understanding client Authenticator security with Keycloak

In this article, we will share tips and tricks about understanding client Authenticator security with Keycloak

When people think about using keycloak Authorization code flow,
the most straightforward to use it is to use Authoriszation Code Flow
with client ID/Client secret key (using keycloak default
authenticator, which is using clientID/client secret).

The Authorization code flow by itself is very secure, but it is
the usage done with the secret key which can be very insecure.

client_id/client_secret
security issue

When using the client key, the concern is always how to share the
client key between the the client and keycloak.

If the clientid/client_secret is used by a client app running on
backend server where nobody has access to the app, apart from the
sysadmin who has deployed it, using keycloak client_id/client_secret
is fine.

But, this point is a real concern when client secret is embedded
in keycloak.json, and when anyone can decompile the application and
thus having access to the client secret

The secret key can even get compromised when exchanged, as it is
very easy to have someone else getting hold of it, even more, if it
is exchanged by mail.

Using
other Keycloak client authenticator

The 2 other alternatives not exposing clientID/client-secret with
keycloak are to use specific keycloak client authenticator such as:

• Signed JWT client authenticator
• X509 client authentificator

Using
Signed JWT client authenticator

When choosing this credential type you will have to also generate
a private key and certificate for the client. The private key will be
used to sign the JWT, while the certificate is used by the server to
verify the signature. Click on the Generate new
keys and certificate button to start this process.

There overall mechanism is that:

• Client application provides a PKI (with key store)
• client app request are signed using the private key
• keycloak is importing the certificate public key in its
  external keystore

JWKS_URI

Client can also implement the a JWKS_URI.

The advantages are:

• keycloak no longer needs import the public key, as it get
  automatically uploaded through JWKS_URI mechanism
• It is possible to perform key rotation on regular basis
  (daily, weekly …) at client application level

   

  • as the jwks_uri mechanism is in place to retrieve the new
    public key, this has no impact on the overall keycloak
    infrastructure

     

https://www.keycloak.org/docs/latest/server_admin/index.html#_client-credentials

Signed
JWT allocator – example

Keycloak provides out-of-the box an example showcasing how to use
signed JWT allocator out of the box.

Product-portal
example

The product portal example is part of keycloak source distribution
and the source code is available at

Registration
of the product-portal client application in keycloak

The product-portal client needs to be registered as client-jwt
authenticator app.

This can be done as follows in json file
format

(extract from testrealm.json)

 {    "clientId": "product-portal",    "enabled": true,    "adminUrl": "/product-portal",    "baseUrl": "/product-portal",    "redirectUris": [        "/product-portal/*"    ],    "clientAuthenticatorType": "client-jwt",    "attributes": {        "use.jwks.url": "true",        "jwks.url": "/product-portal/k_jwks"    }}

Keycloak.json file (product-portal app)

The keycloak.json which is part of the client product-portal app
indicates how this client application authenticates against Keycloak.

The 2 important points to be noticed are:

• « clientAuthenticatorType »: « client-jwt », use.jwks.url »: « true »
• use.jwks.url »: « true »
  • « jwks.url »: « /product-portal/k_jwks

 {            "clientId": "product-portal",            "enabled": true,            "adminUrl": "/product-portal",            "baseUrl": "/product-portal",            "redirectUris": [                "/product-portal/*"            ],            "clientAuthenticatorType": "client-jwt",            "attributes": {                "use.jwks.url": "true",                "jwks.url": "/product-portal/k_jwks"            }        },

Client-app
keystore

The client app has its own keystore

Log
trace

The interesting lines are:

• (1) getting of
  jwks_uri

  adminRequest
  https://localhost:8080/product-portal/k_jwks

   

• (2) indicating that
  authentication occurred using client-jwt
  [org.keycloak.authentication.ClientAuthenticationFlow]
  (default task-12) Client product-portal authenticated by client-jwt