第 11 課：多重驗證 - OTP、WebAuthn 和金鑰

HTMLTAG_1046__HTMLTAG_1047___6.3 憑證對應策略___HTMLTAG_1048__HTMLTAG_1049

有多種方法可以將憑證對應到Keycloak使用者：

# 1. Subject's Common Name → Username
# Certificate: CN=john.doe, OU=Engineering, O=Example Corp
# → username: john.doe

# 2. Subject's e-mail → Email
# Certificate: [email protected]
# → email: [email protected]

# 3. Serial Number → User Attribute
# Certificate: Serial=1A2B3C4D
# → user attribute "x509_serial" = "1A2B3C4D"

# 4. SHA-256 Certificate Thumbprint → User Attribute
# Certificate SHA-256: ab:cd:ef:12:34:...
# → user attribute "x509_thumbprint" = "ab:cd:ef:12:34:..."

# 5. Subject's DN với regex
# Certificate: CN=john.doe, OU=Engineering, O=Example Corp, C=VN
# Regex: CN=(.*?)(?:,|$)
# → Extracted: john.doe

HTMLTAG_1052__HTMLTAG_1053___6.4 CRL 和 OCSP 檢查___HTMLTAG_1054__HTMLTAG_1055

確保憑證未被撤銷：

• Keycloak 從配置的 URI 下載並快取 CRL
• 檢查客戶端憑證的序號是否在CRL中__HTMLTAG_1066___
• 如果 CRL 不可用且 CRL 檢查已啟用=開 → 驗證失敗

___HTMLTAG_1072__HTMLTAG_1073___OCSP（線上憑證狀態協定）：HTMLTAG_1074__HTMLTAG_1075

• 即時查看憑證狀態
• Keycloak 向 OCSP 回應程序發送請求__HTMLTAG_1080___
• 比單獨檢查的 CRL 更快
• 缺點：取決於 OCSP 伺服器可用性

# Test OCSP check
openssl ocsp \
  -issuer ca.pem \
  -cert client.pem \
  -url http://ocsp.example.com \
  -resp_text

# Test certificate info
openssl x509 -in client.pem -noout -subject -serial -fingerprint -sha256

HTMLTAG_1086__HTMLTAG_1087___6.5 Keycloak mTLS 設定___HTMLTAG_1088__HTMLTAG_1089

為了讓Keycloak接收客戶端證書，需要直接配置反向代理或Keycloak：

# Docker Compose — Keycloak với mTLS qua nginx
services:
  nginx:
    image: nginx:latest
    ports:
      - "443:443"
    volumes:
      - ./nginx.conf:/etc/nginx/conf.d/default.conf
      - ./certs/server.crt:/etc/nginx/certs/server.crt
      - ./certs/server.key:/etc/nginx/certs/server.key
      - ./certs/ca.crt:/etc/nginx/certs/ca.crt
    depends_on:
      - keycloak

  keycloak:
    image: quay.io/keycloak/keycloak:26.0
    command: start --proxy-headers xforwarded
    environment:
      KC_HOSTNAME: keycloak.example.com
      KC_HTTP_ENABLED: "true"
      KC_PROXY_HEADERS: xforwarded
      KEYCLOAK_ADMIN: admin
      KEYCLOAK_ADMIN_PASSWORD: admin

# nginx.conf — Forward client certificate
server {
    listen 443 ssl;
    server_name keycloak.example.com;

    ssl_certificate /etc/nginx/certs/server.crt;
    ssl_certificate_key /etc/nginx/certs/server.key;
    ssl_client_certificate /etc/nginx/certs/ca.crt;
    ssl_verify_client optional;

    location / {
        proxy_pass http://keycloak:8080;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-Port 443;
        
        # Forward client certificate
        proxy_set_header ssl-client-cert $ssl_client_escaped_cert;
    }
}

HTMLTAG_1092__HTMLTAG_1093___7。比較 MFA 方法___HTMLTAG_1094__HTMLTAG_1095

HTMLTAG_1184__HTMLTAG_1185___8。摘要___HTMLTAG_1186__HTMLTAG_1187