New Check: Signature Verification for IDPs disabled

iteratec / kcwarden

Keycloak Configuration Auditor

https://iteratec.github.io/kcwarden/

Apache License 2.0

11 stars 0 forks source link

Closed malexmave closed 1 month ago

malexmave commented 1 month ago

When configuring IDPs, it's possible to disable signature verification. This would be a good check to add to kcwarden.

Steps:

Check which IDPs support this setting (definitely OIDC, potentially also others that rely on OIDC internally, and maybe SAML also has a similar flag)
Write one or more auditors that check for this