2:14 a.m.
We'd welcome a contribution.
Tests would need to be written and added to the new testsuite
(testsuite/integration-arquillian). If you are able to send updates to
documentation as well that'd be good.
On 13 January 2017 at 11:59, 乗松隆志 / NORIMATSU，TAKASHI <
takashi.norimatsu.ws(a)hitachi.com> wrote:
Hello.
I've been using keycloak 2.4.0.FINAL.
I've implemented codes for RFC 7636 for Proof Key Code Exchange
experimentally.
(https://tools.ietf.org/html/rfc7636)
[Background: Why RFC7636 is necessary]
RFC 7636 is important for industries where high level security is
required because it can prevent Authorization Code Interception and
Substitution attacks for OAuth2.0. For example, it is required for both
confidential and public clients in draft specification of Financial API of
OpenID foundation. By implementing RFC 7636, keycloak will be used more
widely.
[Description of the implementation]
My implementation is about 90steps for Authorization Server, 90steps for
Client(only Servlet-OAuth), both excluded debug log codes in step counts.
Please see the detail in below links.
* The implementation:
https://github.com/keycloak/keycloak/commit/
9e3d2d1e5e8c3b30ddc9ccd5083ba18adcb4c564
It is based on 2.4.0.FINAL. Hope we'll refine and rebase it onto master
branch for PR if you accept our implementation proposal.
* Design document:
https://github.com/Hitachi/contributions/wiki/Description-of-RFC7636-for-
keycloak
* PoC test:
I've validated my implementation and found worked well in following
scenarios.
[1]
Flow: Authorization Code Flow
Client: RFC 7636 not supported
[2]
Flow: Authorization Code Flow
Client: RFC 7636 supported and operate properly
[3]
Flow: Authorization Code Flow
Client: RFC 7636 supported but operate illegally
(send invalid code_verifier to Token Endpoint)
For detail of PoC test, please see:
https://github.com/Hitachi/contributions/wiki/PoC-Test-Result-of-RFC7636
I am also willing to add tests to community’s testsuites according to the
process as described in “Hacking on Keycloak”.
I've known that related ticket had already been issued as KEYCLOAK-2604.
https://issues.jboss.org/browse/KEYCLOAK-2604
Would you mind if I contribute this RFC 7636 support to Keycloak related
with KEYCLOAK-2604 ticket ?
Best Regards
Takashi Norimatsu
Hitachi, Ltd.
_______________________________________________
keycloak-dev mailing list
keycloak-dev(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-dev