X.509 smartcard and self-registration

Getting advice
1

I was wondering if it possible to have self-registration using the X.509 certificate on the ID card?

The certificate DN includes everything I need for registering a new user, i.e.

  • First name
  • Last name
  • Identification number

Ideally, I would like to create a new user with these attributes, without a possibility to set any credentials, as only X.509 authentication would be used. Authorization, i.e. roles/groups, would of course need to be done separately.

2

Yes, it’s possible with custom SPIs. Perhaps it will be easier to solve everything in the authentication journey. I would say some kind of JIT (Just-in-Time Provisioning) based on the user certificate information. Easy peasy

3

Would you happen to have any examples, links etc? The best I could find is java - Keycloak Attempting to create a user from information from x509 certificate: AuthenticationFlowException Not found serialized context in clientSession - Stack Overflow