Conflict with LastPass Chrome Extension
by Alessandro Segatto
Hi,
we found a conflict between LastPass chrome extension (version 4.1.38) and
Keycloak js adapter (version 2.5). LastPass is sending a message to login
status iframe, which crashes while trying to parse it! I think LastPass
caused the issue with his last update , but i think you should also be
interested in solving this lack of robustness. If you agree, I can open an
issue o Jira.
I made an attempt also with angular2-product-app , but i run into a similar
issue (LastPass and Keycloak messaging one the other, then crashing)
Thanks,
Alessandro Segatto
--
Ing. Alessandro Segatto
Software Engineer
Research and Development
*ESTECO S.p.A.* - AREA Science Park, Padriciano 99 - 34149 Trieste - ITALY
Phone: +39 040 3755548 - Fax: +39 040 3755549 | www.esteco.com
Pursuant to Legislative Decree No. 196/2003, you are hereby informed that
this message contains confidential information intended only for the use of
the addressee. If you are not the addressee, and have received this message
by mistake, please delete it and immediately notify us. You may not copy or
disseminate this message to anyone. Thank you.
5 years, 9 months
Validation of IdP SAML signatures using KeyInfo
by Mark Pardijs
Hi,
Originally posted at the keycloak-dev list, Hynek Mlnarik asked me to post this here.
We use a SAML IdP which is configured in Keycloak as federated IdP, and I’ve a question concerning the validation of SAML signatures. In Keycloaks Identity provider config page, the validating X509 Certificates can be configured, with description “The certificate in PEM format that must be used to check for signatures. Multiple certificates can be entered, separated by comma (,).” but in the code, I see that for checking the signatures a “HardcodedKeyLocator" is used, which does not use the keyName provided in the SAML but always returns the first configured certificate. See org.keycloak.broker.saml.SAMLEndpoint.Binding#getIDPKeyLocator which returns a HardcodedKeyLocator for details.
This code is recently added to solve https://issues.jboss.org/browse/KEYCLOAK-1881, see commit https://github.com/keycloak/keycloak/commit/70a8255eae0af64628f07326df1c7....
My two questions concerning this approach:
1. Keycloak is currently expecting a <KeyInfo> element with a <KeyName> in the incoming SAML message, while this is not a required element in the SAML specs. Are there plans to check the signature against the configured X509 certificates without having to provide a KeyInfo element? Currently I”m facing a NullPointer exception when sending a SAMLResponse without KeyInfo element.
2. What’s the idea behind the HardcodedKeyLocator, it doesn’t seem to match with the multiple keys configuration option in Keycloaks frontend. Is this a preliminary approach which should be extended?
Hope to hear your thoughts on this!
Mark
5 years, 9 months
