Bug 56474 - Make subnet filtering configurable for Kerberos-Auth in Keycloak
Summary: Make subnet filtering configurable for Kerberos-Auth in Keycloak
Status: CLOSED FIXED
Alias: None
Product: UCS
Classification: Unclassified
Component: Keycloak
Version: UCS 5.0
Hardware: Other All
: P5 normal
Target Milestone: UCS 5.0-9-errata
Assignee: Julia Bremer
QA Contact: Christian Castens
URL: https://git.knut.univention.de/univen...
Keywords:
Depends on: 49485
Blocks: 50533
  Show dependency treegraph
 
Reported: 2023-08-22 21:53 CEST by Julia Bremer
Modified: 2024-11-13 17:21 CET (History)
11 users (show)

See Also:
What kind of report is it?: Bug Report
What type of bug is this?: 5: Major Usability: Impairs usability in key scenarios
Who will be affected by this bug?: 3: Will affect average number of installed domains
How will those affected feel about the bug?: 3: A User would likely not purchase the product
User Pain: 0.257
Enterprise Customer affected?:
School Customer affected?: Yes
ISV affected?:
Waiting Support: Yes
Flags outvoted (downgraded) after PO Review:
Ticket number: 2024020621000268, 2024021521000134, 2024020621000268, 2024032521000159, 2024090321000064, 2024101021000182
Bug group (optional):
Customer ID: 09711, 09739, 17994
Max CVSS v3 score:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Julia Bremer univentionstaff 2023-08-22 21:53:57 CEST
+++ This bug was initially created as a clone of Bug #49485 +++

When Kerberos authentication is configured in Keycloak, it will fall back to password authentication if no kerberos ticket is presented by the browser.

When being on an unjoined Windows client on chrome or edge, a popup asking for credentials will be shown. When clicking cancel, the fallback login page for single sign-can be accessed.
This can be annoying to customers.

In simplesamlphp this was configurable by the UCR variable/the simpleSAMLphp setting `saml/idp/negotiate/filter-subnets`

Keycloak doesn't have such a setting to remove certain IPs from the Kerberos authentication. 
But it can be archieved using an apache2 configuration in univention-keycloak.conf that removes the www-authenticate header from the request if it comes from a certain IP.

In a project, the following was configured in the
/var/lib/univention-appcenter/apps/keycloak/data/local-univention-keycloak.conf

<If “%{REMOTE_ADDR} -ipmatch ‘10.200.21.0/24’”>
Header unset WWW-Authenticate


If this should be part of the product, we should make this configurable via a setting
Comment 1 Christina Scheinig univentionstaff 2024-02-06 15:53:26 CET
An other customer needs that 2024020621000268
Comment 3 Finn David univentionstaff 2024-02-19 16:45:36 CET
Another customer that needs to disable kerberos authentication or apply the workaround: 2024021521000134
Comment 5 Christina Scheinig univentionstaff 2024-06-21 13:31:41 CEST
Seem to affect more customers, so I increase the affected customers, and regarding to the not working workaround I am inclined to increase the feel about "flag", because with 5.2 this might get a blocking issue?
Comment 16 Dirk Ahrnke univentionstaff 2024-07-08 15:37:47 CEST
In addition to the already mentioned workflow when logging in through the browser I noticed another and slightly more annoying behaviour.

Customers are using MS365 also to give access to local installable apps like MS Office, To install these appes one has to configure a "Microsoft account" using the "access to work or school account". 
The first step to to provide the mail-address which is loked to the MS365-Account. If this is found one will be redirected to the IDP. This presents the mentioned popup. 
The user has to provide at least a username in this dialog and click "OK" to proceed. In case the dialog is canceled the missing authentication leads to a HTTP 401 error and the connection wizard is stopped. 
Note : it doesnt matter if the username/password entered here is valid or not.
Comment 17 Dirk Ahrnke univentionstaff 2024-07-12 09:16:57 CEST
root@dn1:~# cat /var/lib/univention-appcenter/apps/keycloak/data/local-univention-keycloak.conf
<If "! (-R '10.0.0.0/8') || (-R '172.16.0.0/12') || (-R '192.168.0.0/16')">
Header unset WWW-Authenticate
</If>

This configuration appears to disable the Kerberos-Auth for external clients.
I could not verify yet that it works for internal machines but it looks like it would work. My current setup displays the login dialog as expected when the Kerberos configuration isnt working.
Comment 19 Dirk Ahrnke univentionstaff 2024-09-19 16:27:28 CEST
The workaround using "Header unset WWW-Authenticate" has a major drawback. 
With this it not possible anymore to connect a "Microsoft Account" ("Access to work or school") with clients outside the internal network. 
School customers are using this to provide Office licenses to their teachers and students.
Comment 28 Julia Bremer univentionstaff 2024-11-13 11:26:47 CET
Successful build
Package: univention-keycloak
Version: 1.0.13-2
Branch: 5.0-0
Scope: errata5.0-9
User: jbremer


658a577725 Bug #56474: Add kerberos conditional auth tests
746f93b050 Bug #56474: Enable univention-keycloak to update an existing flow to add
f59b6f94c6 remove obsolte cron job (Bug #36928)
Comment 29 Christian Castens univentionstaff 2024-11-13 16:29:20 CET
QA:
  OK: univention-keycloak script can add new subnet filtering condition to Keycloak auth flow
  OK: subnet filtering condition in Keycloak can be used to exclude ip ranges from using kerberos
  OK: advisories
  OK: new test scenarios
  OK: successful package builds
  OK: ucs-test run
  OK: 5.0-9, 5.1-0, 5.2-0
Comment 30 Christian Castens univentionstaff 2024-11-13 17:21:56 CET
<https://errata.software-univention.de/#/?erratum=5.0x1172>