Client Authentication using Mutual TLS

Getting advice
, ,
1

Hi, greetings to the community!

We have been working to develop an Open Banking product for Banks in the MENA region and we have decided to proceed with Keycloak as our Authorization Server.
As per the Central Bank’s regulations, the client (In our case, its TPP - Third Party Provider) must be authenticated before calling the /auth and /token endpoints. In order to authenticate the client with Keycloak Server, the Central Bank mandates to use Mutual TLS 1.2 Mutual Authentication mechanism.
According to the docs in GitHub (Link: keycloak/enabletls.adoc at main · keycloak/keycloak · GitHub), Mutual TLS authentication mechanism has been introduced in Keycloak, but according to docs (Link: Keycloak - Documentation), we’re unable to extract/figure any information on enabling Mutual TLS Mutual Authentication for Client Authentication.

If someone from the community can pitch-in on how to enable the Mutual TLS for authentication of Client using Certificates, it would be of great help. Also, its my earnest request that the docs be updated to include a step-by-step tutorial/demo on how to enable Mutual TLS for Client authentication.

Thanks and regards,
A Prashanth Selvam

2

Hi! Have got any solution to this?

3

I’ve configured mTLS in Keycloak, and it works properly. Here’s the official documentation:

On the other hand, you also have the option to enable mTLS in the proxy server, such as Nginx, that sits in front of Keycloak. You can configure Keycloak to extract the user certificate from a header using the provided SPI called “x509cert-lookup SPI”.

(user) --mTLS–> (LB Nginx) --TLS + User Cert Header–> (Keycloak)