KEYCLOAK-591 Require SSL for all external requests by default

integration/wildfly-subsystem/src/main/java/org/keycloak/subsystem/extension/KeycloakSubsystemParser.java

@@ -83,7 +83,7 @@ class KeycloakSubsystemParser implements XMLStreamConstants, XMLElementReader<Li
 
         if (!SharedAttributeDefinitons.validateTruststoreSetIfRequired(addRealm)) {
             //TODO: externalize the message
-            throw new XMLStreamException("truststore and truststore-password must be set if both ssl-not-required and disable-trust-maanger are false.");
+            throw new XMLStreamException("truststore and truststore-password must be set if ssl-required is not none and disable-trust-maanger is false.");
         }
 
         list.add(addRealm);
@@ -114,7 +114,7 @@ class KeycloakSubsystemParser implements XMLStreamConstants, XMLElementReader<Li
          * TODO need to check realm-ref first.
         if (!SharedAttributeDefinitons.validateTruststoreSetIfRequired(addSecureDeployment)) {
             //TODO: externalize the message
-            throw new XMLStreamException("truststore and truststore-password must be set if both ssl-not-required and disable-trust-maanger are false.");
+            throw new XMLStreamException("truststore and truststore-password must be set if ssl-required is not none  and disable-trust-maanger is false.");
         }
          */
 

integration/wildfly-subsystem/src/main/java/org/keycloak/subsystem/extension/RealmAddHandler.java

@@ -53,7 +53,7 @@ public final class RealmAddHandler extends AbstractAddStepHandler {
 
         if (!SharedAttributeDefinitons.validateTruststoreSetIfRequired(model.clone())) {
             //TODO: externalize message
-            throw new OperationFailedException("truststore and truststore-password must be set if both ssl-not-required and disable-trust-maanger are false.");
+            throw new OperationFailedException("truststore and truststore-password must be set if ssl-required is not none and disable-trust-maanger is false.");
         }
     }
 

integration/wildfly-subsystem/src/main/java/org/keycloak/subsystem/extension/SharedAttributeDefinitons.java

@@ -44,11 +44,11 @@ public class SharedAttributeDefinitons {
                     .setAllowExpression(true)
                     .setValidator(new StringLengthValidator(1, Integer.MAX_VALUE, true, true))
                     .build();
-    protected static final SimpleAttributeDefinition SSL_NOT_REQUIRED =
-            new SimpleAttributeDefinitionBuilder("ssl-not-required", ModelType.BOOLEAN, true)
-                    .setXmlName("ssl-not-required")
+    protected static final SimpleAttributeDefinition SSL_REQUIRED =
+            new SimpleAttributeDefinitionBuilder("ssl-required", ModelType.STRING, true)
+                    .setXmlName("ssl-required")
                     .setAllowExpression(true)
-                    .setDefaultValue(new ModelNode(false))
+                    .setDefaultValue(new ModelNode("external"))
                     .build();
     protected static final SimpleAttributeDefinition ALLOW_ANY_HOSTNAME =
             new SimpleAttributeDefinitionBuilder("allow-any-hostname", ModelType.BOOLEAN, true)
@@ -137,7 +137,7 @@ public class SharedAttributeDefinitons {
         ATTRIBUTES.add(AUTH_SERVER_URL);
         ATTRIBUTES.add(TRUSTSTORE);
         ATTRIBUTES.add(TRUSTSTORE_PASSWORD);
-        ATTRIBUTES.add(SSL_NOT_REQUIRED);
+        ATTRIBUTES.add(SSL_REQUIRED);
         ATTRIBUTES.add(ALLOW_ANY_HOSTNAME);
         ATTRIBUTES.add(DISABLE_TRUST_MANAGER);
         ATTRIBUTES.add(CONNECTION_POOL_SIZE);
@@ -152,20 +152,22 @@ public class SharedAttributeDefinitons {
     }
 
     /**
-     * truststore and truststore-password must be set if ssl-not-required and disable-trust-manager are both false.
+     * truststore and truststore-password must be set if ssl-required is not none and disable-trust-manager is false.
      *
      * @param attributes The full set of attributes.
      *
      * @return <code>true</code> if the attributes are valid, <code>false</code> otherwise.
      */
     public static boolean validateTruststoreSetIfRequired(ModelNode attributes) {
-        if (!isSet(attributes, SSL_NOT_REQUIRED) && !isSet(attributes, DISABLE_TRUST_MANAGER)) {
-            if (!(isSet(attributes, TRUSTSTORE) && isSet(attributes, TRUSTSTORE_PASSWORD))) {
-                return false;
-            }
+        if (isSet(attributes, DISABLE_TRUST_MANAGER)) {
+            return true;
         }
 
-        return true;
+        if (isSet(attributes, SSL_REQUIRED) && attributes.get(SSL_REQUIRED.getName()).asString().equals("none")) {
+            return true;
+        }
+
+        return isSet(attributes, TRUSTSTORE) && isSet(attributes, TRUSTSTORE_PASSWORD);
     }
 
     private static boolean isSet(ModelNode attributes, SimpleAttributeDefinition def) {

integration/wildfly-subsystem/src/main/resources/org/keycloak/subsystem/extension/LocalDescriptions.properties

@@ -10,7 +10,7 @@ keycloak.realm.remove=Remove a realm from the subsystem.
 keycloak.realm.realm-public-key=Public key of the realm
 keycloak.realm.auth-server-url=Base URL of the Realm Auth Server
 keycloak.realm.disable-trust-manager=Adapter will not use a trust manager when making adapter HTTPS requests
-keycloak.realm.ssl-not-required=SSL is not required for secure interactions
+keycloak.realm.ssl-required=Specify if SSL is required (valid values are all, external and none)
 keycloak.realm.allow-any-hostname=SSL Setting
 keycloak.realm.truststore=Truststore used for adapter client HTTPS requests
 keycloak.realm.truststore-password=Password of the Truststore
@@ -31,7 +31,7 @@ keycloak.secure-deployment.remove=Remove a deployment to be secured by Keycloak
 keycloak.secure-deployment.realm-public-key=Public key of the realm
 keycloak.secure-deployment.auth-server-url=Base URL of the Realm Auth Server
 keycloak.secure-deployment.disable-trust-manager=Adapter will not use a trust manager when making adapter HTTPS requests
-keycloak.secure-deployment.ssl-not-required=SSL is not required for secure interactions
+keycloak.secure-deployment.ssl-required=Specify if SSL is required (valid values are all, external and none)
 keycloak.secure-deployment.allow-any-hostname=SSL Setting
 keycloak.secure-deployment.truststore=Truststore used for adapter client HTTPS requests
 keycloak.secure-deployment.truststore-password=Password of the Truststore

integration/wildfly-subsystem/src/main/resources/schema/wildfly-keycloak_1_0.xsd

@@ -39,7 +39,7 @@
             <xs:element name="auth-server-url" type="xs:string" minOccurs="1" maxOccurs="1"/>
             <xs:element name="expose-token" type="xs:boolean" minOccurs="0" maxOccurs="1"/>
             <xs:element name="disable-trust-manager" type="xs:boolean" minOccurs="0" maxOccurs="1" />
-            <xs:element name="ssl-not-required" type="xs:boolean" minOccurs="0" maxOccurs="1" />
+            <xs:element name="ssl-required" type="xs:string" minOccurs="0" maxOccurs="1" />
             <xs:element name="cors-allowed-methods" type="xs:string" minOccurs="1" maxOccurs="1"/>
             <xs:element name="realm-public-key" type="xs:string" minOccurs="1" maxOccurs="1"/>
         </xs:all>
@@ -71,7 +71,7 @@
             <xs:element name="public-client" type="xs:boolean" minOccurs="0" maxOccurs="1"/>
             <xs:element name="connection-pool-size" type="xs:integer" minOccurs="0" maxOccurs="1"/>
             <xs:element name="expose-token" type="xs:boolean" minOccurs="0" maxOccurs="1"/>
-            <xs:element name="ssl-not-required" type="xs:boolean" minOccurs="0" maxOccurs="1" />
+            <xs:element name="ssl-required" type="xs:string" minOccurs="0" maxOccurs="1" />
             <xs:element name="realm-public-key" type="xs:string" minOccurs="1" maxOccurs="1"/>
             <xs:element name="credential" type="credential-type" minOccurs="1" maxOccurs="1"/>
         </xs:all>

integration/wildfly-subsystem/src/test/java/org/keycloak/subsystem/extension/RealmDefinitionTestCase.java

@@ -48,28 +48,38 @@ public class RealmDefinitionTestCase {
 
     @Test
     public void testIsTruststoreSetIfRequired() throws Exception {
-        model.get("ssl-not-required").set(true);
+        model.get("ssl-required").set("none");
         model.get("disable-trust-manager").set(true);
         Assert.assertTrue(SharedAttributeDefinitons.validateTruststoreSetIfRequired(model));
 
-        model.get("ssl-not-required").set(true);
+        model.get("ssl-required").set("none");
         model.get("disable-trust-manager").set(false);
         Assert.assertTrue(SharedAttributeDefinitons.validateTruststoreSetIfRequired(model));
 
-        model.get("ssl-not-required").set(false);
+        model.get("ssl-required").set("all");
         model.get("disable-trust-manager").set(true);
         Assert.assertTrue(SharedAttributeDefinitons.validateTruststoreSetIfRequired(model));
 
-        model.get("ssl-not-required").set(false);
+        model.get("ssl-required").set("all");
         model.get("disable-trust-manager").set(false);
         Assert.assertFalse(SharedAttributeDefinitons.validateTruststoreSetIfRequired(model));
 
-        model.get("ssl-not-required").set(false);
+        model.get("ssl-required").set("external");
+        model.get("disable-trust-manager").set(false);
+        Assert.assertFalse(SharedAttributeDefinitons.validateTruststoreSetIfRequired(model));
+
+        model.get("ssl-required").set("all");
         model.get("disable-trust-manager").set(false);
         model.get("truststore").set("foo");
         Assert.assertFalse(SharedAttributeDefinitons.validateTruststoreSetIfRequired(model));
 
-        model.get("ssl-not-required").set(false);
+        model.get("ssl-required").set("all");
+        model.get("disable-trust-manager").set(false);
+        model.get("truststore").set("foo");
+        model.get("truststore-password").set("password");
+        Assert.assertTrue(SharedAttributeDefinitons.validateTruststoreSetIfRequired(model));
+
+        model.get("ssl-required").set("external");
         model.get("disable-trust-manager").set(false);
         model.get("truststore").set("foo");
         model.get("truststore-password").set("password");

integration/wildfly-subsystem/src/test/java/org/keycloak/subsystem/extension/SubsystemParsingTestCase.java

@@ -56,7 +56,7 @@ public class SubsystemParsingTestCase extends AbstractSubsystemTest {
         node.get("realm-public-key").set("MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCrVrCuTtArbgaZzL1hvh0xtL5mc7o0NqPVnYXkLvgcwiC3BjLGw1tGEGoJaXDuSaRllobm53JBhjx33UNv+5z/UMG4kytBWxheNVKnL6GgqlNabMaFfPLPCF8kAgKnsi79NMo+n6KnSY8YeUmec/p2vjO2NjsSAVcWEQMVhJ31LwIDAQAB");
         node.get("auth-url").set("http://localhost:8080/auth-server/rest/realms/demo/tokens/login");
         node.get("code-url").set("http://localhost:8080/auth-server/rest/realms/demo/tokens/access/codes");
-        node.get("ssl-not-required").set(true);
+        node.get("ssl-required").set("external");
         node.get("expose-token").set(true);
         ModelNode credential = new ModelNode();
         credential.get("password").set("password");