Re: [keycloak-user] SAML RSAKeyValue causing error
Yes, you can set Keycloak not to include KeyInfo via system
property picketlink.xmlsig.includeKeyInfo set to false. This is far from
ideal though since it affects all clients. Feel free to raise a feature
request in JIRA to support this better.
On Wed, Sep 19, 2018 at 7:51 PM Dean Peterson <peterson.dean(a)gmail.com>
wrote:
I am having trouble using Keycloak as the external provider to our
Websphere Application. I received the following response from IBM support:
I discussed the issue with our SAML SSO SME. He found in SAML token,
besides X509Certificate, it also contains RSAKeyValue (<dsig:RSAKeyValue>).
This document states:
https://www.ibm.com/support/knowledgecenter/en/SSEQTP_8.5.5/com.ibm.websp...
.
RSAKeyValue is supported for the KeyInfo element in a Signature. However,
the X.509 certificate is not available when using RSAKeyValue. When the
X.509 certificate is not available to the runtime, the signer of the SAML
Assertion cannot be checked against a truststore. If you want to receive
SAML Assertions that use RSAKeyValue you cannot configure the runtime to
use a truststore.
.
Can you config the idP so that it only sends X509 certificate, not RSAKey?
Is it possible to remove the RSAKeyValue from the saml token and still send
just the certificate?
_______________________________________________
keycloak-user mailing list
keycloak-user(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user