Implement recovery key support for user storage providers #2
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change | ||||
|---|---|---|---|---|---|---|
|
|
@@ -18,11 +18,12 @@ | |||||
|
|
||||||
| package org.keycloak.testsuite.federation; | ||||||
|
|
||||||
| import java.io.IOException; | ||||||
| import java.util.ArrayList; | ||||||
| import java.util.HashSet; | ||||||
| import java.util.List; | ||||||
| import java.util.Map; | ||||||
| import java.util.Set; | ||||||
| import java.util.stream.Stream; | ||||||
|
|
||||||
| import org.jboss.logging.Logger; | ||||||
|
|
@@ -33,7 +34,6 @@ | |||||
| import org.keycloak.credential.CredentialInputValidator; | ||||||
| import org.keycloak.credential.CredentialModel; | ||||||
| import org.keycloak.credential.hash.PasswordHashProvider; | ||||||
| import org.keycloak.models.GroupModel; | ||||||
| import org.keycloak.models.KeycloakSession; | ||||||
| import org.keycloak.models.OTPPolicy; | ||||||
|
|
@@ -43,6 +43,8 @@ | |||||
| import org.keycloak.models.UserModel; | ||||||
| import org.keycloak.models.cache.UserCache; | ||||||
| import org.keycloak.models.credential.PasswordUserCredentialModel; | ||||||
| import org.keycloak.models.credential.RecoveryAuthnCodesCredentialModel; | ||||||
| import org.keycloak.models.utils.KeycloakModelUtils; | ||||||
| import org.keycloak.models.utils.TimeBasedOTP; | ||||||
| import org.keycloak.storage.StorageId; | ||||||
| import org.keycloak.storage.UserStorageProvider; | ||||||
|
|
@@ -51,11 +53,12 @@ | |||||
| import org.keycloak.storage.user.UserLookupProvider; | ||||||
| import org.keycloak.storage.user.UserQueryProvider; | ||||||
| import org.keycloak.storage.user.UserRegistrationProvider; | ||||||
| import org.keycloak.util.JsonSerialization; | ||||||
|
|
||||||
| /** | ||||||
| * UserStorage implementation created in Keycloak 4.8.3. It is used for backwards compatibility testing. Future Keycloak versions | ||||||
| * should work fine without a need to change the code of this provider. | ||||||
| * <p> | ||||||
| * TODO: Have some good mechanims to make sure that source code of this provider is really compatible with Keycloak 4.8.3 | ||||||
| * | ||||||
| * @author <a href="mailto:[email protected]">Marek Posolda</a> | ||||||
|
|
@@ -89,7 +92,7 @@ public UserModel getUserById(RealmModel realm, String id) { | |||||
| } | ||||||
|
|
||||||
| private UserModel createUser(RealmModel realm, String username) { | ||||||
| return new AbstractUserAdapterFederatedStorage(session, realm, model) { | ||||||
| @Override | ||||||
| public String getUsername() { | ||||||
| return username; | ||||||
|
|
@@ -107,7 +110,8 @@ public void setUsername(String username1) { | |||||
| @Override | ||||||
| public boolean supportsCredentialType(String credentialType) { | ||||||
| if (CredentialModel.PASSWORD.equals(credentialType) | ||||||
| || isOTPType(credentialType) | ||||||
| || credentialType.equals(RecoveryAuthnCodesCredentialModel.TYPE)) { | ||||||
| return true; | ||||||
| } else { | ||||||
| log.infof("Unsupported credential type: %s", credentialType); | ||||||
|
|
@@ -172,6 +176,7 @@ public boolean updateCredential(RealmModel realm, UserModel user, CredentialInpu | |||||
| OTPPolicy otpPolicy = session.getContext().getRealm().getOTPPolicy(); | ||||||
|
|
||||||
| CredentialModel newOTP = new CredentialModel(); | ||||||
| newOTP.setId(KeycloakModelUtils.generateId()); | ||||||
| newOTP.setType(input.getType()); | ||||||
| long createdDate = Time.currentTimeMillis(); | ||||||
| newOTP.setCreatedDate(createdDate); | ||||||
|
|
@@ -184,6 +189,15 @@ public boolean updateCredential(RealmModel realm, UserModel user, CredentialInpu | |||||
|
|
||||||
| users.get(translateUserName(user.getUsername())).otp = newOTP; | ||||||
|
|
||||||
| return true; | ||||||
| } else if (input.getType().equals(RecoveryAuthnCodesCredentialModel.TYPE)) { | ||||||
| CredentialModel recoveryCodesModel = new CredentialModel(); | ||||||
| recoveryCodesModel.setId(KeycloakModelUtils.generateId()); | ||||||
| recoveryCodesModel.setType(input.getType()); | ||||||
| recoveryCodesModel.setCredentialData(input.getChallengeResponse()); | ||||||
| long createdDate = Time.currentTimeMillis(); | ||||||
| recoveryCodesModel.setCreatedDate(createdDate); | ||||||
| users.get(translateUserName(user.getUsername())).recoveryCodes = recoveryCodesModel; | ||||||
| return true; | ||||||
| } else { | ||||||
| log.infof("Attempt to update unsupported credential of type: %s", input.getType()); | ||||||
|
|
@@ -213,6 +227,30 @@ private MyUser getMyUser(UserModel user) { | |||||
| return users.get(translateUserName(user.getUsername())); | ||||||
| } | ||||||
|
|
||||||
| @Override | ||||||
| public Stream<CredentialModel> getCredentials(RealmModel realm, UserModel user) { | ||||||
| var myUser = getMyUser(user); | ||||||
| RecoveryAuthnCodesCredentialModel model; | ||||||
| List<CredentialModel> credentialModels = new ArrayList<>(); | ||||||
| if (myUser.recoveryCodes != null) { | ||||||
| try { | ||||||
| model = RecoveryAuthnCodesCredentialModel.createFromValues( | ||||||
| JsonSerialization.readValue(myUser.recoveryCodes.getCredentialData(), List.class), | ||||||
| myUser.recoveryCodes.getCreatedDate(), | ||||||
| myUser.recoveryCodes.getUserLabel() | ||||||
| ); | ||||||
| credentialModels.add(model); | ||||||
| } catch (IOException e) { | ||||||
| log.error("Could not deserialize credential of type: recovery-codes"); | ||||||
| } | ||||||
| } | ||||||
| if (myUser.otp != null) { | ||||||
| credentialModels.add(myUser.getOtp()); | ||||||
| } | ||||||
|
|
||||||
| return credentialModels.stream(); | ||||||
| } | ||||||
|
|
||||||
| @Override | ||||||
| public Stream<String> getDisableableCredentialTypesStream(RealmModel realm, UserModel user) { | ||||||
| Set<String> types = new HashSet<>(); | ||||||
|
|
@@ -234,6 +272,8 @@ public boolean isConfiguredFor(RealmModel realm, UserModel user, String credenti | |||||
|
|
||||||
| if (isOTPType(credentialType) && myUser.otp != null) { | ||||||
| return true; | ||||||
| } else if (credentialType.equals(RecoveryAuthnCodesCredentialModel.TYPE) && myUser.recoveryCodes != null) { | ||||||
| return true; | ||||||
| } else { | ||||||
| log.infof("Not supported credentialType '%s' for user '%s'", credentialType, user.getUsername()); | ||||||
| return false; | ||||||
|
|
@@ -283,7 +323,22 @@ public boolean isValid(RealmModel realm, UserModel user, CredentialInput input) | |||||
| TimeBasedOTP validator = new TimeBasedOTP(storedOTPCredential.getAlgorithm(), storedOTPCredential.getDigits(), | ||||||
| storedOTPCredential.getPeriod(), realm.getOTPPolicy().getLookAheadWindow()); | ||||||
| return validator.validateTOTP(otpCredential.getValue(), storedOTPCredential.getValue().getBytes()); | ||||||
| } else if (input.getType().equals(RecoveryAuthnCodesCredentialModel.TYPE)) { | ||||||
| CredentialModel storedRecoveryKeys = myUser.recoveryCodes; | ||||||
| if (storedRecoveryKeys == null) { | ||||||
| log.warnf("Not found credential for the user %s", user.getUsername()); | ||||||
| return false; | ||||||
| } | ||||||
| List generatedKeys; | ||||||
| try { | ||||||
| generatedKeys = JsonSerialization.readValue(storedRecoveryKeys.getCredentialData(), List.class); | ||||||
| } catch (IOException e) { | ||||||
| log.warnf("Cannot deserialize recovery keys credential for the user %s", user.getUsername()); | ||||||
| return false; | ||||||
| } | ||||||
|
|
||||||
| return generatedKeys.stream().anyMatch(key -> key.equals(input.getChallengeResponse())); | ||||||
|
There was a problem hiding this comment. logic: Plain text comparison used instead of hash verification. Should use
Suggested change
Prompt To Fix With AIThis is a comment left during a code review.
Path: testsuite/integration-arquillian/servers/auth-server/services/testsuite-providers/src/main/java/org/keycloak/testsuite/federation/BackwardsCompatibilityUserStorage.java
Line: 340:340
Comment:
**logic:** Plain text comparison used instead of hash verification. Should use `RecoveryAuthnCodesUtils.verifyRecoveryCodeInput()` to validate hashed codes consistently with the main credential provider.
```suggestion
return generatedKeys.stream().anyMatch(key -> RecoveryAuthnCodesUtils.verifyRecoveryCodeInput(input.getChallengeResponse(), key));
```
How can I resolve this? If you propose a fix, please make it concise. |
||||||
| } else { | ||||||
| log.infof("Not supported to validate credential of type '%s' for user '%s'", input.getType(), user.getUsername()); | ||||||
| return false; | ||||||
| } | ||||||
|
|
@@ -369,6 +424,7 @@ static class MyUser { | |||||
| private String username; | ||||||
| private CredentialModel hashedPassword; | ||||||
| private CredentialModel otp; | ||||||
| private CredentialModel recoveryCodes; | ||||||
|
|
||||||
| private MyUser(String username) { | ||||||
| this.username = username; | ||||||
|
|
@@ -377,6 +433,10 @@ private MyUser(String username) { | |||||
| public CredentialModel getOtp() { | ||||||
| return otp; | ||||||
| } | ||||||
|
|
||||||
| public CredentialModel getRecoveryCodes() { | ||||||
| return recoveryCodes; | ||||||
| } | ||||||
| } | ||||||
|
|
||||||
|
|
||||||
|
|
||||||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -50,4 +50,9 @@ public boolean hasUserOTP(String username) { | |
| return user.getOtp() != null; | ||
| } | ||
|
|
||
| public boolean hasRecoveryCodes(String username) { | ||
| BackwardsCompatibilityUserStorage.MyUser user = userPasswords.get(username); | ||
| if (user == null) return false; | ||
| return user.getRecoveryCodes() != null; | ||
| } | ||
| } | ||
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
logic: Storing unhashed recovery codes in user storage is a critical security vulnerability. The
generatedCodeslist contains plain text codes, but user storage providers may persist these to their backend systems. When stored in local DB viacreateCredential, codes are hashed (viaRecoveryAuthnCodesCredentialModel.createFromValues), but when stored in user storage viaupdateCredential, they remain unhashed.Prompt To Fix With AI