Re: [keycloak-user] Apache X509 cert-lookup

Also, just to confirm: are you running kc in a cluster mode or standalone? In your post you mentioned domain.xml so I am assuming you are running a cluster, but just want to make sure... ________________________________________ From: Nalyvayko, Peter Sent: Friday, June 22, 2018 9:30 PM To: Matthias ANGLADE; keycloak-user(a)lists.jboss.org Subject: RE: [keycloak-user] Apache X509 cert-lookup Hi Matthias, Can you attach the x509 cert lookup SPI config? --Peter ________________________________________ From: keycloak-user-bounces(a)lists.jboss.org [keycloak-user-bounces(a)lists.jboss.org] on behalf of Matthias ANGLADE [manglade(a)nextoo.fr] Sent: Friday, June 22, 2018 4:56 AM To: keycloak-user(a)lists.jboss.org Subject: [keycloak-user] Apache X509 cert-lookup Hello, I'm trying to setup a client cert authentication. Since my Keycloak server is running behind an SSL reverse proxy I modified the domain.xml file in order to declare the Apache cert lookup SPI. I checked that the certificate was properly embedded in the HTTP header still, I can't get to authenticate using this approach. In the log file I see no line related to this authentication (I should be able to see log coming from AbstractClientCertificateFromHttpHeadersLookup. It behaves just as if the SPI wasn't active. Note that even if my proxy isn't an Apache server, the certificate it emits is formatted like for Apache. Any clue on this ? Regards, _______________________________________________ keycloak-user mailing list keycloak-user(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/keycloak-user