包括 docker OWASP ZAP 容器的 Keycloak 身份验证

Question

I'm working on a solution that involves running a the owasp/zap2docker-stable image in order to fully scan a web app that implements Keycloak for authentication and user management.

If I'm understanding correctly I would need to include a context file with auth details such as user/password, login form target URLs and having the assumption that the authentication method is Form-based when executing a docker run . If I'm not wrong and have followed information on the web correctly, it would seem that this context file should be created and exported from the ZAP UI app.

My questions are as follows:

• Is it confirmed that Keycloak uses form-based authentication?
• Am I correct in understanding that the context file has to be created, exported and supplied to docker run commands for this to happen?
• Are there any specific steps that I would need to take note of when creating the context file?
• How could I confirm that the login process occurred successfully?

Answer 1

No idea about Keycloak but you are right about the ZAP context file. Although if you can authenticate to your app using a header then you can just set that via an env var.

ZAP maintains stats - see https://www.zaproxy.org/docs/internal-statistics/ and search for "auth" in the key. You can test those via scan hooks https://www.zaproxy.org/docs/docker/scan-hooks/

Alternatively you can wait until the Automation Framework fully supports authentication - thats hopefully going to be soon but no ETA. In any case you'll still need to set up and test the auth in the ZAP desktop first.