Support SSF Receivers with Push Delivery #43950
Draft
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Contributor
Author
|
TODOs:
Backlog:
|
Contributor
Author
Usage example with caep.devSSF Stream setup with caep.devRegister with https://caep.dev to obtain an SSF transmitter access token:
Create a SSF Stream on caep.dev
Create a stream request with caep.devUse the provided access token as In the following I use the Keycloak realm POST https://ssf.caep.dev/ssf/streams
Authorization: Bearer {{transmitterToken}}
Content-Type: application/json
{
"delivery": {
"method": "urn:ietf:rfc:8935",
"endpoint_url": "{{pushEndpointUrl}}",
"authorization_header": "{{pushAuthHeader}}"
},
"events_requested": [
"https://schemas.openid.net/secevent/caep/event-type/session-revoked",
"https://schemas.openid.net/secevent/caep/event-type/credential-change",
"https://schemas.openid.net/secevent/caep/event-type/device-compliance-change",
"https://schemas.openid.net/secevent/caep/event-type/token-claims-change",
"https://schemas.openid.net/secevent/caep/event-type/assurance-level-change"
],
"description": "This field is optional. Remove this field if not needed."
}This will yield a 201 Created response like this: Now our stream is created and we can start sending events to it. Bit first we need to create a Create a SSF Receiver in Keycloak
Demo
In the server log you should see log messages like this: |
098ac04 to
998edb6
Compare
fa479a4 to
27de092
Compare
4c289f8 to
fd5db12
Compare
- Add new experimental SSF feature flag - Add SET parsing infrastructure - Add support for Subject Identifier parsing - Add receiver management - Add transmitter stream / keys management - Add support for SET PUSH Delivery Fixes keycloak#43614 Signed-off-by: Thomas Darimont <[email protected]>
Signed-off-by: Thomas Darimont <[email protected]>
- Represent SSF Receivers as Identity Providers in Admin UI - Gradually move from SsfReceiverModel to SsfReceiverProviderConfig - Move to external stream management model (streams are created outside of Keycloak) - Move verification functionality to SsfReceiverProvider - Make SsfReceiverManager obsolete Signed-off-by: Thomas Darimont <[email protected]> # Conflicts: # js/apps/admin-ui/src/identity-providers/add/DetailSettings.tsx # services/src/main/resources/META-INF/services/org.keycloak.broker.provider.IdentityProviderFactory
- Represent SSF Receivers as Identity Providers in Admin UI - Gradually move from SsfReceiverModel to SsfReceiverProviderConfig - Move to external stream management model (streams are created outside of Keycloak) - Move verification functionality to SsfReceiverProvider - Make SsfReceiverManager obsolete Signed-off-by: Thomas Darimont <[email protected]>
Signed-off-by: Thomas Darimont <[email protected]>
Signed-off-by: Thomas Darimont <[email protected]>
Signed-off-by: Thomas Darimont <[email protected]>
- Removed SCIM Events (which are still in draft status https://www.ietf.org/archive/id/draft-ietf-scim-events-16.html) - Revised JSON deserialization of SSF events (result is now SsfEvent instead of Map<String,Object>) - Introduced StreamEvent base class for SSF Stream events - Remove unnecessary methods Signed-off-by: Thomas Darimont <[email protected]>
- Rename SsfSpi to SsfReceiverSpi - Rename SsfReceiverProvider to SsfRegistrationProvider - Rename SsfProvider to SsfReceiverProvider This allows us to add SSF Transmitter support independently of the SSF Receiver support Signed-off-by: Thomas Darimont <[email protected]>
fd5db12 to
9be27de
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR adds initial support for Shared Signals Framework with Security Event Token (SET) Push Delivery using HTTP.
Users can manage SSF Receiver components within a realm that can be connected with a SSF Transmitter.
The SSF Transmitter can send SETs (Security Event Tokens) via HTTP Push to an endpoint exposed by the Keycloak realm. A new SsfEventListener SPI can be used to react on received SSF events from a SET.
This PR assumes SSF Streams to be registered outside of Keycloak. A SSF Receiver in Keycloak is associated with a stream by configuring the StreamId, Audience and SSF Transmitter Access token in the SSF Receiver configuration.
There can be multiple logical SSF Receivers defined within a realm that can handle SET events via a
SsfEventListener.Fixes #43614
The redirect URI, client_id and client_secret will be removed later.
Demo
ssf-keycloak-SET-push-demo.mov
Signed-off-by: Thomas Darimont [email protected]