
single key/realm model?
From: keycloak-dev-bounces(a)lists.jboss.org [mailto:keycloak-dev-bounces@lists.jboss.org]
On Behalf Of Stian Thorgersen
Sent: Tuesday, September 13, 2016 9:29 AM
To: keycloak-dev <keycloak-dev(a)lists.jboss.org>
Subject: [keycloak-dev] Realm key rotation support
To be able to gracefully rotate the realm keys periodically a realm needs to have more
than one keypair. One keypair that is active and will be used to issue new cookies and
tokens. Also, one or more keypairs that are inactive that can be used to verify old
cookies and tokens.
I'm going to start work on this soon, but here's some initial thoughts:
* Realm keys will have a list of keypairs rather than just one. Only one can be active.
There will also be an expiration time on the inactive keypairs. Once expired and inactive
keypair is no longer usable.
* There will also be an option to automatically generate a new key every N days.
* If a session cookie is signed with an inactive pair the cookie will be refreshed so
it's signed with the active keypair
* Token introspect endpoint will allow any token that is signed with any keypair that is
not expired
* If a refresh token is signed with an inactive pair the new tokens (including refresh
token) will be signed with the active keypair
* Secret used to generate client code will be linked to the keypair. I'll need a way
to specify what secret it was signed with so codes are still valid even if they where
signed with an old.
This is only for login cookie and OIDC protocol. Is it even necessary to have support for
multiple certificates for SAML? SAML doesn't have a token introspection or refresh of
the assertions right, so not sure it's needed.
With regards to the applications. Marek has already added support for clients to fetch new
keypairs for the realm. See his email on keycloak-dev for details around that.