Add configuration that allows filtering based on known `client_id` #100

New issue

Closed

opened 2024-10-28 16:51:37 +01:00 by xgp · 2 comments

xgp commented

2024-10-28 16:51:37 +01:00

(Migrated from github.com)

https://github.com/kokuwaio/keycloak-event-metrics/blob/main/src/main/java/io/kokuwa/keycloak/metrics/event/MetricsEventListener.java#L36

If a Keycloak system is under attack by an adversary that is attempting to find vulnerabilities or execute script injection attacks, they may set the client_id value to arbitrary values. This can pollute the metrics, and cause an explosion of the counters. In order to mitigate this, I suggest adding a configuration that allows unknown clients to either be ignored, or grouped into an UNKNOWN client_id.

Let me know what you think, and I'll PR.

https://github.com/kokuwaio/keycloak-event-metrics/blob/main/src/main/java/io/kokuwa/keycloak/metrics/event/MetricsEventListener.java#L36 If a Keycloak system is under attack by an adversary that is attempting to find vulnerabilities or execute script injection attacks, they may set the `client_id` value to arbitrary values. This can pollute the metrics, and cause an explosion of the counters. In order to mitigate this, I suggest adding a configuration that allows unknown clients to either be ignored, or grouped into an `UNKNOWN` `client_id`. Let me know what you think, and I'll PR.

Rows
Columns

Add configuration that allows filtering based on known client_id #100

Add configuration that allows filtering based on known `client_id` #100