Submit Search
Upload
Implementing WebAuthn & FAPI supports on Keycloak
•
8 likes
•
2,977 views
Y
Yuichi Nakamura
Follow
Presentation at Keyconf19
Read less
Read more
Software
Report
Share
Report
Share
1 of 22
Download now
Download to read offline
Recommended
FIDO認証によるパスワードレスログイン実装入門
FIDO認証によるパスワードレスログイン実装入門
Yahoo!デベロッパーネットワーク
RPで受け入れる認証器を選択する ~Idance lesson 2~
RPで受け入れる認証器を選択する ~Idance lesson 2~
5 6
Lightweight Zero-trust Network Implementation and Transition with Keycloak an...
Lightweight Zero-trust Network Implementation and Transition with Keycloak an...
Hitachi, Ltd. OSS Solution Center.
Securing a Web App with Passwordless Web Authentication
Securing a Web App with Passwordless Web Authentication
FIDO Alliance
#idcon vol.29 - #fidcon WebAuthn, Next Stage
#idcon vol.29 - #fidcon WebAuthn, Next Stage
Nov Matake
Web Authentication API
Web Authentication API
FIDO Alliance
FIDO and the Future of User Authentication
FIDO and the Future of User Authentication
FIDO Alliance
IBM: Hey FIDO, Meet Passkey!.pptx
IBM: Hey FIDO, Meet Passkey!.pptx
FIDO Alliance
Recommended
FIDO認証によるパスワードレスログイン実装入門
FIDO認証によるパスワードレスログイン実装入門
Yahoo!デベロッパーネットワーク
RPで受け入れる認証器を選択する ~Idance lesson 2~
RPで受け入れる認証器を選択する ~Idance lesson 2~
5 6
Lightweight Zero-trust Network Implementation and Transition with Keycloak an...
Lightweight Zero-trust Network Implementation and Transition with Keycloak an...
Hitachi, Ltd. OSS Solution Center.
Securing a Web App with Passwordless Web Authentication
Securing a Web App with Passwordless Web Authentication
FIDO Alliance
#idcon vol.29 - #fidcon WebAuthn, Next Stage
#idcon vol.29 - #fidcon WebAuthn, Next Stage
Nov Matake
Web Authentication API
Web Authentication API
FIDO Alliance
FIDO and the Future of User Authentication
FIDO and the Future of User Authentication
FIDO Alliance
IBM: Hey FIDO, Meet Passkey!.pptx
IBM: Hey FIDO, Meet Passkey!.pptx
FIDO Alliance
いまどきの OAuth / OpenID Connect (OIDC) 一挙おさらい (2020 年 2 月) #authlete
いまどきの OAuth / OpenID Connect (OIDC) 一挙おさらい (2020 年 2 月) #authlete
Tatsuo Kudo
Keycloakのステップアップ認証について
Keycloakのステップアップ認証について
Hitachi, Ltd. OSS Solution Center.
OpenID Connect入門
OpenID Connect入門
土岐 孝平
U2F/FIDO2 implementation of YubiKey
U2F/FIDO2 implementation of YubiKey
Haniyama Wataru
Azure ADとIdentity管理
Azure ADとIdentity管理
Naohiro Fujie
OpenID Connect 入門 〜コンシューマーにおけるID連携のトレンド〜
OpenID Connect 入門 〜コンシューマーにおけるID連携のトレンド〜
Masaru Kurahayashi
KeycloakでFAPIに対応した高セキュリティなAPIを公開する
KeycloakでFAPIに対応した高セキュリティなAPIを公開する
Hitachi, Ltd. OSS Solution Center.
Keycloakの実際・翻訳プロジェクト紹介
Keycloakの実際・翻訳プロジェクト紹介
Hiroyuki Wada
Keycloakの紹介と最新開発動向
Keycloakの紹介と最新開発動向
Yuichi Nakamura
Building secure applications with keycloak
Building secure applications with keycloak
Abhishek Koserwal
Developer Tutorial: WebAuthn for Web & FIDO2 for Android
Developer Tutorial: WebAuthn for Web & FIDO2 for Android
FIDO Alliance
FAPI (Financial-grade API) and CIBA (Client Initiated Backchannel Authenticat...
FAPI (Financial-grade API) and CIBA (Client Initiated Backchannel Authenticat...
Tatsuo Kudo
Keycloak拡張入門
Keycloak拡張入門
Hiroyuki Wada
Fido認証概要説明
Fido認証概要説明
FIDO Alliance
最近のKeycloakのご紹介 ~クライアントポリシーとFAPI~
最近のKeycloakのご紹介 ~クライアントポリシーとFAPI~
Hitachi, Ltd. OSS Solution Center.
KeycloakでAPI認可に入門する
KeycloakでAPI認可に入門する
Hitachi, Ltd. OSS Solution Center.
Hashicorp Vault ppt
Hashicorp Vault ppt
Shrey Agarwal
Introduction to FIDO Alliance
Introduction to FIDO Alliance
FIDO Alliance
なぜOpenID Connectが必要となったのか、その歴史的背景
なぜOpenID Connectが必要となったのか、その歴史的背景
Tatsuo Kudo
これからのネイティブアプリにおけるOpenID Connectの活用
これからのネイティブアプリにおけるOpenID Connectの活用
Masaru Kurahayashi
APIdays London 2020: Toward certifying Financial-grade API security profile w...
APIdays London 2020: Toward certifying Financial-grade API security profile w...
Hitachi, Ltd. OSS Solution Center.
KubeConRecap_nakamura.pdf
KubeConRecap_nakamura.pdf
Hitachi, Ltd. OSS Solution Center.
More Related Content
What's hot
いまどきの OAuth / OpenID Connect (OIDC) 一挙おさらい (2020 年 2 月) #authlete
いまどきの OAuth / OpenID Connect (OIDC) 一挙おさらい (2020 年 2 月) #authlete
Tatsuo Kudo
Keycloakのステップアップ認証について
Keycloakのステップアップ認証について
Hitachi, Ltd. OSS Solution Center.
OpenID Connect入門
OpenID Connect入門
土岐 孝平
U2F/FIDO2 implementation of YubiKey
U2F/FIDO2 implementation of YubiKey
Haniyama Wataru
Azure ADとIdentity管理
Azure ADとIdentity管理
Naohiro Fujie
OpenID Connect 入門 〜コンシューマーにおけるID連携のトレンド〜
OpenID Connect 入門 〜コンシューマーにおけるID連携のトレンド〜
Masaru Kurahayashi
KeycloakでFAPIに対応した高セキュリティなAPIを公開する
KeycloakでFAPIに対応した高セキュリティなAPIを公開する
Hitachi, Ltd. OSS Solution Center.
Keycloakの実際・翻訳プロジェクト紹介
Keycloakの実際・翻訳プロジェクト紹介
Hiroyuki Wada
Keycloakの紹介と最新開発動向
Keycloakの紹介と最新開発動向
Yuichi Nakamura
Building secure applications with keycloak
Building secure applications with keycloak
Abhishek Koserwal
Developer Tutorial: WebAuthn for Web & FIDO2 for Android
Developer Tutorial: WebAuthn for Web & FIDO2 for Android
FIDO Alliance
FAPI (Financial-grade API) and CIBA (Client Initiated Backchannel Authenticat...
FAPI (Financial-grade API) and CIBA (Client Initiated Backchannel Authenticat...
Tatsuo Kudo
Keycloak拡張入門
Keycloak拡張入門
Hiroyuki Wada
Fido認証概要説明
Fido認証概要説明
FIDO Alliance
最近のKeycloakのご紹介 ~クライアントポリシーとFAPI~
最近のKeycloakのご紹介 ~クライアントポリシーとFAPI~
Hitachi, Ltd. OSS Solution Center.
KeycloakでAPI認可に入門する
KeycloakでAPI認可に入門する
Hitachi, Ltd. OSS Solution Center.
Hashicorp Vault ppt
Hashicorp Vault ppt
Shrey Agarwal
Introduction to FIDO Alliance
Introduction to FIDO Alliance
FIDO Alliance
なぜOpenID Connectが必要となったのか、その歴史的背景
なぜOpenID Connectが必要となったのか、その歴史的背景
Tatsuo Kudo
これからのネイティブアプリにおけるOpenID Connectの活用
これからのネイティブアプリにおけるOpenID Connectの活用
Masaru Kurahayashi
What's hot
(20)
いまどきの OAuth / OpenID Connect (OIDC) 一挙おさらい (2020 年 2 月) #authlete
いまどきの OAuth / OpenID Connect (OIDC) 一挙おさらい (2020 年 2 月) #authlete
Keycloakのステップアップ認証について
Keycloakのステップアップ認証について
OpenID Connect入門
OpenID Connect入門
U2F/FIDO2 implementation of YubiKey
U2F/FIDO2 implementation of YubiKey
Azure ADとIdentity管理
Azure ADとIdentity管理
OpenID Connect 入門 〜コンシューマーにおけるID連携のトレンド〜
OpenID Connect 入門 〜コンシューマーにおけるID連携のトレンド〜
KeycloakでFAPIに対応した高セキュリティなAPIを公開する
KeycloakでFAPIに対応した高セキュリティなAPIを公開する
Keycloakの実際・翻訳プロジェクト紹介
Keycloakの実際・翻訳プロジェクト紹介
Keycloakの紹介と最新開発動向
Keycloakの紹介と最新開発動向
Building secure applications with keycloak
Building secure applications with keycloak
Developer Tutorial: WebAuthn for Web & FIDO2 for Android
Developer Tutorial: WebAuthn for Web & FIDO2 for Android
FAPI (Financial-grade API) and CIBA (Client Initiated Backchannel Authenticat...
FAPI (Financial-grade API) and CIBA (Client Initiated Backchannel Authenticat...
Keycloak拡張入門
Keycloak拡張入門
Fido認証概要説明
Fido認証概要説明
最近のKeycloakのご紹介 ~クライアントポリシーとFAPI~
最近のKeycloakのご紹介 ~クライアントポリシーとFAPI~
KeycloakでAPI認可に入門する
KeycloakでAPI認可に入門する
Hashicorp Vault ppt
Hashicorp Vault ppt
Introduction to FIDO Alliance
Introduction to FIDO Alliance
なぜOpenID Connectが必要となったのか、その歴史的背景
なぜOpenID Connectが必要となったのか、その歴史的背景
これからのネイティブアプリにおけるOpenID Connectの活用
これからのネイティブアプリにおけるOpenID Connectの活用
Similar to Implementing WebAuthn & FAPI supports on Keycloak
APIdays London 2020: Toward certifying Financial-grade API security profile w...
APIdays London 2020: Toward certifying Financial-grade API security profile w...
Hitachi, Ltd. OSS Solution Center.
KubeConRecap_nakamura.pdf
KubeConRecap_nakamura.pdf
Hitachi, Ltd. OSS Solution Center.
apidays LIVE LONDON - Toward certifying Financial-grade API profile with Keyc...
apidays LIVE LONDON - Toward certifying Financial-grade API profile with Keyc...
apidays
Implementing security requirements for banking API system using Open Source ...
Implementing security requirements for banking API system using Open Source ...
Yuichi Nakamura
Implementing security and availability requirements for banking API system us...
Implementing security and availability requirements for banking API system us...
Hitachi, Ltd. OSS Solution Center.
Guide of authentication and authorization for cloud native applications with ...
Guide of authentication and authorization for cloud native applications with ...
Hitachi, Ltd. OSS Solution Center.
APIdays Paris 2019 : Financial-grade API (FAPI) Security Profile
APIdays Paris 2019 : Financial-grade API (FAPI) Security Profile
Hitachi, Ltd. OSS Solution Center.
APIdays Paris 2019 - What are protected and secured by security requirements ...
APIdays Paris 2019 - What are protected and secured by security requirements ...
apidays
DevConf.CZ 2020 @ Brno, Czech Republic : WebAuthn support for keycloak
DevConf.CZ 2020 @ Brno, Czech Republic : WebAuthn support for keycloak
Hitachi, Ltd. OSS Solution Center.
apidays Paris 2022 - Securing APIs in Open Banking, Takashi Norimatsu, Hitachi
apidays Paris 2022 - Securing APIs in Open Banking, Takashi Norimatsu, Hitachi
apidays
IRJET- Proof of Document using Multichain and Ethereum
IRJET- Proof of Document using Multichain and Ethereum
IRJET Journal
Apache con@home 2021_sha
Apache con@home 2021_sha
Hitachi, Ltd. OSS Solution Center.
What API Specifications and Tools Help Engineers to Construct a High-Security...
What API Specifications and Tools Help Engineers to Construct a High-Security...
Hitachi, Ltd. OSS Solution Center.
20190523 archiver fim
20190523 archiver fim
Archiver
Trust Data Sharing and Utilization Infrastructure for Sensitive Data Using Hy...
Trust Data Sharing and Utilization Infrastructure for Sensitive Data Using Hy...
Koshi Ikegawa
Webinar: ForgeRock Identity Platform Preview (Dec 2015)
Webinar: ForgeRock Identity Platform Preview (Dec 2015)
ForgeRock
Standard Based API Security, Access Control and AI Based Attack - API Days Pa...
Standard Based API Security, Access Control and AI Based Attack - API Days Pa...
Ping Identity
DeveloperWeek2018 - Let's Build a Chatbot
DeveloperWeek2018 - Let's Build a Chatbot
Tessa Mero
WebAuthn & FIDO2
WebAuthn & FIDO2
Leonard Moustacchis
SecureIoT Programming Support Service
SecureIoT Programming Support Service
Mariza Konidi
Similar to Implementing WebAuthn & FAPI supports on Keycloak
(20)
APIdays London 2020: Toward certifying Financial-grade API security profile w...
APIdays London 2020: Toward certifying Financial-grade API security profile w...
KubeConRecap_nakamura.pdf
KubeConRecap_nakamura.pdf
apidays LIVE LONDON - Toward certifying Financial-grade API profile with Keyc...
apidays LIVE LONDON - Toward certifying Financial-grade API profile with Keyc...
Implementing security requirements for banking API system using Open Source ...
Implementing security requirements for banking API system using Open Source ...
Implementing security and availability requirements for banking API system us...
Implementing security and availability requirements for banking API system us...
Guide of authentication and authorization for cloud native applications with ...
Guide of authentication and authorization for cloud native applications with ...
APIdays Paris 2019 : Financial-grade API (FAPI) Security Profile
APIdays Paris 2019 : Financial-grade API (FAPI) Security Profile
APIdays Paris 2019 - What are protected and secured by security requirements ...
APIdays Paris 2019 - What are protected and secured by security requirements ...
DevConf.CZ 2020 @ Brno, Czech Republic : WebAuthn support for keycloak
DevConf.CZ 2020 @ Brno, Czech Republic : WebAuthn support for keycloak
apidays Paris 2022 - Securing APIs in Open Banking, Takashi Norimatsu, Hitachi
apidays Paris 2022 - Securing APIs in Open Banking, Takashi Norimatsu, Hitachi
IRJET- Proof of Document using Multichain and Ethereum
IRJET- Proof of Document using Multichain and Ethereum
Apache con@home 2021_sha
Apache con@home 2021_sha
What API Specifications and Tools Help Engineers to Construct a High-Security...
What API Specifications and Tools Help Engineers to Construct a High-Security...
20190523 archiver fim
20190523 archiver fim
Trust Data Sharing and Utilization Infrastructure for Sensitive Data Using Hy...
Trust Data Sharing and Utilization Infrastructure for Sensitive Data Using Hy...
Webinar: ForgeRock Identity Platform Preview (Dec 2015)
Webinar: ForgeRock Identity Platform Preview (Dec 2015)
Standard Based API Security, Access Control and AI Based Attack - API Days Pa...
Standard Based API Security, Access Control and AI Based Attack - API Days Pa...
DeveloperWeek2018 - Let's Build a Chatbot
DeveloperWeek2018 - Let's Build a Chatbot
WebAuthn & FIDO2
WebAuthn & FIDO2
SecureIoT Programming Support Service
SecureIoT Programming Support Service
More from Yuichi Nakamura
About secure oss_sig_20190607
About secure oss_sig_20190607
Yuichi Nakamura
OAuthのHolder of Key Token
OAuthのHolder of Key Token
Yuichi Nakamura
OSSセキュリティ技術の会について
OSSセキュリティ技術の会について
Yuichi Nakamura
Open shiftmeetup 3scalelt_3
Open shiftmeetup 3scalelt_3
Yuichi Nakamura
Keycloak開発入門
Keycloak開発入門
Yuichi Nakamura
Keycloakの動向
Keycloakの動向
Yuichi Nakamura
Keycloak入門-OpenID ConnectによるAPIセキュリティ
Keycloak入門-OpenID ConnectによるAPIセキュリティ
Yuichi Nakamura
OSSセキュリティ技術の会について
OSSセキュリティ技術の会について
Yuichi Nakamura
More from Yuichi Nakamura
(8)
About secure oss_sig_20190607
About secure oss_sig_20190607
OAuthのHolder of Key Token
OAuthのHolder of Key Token
OSSセキュリティ技術の会について
OSSセキュリティ技術の会について
Open shiftmeetup 3scalelt_3
Open shiftmeetup 3scalelt_3
Keycloak開発入門
Keycloak開発入門
Keycloakの動向
Keycloakの動向
Keycloak入門-OpenID ConnectによるAPIセキュリティ
Keycloak入門-OpenID ConnectによるAPIセキュリティ
OSSセキュリティ技術の会について
OSSセキュリティ技術の会について
Recently uploaded
Introduction to Decentralized Applications (dApps)
Introduction to Decentralized Applications (dApps)
Intelisync
Der Spagat zwischen BIAS und FAIRNESS (2024)
Der Spagat zwischen BIAS und FAIRNESS (2024)
OPEN KNOWLEDGE GmbH
Short Story: Unveiling the Reasoning Abilities of Large Language Models by Ke...
Short Story: Unveiling the Reasoning Abilities of Large Language Models by Ke...
kellynguyen01
Unit 1.1 Excite Part 1, class 9, cbse...
Unit 1.1 Excite Part 1, class 9, cbse...
aditisharan08
Call Girls In Mukherjee Nagar 📱 9999965857 🤩 Delhi 🫦 HOT AND SEXY VVIP 🍎 SE...
Call Girls In Mukherjee Nagar 📱 9999965857 🤩 Delhi 🫦 HOT AND SEXY VVIP 🍎 SE...
Call Girls In Delhi Whatsup 9873940964 Enjoy Unlimited Pleasure
Salesforce Certified Field Service Consultant
Salesforce Certified Field Service Consultant
AxelRicardoTrocheRiq
Optimizing AI for immediate response in Smart CCTV
Optimizing AI for immediate response in Smart CCTV
shikhaohhpro
Cloud Management Software Platforms: OpenStack
Cloud Management Software Platforms: OpenStack
VICTOR MAESTRE RAMIREZ
Exploring iOS App Development: Simplifying the Process
Exploring iOS App Development: Simplifying the Process
Evangelist Apps https://twitter.com/EvangelistSW/
The Essentials of Digital Experience Monitoring_ A Comprehensive Guide.pdf
The Essentials of Digital Experience Monitoring_ A Comprehensive Guide.pdf
kalichargn70th171
A Secure and Reliable Document Management System is Essential.docx
A Secure and Reliable Document Management System is Essential.docx
ComplianceQuest1
chapter--4-software-project-planning.ppt
chapter--4-software-project-planning.ppt
kotipi9215
Learn the Fundamentals of XCUITest Framework_ A Beginner's Guide.pdf
Learn the Fundamentals of XCUITest Framework_ A Beginner's Guide.pdf
kalichargn70th171
DNT_Corporate presentation know about us
DNT_Corporate presentation know about us
Dynamic Netsoft
Try MyIntelliAccount Cloud Accounting Software As A Service Solution Risk Fre...
Try MyIntelliAccount Cloud Accounting Software As A Service Solution Risk Fre...
MyIntelliSource, Inc.
Reassessing the Bedrock of Clinical Function Models: An Examination of Large ...
Reassessing the Bedrock of Clinical Function Models: An Examination of Large ...
harshavardhanraghave
Project Based Learning (A.I).pptx detail explanation
Project Based Learning (A.I).pptx detail explanation
kaushalgiri8080
Alluxio Monthly Webinar | Cloud-Native Model Training on Distributed Data
Alluxio Monthly Webinar | Cloud-Native Model Training on Distributed Data
Alluxio, Inc.
Asset Management Software - Infographic
Asset Management Software - Infographic
Hr365.us smith
EY_Graph Database Powered Sustainability
EY_Graph Database Powered Sustainability
Neo4j
Recently uploaded
(20)
Introduction to Decentralized Applications (dApps)
Introduction to Decentralized Applications (dApps)
Der Spagat zwischen BIAS und FAIRNESS (2024)
Der Spagat zwischen BIAS und FAIRNESS (2024)
Short Story: Unveiling the Reasoning Abilities of Large Language Models by Ke...
Short Story: Unveiling the Reasoning Abilities of Large Language Models by Ke...
Unit 1.1 Excite Part 1, class 9, cbse...
Unit 1.1 Excite Part 1, class 9, cbse...
Call Girls In Mukherjee Nagar 📱 9999965857 🤩 Delhi 🫦 HOT AND SEXY VVIP 🍎 SE...
Call Girls In Mukherjee Nagar 📱 9999965857 🤩 Delhi 🫦 HOT AND SEXY VVIP 🍎 SE...
Salesforce Certified Field Service Consultant
Salesforce Certified Field Service Consultant
Optimizing AI for immediate response in Smart CCTV
Optimizing AI for immediate response in Smart CCTV
Cloud Management Software Platforms: OpenStack
Cloud Management Software Platforms: OpenStack
Exploring iOS App Development: Simplifying the Process
Exploring iOS App Development: Simplifying the Process
The Essentials of Digital Experience Monitoring_ A Comprehensive Guide.pdf
The Essentials of Digital Experience Monitoring_ A Comprehensive Guide.pdf
A Secure and Reliable Document Management System is Essential.docx
A Secure and Reliable Document Management System is Essential.docx
chapter--4-software-project-planning.ppt
chapter--4-software-project-planning.ppt
Learn the Fundamentals of XCUITest Framework_ A Beginner's Guide.pdf
Learn the Fundamentals of XCUITest Framework_ A Beginner's Guide.pdf
DNT_Corporate presentation know about us
DNT_Corporate presentation know about us
Try MyIntelliAccount Cloud Accounting Software As A Service Solution Risk Fre...
Try MyIntelliAccount Cloud Accounting Software As A Service Solution Risk Fre...
Reassessing the Bedrock of Clinical Function Models: An Examination of Large ...
Reassessing the Bedrock of Clinical Function Models: An Examination of Large ...
Project Based Learning (A.I).pptx detail explanation
Project Based Learning (A.I).pptx detail explanation
Alluxio Monthly Webinar | Cloud-Native Model Training on Distributed Data
Alluxio Monthly Webinar | Cloud-Native Model Training on Distributed Data
Asset Management Software - Infographic
Asset Management Software - Infographic
EY_Graph Database Powered Sustainability
EY_Graph Database Powered Sustainability
Implementing WebAuthn & FAPI supports on Keycloak
1.
© Hitachi, Ltd.
2019. All rights reserved. Implementing Web Authentication API (WebAuthn) & Financial-Grade API (FAPI) supports on keycloak KeyConf 2019 @ STFC Hartree Centre, United Kingdom Hitachi, Ltd. OSS Solution Center 12 June 2019 Takashi Norimatsu
2.
1© Hitachi, Ltd.
2019. All rights reserved. Self Introduction Engaging in : ◼ providing support services about OSS ◼ implementing and contributing promising features to OSS The current works : contributing WebAuthn support to keycloak making keycloak pass FAPI’s conformance tests to get FAPI Certificate Takashi Norimatsu (@tnorimat in github) : OSS Solution Center, Hitachi, Ltd. @ Yokohama, Japan * Yokohama : the 2nd largest city in Japan by population, about 35km south west from Tokyo
3.
© Hitachi, Ltd.
2019. All rights reserved. 1. Overview 2. Web Authentication API (WebAuthn) Support 3. Financial-Grade API (FAPI) Support Contents 2
4.
3© Hitachi, Ltd.
2019. All rights reserved. 1. Overview
5.
4© Hitachi, Ltd.
2019. All rights reserved. 1-1 Overview: WebAuthn [ What’s WebAuthn ? ] Web standard as W3C Recommendation for achieving secure authentication (2FA, passwordless) resolving problems arising in password authentication. [ Motivation : Why we try to support WebAuthn for keycloak ? ] WebAuthn is promising technology. Therefore, it will be nothing special for IAM products to support it in the future.
6.
5© Hitachi, Ltd.
2019. All rights reserved. 1-2 Overview: FAPI [ What’s FAPI ? ] OAuth 2.0’s security profile of APIs intended for financial institutes [ Motivation : Why we try to support FAPI for keycloak ? ] We would like to apply keycloak in financial sector requiring high security level for APIs. (*) Based on survey of Japanese Bankers Association as of Dec 2017 Quoted from Report about open API by the Japanese Bankers Association https://www.zenginkyo.or.jp/fileadmin/res/news/news290713_3.pdf In Japan… ◆ The revised banking act was published in Jun 2017 to promote API. Similar to PSD2 in EU. ◆ 83% of banks (114 banks) answered they will open API by Jun 2020(*). ◆ OAuth 2.0 is recognized as a key technology to secure API. FAPI is also being required. In UK… ◆ UK OpenBanking security profile is based on FAPI. (https://bitbucket.org/openid/obuk/src/master/uk-openbanking-security-profile.md)
7.
6© Hitachi, Ltd.
2019. All rights reserved. 2. Web Authentication API (WebAuthn) Support
8.
7© Hitachi, Ltd.
2019. All rights reserved. 2-1 WebAuthn: Contribution Plan Hitachi, Ltd. and WebAuthn4j community(https://github.com/webauthn4j/) are working for it. Now still in “Develop” phase, working in https://github.com/webauthn4j/keycloak-webauthn- authenticator . We are happy if you could contribute to it. Develop ✓ Build a prototype for feasibility study ◼ Write and submit design documents to community to be reviewed and approved Implement WebAuthn RP’s features to keycloak based on the approved design Merged Issue pull requests to keycloak to be reviewed and approved Make them merged onto keycloak Certified Pass conformance Self-Validation Testing against keycloak Get certificate confirming that keycloak complies with FIDO2 2.0 Specification for Servers (*) (*) managed and presented by FIDO Alliance
9.
8© Hitachi, Ltd.
2019. All rights reserved. 2-3 WebAuthn: Current Status - Prototype You can actually try this prototype from https://github.com/webauthn4j/keycloak- webauthn-authenticator . You can experience the following 2 scenario using this prototype: ◼ 2 Factor Authentication (2FA) Scenario OS : Windows 10, macOS Mojave (ver 10.14.4) Browser : Google Chrome (ver 75), Mozilla Firefox (ver 66) Authenticator : Yubico Security Key, Touch ID (macOS) ◼ Authentication with Resident Key (passwordless) Scenario OS : Windows 10 Browser : Microsoft Edge (ver 44) Authenticator : Internal Fingerprint Authentication Device
10.
9© Hitachi, Ltd.
2019. All rights reserved. 2-3 WebAuthn: Current Status - Design [ Objective ] 2FA scenario at first, passwordless scenario next. Major topics to be considered (picked up three here): Verifying Attestation Statement and Authentication Assertion • On registration, an attestation certificate should be verified Need to manage trust anchor certificate sources (e.g. FIDO Metadata Service) • On registration and authentication, keycloak need to verify information returned from Web Authentication API (e.g. navigator.credentials.create(), .get()) Need to choose an appropriate library to treat them We adopted “webauthn4j” (https://github.com/webauthn4j/webauthn4j) as a core library where all mandatory test cases and optional Android Key attestation test cases of FIDO2 Test Tools provided by FIDO Alliance has been passed. We not only use “webauthn4j” but contribute to it.
11.
10© Hitachi, Ltd.
2019. All rights reserved. 2-3 WebAuthn: Current Status - Design (cont.) Public Key Credentials Management • Users might have multiple authenticators. (e.g. security key, fingerprint) Need to retain multiple public key credentials per user. • On authentication, the user can select which public key credentials are used. Need to retain Information the user can use to identify their credentials. • Administrator wants to restrict authenticators the user can use. Need to obtain authenticator’s metadata. (e.g. AAGUID) Automated Functional Test (E2E Test) • Automate tests of registration and authentication flows including or emulating real entities (e.g. authenticator, browser) … our design document considering these topics can be found in https://github.com/keycloak/keycloak-community/pull/11
12.
11© Hitachi, Ltd.
2019. All rights reserved. 3. Financial-Grade API (FAPI) Support
13.
12© Hitachi, Ltd.
2019. All rights reserved. 3-1 FAPI: Contribution Plan (*) managed and presented by OpenID Foundation Develop ✓ Clarify FAPI’s requirements keycloak does not satisfy ✓ Implement features satisfying such FAPI’s requirements to keycloak Merged ✓ Issue pull requests to keycloak to be reviewed and approved ✓ Make them merged onto keycloak Certified ◼ Pass all of FAPI conformance tests against keycloak Get certificate confirming that keycloak complies with Financial- grade API (FAPI) OpenID Providers (*) Hitachi, Ltd. has been working for it, and Nomura Research Institute, Ltd. joined it from “Certified” step. We are now already in “Certified” step, working in https://github.com/jsoss-sig/keycloak-fapi. We are happy if you could contribute to it.
14.
13© Hitachi, Ltd.
2019. All rights reserved. 3-2 FAPI: Created and Merged Pull Requests Content Slide # JIRA Ticket Description Pull Request Included Version 1 KEYCLOAK-2604 Support RFC 7636 Proof Key for Code Exchange (PKCE) 3831 3.1.0 2 KEYCLOAK-5661 Return the list of allowed scopes with the issued access token 4527 3.4.0 3 KEYCLOAK-5811 Support client authentication in client_secret_jwt 4835 4.0.0 4 KEYCLOAK-6700 Support s_hash 5022 4.0.0 5 KEYCLOAK-6771 Support Holder of Key mechanism for tokens 5083 4.0.0 6 KEYCLOAK-6768 Support signed and encrypted ID token 5779 Now reviewed by maintainers 7 KEYCLOAK-6770 Support signature algorithm ES256/384/512 for tokens 5533 4.5.0 8 KEYCLOAK-7451 Support server metadata for PKCE 5228 4.0.0 9 KEYCLOAK-7959 Support Holder of Key mechanism for tokens in reverse proxy deployed environment 5418 4.2.0 10 KEYCLOAK-8460 Support signature algorithm ES256/384/512 for request object 5603 4.7.0 11 KEYCLOAK-9756 Support signature algorithm PS256/384/512 for tokens and request object 5974 6.0.0
15.
14© Hitachi, Ltd.
2019. All rights reserved. 3-3 Featured FAPI function : Proof Key for Code Exchange (PKCE) Safeguard against Fraudulent Token Acquisition If an attacker steals a victim’s authorization code… ⚫ Without PKCE Client gets Access Token in return to Authorization Code The attacker can get the victim’s access token in return to the victim’s authorization code. ⚫ With PKCE Client gets Access Token in return to Authorization Code + Code Verifier The attacker can NOT get the victim’s access token in return to the victim’s authorization code alone. We has already contributed supporting PKCE (Included in Keycloak 3.1.0)
16.
15© Hitachi, Ltd.
2019. All rights reserved. 3-4 Featured FAPI function : Holder-of-Key Mechanism Safeguard against Fraudulent Token Exercise If an attacker steals an access token that enable to access victim’s resource … ⚫ Bearer Token Any party possessing a token can exercise this token (e.g., train ticket) The attacker can access a victim’s resource by the access token. ⚫ Holder-of-Key Token Only certain party can exercise a token (e.g. passport) The attacker can NOT access a victim’s resource by the access token. We have contributed supporting Holder-of-Key Token “OAuth2 Certificate Bound Access Tokens” (Included in Keycloak 4.0.0)
17.
16© Hitachi, Ltd.
2019. All rights reserved. 3-5 Featured FAPI function : Secure Signature Algorithm ⚫ Refactor sign/verify mechanism keycloak before 4.5.0 supported only RS256 and it was hardcoded. We’ve made some part of contribution to refactor sign/verify mechanism with community and now signature algorithm is pluggable (Signature SPI). ⚫ Signature algorithms other than RS256 keycloak before 4.5.0 supported only RS256 for signature. Crypto specialists say RS256 is not strong enough. Either PS256 or ES256 is required in FAPI. We’ve made some part of contribution to support secure signature algorithms : 4.5.0(Tokens) / 4.7.0(Request Object) ES256, ES384, ES512, HS256, HS384,HS512 are supported. 6.0.0(Tokens, Request Object) PS256, PS384, PS512 are supported.
18.
17© Hitachi, Ltd.
2019. All rights reserved. 3-5 FAPI Conformance Tests : Issues to be resolved # Item Description 1 OAuth2 Client Authentication in [MTLS] : support Server Metadata and Client Registration keycloak(6.0.0) has already implemented OAuth2 Client Authentication in the way defined in Section 2 of [MTLS]. However, it has not yet supported its Server Metadata advertisement and Client Registration. 2 OAuth2 Client Authentication in private_key_jwt : support ES256 or PS256 keycloak(6.0.0) has already supported private_key_jwt, but only supported RS256 in private_key_jwt. 3 Advertise "acr" claim in "claims_supported" Server Metadata keycloak(6.0.0) has already support "acr" claim in ID token, but not advertise "acr" in "claims_supported" in Server Metadata. … and so on. All issues and their details can be found in https://github.com/jsoss-sig/keycloak-fapi [why so many issues arise] Implementer's Draft version 1 (2 Feb, 2017) Read-Only : https://openid.net/specs/openid-financial-api-part-1-ID1.html Read and Write : https://openid.net/specs/openid-financial-api-part-2-ID1.html We worked with this version. ◼ Implementer's Draft version 2 (17 Oct, 2018) Read-Only : https://openid.net/specs/openid-financial-api-part-1-ID2.html Read and Write : https://openid.net/specs/openid-financial-api-part-2-ID2.html Conformance test checks requirements on this version.
19.
18© Hitachi, Ltd.
2019. All rights reserved. Concluding Remarks ⚫ We try to support WebAuthn RP’s feature onto keycloak. Prototype : https://github.com/webauthn4j/keycloak-webauthn-authenticator Design Document : https://github.com/keycloak/keycloak-community/pull/11 … but not yet completed. ⚫ We try to make keycloak satisfy FAPI’s requirements and get FAPI’s certificate. Conformance Test Execution : https://github.com/jsoss-sig/keycloak-fapi … but not yet completed. We are very happy if you make some contributions to those work.
20.
© Hitachi, Ltd.
2019. All rights reserved. Takashi Norimatsu 12 June 2019 Hitachi, Ltd. OSS Solution Center END KeyConf 2019 @ STFC Hartree Centre, United Kingdom Implementing Web Authentication API (WebAuthn) & Financial-Grade API (FAPI) supports on keycloak 19
21.
20© Hitachi, Ltd.
2019. All rights reserved. Trademark • FIDO is a trademark or registered trademark of FIDO Alliance, Inc. in the United States and other countries. • OpenID is a trademark or registered trademark of OpenID Foundation in the United States and other countries. • Github is a trademark or registered trademark of Github, Inc. in the United States and other countries. • Other brand names and product names used in this material are trademarks, registered trademarks, or trade names of their respective holders.
Download now