Re: [keycloak-dev] Use LDAP's PasswordPolicy

Hello, For the password policy, I think Keycloak's password is more easily extensible than openldap's. I'm not sure that the openldap implementation is the one adopted by other ldap servers. So, I think, as Marek says, having both options would be a good choice. For ldap account for the change of password, it would be a real benefits to use that of the end user, since this would allow to configure an anonymous connection at the level of the federation keycloak, which is rather a good point in security term.

Kind regards, Cédric 2017-11-08 10:42 GMT+01:00 Marek Posolda <mposolda(a)redhat.com&gt;: > Hi Rafael, > > Thanks a lot for sharing this! > > Few points: > - The https://issues.jboss.org/browse/KEYCLOAK-4052 adds the optional > config switch whether Keycloak password policies should be checked for > LDAP password updates. You mentioned it doesn't make too much sense for > you, however as you can see, there were few people, who want this. Hence > the switch is optional and it's up to you whether you rely just on LDAP > password policies or want to use the Keycloak policies too. > > - It's great you found the solution for the issue by yourself! > Unfortunately it looks that solution is specific for OpenLDAP. Is it > correct? TBH OpenLDAP is not the priority for the Keycloak team. We are > doing some basic testing with it and it should work, but don't want to > add the fix, which is specific for OpenLDAP and which contains a bigger > amount of changes/refactoring as it adds a risk of breaking the other > things. However if your change doesn't involve too much refactoring in > the existing code (ideally just the new mapper impl), feel free to send > the PR. > > Maybe you can create JIRA with the description of your requirement and > the work done and ideally send PR? Then we can discuss whether the PR > can be accepted or not. > > - Some time ago, I worked on support this for MSAD (that one is big > priority for us). I was also looking at the delete+add approach, but > that didn't work well. Mainly because the LDAP connection needed to be > under the user himself as you mentioned and also because you needed to > know the old password. Not sure if in OpenLDAP you need to know the old > password too? So in the end, it was possible to just add some request > controls to the updatePassword LDAP request and the MSAD policies are > preserved. More details in class LDAPServerPolicyHintsDecorator and some > background here [1] . Wonder if something possible can be used for > OpenLDAP too? > > [1] > https://blogs.technet.microsoft.com/fieldcoding/2013/01/09/resetting-pass... > > Marek > > On 30/10/17 01:13, Rafael Ladislau wrote: >> Hello, I'm pretty new here, but I've been using Keycloak with an OpenLDAP >> as the user federation and I've noted some problems that I had to fix by >> myself and I would like to share with the community the fixes I've made. >> >> I'm Software Developer at NYU and I had to change the Keycloak source code >> to make it works in one of our Projects. It's not a big refactoring. It's >> reasonable. >> >> >> Problems and my solutions: >> >> 1 - Keycloak changes the password of the users coming from LDAP sending a >> replace command to LDAP using a connection bound to the LDAP administrator. >> (WRITE mode). It allows the users not respect the >> password policy installed in LDAP if it has it installed. In order to fix >> it, you need to use a connection bound to the user changing the password, >> and Keyucloak should send two commands to LDAP: a command to delete the >> password field with the current password value and a command to add the >> password field with the new value. It makes Keycloak respect the password >> policy installed in LDAP, the operation raises an exception when the >> password is not compliant, after my fixes, I'm handling this exception and >> I'm letting the user knows about the error. (I'm doing this in the >> UPDATE_PASSWORD required action and in the manage account screen) >> >> >> 2 - Because I was making Keycloak respect the password policy in LDAP, I >> had to create a Password Policy User Account Control Mapper. This Mapper is >> based on the MSAD User Account Control Mapper. It has the same idea, but it >> writes the properties "pwdReset" and "pwdAccountLockedTime" to make >> Keycloak knows and let OpenLDAP knows when the user must reset his password >> and when the user is locked. >> >> >> 3 - The step 2 is necessary because when you have a password policy in LDAP >> saying the min age is one day, and you set a temporary password for the >> user. If Keycloak doesn't set the pwdReset flag, the user will not be able >> to change his password. (only after 24 hours) >> >> >> 4 - I've made some changes in the User Federation Configuration in order to >> allow the Keycloak administrator turn on and turn off this feature. >> >> >> The issue https://issues.jboss.org/browse/KEYCLOAK-4052 has made the users >> coming from LDAP go through the Keycloak's Password Policy before they >> change their passwords, but what I'm proposing is making Keycloak be aware >> of the Password Policy installed in LDAP. >> >> >> Do you think it would be a good feature? >> _______________________________________________ >> keycloak-dev mailing list >> keycloak-dev(a)lists.jboss.org >> https://lists.jboss.org/mailman/listinfo/keycloak-dev > > _______________________________________________ > keycloak-dev mailing list > keycloak-dev(a)lists.jboss.org > https://lists.jboss.org/mailman/listinfo/keycloak-dev