8000 Add conditional http request header to close #14604 by kreativmonkey · Pull Request #14605 · keycloak/keycloak · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content

Add conditional http request header to close #14604 #14605

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Add conditional http request header to close #14604 #14605

wants to merge 1 commit into from

Conversation

kreativmonkey
Copy link

This change will be close #14604

I added a condition to check the http request header to match on a regex string.
It is inspired by the ConditionalOTPFormAuthenticator but not limited to the OTP Form.

@stianst stianst added the missing/tests Tests are missing label Oct 4, 2022
@kreativmonkey
Copy link
Author

@stianst can you explain how to add tests to this feature? i can't find any example for that.

@thomasdarimont
Copy link
Contributor
thomasdarimont commented Nov 21, 2022 •
edited
Loading

@kreativmonkey take a look at this: org.keycloak.testsuite.forms.AllowDenyAuthenticatorTest#testDenyAccessWithNegateUserAttributeCondition

... however there seems to be no way currently to use a custom HTTP header with the webdriver.
How about the following:

Take a look at org.keycloak.testsuite.forms.DirectGrantFlowTest and create a custom direct grant flow with your conditional authenticator and use a http client to call the token endpoint with grant_type=password and without your custom http header.

@kreativmonkey
Copy link
Author

Thanks for your answer, I need to figure out how to do the tests. It's much more work than writing the condition ;-)

@kreativmonkey kreativmonkey mentioned this pull request Jan 23, 2023
Closed
@kreativmonkey kreativmonkey requested a review from a team as a code owner March 3, 2023 08:13
@kreativmonkey kreativmonkey requested review from a team as code owners March 9, 2023 14:09
@kreativmonkey kreativmonkey requested a review from a team March 9, 2023 14:09
@kreativmonkey kreativmonkey force-pushed the main branch 3 times, most recently from 4497e92 to 46c7662 Compare March 10, 2023 09:15
@kreativmonkey
Copy link
Author
kreativmonkey commented Mar 10, 2023 •
edited
Loading

@stianst I have finished the implementation of tests.

At this point I would like to explain the condition again in more detail. With this authenticator it is possible to check the http header for certain entries using regex patterns. This allows for example to check if a login request comes from the company network or from external. For example, this can be used to control the query of the 2FA.

The Authenticator is a bit more flexible than just checking for IP ranges (#16453). However, the user interface is not as comfortable and the operation is not as easy.

As an example to match a specific IP range 203.0.113.0/24 you need to add the regex like: X-Forwarded-For: 203\.0\.113\.\b(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?(\.|$)). But of course, you are not limited to the X-Forwarded-For header.

add Conditional http request header
6ab91a1 
This change will add a condition to check the http request header to match on a regex string.
It is inspired by the ConditionalOTPFormAuthenticator but not limited to the OTP Form.
@kreativmonkey
Copy link
Author

is there still somthing missing?

@col-panic
Copy link

I have the following scenario: both internal and external network. If the request originates from the internal network, I add the HTTP Header IngressNetwork: internal.

Now if a login request originates from the external network (header is missing), I only want to allow it IF the user already configured its credentials including the 2FA. That is, initial password change and 2FA setting should NOT be possible if connecting from the external network.

So I guess in the Condition that User Configured is not the case, I would need a Sub flow with this conditional to check.
Do you think this can be realized with your code? If yes, I'll dig deeper! thanks

@col-panic
Copy link

Thank you for your PR - as I needed this functionality, I took the liberty to create it as a separate repository to build as keycloak-extension in https://github.com/elexis/keycloak-conditional-http-header-authenticator.

@romge
Copy link
Contributor
romge commented Mar 31, 2025

I'm also using this condition and it would be great if it could be merged into main. Thank you for your effort.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
missing/tests Tests are missing
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

Condition to check the HTTP Request header
5 participants
@kreativmonkey @thomasdarimont @col-panic @romge @stianst
0