9:52 a.m.
I'll look into all the social/broker errors and test out on all social
providers (again) after I finish up some logout work.
--
Bill Burke
JBoss, a division of Red Hat
http://bill.burkecentral.com
9:57 a.m.
Had a quick look at it and seems Facebook and GitHub return access token response as
form-url-encoded (access_token=<...>&foo=bar).
Another thing I spotted was that I'm pretty sure we're not validating the SSL
connection when sending requests to the IdPs. We should drop the SimpleHttp util I created
and use something better (Apache or RestEasy) and make sure it's possible to setup a
truststore). SimpleHttp was only created as we initially wanted the social lib to be a
reusable lightweight lib, but now it's only for KC so there's no point in it and
it's pretty crap for many reasons!
----- Original Message -----
From: "Bill Burke" <bburke(a)redhat.com>
To: keycloak-dev(a)lists.jboss.org
Sent: Wednesday, 25 March, 2015 2:52:07 PM
Subject: [keycloak-dev] social/broker errors
I'll look into all the social/broker errors and test out on all social
providers (again) after I finish up some logout work.
--
Bill Burke
JBoss, a division of Red Hat
http://bill.burkecentral.com
_______________________________________________
keycloak-dev mailing list
keycloak-dev(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-dev
10:43 a.m.
Same is StackOverflow provider I added on monday, it doesn't work now.
Problem is in AbstractOAuth2IdentityProvider class, where
extractTokenFromResponse() method (which was able to distinguish between
JSON and URL encoded responses) is not used anymore, but direct JSON
parsing is used now. We should return back use of
extractTokenFromResponse()
Vl.
On 25.3.2015 14:57, Stian Thorgersen wrote:
Had a quick look at it and seems Facebook and GitHub return access
token response as form-url-encoded (access_token=<...>&foo=bar).
Another thing I spotted was that I'm pretty sure we're not validating the SSL
connection when sending requests to the IdPs. We should drop the SimpleHttp util I created
and use something better (Apache or RestEasy) and make sure it's possible to setup a
truststore). SimpleHttp was only created as we initially wanted the social lib to be a
reusable lightweight lib, but now it's only for KC so there's no point in it and
it's pretty crap for many reasons!
----- Original Message -----
> From: "Bill Burke" <bburke(a)redhat.com>
> To: keycloak-dev(a)lists.jboss.org
> Sent: Wednesday, 25 March, 2015 2:52:07 PM
> Subject: [keycloak-dev] social/broker errors
>
> I'll look into all the social/broker errors and test out on all social
> providers (again) after I finish up some logout work.
> --
> Bill Burke
> JBoss, a division of Red Hat
> http://bill.burkecentral.com
> _______________________________________________
> keycloak-dev mailing list
> keycloak-dev(a)lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-dev
>
_______________________________________________
keycloak-dev mailing list
keycloak-dev(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-dev
--
Vlastimil Elias
Principal Software Engineer
jboss.org Development Team
10:56 a.m.
On 25.3.2015 14:57, Stian Thorgersen wrote:
Had a quick look at it and seems Facebook and GitHub return access
token response as form-url-encoded (access_token=<...>&foo=bar).
Another thing I spotted was that I'm pretty sure we're not validating the SSL
connection when sending requests to the IdPs. We should drop the SimpleHttp util I created
and use something better (Apache or RestEasy) and make sure it's possible to setup a
truststore). SimpleHttp was only created as we initially wanted the social lib to be a
reusable lightweight lib, but now it's only for KC so there's no point in it and
it's pretty crap for many reasons!
SimpleHttp uses common java HttpsURLConnection which by default
validates https certificates against common JVM truststore (typically
cacerts somewhere in java installation directory) as I know.
See
http://docs.oracle.com/javase/7/docs/api/javax/net/ssl/HttpsURLConnection...
and
http://docs.oracle.com/javase/8/docs/technotes/guides/security/jsse/JSSER...
Vl.
----- Original Message -----
> From: "Bill Burke" <bburke(a)redhat.com>
> To: keycloak-dev(a)lists.jboss.org
> Sent: Wednesday, 25 March, 2015 2:52:07 PM
> Subject: [keycloak-dev] social/broker errors
>
> I'll look into all the social/broker errors and test out on all social
> providers (again) after I finish up some logout work.
> --
> Bill Burke
> JBoss, a division of Red Hat
> http://bill.burkecentral.com
> _______________________________________________
> keycloak-dev mailing list
> keycloak-dev(a)lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-dev
>
_______________________________________________
keycloak-dev mailing list
keycloak-dev(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-dev
--
Vlastimil Elias
Principal Software Engineer
jboss.org Development Team
11:02 a.m.
Question about logout: Should logout always trigger parent broker logout
even if "child" is not the initiator of parent SSO login?
Some example: I have keycloak server on configured to login against
Salesforce SAML broker
1) I login to Salesforce
2) Then I login to Keycloak with usage of Salesforce broker
3) Now I trigger logout from Keycloak. Should it trigger logout from
Salesforce too? IMO it shouldn't as localhost:8081 wasn't the initiator
of the Salesforce login (in step 1).
Wdyt?
Marek
On 25.3.2015 14:57, Stian Thorgersen wrote:
Had a quick look at it and seems Facebook and GitHub return access
token response as form-url-encoded (access_token=<...>&foo=bar).
Another thing I spotted was that I'm pretty sure we're not validating the SSL
connection when sending requests to the IdPs. We should drop the SimpleHttp util I created
and use something better (Apache or RestEasy) and make sure it's possible to setup a
truststore). SimpleHttp was only created as we initially wanted the social lib to be a
reusable lightweight lib, but now it's only for KC so there's no point in it and
it's pretty crap for many reasons!
----- Original Message -----
> From: "Bill Burke" <bburke(a)redhat.com>
> To: keycloak-dev(a)lists.jboss.org
> Sent: Wednesday, 25 March, 2015 2:52:07 PM
> Subject: [keycloak-dev] social/broker errors
>
> I'll look into all the social/broker errors and test out on all social
> providers (again) after I finish up some logout work.
> --
> Bill Burke
> JBoss, a division of Red Hat
> http://bill.burkecentral.com
> _______________________________________________
> keycloak-dev mailing list
> keycloak-dev(a)lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-dev
>
_______________________________________________
keycloak-dev mailing list
keycloak-dev(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-dev
11:27 a.m.
So Salesforce IDP is the "parent" and Keycloak is the child? I think
Salesforce IDP should be logged out as well, because think of it this way
1. user logs out of keycloak app, but doesn't get logged out of Salesforce
2. user goes away form machine
3. Attacker sits down at desk
4. Attacker visits keycloak app
5. Still logged in at Salesforce, so keycloak app has a successful login
due to SSO.
I have
Currently, if you don't register a logout url for saml or oidc broker
providers, then logout isn't propagated to parent IDP. Parent to child
logout will always happen though. I have no controls in place for that.
I do not support logout for social providers.
We might want to have a prompt asking if the user should be logged out
from parent.
On 3/25/2015 11:02 AM, Marek Posolda wrote:
Question about logout: Should logout always trigger parent broker
logout
even if "child" is not the initiator of parent SSO login?
Some example: I have keycloak server on configured to login against
Salesforce SAML broker
1) I login to Salesforce
2) Then I login to Keycloak with usage of Salesforce broker
3) Now I trigger logout from Keycloak. Should it trigger logout from
Salesforce too? IMO it shouldn't as localhost:8081 wasn't the initiator
of the Salesforce login (in step 1).
Wdyt?
Marek
On 25.3.2015 14:57, Stian Thorgersen wrote:
> Had a quick look at it and seems Facebook and GitHub return access
> token response as form-url-encoded (access_token=<...>&foo=bar).
>
> Another thing I spotted was that I'm pretty sure we're not validating
> the SSL connection when sending requests to the IdPs. We should drop
> the SimpleHttp util I created and use something better (Apache or
> RestEasy) and make sure it's possible to setup a truststore).
> SimpleHttp was only created as we initially wanted the social lib to
> be a reusable lightweight lib, but now it's only for KC so there's no
> point in it and it's pretty crap for many reasons!
>
> ----- Original Message -----
>> From: "Bill Burke" <bburke(a)redhat.com>
>> To: keycloak-dev(a)lists.jboss.org
>> Sent: Wednesday, 25 March, 2015 2:52:07 PM
>> Subject: [keycloak-dev] social/broker errors
>>
>> I'll look into all the social/broker errors and test out on all social
>> providers (again) after I finish up some logout work.
>> --
>> Bill Burke
>> JBoss, a division of Red Hat
>> http://bill.burkecentral.com
>> _______________________________________________
>> keycloak-dev mailing list
>> keycloak-dev(a)lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-dev
>>
> _______________________________________________
> keycloak-dev mailing list
> keycloak-dev(a)lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-dev
--
Bill Burke
JBoss, a division of Red Hat
http://bill.burkecentral.com
12:23 p.m.
On 25.3.2015 16:27, Bill Burke wrote:
So Salesforce IDP is the "parent" and Keycloak is the
child?
Yes
I think Salesforce IDP should be logged out as well, because think
of it this way
1. user logs out of keycloak app, but doesn't get logged out of
Salesforce
2. user goes away form machine
3. Attacker sits down at desk
4. Attacker visits keycloak app
5. Still logged in at Salesforce, so keycloak app has a successful
login due to SSO.
I see the point. However if you consider scenario like:
1. I am logged in salesforce.com and doing some important transactions there
2. Now I clicked to different browser tab and want to quickly check
something in some keycloak-secured-app. I logged-in to the app through
Keycloak + Salesforce broker
3. I checked calendar, clicked "logout" in Zimbra and I want to continue
back in Salesforce. But I am logged out from Salesforce... :-(
The prompt makes sense to me. At least for the cases when user was
logged in before. But not sure if there is a way to track this (In case
that Keycloak itself is parent broker, we can check if auth-method was
FORM (user just logged in) or SSO (user was already logged before)), but
that would require propagate this info from parent broker to child
broker too. Maybe easiest is to always display prompt?
Marek
I have
Currently, if you don't register a logout url for saml or oidc broker
providers, then logout isn't propagated to parent IDP. Parent to child
logout will always happen though. I have no controls in place for that.
I do not support logout for social providers.
We might want to have a prompt asking if the user should be logged out
from parent.
On 3/25/2015 11:02 AM, Marek Posolda wrote:
> Question about logout: Should logout always trigger parent broker logout
> even if "child" is not the initiator of parent SSO login?
>
> Some example: I have keycloak server on configured to login against
> Salesforce SAML broker
>
> 1) I login to Salesforce
> 2) Then I login to Keycloak with usage of Salesforce broker
> 3) Now I trigger logout from Keycloak. Should it trigger logout from
> Salesforce too? IMO it shouldn't as localhost:8081 wasn't the initiator
> of the Salesforce login (in step 1).
>
> Wdyt?
>
> Marek
>
>
> On 25.3.2015 14:57, Stian Thorgersen wrote:
>> Had a quick look at it and seems Facebook and GitHub return access
>> token response as form-url-encoded (access_token=<...>&foo=bar).
>>
>> Another thing I spotted was that I'm pretty sure we're not validating
>> the SSL connection when sending requests to the IdPs. We should drop
>> the SimpleHttp util I created and use something better (Apache or
>> RestEasy) and make sure it's possible to setup a truststore).
>> SimpleHttp was only created as we initially wanted the social lib to
>> be a reusable lightweight lib, but now it's only for KC so there's no
>> point in it and it's pretty crap for many reasons!
>>
>> ----- Original Message -----
>>> From: "Bill Burke" <bburke(a)redhat.com>
>>> To: keycloak-dev(a)lists.jboss.org
>>> Sent: Wednesday, 25 March, 2015 2:52:07 PM
>>> Subject: [keycloak-dev] social/broker errors
>>>
>>> I'll look into all the social/broker errors and test out on all social
>>> providers (again) after I finish up some logout work.
>>> --
>>> Bill Burke
>>> JBoss, a division of Red Hat
>>> http://bill.burkecentral.com
>>> _______________________________________________
>>> keycloak-dev mailing list
>>> keycloak-dev(a)lists.jboss.org
>>> https://lists.jboss.org/mailman/listinfo/keycloak-dev
>>>
>> _______________________________________________
>> keycloak-dev mailing list
>> keycloak-dev(a)lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-dev
>
7:18 p.m.
On 3/25/2015 12:23 PM, Marek Posolda wrote:
On 25.3.2015 16:27, Bill Burke wrote:
> So Salesforce IDP is the "parent" and Keycloak is the child?
Yes
> I think Salesforce IDP should be logged out as well, because think
> of it this way
>
> 1. user logs out of keycloak app, but doesn't get logged out of
> Salesforce
> 2. user goes away form machine
> 3. Attacker sits down at desk
> 4. Attacker visits keycloak app
> 5. Still logged in at Salesforce, so keycloak app has a successful
> login due to SSO.
I see the point. However if you consider scenario like:
1. I am logged in salesforce.com and doing some important transactions
there
2. Now I clicked to different browser tab and want to quickly check
something in some keycloak-secured-app. I logged-in to the app through
Keycloak + Salesforce broker
3. I checked calendar, clicked "logout" in Zimbra and I want to continue
back in Salesforce. But I am logged out from Salesforce... :-(
The prompt makes sense to me. At least for the cases when user was
logged in before. But not sure if there is a way to track this (In case
that Keycloak itself is parent broker, we can check if auth-method was
FORM (user just logged in) or SSO (user was already logged before)), but
that would require propagate this info from parent broker to child
broker too. Maybe easiest is to always display prompt?
What should the prompt say? User will have no idea what it means by
"Should I logout of parent broker?"
Maybe "Logout of <broker> too?"
i.e.
"Logout of Saleforce too?"
"Logout of Facebook too?"
--
Bill Burke
JBoss, a division of Red Hat
http://bill.burkecentral.com
1:22 a.m.
I don't like the idea of a prompt to the user. I'd rather have a configuration
option on IdP to select when logout should be propagated:
* Always
* Only if used as log-in mechanism
* Never
Same goes for the other way around (user logs out of SalesForce).
----- Original Message -----
From: "Bill Burke" <bburke(a)redhat.com>
To: "Marek Posolda" <mposolda(a)redhat.com>, "Stian Thorgersen"
<stian(a)redhat.com>
Cc: keycloak-dev(a)lists.jboss.org
Sent: Thursday, 26 March, 2015 12:18:48 AM
Subject: Re: [keycloak-dev] social/broker errors
On 3/25/2015 12:23 PM, Marek Posolda wrote:
> On 25.3.2015 16:27, Bill Burke wrote:
>> So Salesforce IDP is the "parent" and Keycloak is the child?
> Yes
>> I think Salesforce IDP should be logged out as well, because think
>> of it this way
>>
>> 1. user logs out of keycloak app, but doesn't get logged out of
>> Salesforce
>> 2. user goes away form machine
>> 3. Attacker sits down at desk
>> 4. Attacker visits keycloak app
>> 5. Still logged in at Salesforce, so keycloak app has a successful
>> login due to SSO.
> I see the point. However if you consider scenario like:
>
> 1. I am logged in salesforce.com and doing some important transactions
> there
> 2. Now I clicked to different browser tab and want to quickly check
> something in some keycloak-secured-app. I logged-in to the app through
> Keycloak + Salesforce broker
> 3. I checked calendar, clicked "logout" in Zimbra and I want to continue
> back in Salesforce. But I am logged out from Salesforce... :-(
>
>
> The prompt makes sense to me. At least for the cases when user was
> logged in before. But not sure if there is a way to track this (In case
> that Keycloak itself is parent broker, we can check if auth-method was
> FORM (user just logged in) or SSO (user was already logged before)), but
> that would require propagate this info from parent broker to child
> broker too. Maybe easiest is to always display prompt?
>
What should the prompt say? User will have no idea what it means by
"Should I logout of parent broker?"
Maybe "Logout of <broker> too?"
i.e.
"Logout of Saleforce too?"
"Logout of Facebook too?"
--
Bill Burke
JBoss, a division of Red Hat
http://bill.burkecentral.com
3317
days inactive
3318
days old
8 comments
4 participants
participants (4)
-
Bill Burke -
Marek Posolda -
Stian Thorgersen -
Vlastimil Elias