Create SAML client with keycloak admin api wrong value for signing

[devmanspi]

Before reporting an issue

• I have read and understood the above terms for submitting issues, and I understand that my issue may be closed without action if I do not follow them.

Area

admin/api

Describe the bug

I am using the keycloak admin api in my own java application to administrate keycloak from there.
Now i want to create a SAMl client from there.

In my SP metadata signing is set to false (e.g. AuthnRequestsSigned="false") and I'm not providing any certificate.

When I create a SAML client with this metadata in the keycloak admin api, the resulting client doesn't have the right value for 'Client signature required' (it's always true). Everything else seems to be converted correctly from the metadata and the client is created successfully.

If I use the import client function in the keycloak admin console (web) I can see the switch for 'Client signature required' is turning on or off based on the metadata I'm providing and the client is created with the rigth value for this.

Version

24.0.2

Regression

• The issue is a regression

Expected behavior

The SAML client I'm creating with the admin api in my java app should have 'Client signature required' based on the SP metadata.

Actual behavior

The SAML client always has 'Client signature required' set to true.

How to Reproduce?

1. Create a client with the admin api using metadata that has signing set to false.

Keycloak keycloak = Keycloak.getInstance(...);
RealmResource realm = keycloak.realm(realmName);
String metadata;
...
ClientRepresentation cliRep = realm.convertClientDescription(metadata);
Response kcResp = realm.clients().create(cliRep);

2. Check the client and see that 'Client signature required' is set to true.

3. Create a client with the admin console (web) using the same metadata as before. This client has 'Client signature required' set based on the metadata.

Anything else?

Example SP metadata with signing=false

<?xml version="1.0"?><md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" validUntil="2024-04-04T13:52:37Z" cacheDuration="PT604800S" entityID="http://example.saml.client" ID="ONELOGIN_0d4ce3be-d87a-4fee-938c-e5958d2cc6bc"><md:SPSSODescriptor AuthnRequestsSigned="false" WantAssertionsSigned="false" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol"><md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="http://mySPHost:1234/mySamlClient/sls.jsp"/><md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</md:NameIDFormat><md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="http://mySPHost:1234/mySamlClient/acs.jsp" index="1"/></md:SPSSODescriptor><md:Organization><md:OrganizationName xml:lang="en">SP Java</md:OrganizationName><md:OrganizationDisplayName xml:lang="en">SP Java Example</md:OrganizationDisplayName><md:OrganizationURL xml:lang="en">http://sp.example.com</md:OrganizationURL></md:Organization><md:ContactPerson contactType="technical"><md:GivenName>Technical Guy</md:GivenName><md:EmailAddress>technical@example.com</md:EmailAddress></md:ContactPerson><md:ContactPerson contactType="support"><md:GivenName>Support Guy</md:GivenName><md:EmailAddress>support@example.com</md:EmailAddress></md:ContactPerson></md:EntityDescriptor>

Example SP metadata with signing=true

<?xml version="1.0"?><md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" validUntil="2024-04-04T14:18:40Z" cacheDuration="PT604800S" entityID="http://example.saml.client" ID="ONELOGIN_296e840e-8a5a-40e0-9e80-267e63552cca"><md:SPSSODescriptor AuthnRequestsSigned="true" WantAssertionsSigned="false" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol"><md:KeyDescriptor use="signing"><ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#"><ds:X509Data><ds:X509Certificate>
...
</ds:X509Certificate></ds:X509Data></ds:KeyInfo></md:KeyDescriptor><md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="http://mySPHost:1234/mySamlClient/sls.jsp"/><md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</md:NameIDFormat><md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="http://mySPHost:1234/mySamlClient/acs.jsp" index="1"/></md:SPSSODescriptor><md:Organization><md:OrganizationName xml:lang="en">SP Java</md:OrganizationName><md:OrganizationDisplayName xml:lang="en">SP Java Example</md:OrganizationDisplayName><md:OrganizationURL xml:lang="en">http://sp.example.com</md:OrganizationURL></md:Organization><md:ContactPerson contactType="technical"><md:GivenName>Technical Guy</md:GivenName><md:EmailAddress>technical@example.com</md:EmailAddress></md:ContactPerson><md:ContactPerson contactType="support"><md:GivenName>Support Guy</md:GivenName><md:EmailAddress>support@example.com</md:EmailAddress></md:ContactPerson></md:EntityDescriptor>

[keycloak-github-bot]

Thanks for reporting this issue, but as this is reported against an older and unsupported release we are not able to evaluate the issue. Please verify with the nightly buildor the latest release.

If the issue can be reproduced in the nightly build or latest release add a comment with additional information, otherwise this issue will be automatically closed within 14 days.

[devmanspi]

Thanks for reporting this issue, but as this is reported against an older and unsupported release we are not able to evaluate the issue. Please verify with the nightly buildor the latest release.

If the issue can be reproduced in the nightly build or latest release add a comment with additional information, otherwise this issue will be automatically closed within 14 days.

I updated to v24.0.2, still same behaviour.

[rmartinc]

Hi @devmanspi!

This is a real issue but I think that it's low priority. The main reason is the converter is just adding SAML_CLIENT_SIGNATURE_ATTRIBUTE to true when the signing certificate is there (here). There is a setupClientDefaults that enables some default values because of security (one of them is client signatures to true). So if it is not specified then it will be true. Probably the converter needs to set it to true/false depending the AuthnRequestsSigned in the metadata. Nevertheless using SAML without signatures is a big security risk and totally not recommended for any production environment. If someone wants to fix this a test will be needed, for example in ClientDescriptionConverterTest.