-
Notifications
You must be signed in to change notification settings - Fork 8.7k
Add support for per-client signing key selection for SAML and OIDC #47277
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Open
wadahiro
wants to merge
1
commit into
keycloak:main
Choose a base branch
from
openstandia:issue-10367
base: main
Could not load branches
Branch not found: {{ refName }}
Loading
Could not load tags
Nothing to show
Loading
Are you sure you want to change the base?
Some commits from the old base branch may be removed from the timeline,
and old review comments may become outdated.
Open
Changes from all commits
Commits
File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
145 changes: 145 additions & 0 deletions
145
js/apps/admin-ui/src/components/signing-key/SigningKeySelect.tsx
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,145 @@ | ||
| import { useWatch } from "react-hook-form"; | ||
| import { useTranslation } from "react-i18next"; | ||
| import { SelectControl } from "@keycloak/keycloak-ui-shared"; | ||
| import type { KeyMetadataRepresentation } from "@keycloak/keycloak-admin-client/lib/defs/keyMetadataRepresentation"; | ||
| import { useRealmKeys } from "./useRealmKeys"; | ||
|
|
||
| type SigningKeySelectProps = { | ||
| name: string; | ||
| protocol: "openid-connect" | "saml"; | ||
| label: string; | ||
| labelIcon: string; | ||
| // When several selectors share one parent (the OIDC advanced tab renders four), the | ||
| // parent fetches the realm keys once with useRealmKeys() and passes them in to avoid | ||
| // duplicate requests. Omit for standalone usage (e.g. the single SAML selector), in which | ||
| // case the component fetches them itself. `undefined` means "not provided"; an empty array | ||
| // means "fetched, but the realm has no keys". | ||
| realmKeys?: KeyMetadataRepresentation[]; | ||
| canViewRealmKeys?: boolean; | ||
| }; | ||
|
|
||
| // The kid is a long opaque string; a short prefix is appended to the label so the | ||
| // selected option (the collapsed toggle only renders the label, not the description) | ||
| // still shows which key is chosen. The full kid is repeated as the option description. | ||
| const KID_LABEL_LENGTH = 12; | ||
| const truncateKid = (kid: string) => | ||
| kid.length > KID_LABEL_LENGTH ? `${kid.slice(0, KID_LABEL_LENGTH)}…` : kid; | ||
|
|
||
| // Order within a protocol's key list: group by algorithm, then active keys first | ||
| // (highest-priority active is the realm's default for that algorithm), then by | ||
| // priority descending so the effective signing key surfaces at the top of its group. | ||
| const STATUS_ORDER: Record<string, number> = { | ||
| ACTIVE: 0, | ||
| PASSIVE: 1, | ||
| DISABLED: 2, | ||
| }; | ||
|
|
||
| function formatKeyOption( | ||
| kid: string, | ||
| algorithm: string | undefined, | ||
| status: string | undefined, | ||
| priority: number | undefined, | ||
| t: (key: string) => string, | ||
| ): string { | ||
| const alg = algorithm ?? "unknown"; | ||
| const shortKid = truncateKid(kid); | ||
| const prio = `${t("signingKeyPriority")} ${priority ?? 0}`; | ||
| switch (status) { | ||
| case "ACTIVE": | ||
| return `${alg} (${t("signingKeyActive")}, ${prio}) - ${shortKid}`; | ||
| case "PASSIVE": | ||
| return `${alg} (${t("signingKeyPassive")}, ${prio}) - ${shortKid}`; | ||
| case "DISABLED": | ||
| return `${alg} (${t("signingKeyDisabled")}, ${prio}) - ${shortKid}`; | ||
| default: | ||
| return `${t("signingKeyNotFound")} - ${shortKid}`; | ||
| } | ||
| } | ||
|
|
||
| export const SigningKeySelect = ({ | ||
| name, | ||
| protocol, | ||
| label, | ||
| labelIcon, | ||
| realmKeys: providedRealmKeys, | ||
| canViewRealmKeys: providedCanViewRealmKeys, | ||
| }: SigningKeySelectProps) => { | ||
| const { t } = useTranslation(); | ||
| const currentValue = useWatch({ name }); | ||
|
|
||
| // Fetch internally only when a parent hasn't already provided the keys. When the admin | ||
| // can't list the realm keys, the selector degrades to read-only and preserves the | ||
| // currently configured value. | ||
| const fetched = useRealmKeys(providedRealmKeys === undefined); | ||
| const realmKeys = providedRealmKeys ?? fetched.realmKeys; | ||
| const canViewRealmKeys = providedCanViewRealmKeys ?? fetched.canViewRealmKeys; | ||
|
|
||
| const toOption = ( | ||
| kid: string, | ||
| alg?: string, | ||
| status?: string, | ||
| priority?: number, | ||
| ) => ({ | ||
| key: kid, | ||
| value: formatKeyOption(kid, alg, status, priority, t), | ||
| // Full kid shown as the option description (second line); the label carries a short prefix. | ||
| description: kid, | ||
| }); | ||
|
|
||
| const isSigningKey = (k: KeyMetadataRepresentation) => | ||
| k.kid && | ||
| k.algorithm && | ||
| k.use === "SIG" && | ||
| ["ACTIVE", "PASSIVE", "DISABLED"].includes(k.status!); | ||
|
|
||
| // SAML: only RS256 keys are supported (server-side key lookup uses Algorithm.RS256) | ||
| // OIDC: exclude HMAC (OCT) keys as they are derived from client secrets, not realm keys | ||
| const isKeyTypeAllowed = (k: KeyMetadataRepresentation) => | ||
| protocol === "saml" ? k.algorithm === "RS256" : k.type !== "OCT"; | ||
|
|
||
| const filtered = realmKeys | ||
| .filter((k) => isSigningKey(k) && isKeyTypeAllowed(k)) | ||
| .sort((a, b) => { | ||
| const byAlgorithm = (a.algorithm ?? "").localeCompare(b.algorithm ?? ""); | ||
| if (byAlgorithm !== 0) return byAlgorithm; | ||
| const byStatus = | ||
| (STATUS_ORDER[a.status!] ?? 99) - (STATUS_ORDER[b.status!] ?? 99); | ||
| if (byStatus !== 0) return byStatus; | ||
| return (b.providerPriority ?? 0) - (a.providerPriority ?? 0); | ||
| }) | ||
| .map((k) => toOption(k.kid!, k.algorithm, k.status, k.providerPriority)); | ||
|
|
||
| // If the configured key is not in the eligible list, it is either deleted or exists but | ||
| // is ineligible for this protocol (wrong type/algorithm). Either way the server will not | ||
| // use it — it falls back to the realm's active key — so render it as "Not found" rather | ||
| // than surfacing its real (misleading) status metadata as if it were usable. | ||
| const notFound = (() => { | ||
| if (!currentValue || filtered.some((o) => o.key === currentValue)) | ||
| return []; | ||
| return [toOption(currentValue)]; | ||
| })(); | ||
|
|
||
| // Without realm access the key list can't be fetched, so keep only the realm-active | ||
| // option plus the currently configured key (shown as its raw kid) to preserve the value. | ||
| const keyOptions = canViewRealmKeys | ||
| ? [ | ||
| { key: "", value: t("signingKeyUseRealmActive") }, | ||
| ...filtered, | ||
| ...notFound, | ||
| ] | ||
| : [ | ||
| { key: "", value: t("signingKeyUseRealmActive") }, | ||
| ...(currentValue ? [{ key: currentValue, value: currentValue }] : []), | ||
| ]; | ||
|
|
||
| return ( | ||
| <SelectControl | ||
| name={name} | ||
| label={label} | ||
| labelIcon={labelIcon} | ||
| controller={{ defaultValue: "" }} | ||
| options={keyOptions} | ||
| isDisabled={!canViewRealmKeys} | ||
| /> | ||
| ); | ||
| }; |
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.