Ignore "broker" and "realm-management" client for PKCE and client aut…

…h checks. Closes #27
iteratec · Oct 1, 2024 · 8ffcda5 · 8ffcda5
1 parent 79f9551
commit 8ffcda5
Show file tree

Hide file tree

Showing 2 changed files with 10 additions and 0 deletions.
diff --git a/kcwarden/auditors/client/client_authentication_via_mtls_or_jwt_recommended.py b/kcwarden/auditors/client/client_authentication_via_mtls_or_jwt_recommended.py
@@ -17,6 +17,11 @@ def should_consider_client(self, client) -> bool:
             and not client.is_realm_specific_client()
             and client.is_oidc_client()
             and not client.is_public()
+            # Ignore broker and realm-management - they show up as having the standard
+            # flow enabled, but don't actually have it, according to the UI. They are
+            # also lacking redirect URIs and other relevant settings. See issue #27 on
+            # GitHub.
+            and client.get_name() not in ["broker", "realm-management"]
         )
 
     def client_does_not_use_mtls_or_jwt_auth(self, client) -> bool:

diff --git a/kcwarden/auditors/client/confidential_client_should_enforce_pkce.py b/kcwarden/auditors/client/confidential_client_should_enforce_pkce.py
@@ -19,6 +19,11 @@ def should_consider_client(self, client) -> bool:
             and not client.is_realm_specific_client()
             and (not client.is_public())
             and client.has_standard_flow_enabled()
+            # Ignore broker and realm-management - they show up as having the standard
+            # flow enabled, but don't actually have it, according to the UI. They are
+            # also lacking redirect URIs and other relevant settings. See issue #27 on
+            # GitHub.
+            and client.get_name() not in ["broker", "realm-management"]
         )
 
     def client_does_not_enforce_pkce(self, client) -> bool: