5:24 p.m.
At the moment we have a SSL required setting per-realm. I was thinking that it should be a
global configuration for a Keycloak server. In production all requests to a Keycloak
server should be over https, while in development it should be possible to use http for
simplicity. That's not a per-realm thing IMO.
If it's ok that it's a global config, we can drop it from the realm and instead
add:
<security-constraint>
<web-resource-collection>
<web-resource-name>keycloak</web-resource-name>
<url-pattern>/*</url-pattern>
</web-resource-collection>
<user-data-constraint>
<transport-guarantee>CONFIDENTIAL</transport-guarantee>
</user-data-constraint>
</security-constraint>
To the web.xml in the distribution. In the documentation we should then have two options,
first how to configure SSL on WildFly, second how to allow HTTP (with a warning that
it's only for development!).
5:32 p.m.
"Require SSL" is mainly used to force application/oauth redirect URLs to
be HTTPS endpoints. Otherwise, auth codes (not tokens) are transmitted
in the clear back to the application. A nice side-effect is that if the
admin forgets to set up web.xml, the token service will barf too :)
On 1/10/2014 11:24 AM, Stian Thorgersen wrote:
At the moment we have a SSL required setting per-realm. I was
thinking that it should be a global configuration for a Keycloak server. In production all
requests to a Keycloak server should be over https, while in development it should be
possible to use http for simplicity. That's not a per-realm thing IMO.
If it's ok that it's a global config, we can drop it from the realm and instead
add:
<security-constraint>
<web-resource-collection>
<web-resource-name>keycloak</web-resource-name>
<url-pattern>/*</url-pattern>
</web-resource-collection>
<user-data-constraint>
<transport-guarantee>CONFIDENTIAL</transport-guarantee>
</user-data-constraint>
</security-constraint>
To the web.xml in the distribution. In the documentation we should then have two options,
first how to configure SSL on WildFly, second how to allow HTTP (with a warning that
it's only for development!).
_______________________________________________
keycloak-dev mailing list
keycloak-dev(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-dev
--
Bill Burke
JBoss, a division of Red Hat
http://bill.burkecentral.com
5:49 p.m.
Yer, but does it have to be a per-realm thing? It makes more sense to me that by default
all traffic to Keycloak is required to be https, unless you explicitly disable it (for
dev).
----- Original Message -----
From: "Bill Burke" <bburke(a)redhat.com>
To: keycloak-dev(a)lists.jboss.org
Sent: Friday, 10 January, 2014 4:32:25 PM
Subject: Re: [keycloak-dev] Isn't SSL required a global setting?
"Require SSL" is mainly used to force application/oauth redirect URLs to
be HTTPS endpoints. Otherwise, auth codes (not tokens) are transmitted
in the clear back to the application. A nice side-effect is that if the
admin forgets to set up web.xml, the token service will barf too :)
On 1/10/2014 11:24 AM, Stian Thorgersen wrote:
> At the moment we have a SSL required setting per-realm. I was thinking that
> it should be a global configuration for a Keycloak server. In production
> all requests to a Keycloak server should be over https, while in
> development it should be possible to use http for simplicity. That's not a
> per-realm thing IMO.
>
> If it's ok that it's a global config, we can drop it from the realm and
> instead add:
>
> <security-constraint>
> <web-resource-collection>
> <web-resource-name>keycloak</web-resource-name>
> <url-pattern>/*</url-pattern>
> </web-resource-collection>
> <user-data-constraint>
> <transport-guarantee>CONFIDENTIAL</transport-guarantee>
> </user-data-constraint>
> </security-constraint>
>
> To the web.xml in the distribution. In the documentation we should then
> have two options, first how to configure SSL on WildFly, second how to
> allow HTTP (with a warning that it's only for development!).
> _______________________________________________
> keycloak-dev mailing list
> keycloak-dev(a)lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-dev
>
--
Bill Burke
JBoss, a division of Red Hat
http://bill.burkecentral.com
_______________________________________________
keycloak-dev mailing list
keycloak-dev(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-dev
5:59 p.m.
I don't know. Maybe some applications will not be able to have HTTPS.
A realm may want to allow an application to receive auth code redirects
over an unsecure channel.
On 1/10/2014 11:49 AM, Stian Thorgersen wrote:
Yer, but does it have to be a per-realm thing? It makes more sense to
me that by default all traffic to Keycloak is required to be https, unless you explicitly
disable it (for dev).
----- Original Message -----
> From: "Bill Burke" <bburke(a)redhat.com>
> To: keycloak-dev(a)lists.jboss.org
> Sent: Friday, 10 January, 2014 4:32:25 PM
> Subject: Re: [keycloak-dev] Isn't SSL required a global setting?
>
> "Require SSL" is mainly used to force application/oauth redirect URLs to
> be HTTPS endpoints. Otherwise, auth codes (not tokens) are transmitted
> in the clear back to the application. A nice side-effect is that if the
> admin forgets to set up web.xml, the token service will barf too :)
>
> On 1/10/2014 11:24 AM, Stian Thorgersen wrote:
>> At the moment we have a SSL required setting per-realm. I was thinking that
>> it should be a global configuration for a Keycloak server. In production
>> all requests to a Keycloak server should be over https, while in
>> development it should be possible to use http for simplicity. That's not a
>> per-realm thing IMO.
>>
>> If it's ok that it's a global config, we can drop it from the realm and
>> instead add:
>>
>> <security-constraint>
>> <web-resource-collection>
>> <web-resource-name>keycloak</web-resource-name>
>> <url-pattern>/*</url-pattern>
>> </web-resource-collection>
>> <user-data-constraint>
>> <transport-guarantee>CONFIDENTIAL</transport-guarantee>
>> </user-data-constraint>
>> </security-constraint>
>>
>> To the web.xml in the distribution. In the documentation we should then
>> have two options, first how to configure SSL on WildFly, second how to
>> allow HTTP (with a warning that it's only for development!).
>> _______________________________________________
>> keycloak-dev mailing list
>> keycloak-dev(a)lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-dev
>>
>
> --
> Bill Burke
> JBoss, a division of Red Hat
> http://bill.burkecentral.com
> _______________________________________________
> keycloak-dev mailing list
> keycloak-dev(a)lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-dev
>
--
Bill Burke
JBoss, a division of Red Hat
http://bill.burkecentral.com
6:02 p.m.
----- Original Message -----
From: "Bill Burke" <bburke(a)redhat.com>
To: "Stian Thorgersen" <stian(a)redhat.com>
Cc: keycloak-dev(a)lists.jboss.org
Sent: Friday, 10 January, 2014 4:59:35 PM
Subject: Re: [keycloak-dev] Isn't SSL required a global setting?
I don't know. Maybe some applications will not be able to have HTTPS.
A realm may want to allow an application to receive auth code redirects
over an unsecure channel.
You might be right - playing devils advocate here, but wouldn't that mean it should be
a per-app config? ;)
On 1/10/2014 11:49 AM, Stian Thorgersen wrote:
> Yer, but does it have to be a per-realm thing? It makes more sense to me
> that by default all traffic to Keycloak is required to be https, unless
> you explicitly disable it (for dev).
>
> ----- Original Message -----
>> From: "Bill Burke" <bburke(a)redhat.com>
>> To: keycloak-dev(a)lists.jboss.org
>> Sent: Friday, 10 January, 2014 4:32:25 PM
>> Subject: Re: [keycloak-dev] Isn't SSL required a global setting?
>>
>> "Require SSL" is mainly used to force application/oauth redirect URLs
to
>> be HTTPS endpoints. Otherwise, auth codes (not tokens) are transmitted
>> in the clear back to the application. A nice side-effect is that if the
>> admin forgets to set up web.xml, the token service will barf too :)
>>
>> On 1/10/2014 11:24 AM, Stian Thorgersen wrote:
>>> At the moment we have a SSL required setting per-realm. I was thinking
>>> that
>>> it should be a global configuration for a Keycloak server. In production
>>> all requests to a Keycloak server should be over https, while in
>>> development it should be possible to use http for simplicity. That's
not
>>> a
>>> per-realm thing IMO.
>>>
>>> If it's ok that it's a global config, we can drop it from the realm
and
>>> instead add:
>>>
>>> <security-constraint>
>>> <web-resource-collection>
>>> <web-resource-name>keycloak</web-resource-name>
>>> <url-pattern>/*</url-pattern>
>>> </web-resource-collection>
>>> <user-data-constraint>
>>>
<transport-guarantee>CONFIDENTIAL</transport-guarantee>
>>> </user-data-constraint>
>>> </security-constraint>
>>>
>>> To the web.xml in the distribution. In the documentation we should then
>>> have two options, first how to configure SSL on WildFly, second how to
>>> allow HTTP (with a warning that it's only for development!).
>>> _______________________________________________
>>> keycloak-dev mailing list
>>> keycloak-dev(a)lists.jboss.org
>>> https://lists.jboss.org/mailman/listinfo/keycloak-dev
>>>
>>
>> --
>> Bill Burke
>> JBoss, a division of Red Hat
>> http://bill.burkecentral.com
>> _______________________________________________
>> keycloak-dev mailing list
>> keycloak-dev(a)lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-dev
>>
--
Bill Burke
JBoss, a division of Red Hat
http://bill.burkecentral.com
6:35 p.m.
Created https://issues.jboss.org/browse/KEYCLOAK-260 to track this
----- Original Message -----
From: "Stian Thorgersen" <stian(a)redhat.com>
To: "Bill Burke" <bburke(a)redhat.com>
Cc: keycloak-dev(a)lists.jboss.org
Sent: Friday, 10 January, 2014 5:02:49 PM
Subject: Re: [keycloak-dev] Isn't SSL required a global setting?
----- Original Message -----
> From: "Bill Burke" <bburke(a)redhat.com>
> To: "Stian Thorgersen" <stian(a)redhat.com>
> Cc: keycloak-dev(a)lists.jboss.org
> Sent: Friday, 10 January, 2014 4:59:35 PM
> Subject: Re: [keycloak-dev] Isn't SSL required a global setting?
>
> I don't know. Maybe some applications will not be able to have HTTPS.
> A realm may want to allow an application to receive auth code redirects
> over an unsecure channel.
You might be right - playing devils advocate here, but wouldn't that mean it
should be a per-app config? ;)
>
> On 1/10/2014 11:49 AM, Stian Thorgersen wrote:
> > Yer, but does it have to be a per-realm thing? It makes more sense to me
> > that by default all traffic to Keycloak is required to be https, unless
> > you explicitly disable it (for dev).
> >
> > ----- Original Message -----
> >> From: "Bill Burke" <bburke(a)redhat.com>
> >> To: keycloak-dev(a)lists.jboss.org
> >> Sent: Friday, 10 January, 2014 4:32:25 PM
> >> Subject: Re: [keycloak-dev] Isn't SSL required a global setting?
> >>
> >> "Require SSL" is mainly used to force application/oauth redirect
URLs to
> >> be HTTPS endpoints. Otherwise, auth codes (not tokens) are transmitted
> >> in the clear back to the application. A nice side-effect is that if the
> >> admin forgets to set up web.xml, the token service will barf too :)
> >>
> >> On 1/10/2014 11:24 AM, Stian Thorgersen wrote:
> >>> At the moment we have a SSL required setting per-realm. I was thinking
> >>> that
> >>> it should be a global configuration for a Keycloak server. In
> >>> production
> >>> all requests to a Keycloak server should be over https, while in
> >>> development it should be possible to use http for simplicity.
That's
> >>> not
> >>> a
> >>> per-realm thing IMO.
> >>>
> >>> If it's ok that it's a global config, we can drop it from the
realm and
> >>> instead add:
> >>>
> >>> <security-constraint>
> >>> <web-resource-collection>
> >>> <web-resource-name>keycloak</web-resource-name>
> >>> <url-pattern>/*</url-pattern>
> >>> </web-resource-collection>
> >>> <user-data-constraint>
> >>>
<transport-guarantee>CONFIDENTIAL</transport-guarantee>
> >>> </user-data-constraint>
> >>> </security-constraint>
> >>>
> >>> To the web.xml in the distribution. In the documentation we should
then
> >>> have two options, first how to configure SSL on WildFly, second how to
> >>> allow HTTP (with a warning that it's only for development!).
> >>> _______________________________________________
> >>> keycloak-dev mailing list
> >>> keycloak-dev(a)lists.jboss.org
> >>> https://lists.jboss.org/mailman/listinfo/keycloak-dev
> >>>
> >>
> >> --
> >> Bill Burke
> >> JBoss, a division of Red Hat
> >> http://bill.burkecentral.com
> >> _______________________________________________
> >> keycloak-dev mailing list
> >> keycloak-dev(a)lists.jboss.org
> >> https://lists.jboss.org/mailman/listinfo/keycloak-dev
> >>
>
> --
> Bill Burke
> JBoss, a division of Red Hat
> http://bill.burkecentral.com
>
_______________________________________________
keycloak-dev mailing list
keycloak-dev(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-dev
3781
days inactive
3781
days old
5 comments
2 participants
participants (2)
-
Bill Burke -
Stian Thorgersen