Allow configure encryption details for SAML clients #40937
+695
−45
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
One more thing, now I see that there is a |
|
Sounds like a better place to move it to, go for it :) |
Closes keycloak#40933 Signed-off-by: rmartinc <rmartinc@redhat.com>
|
I have modified the default encryption values. Now by default the encryption uses aes_256_gcm, rsa-oaep, sha-256 and mgf1sha256 when nothing is configured. It's the migration task the one in charge to set the previous old configuration to existing clients to not use the new default values and maintain backwards compatibility. I have added a note in the migration guide but maybe it's better to add the note at the release notes now. Moving out of draft for the review. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Closes #40933
Draft PR to add configuration details to SAML assertion encryption. The main idea is that all the details (all the algorithms) can be configured. missing points:
The current draft does not change any default. It just allows to configured the options individually per client.