[keycloak-dev] X.509 User Identity Extractor - multiple values

[Sven-Torben Janus]

Hey all!

I am currently facing a situation with a customer who wants to implement mutual SSL / client cert authentication. As I understand from the UserIdentityExtractor[1] implementations, currently only returning a single value is allowed, because the UserIdentityToModelMapper[2] calls toString on the actual userIdentity object.

Now my customer uses the serial number from the certificate to identify users. However, this is only unique in combination with the issuer of the certificate, since my customer supports multiple CAs. The combination of both exists in their LDAP as a single attribute where both parts are separated by a special separator character.
In addition to that, the whole certificate of the user is also available in another LDAP attribute.

I currently see the following options to implement a solution for this:
1) Writing a custom Authenticator to handle that specific situation. This one would look very similar to the ootb X509 authenticator, but implements either a) or b) (see below)
2) Making a contribution to Keycloak and extend the list of available UserIdentitiyExtractors.

For both approaches two different implementations come to my mind:

a) Adding an additional UserIdentitiyExtractor which combines the issuer and the serial number into a single string and use that as an identity.
b) Adding an additional UserIdentitiyExtractor which returns the whole certificate as the user's identity.

We would prefer contributing to Keycloak, if such a contribution is welcome and meaningful.

Do you have any advice on which way to go here?

[1]https://github.com/keycloak/keycloak/blob/master/services/src/main/java/org/keycloak/authentication/authenticators/x509/UserIdentityExtractor.java
[2]https://github.com/keycloak/keycloak/blob/master/services/src/main/java/org/keycloak/authentication/authenticators/x509/UserIdentityToModelMapper.java#L57

Regards
Sven-Torben