From 5569c38d44b8f76e944b5f9fab108c22e08d9fb2 Mon Sep 17 00:00:00 2001 From: Jim Martens Date: Sun, 2 Feb 2025 10:29:01 +0100 Subject: [PATCH] security: Revoke refresh tokens on first use and prevent duplicate authenticator registrations --- terraform/keycloak.tf | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) diff --git a/terraform/keycloak.tf b/terraform/keycloak.tf index ecde68e..9a5828a 100644 --- a/terraform/keycloak.tf +++ b/terraform/keycloak.tf @@ -28,6 +28,20 @@ resource "keycloak_realm" "twomartens_realm" { max_login_failures = 5 } } + + default_signature_algorithm = "ES256" + revoke_refresh_token = true + refresh_token_max_use_count = 0 + + web_authn_policy { + signature_algorithms = ["ES256"] + avoid_same_authenticator_register = true + } + + web_authn_policy_passwordless { + signature_algorithms = ["ES256"] + avoid_same_authenticator_register = true + } } resource "keycloak_oidc_identity_provider" "twomartens_github_identity_provider" { @@ -82,7 +96,7 @@ resource "keycloak_openid_client" "twomartens_nextcloud" { client_id = "nextcloud" client_secret = var.nextcloud_client_secret standard_flow_enabled = true - use_refresh_tokens = false + use_refresh_tokens = true consent_required = true