merge: shared Google brokering baseline
This commit is contained in:
donghyeon-ka
@@ -0,0 +1,27 @@
|
||||
# First Broker Login security
|
||||
|
||||
Keycloak 26.7.0's built-in `first broker login` flow does **not** silently
|
||||
auto-link by email. It contains:
|
||||
|
||||
- `Create User If Unique`
|
||||
- `Handle Existing Account`
|
||||
- `Confirm link existing account`
|
||||
- email verification or re-authentication ownership proof
|
||||
|
||||
`Automatically set existing user` is an explicit, dangerous opt-in. The local
|
||||
acceptance harness copies the built-in flow, enables AutoLink, disables the
|
||||
ownership-proof branch, and signs in through a controllable OIDC account whose
|
||||
email collides with `regular-user`. It verifies that the external identity is
|
||||
attached without proof. The harness then assigns the original built-in flow,
|
||||
repeats the login, observes the existing-account confirmation page, and verifies
|
||||
that no federated identity was attached.
|
||||
|
||||
Run after the stack is healthy:
|
||||
|
||||
```bash
|
||||
./scripts/verify-first-broker-login.sh
|
||||
```
|
||||
|
||||
The vulnerable flow remains only as a disabled learning artifact. The
|
||||
`mock-google` provider is always returned to the secure built-in flow at the end
|
||||
of the verification.
|
||||
@@ -0,0 +1,28 @@
|
||||
# Google IdP brokering
|
||||
|
||||
Keycloak is the only issuer trusted by AP1–AP4. Google is an upstream Identity
|
||||
Provider; applications do not receive or validate a Google token.
|
||||
|
||||
## Two verification profiles
|
||||
|
||||
The default local profile imports a second Keycloak realm named `mock-google`.
|
||||
It acts as a controllable OIDC provider and allows tests to choose claims such
|
||||
as a duplicate email, `email_verified=false`, `hd`, and `picture`. This is the
|
||||
safe way to reproduce an unsafe email auto-link without impersonating a real
|
||||
Google account.
|
||||
|
||||
The real-Google profile is configured explicitly:
|
||||
|
||||
1. Create a Google OAuth **Web application**.
|
||||
2. Register the exact redirect URI printed by
|
||||
`./scripts/configure-google-idp.sh`.
|
||||
3. Put `GOOGLE_CLIENT_ID` and `GOOGLE_CLIENT_SECRET` in ignored `.env`.
|
||||
4. Start the stack and run the configuration script.
|
||||
|
||||
The script writes `providerId=google`, `trustEmail=false`, minimal
|
||||
`openid profile email` scopes, and `syncMode=IMPORT` through the Keycloak Admin
|
||||
API. Credentials are never written to the realm export or repository.
|
||||
|
||||
Google requires a public HTTPS redirect for non-local deployments. Local mock
|
||||
verification proves the Keycloak brokering boundary; a real Google login is a
|
||||
separate credentialed acceptance profile.
|
||||
@@ -0,0 +1,29 @@
|
||||
# Keycloak branch implementation index
|
||||
|
||||
The source inventory contains 39 `feature-keycloak-*.md` branch notes. This
|
||||
repository preserves one local Git feature branch for every note and merges it
|
||||
with `--no-ff` into either the common `develop` baseline or one of the four
|
||||
authentication-pattern branches.
|
||||
|
||||
| Target | Meaning |
|
||||
|---|---|
|
||||
| `common` | Shared realm, federation, deployment, or governance contract. Merge into `develop`, then propagate to AP1–AP4. |
|
||||
| `ap1` | Browser-based OAuth client: vanilla SPA, Authorization Code + PKCE, Resource Server. |
|
||||
| `ap2` | Token-mediating confidential backend: browser receives access token only. |
|
||||
| `ap3` | BFF: backend owns every OAuth token and browser owns only a session cookie. |
|
||||
| `ap4` | Edge forward-auth: oauth2-proxy/Nginx owns login and backend trusts an isolated identity header. |
|
||||
|
||||
The machine-readable registry is
|
||||
[`keycloak-branch-manifest.tsv`](keycloak-branch-manifest.tsv). Run:
|
||||
|
||||
```bash
|
||||
./scripts/audit-keycloak-branches.sh
|
||||
```
|
||||
|
||||
The audit succeeds only when all 39 note names have matching local feature
|
||||
branches and each feature tip is reachable from its declared target branch.
|
||||
|
||||
Google credentials are never committed. The default local acceptance harness
|
||||
uses a second Keycloak realm as a controllable OIDC provider so claim mapping
|
||||
and unsafe-linking failure paths can be reproduced. A real Google login remains
|
||||
an explicit credentialed/public-HTTPS verification profile.
|
||||
@@ -0,0 +1,40 @@
|
||||
branch target delivery
|
||||
feature/keycloak-account-linking-spa-ux ap1 documented-and-contract-tested
|
||||
feature/keycloak-account-linking-sub-vs-email common documented-and-contract-tested
|
||||
feature/keycloak-bff-csrf-samesite-defense ap3 locally-verified
|
||||
feature/keycloak-bff-oauth2login-session ap3 locally-verified
|
||||
feature/keycloak-bff-vs-spa-direct ap3 documented
|
||||
feature/keycloak-docker-compose-stack common locally-verified
|
||||
feature/keycloak-edge-forwardauth-google-federation ap4 documented-and-config-tested
|
||||
feature/keycloak-edge-forwardauth-no-google ap4 documented-and-config-tested
|
||||
feature/keycloak-federation-spa-zero-change ap1 contract-tested
|
||||
feature/keycloak-first-broker-login-flow common locally-verified-with-mock-idp
|
||||
feature/keycloak-four-pattern-tradeoff-matrix common documented-and-evidence-linked
|
||||
feature/keycloak-google-claim-attribute-mapping common locally-verified-with-mock-idp
|
||||
feature/keycloak-google-redirect-uri-policy common config-tested
|
||||
feature/keycloak-header-spoofing-defense ap4 locally-verified
|
||||
feature/keycloak-https-termination-caddy-nginx common config-tested
|
||||
feature/keycloak-idp-brokering-google-client common locally-verified-with-mock-idp
|
||||
feature/keycloak-idp-mappers-claim-to-role common locally-verified-with-mock-idp
|
||||
feature/keycloak-internal-spa-direct-google-federation ap1 documented-and-contract-tested
|
||||
feature/keycloak-internal-spa-direct-no-google ap1 documented-and-contract-tested
|
||||
feature/keycloak-iss-claim-hostname-mismatch ap1 locally-verified
|
||||
feature/keycloak-nginx-auth-request-integration ap4 locally-verified
|
||||
feature/keycloak-oauth2-proxy-oidc-flow ap4 locally-verified
|
||||
feature/keycloak-patterns common governance
|
||||
feature/keycloak-pkce-flow-stages ap1 contract-tested
|
||||
feature/keycloak-public-domain-tunneling common config-tested
|
||||
feature/keycloak-realm-client-export common locally-verified
|
||||
feature/keycloak-refresh-rotation-and-logout ap1 locally-verified
|
||||
feature/keycloak-refresh-token-rotation ap1 contract-tested
|
||||
feature/keycloak-reverse-proxy-headers common config-tested
|
||||
feature/keycloak-single-ec2-google-federation ap1 documented-and-config-tested
|
||||
feature/keycloak-single-ec2-no-google ap1 documented-and-contract-tested
|
||||
feature/keycloak-spa-token-storage-tradeoff ap1 locally-verified
|
||||
feature/keycloak-spring-rs-audience-validator ap1 locally-verified
|
||||
feature/keycloak-spring-rs-role-mapping ap1 locally-verified
|
||||
feature/keycloak-three-leg-trust-chain ap1 documented-and-contract-tested
|
||||
feature/keycloak-token-mediating-access-handoff ap2 locally-verified
|
||||
feature/keycloak-token-mediating-confidential-client ap2 locally-verified
|
||||
feature/keycloak-traefik-forwardauth-alternative ap4 config-tested
|
||||
feature/keycloak-vanilla-js-spa-pkce ap1 locally-verified
|
||||
|
Reference in New Issue
Block a user