Example: RFC 8705 - OAuth MTLS

[tnpradeep]

Hi,

Are you already supporting certificate based oauth client authentication (mtls) ?
Any plans to support it?

References:
OAuth MTLS : https://oauth.net/2/mtls/
RFC 8705: https://datatracker.ietf.org/doc/html/rfc8705

Thanks
Pradeep

[pboling]

All efforts are directed at preparing the v2 release, and no new features are planned right now. However, we very much encourage Pull Requests if you want to take a stab at it. I'll make a note to review this once I have v2 closer release-ready.

[stanhu]

@pboling What do you think about removing this from the 2.0 milestone?

I found these references useful:

1. https://youtu.be/kRI5geKohjo?t=3035
2. https://auth0.com/blog/identity-unlocked-explained-episode-1/
3. https://backstage.forgerock.com/docs/ig/7/gateway-guide/oauth2-rs-introspect-mtls.html

Thinking aloud, I think to support RFC 8705, I wonder if we don't actually have to make any changes here. Client#get_token needs clientCertificate as a parameter.

I initially thought Client#connection needs to set up a connection with mutual TLS by configuring Faraday to use client_cert and client_key (https://github.com/lostisland/faraday/blob/21ac595919b0372b41386ae00640e16f73a20d31/lib/faraday/options/ssl_options.rb#L45), but I think that's only needed by the client accessing the resource.

It seems to me most of the heavy lifting of RFC 8705 is on the server side, which has to:

1. Retrieve the peer certificate from the TLS connection.
2. Verify that the cnf value matches the certificate used.

But I don't think this library needs to handle this?

It does look like Keycloak supports RFC 8705: https://www.keycloak.org/docs/17.0/server_admin/#con-advanced-settings_server_administration_guide

[stanhu]

Ok, re-reading https://backstage.forgerock.com/docs/ig/7/gateway-guide/oauth2-rs-introspect-mtls.html, I believe we have to enable mutual TLS on Faraday, so perhaps the client_cert and client_key need to be parameters in #initialize.

[stanhu]

Oh, I think this can just be passed via connection_opts, so maybe nothing has to change in the code? We can document this:

client = OAuth2::Client.new('YOUR-CLIENT-ID', 'YOUR-CLIENT-SECRET',
  site: 'https://example.com',
  authorize_url: '/oauth/authorize/',
  token_url: '/oauth/token/',
  connection_opts: {
    ssl: {
      client_cert: OpenSSL::X509::Certificate.new(File.read('localhost.pem')),
      client_key: OpenSSL::PKey::RSA.new(File.read('localhost-key.pem'))
    }
  })

[stanhu]

Relevant Keycloak pull requests for mutual TLS support:

1. KEYCLOAK-6771 Holder of Key mechanism: OAuth 2.0 Mutual TLS Client Authentication and Certificate Bound Access Tokens keycloak/keycloak#5083
2. Keycloak 7635/part 2 keycloak/keycloak#5449

[pboling]

Thanks for looking into this @stanhu. The documentation solution seems to be the right one. Leaving this open as a reminder to add documentation, and removing from 2.0.0 milestone, since that's not relevant.