1

How to restrict openid-connect request from the unknown source.

If we've Access Token available anyone can request for userinfo (we are saving user information and claims into userinfo) which we want to restrict.

means, the request we should allow from known clients only.

Note: we are using Keycloak as Identity Server

Please help!!

Nick
  • 65
  • 1
  • 8

1 Answers1

-1

First and foremost, access token must be protected as same as user credentials. What OAuth2.0 framework give us is the ability to replace username/password based authentication/authorization with dynamically generated tokens. Thus these tokens must be protected. That is why TLS is a must for token transmission.

RFC6749 section 10.3 - Access token credentials (as well as any confidential access token attributes) MUST be kept confidential in transit and storage, and only shared among the authorization server, the resource servers the access token is valid for, and the client to whom the access token is issued. Access token credentials MUST only be transmitted using TLS as described in Section 1.6 with server authentication as defined by [RFC2818].

So if you are worrying over access token misuse, you must first worry about adopting token based communication. Your clients must be secure enough not to misuse the tokens.

Also one other thing you can do is to enable CORS headers to restrict the access to the endpoint. But, this is only after protecting the tokens.!

p.s Alternatively, network configurations can be set to allow only the known/valid IP addresses to communicate to your back end. But that is out of the OIDC protocol.

Community
  • 1
  • 1
Kavindu Dodanduwa
  • 12,193
  • 3
  • 33
  • 46
  • Thanks!! But, I didn’t get actual answer and yes, we are protecting the access token. Actually, any user can request for userinfo right if they have access token either through unknown source or postman. I want to restrict this. and share the details if request comes from our clients (Microservice) only. – Nick Nov 19 '17 at 00:40
  • @Nick As you given in the example case, don't you send the postman request with the valid access token ? That means if your access token is protected and no other party can obtain it, they won't be able to obtain information from userinfo endpoint. The protocol's protection is limited to access token (my answer explains why). Alternatively, one can tweak network to blacklist IP addresses other than intended audience. But that's from network perspective. – Kavindu Dodanduwa Nov 19 '17 at 01:17