keycloak/keycloak
Client credentials hashing (encryption / decryption)
オープン
#15,567 opened on 2022/11/18
area/weaknesshelp wantedkind/featureteam/core-clients
Repository metrics
- Stars
- (34,398 個のスター)
- PR merge metrics
- (平均マージ 6d 19h) (30d で 384 merged PRs)
説明
Description
Client credentials are currently stored as clear text. To improve Keycloak security, client credentials/secrets should be optionally be stored as hashes. A new pluggable SPI would be a great way to achieve this.
References:
- https://issues.redhat.com/browse/KEYCLOAK-10774
- https://github.com/keycloak/keycloak-community/blob/main/design/secure-credentials-store.md
Discussion
No response
Motivation
My Company, Transatel, is providing client credentials to our customers in order to use some of our APIs. These APIs give access to personal data, so, in order to respect the GDPR regulations, we must store these secrets in a secure way so that the secrets cannot be retrieved.
Details
No response