WIP

Signed-off-by: stianst <stianst@gmail.com>

Author: stianst

demos/spiffe/README.md

@@ -47,7 +47,7 @@ kct decode $(./fetch-jwt-svid.sh) --jwks=http://localhost:8082/keys
 
 ## Configuring Keycloak
 
-You need to first have Keycloak with the experimental External JWT client auth feature enabled (`./kc.sh start-dev --features=client-auth-idp`).
+You need to first have Keycloak with the experimental External JWT client auth feature enabled (`./kc.sh start-dev --features=client-auth-federated`).
 
 As of writing this is available in https://github.com/stianst/keycloak/tree/spiffe-jwt-svids-with-idp, but is expected to be available in nightly releases soon and in Keycloak 26.4.0.
 
@@ -64,9 +64,11 @@ Optionally create a new realm:
   "hideOnLogin": true,
   "config": {
     "validateSignature": "true",
+    "issuer": "http://localhost:8082",
     "jwksUrl": "http://localhost:8082/keys",
     "useJwksUrl": "true",
-    "supportsClientAssertions": "true"
+    "supportsClientAssertions": "true",
+    "supportsClientAssertionReuse": "true"
   }
 }
 EOF
@@ -78,7 +80,7 @@ Then create a new client within the realm:
 {
   "clientId": "spiffe://example.org/myclient",
   "serviceAccountsEnabled": true,
-  "clientAuthenticatorType": "idp-jwt",
+  "clientAuthenticatorType": "federated-jwt",
   "attributes": {
     "jwt.credential.issuer": "spiffe"
   }

demos/spiffe/client-credential-grant.sh

@@ -4,7 +4,6 @@ SPIFFE_JWT_SVID=$(./fetch-jwt-svid.sh)
 
 curl -s -X POST \
   -d grant_type=client_credentials \
-  -d client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-spiffe \
-  -d client-assertion-type=jwt-bearer \
+  -d client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer \
   -d client_assertion="$SPIFFE_JWT_SVID" \
   http://localhost:8080/realms/spiffe/protocol/openid-connect/token

demos/spiffe/spire-server-example.conf

@@ -2,6 +2,7 @@ server {
     bind_address = "127.0.0.1"
     bind_port = "8081"
     trust_domain = "example.org"
+    jwt_issuer = "http://localhost:8082"
     data_dir = "./data/server"
     log_level = "DEBUG"
     ca_ttl = "168h"

demos/spiffe/token-introspection.sh

@@ -5,7 +5,6 @@ ACCESS_TOKEN=$(./client-credential-grant.sh | jq -r .access_token)
 
 curl -s -X POST \
   -d token=$ACCESS_TOKEN \
-  -d client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-spiffe \
-  -d client-assertion-type=jwt-bearer \
+  -d client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer \
   -d client_assertion="$SPIFFE_JWT_SVID" \
   http://localhost:8080/realms/spiffe/protocol/openid-connect/token/introspect | jq