第 19 課：進階安全性與 Vault 集成

HTMLTAG_753__HTMLTAG_754___7。點選劫持保護___HTMLTAG_755__HTMLTAG_756

點擊劫持攻擊將 Keycloak 登入頁面嵌入到 iframe 中以竊取憑證。

HTMLTAG_759__HTMLTAG_760___7.1 設定 X 框架選項___HTMLTAG_761__HTMLTAG_762

# Realm Settings → Security Defenses → Headers

X-Frame-Options: SAMEORIGIN
# - DENY: Không cho phép iframe dưới bất kỳ điều kiện nào
# - SAMEORIGIN: Chỉ cho phép iframe từ cùng origin
# - ALLOW-FROM uri: (deprecated, dùng CSP frame-ancestors thay thế)

___HTMLTAG_763__HTMLTAG_764___7.2 CSP 框架祖先（首選）HTMLTAG_765__HTMLTAG_766

# Content-Security-Policy header
frame-ancestors 'self';

# Cho phép specific parent origins
frame-ancestors 'self' https://portal.mycompany.com;

HTMLTAG_767__HTMLTAG_768___8。 HTTPS/TLS 強制執行___HTMLTAG_769__HTMLTAG_770

HTMLTAG_771__HTMLTAG_772___8.1 主機名稱與 TLS 設定___HTMLTAG_773__HTMLTAG_774

# Production: Strict HTTPS
bin/kc.sh start \
  --hostname=auth.mycompany.com \
  --hostname-strict=true \
  --https-certificate-file=/etc/certs/tls.crt \
  --https-certificate-key-file=/etc/certs/tls.key \
  --https-port=8443 \
  --http-enabled=false

___HTMLTAG_775__HTMLTAG_776___8.2 具有反向代理的 TLS（流行）HTMLTAG_777__HTMLTAG_778

# Khi sử dụng reverse proxy (Nginx, HAProxy) terminate TLS
bin/kc.sh start \
  --hostname=auth.mycompany.com \
  --hostname-strict=true \
  --proxy-headers=xforwarded \
  --http-enabled=true \
  --http-port=8080

# Nginx reverse proxy configuration
server {
    listen 443 ssl http2;
    server_name auth.mycompany.com;

    ssl_certificate /etc/ssl/certs/auth.mycompany.com.crt;
    ssl_certificate_key /etc/ssl/private/auth.mycompany.com.key;

    # Strong TLS configuration
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;
    ssl_prefer_server_ciphers off;

    # HSTS
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

    location / {
        proxy_pass http://keycloak:8080;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-Port $server_port;

        # WebSocket support
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";

        # Timeouts
        proxy_read_timeout 90s;
        proxy_send_timeout 90s;
    }
}

# Redirect HTTP to HTTPS
server {
    listen 80;
    server_name auth.mycompany.com;
    return 301 https://$host$request_uri;
}

___HTMLTAG_779__HTMLTAG_780___8.3 相互 TLS (mTLS)HTMLTAG_781__HTMLTAG_782

# Bật mTLS cho client authentication
bin/kc.sh start \
  --https-certificate-file=/etc/certs/tls.crt \
  --https-certificate-key-file=/etc/certs/tls.key \
  --https-trust-store-file=/etc/certs/truststore.jks \
  --https-trust-store-password=changeit \
  --https-client-auth=request

# --https-client-auth options:
# none: không yêu cầu client cert
# request: yêu cầu nhưng không bắt buộc
# required: bắt buộc client cert

HTMLTAG_783__HTMLTAG_784___8.4 憑證管理___HTMLTAG_785__HTMLTAG_786

# Sử dụng cert-manager trong Kubernetes
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: keycloak-tls
  namespace: keycloak
spec:
  secretName: keycloak-tls-secret
  issuerRef:
    name: letsencrypt-prod
    kind: ClusterIssuer
  dnsNames:
    - auth.mycompany.com
  renewBefore: 720h  # Renew 30 ngày trước khi hết hạn

預編碼_20

HTMLTAG_787__HTMLTAG_788___9。保險櫃整合___HTMLTAG_789__HTMLTAG_790

Keycloak 支援在外部保管庫中儲存機密（LDAP 綁定密碼、SMTP 密碼、用戶端機密），而不是在資料庫中儲存明文。

HTMLTAG_793__HTMLTAG_794___9.1 HashiCorp Vault 整合___HTMLTAG_795__HTMLTAG_796

# Cấu hình Keycloak sử dụng HashiCorp Vault
bin/kc.sh start \
  --vault=hashicorp \
  --vault-hashicorp-paths=/secret/data/keycloak \
  --vault-hashicorp-address=https://vault.mycompany.com:8200 \
  --vault-hashicorp-auth-method=token \
  --vault-hashicorp-token=$VAULT_TOKEN

# Hoặc sử dụng AppRole authentication
bin/kc.sh start \
  --vault=hashicorp \
  --vault-hashicorp-paths=/secret/data/keycloak \
  --vault-hashicorp-address=https://vault.mycompany.com:8200 \
  --vault-hashicorp-auth-method=approle \
  --vault-hashicorp-approle-role-id=$ROLE_ID \
  --vault-hashicorp-approle-secret-id=$SECRET_ID

HTMLTAG_797__HTMLTAG_798___9.2 在 HashiCorp Vault 中保存機密___HTMLTAG_799__HTMLTAG_800

# Cấu hình Vault KV secrets engine
vault secrets enable -path=secret kv-v2

# Lưu LDAP bind password
vault kv put secret/keycloak/my-realm \
  ldap_bind_credential="LdapS3cur3P@ss!" \
  smtp_password="SmtpP@ssw0rd!" \
  my-client-secret="Cl13ntS3cr3t!"

# Cấu trúc path trong Vault:
# secret/data/keycloak/{realm-name}/{key}

HTMLTAG_801__HTMLTAG_802___9.3 在 Keycloak 中使用 Vault 引用___HTMLTAG_803__HTMLTAG_804

在 Keycloak 中，使用語法 ${vault.key} 而非純文字：

# LDAP User Federation
Bind Credential: ${vault.ldap_bind_credential}

# SMTP Settings
Password: ${vault.smtp_password}

# Client Secret
Client Secret: ${vault.my-client-secret}

HTMLTAG_809__HTMLTAG_810___9.4 Kubernetes/OpenShift Secrets Vault___HTMLTAG_811__HTMLTAG_812

預編碼_24

預編碼_25

# Mount Secret vào Keycloak Pod
apiVersion: apps/v1
kind: Deployment
metadata:
  name: keycloak
spec:
  template:
    spec:
      containers:
        - name: keycloak
          args:
            - start
            - --vault=file
            - --vault-dir=/mnt/secrets
          volumeMounts:
            - name: vault-secrets
              mountPath: /mnt/secrets
              readOnly: true
      volumes:
        - name: vault-secrets
          secret:
            secretName: keycloak-vault

___HTMLTAG_813__HTMLTAG_814___9.5 基於文件的保管庫（開發）HTMLTAG_815__HTMLTAG_816

預編碼_27

HTMLTAG_817__HTMLTAG_818___9.6 輪替憑證___HTMLTAG_819__HTMLTAG_820

預編碼_28

HTMLTAG_821__HTMLTAG_822___10。管理控制台存取限制___HTMLTAG_823__HTMLTAG_824

HTMLTAG_825__HTMLTAG_826___10.1 專用管理領域___HTMLTAG_827__HTMLTAG_828

使用 主領域 僅用於管理員，不建立使用者/客戶業務：

預編碼_29

HTMLTAG_833__HTMLTAG_834___10.2 管理控制台的 IP 白名單___HTMLTAG_835__HTMLTAG_836

# Nginx: Restrict Admin Console access
location /admin/ {
    # Chỉ cho phép IP nội bộ
    allow 10.0.0.0/8;
    allow 172.16.0.0/12;
    allow 192.168.0.0/16;
    deny all;

    proxy_pass http://keycloak:8080;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
}

# Block admin REST API từ external
location /admin/realms/ {
    allow 10.0.0.0/8;
    deny all;

    proxy_pass http://keycloak:8080;
    proxy_set_header Host $host;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
}

HTMLTAG_837__HTMLTAG_838___10.3 Kubernetes 網路策略___HTMLTAG_839__HTMLTAG_840

# NetworkPolicy: Restrict Admin API access
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: keycloak-admin-restrict
  namespace: keycloak
spec:
  podSelector:
    matchLabels:
      app: keycloak
  policyTypes:
    - Ingress
  ingress:
    # Allow user-facing traffic from ingress controller
    - from:
        - namespaceSelector:
            matchLabels:
              name: ingress-nginx
      ports:
        - port: 8080
    # Allow admin traffic only from management namespace
    - from:
        - namespaceSelector:
            matchLabels:
              name: management
      ports:
        - port: 8080

HTMLTAG_845__HTMLTAG_846___11.1 短期代幣___HTMLTAG_847__HTMLTAG_848

# Cấu hình token lifespans
curl -X PUT "http://localhost:8080/admin/realms/my-realm" \
  -H "Authorization: Bearer $ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "accessTokenLifespan": 300,
    "accessTokenLifespanForImplicitFlow": 900,
    "actionTokenGeneratedByUserLifespan": 300,
    "actionTokenGeneratedByAdminLifespan": 43200
  }'

# Per-client token lifespan override
curl -X PUT "http://localhost:8080/admin/realms/my-realm/clients/$CLIENT_UUID" \
  -H "Authorization: Bearer $ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "attributes": {
        "access.token.lifespan": "180",
        "client.session.idle.timeout": "600",
        "client.session.max.lifespan": "3600"
    }
  }'

HTMLTAG_849__HTMLTAG_850___11.2 令牌自省___HTMLTAG_851__HTMLTAG_852

# Introspect token (kiểm tra validity)
curl -X POST "http://localhost:8080/realms/my-realm/protocol/openid-connect/token/introspect" \
  -d "client_id=my-resource-server" \
  -d "client_secret=$CLIENT_SECRET" \
  -d "token=$ACCESS_TOKEN"

# Response
# {
#   "active": true,
#   "sub": "user-uuid",
#   "aud": "my-app",
#   "exp": 1710492645,
#   "iat": 1710489045,
#   "realm_access": { "roles": ["user"] },
#   "scope": "openid profile email"
# }

HTMLTAG_853__HTMLTAG_854___11.3 令牌撤銷___HTMLTAG_855__HTMLTAG_856

# Revoke refresh token
curl -X POST "http://localhost:8080/realms/my-realm/protocol/openid-connect/revoke" \
  -d "client_id=my-app" \
  -d "client_secret=$CLIENT_SECRET" \
  -d "token=$REFRESH_TOKEN" \
  -d "token_type_hint=refresh_token"

# Revoke access token
curl -X POST "http://localhost:8080/realms/my-realm/protocol/openid-connect/revoke" \
  -d "client_id=my-app" \
  -d "client_secret=$CLIENT_SECRET" \
  -d "token=$ACCESS_TOKEN" \
  -d "token_type_hint=access_token"

HTMLTAG_857__HTMLTAG_858___12。生產部署 — 強化___HTMLTAG_859__HTMLTAG_860

# docker-compose.production.yml - Hardened Keycloak
services:
  keycloak:
    image: quay.io/keycloak/keycloak:26.1
    command:
      - start
      - --hostname=auth.mycompany.com
      - --hostname-strict=true
      - --proxy-headers=xforwarded
      - --http-enabled=true
      - --metrics-enabled=true
      - --health-enabled=true
      - --vault=file
      - --vault-dir=/mnt/secrets
      - --log=console
      - --log-console-output=json
    environment:
      KC_DB: postgres
      KC_DB_URL: jdbc:postgresql://postgres:5432/keycloak
      KC_DB_USERNAME: keycloak
      KC_DB_PASSWORD_FILE: /run/secrets/db_password
      KC_CACHE: ispn
      KC_CACHE_STACK: kubernetes
    volumes:
      - ./secrets:/mnt/secrets:ro
    secrets:
      - db_password
    deploy:
      replicas: 2
      resources:
        limits:
          memory: 1G
          cpus: '1.0'
        reservations:
          memory: 512M
          cpus: '0.5'
    healthcheck:
      test: ["CMD-SHELL", "exec 3<>/dev/tcp/localhost/9000 && echo -e 'GET /health/ready HTTP/1.1\r\nHost: localhost\r\n\r\n' >&3 && cat <&3 | grep -q '\"status\":\"UP\"'"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 60s

secrets:
  db_password:
    file: ./secrets/db_password

HTMLTAG_861__HTMLTAG_862___13。最佳實務摘要___HTMLTAG_863__HTMLTAG_864

___HTMLTAG_866__HTMLTAG_867___HTTPS 無所不在 — 切勿在沒有 TLS 的情況下部署 Keycloak 生產。使用 HSTS 標頭。 ___HTMLTAG_870__HTMLTAG_871___保管庫中的秘密 — 請勿在資料庫中儲存明文憑。使用 HashiCorp Vault 或 Kubernetes Secrets. ___HTMLTAG_874__HTMLTAG_875___強密碼策略 — 至少 12 個字符，使用具有高迭代次數的 Argon2 或 PBKDF2-SHA512。 ___HTMLTAG_878__HTMLTAG_879___會話限制__HTMLTAG_880___ — 限制並發會話數。設定適當的空閒/最大超時。 ___HTMLTAG_882__HTMLTAG_883___管理員存取受限 — 管理控制台的 IP 白名單。管理員帳戶需要 MFA。 ___HTMLTAG_886__HTMLTAG_887___短期令牌 — 存取權杖 5 分鐘，啟用刷新令牌輪替。 ___HTMLTAG_890__HTMLTAG_891___暴力保護 — 適當啟用與設定。監控登入失敗率。 ___HTMLTAG_894__HTMLTAG_895___定期安全審核 — 定期檢查 Keycloak 配置。更新到最新版本。 ___HTMLTAG_898__HTMLTAG_899___單獨的管理領域 — 僅將主領域用於管理。請勿混合管理用戶和企業用戶。 ___HTMLTAG_902__HTMLTAG_903___監視和警報 — 將事件日誌記錄（第 18 課）與安全監視結合以進行偵測和回應。