Client authentication with SPIFFE X509 SVID
Description
Great work for accepting JWT SVIDs was done as part of #42634, but we noticed accepting X509 SVIDs was considered a non-goal.
This issue is specifically about accepting X509 SVIDs:
Value Proposition
Will let it harden Keycloak mTLS authentication with extra SPIFFE certificate constraint checks
Goals
Add mTLS authentication post-processing action to verify the leaf certificate meets SPIFFE X509 SVID constraints after performing a typical X509 certificate chain validation.
CC @ryanemerson @michalvavrik @sabre1041
Non-Goals
I believe it should be reasonable to expect that the Spiffe bundle trust anchor is already in the server truststore.
Dynamic acquisition of Spiffe bundles and updating the server truststore can be achieved in a follow up issue. In fact the dynamism can likely be managed by a separate process that gets fresher certificates and updates the server truststore - Keycloak will only need an option for users to choose to reload TLS registry which is already supported at the Quarkus level.
Discussion
No response
Notes
No response
Source: keycloak/keycloak