April 2018 - keycloak-user - Jboss List Archives

by Jean-François HEROUARD

Hi, I am looking for a way to enable a user account only during a period (after a date and / or before an ending date), to follow a delayed user provisionning process. I have not found any previous question about that feature and do not see an easy way to implement it. Does anybody had the same need or a workaround ? Thanks.

6 years, 1 month

1
0
0 / 0

keycloak admin-client not return error message when password violate password policy

by Nhut Thai Le

Hello, I configued some password policy on keycloak console and it's working fine. However when using the admin-client to reset password: realm.users().get(userUuid).resetPassword(cred); I get an exception nesting a http 400 error (expected) but there is no message about which policy is being violate. If i call the admin REST api directly, i got the error message in the body. Is there anyway I can retrieve the error message using admin-client? Thai

6 years, 1 month

1
0
0 / 0

Keycloak Duo MFA SPI

by Chris Byron

I searched for an authentication integration with Duo Security and came across the recommendation in this user list to write it as an Authenticator SPI ( http://lists.jboss.org/pipermail/keycloak-user/2016-November/008234.html). I have written one and just wanted to share it here: https://github.com/mulesoft-labs/keycloak-duo-spi Please advise if there is a better place to promote this! Cheers, Chris Byron

6 years, 1 month

1
0
0 / 0

Fine grain permission on "listing" endpoint

by Domenico Briganti

Hi list, I have a question about Authorization Services. I made a demo project in which I list maintenance tasks of some machines. I would like to call the list endpoint (/api/tasks) and return all tasks if the current logged user has the role ADMIN, and only the tasks assigned to the current logged user if this is not ADMIN. I've read the Authorization Services guide and I think I understand how to manage permissions on single resource (es GET/POST/DELETE on /api/tasks/1 https://github.com/keycloak/keycloak/blob/3.4.3.Final/exam ples/authz/photoz/photoz-restful- api/src/main/java/org/keycloak/example/photoz/album/AlbumService.java#L 102-L134). Now I would like to move the condition that manager this filter in my code (pseudo code: if (!request.isUserInRole(Roles.ADMIN)) tasksFilter += " and t.assigned = " + request.getUserPrincipal(); ) into Keycloak, and having my application ask Keycloak for some sort of filter to add to sql query for filtering the output listing the tasks. It's possible? What I've seen until now is that with Protection API I can check if the current request can go to Protected Resource or not. What I need instead is to get a value whereby I can filter the Protected Resources returned. I hope I explained myself, available for clarification. Thanks, Domenico

6 years, 1 month

1
0
0 / 0

How to use signed JWT to use REST API

by Emanuele Gesuato

Hi all, I know that in keycloak 3.4.2 you can use rest admin api by retrieving a token. This token can be retrieved by using: - username & password - clientid & client secret - signed jwt for instance by using clientid & clientsecret I can connect to keycloak host by using the following: KeycloakBuilder keycloakBuilder = KeycloakBuilder.builder() .serverUrl(AUTH_SERVER) .realm(ADMIN_REALM) .grantType("client_credentials") .clientId("admin-cli") .clientSecret("XXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX") .grantType("client_credentials") .resteasyClient(client); My question is how should I use JWT ? I changed client authenticator in "credentials" tab by selecting "signed jwt" but from documentation it is not clear to me how to connect by using this kind of authentication method. thanks for any help Emanuele

6 years, 1 month

3
2
0 / 0

Logouts in a clustered environment with OIDC based apps

by Pulkit Gupta

Hi All, Sometime back I reported an issue https://issues.jboss.org /browse/KEYCLOAK-4288 <https://issues.jboss.org/browse/KEYCLOAK-4288> in which the back channel logouts were not working for SAML in a clustered JBoss environment with EAP6 SAML Adapter. It was fixed and released as well. I started on an app and was using OIDC RH_SS0-7.2 EAP 6(3.4.3) adapter in a clustered environment. We do not have an option for setting back channel/Front channel logouts for OIDC client but it looks like we are facing a similar issue for clustered application where even after logging out we can see that all sessions are not invalidated and we can see secure pages without logging in again. Please suggest if someone has faced similar issue. -- PULKIT GUPTA

6 years, 1 month

1
1
0 / 0

Admin Rest API

by Tony Harris

I am trying to move an application from 3.1.0-Final to 3.4.3-Final The application creates Realms, clients, roles etc via the admin rest api At 3.1.0 Immediately after creating the realm I could then find it and add clients etc. After moving to 3.4.3.Final I am finding that after creating the realm and attempt to immediately find the realm fails. If I suspend the application after the realm create the realm does not show up in the admin console either. If I let the application finish because the find fails the realm shows up, in the admin console. Any help appreciated, superficially looks like some transaction management going on but I can't see any documentation to suggest that's what is going on. Tony Harris ________________________________ Please consider the environment: Think before you print! This message has been scanned for malware by Websense. www.websense.com

6 years, 1 month

2
1
0 / 0

Max Size of Kerberos Ticket

by Carrasco, Jonathan J (173F)

Is there a max size set for Kerberos ticket… if so, where is it set? Trying to eliminate a possibility for Kerberos login error… and yes the ticket size Im dealing with could cause login problems. -- Jonathan Carrasco (173F) Jet Propulsion Laboratory – California Institute of Technology

6 years, 1 month

2
1
0 / 0

Failing to start Keycloak with restored production db in test environment due to offline session loading

by Chaminda Divitotawela

Hello, I have a requirement to start Keycloak-2.5.0 in test environment with a database copy from our production environment. We use AWS for our infrastructure. Following steps followed to setting up test environment with prod data. 1. Restored a production db snapshot in our test environment and deleted the records from table JGROUPSPING (we use JDBC as the cluster instance discovery as AWS does not support multicast). 2. Start the same version of Keycloak-2.5.0 (same docker image) 3. Keycloak start fails with error as per below. We use the offline tokens also for our mobile apps. It appears error occurs when it try to load the offline sessions. If I delete the entries in the table OFFLINE_USER_SESSION then Keycloak starts correctly. While it is not required to have the user sessions in the test environment, I would like to understand why Keycloak start failing to start. Appreciate for help in advance. --- Error Log --- 2018-04-27 04:40:09,600 ERROR [org.keycloak.models.sessions.infinispan.initializer.InfinispanUserSessionInitializer] (ServerService Thread Pool -- 56) ExecutionException when computed future. Errors: 1: java.util.concurrent.ExecutionException: java.lang.NullPointerException at java.util.concurrent.FutureTask.report(FutureTask.java:122) at java.util.concurrent.FutureTask.get(FutureTask.java:206) at org.infinispan.commons.util.concurrent.NotifyingFutureImpl.get(NotifyingFutureImpl.java:88) at org.infinispan.distexec.DefaultExecutorService$LocalDistributedTaskPart.getResult(DefaultExecutorService.java:1084) at org.infinispan.distexec.DefaultExecutorService$DistributedTaskPart.innerGet(DefaultExecutorService.java:869) at org.infinispan.distexec.DefaultExecutorService$DistributedTaskPart.get(DefaultExecutorService.java:849) at org.keycloak.models.sessions.infinispan.initializer.InfinispanUserSessionInitializer.startLoading(InfinispanUserSessionInitializer.java:204) at org.keycloak.models.sessions.infinispan.initializer.InfinispanUserSessionInitializer.loadPersistentSessions(InfinispanUserSessionInitializer.java:88) at org.keycloak.models.sessions.infinispan.InfinispanUserSessionProviderFactory$2.run(InfinispanUserSessionProviderFactory.java:101) at org.keycloak.models.utils.KeycloakModelUtils.runJobInTransaction(KeycloakModelUtils.java:219) at org.keycloak.models.sessions.infinispan.InfinispanUserSessionProviderFactory.loadPersistentSessions(InfinispanUserSessionProviderFactory.java:92) at org.keycloak.models.sessions.infinispan.InfinispanUserSessionProviderFactory$1.onEvent(InfinispanUserSessionProviderFactory.java:76) at org.keycloak.services.DefaultKeycloakSessionFactory.publish(DefaultKeycloakSessionFactory.java:67) at org.keycloak.services.resources.KeycloakApplication.<init>(KeycloakApplication.java:162) at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method) at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62) at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45) at java.lang.reflect.Constructor.newInstance(Constructor.java:423) at org.jboss.resteasy.core.ConstructorInjectorImpl.construct(ConstructorInjectorImpl.java:150) at org.jboss.resteasy.spi.ResteasyProviderFactory.createProviderInstance(ResteasyProviderFactory.java:2209) at org.jboss.resteasy.spi.ResteasyDeployment.createApplication(ResteasyDeployment.java:299) at org.jboss.resteasy.spi.ResteasyDeployment.start(ResteasyDeployment.java:240) at org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.init(ServletContainerDispatcher.java:113) at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.init(HttpServletDispatcher.java:36) at io.undertow.servlet.core.LifecyleInterceptorInvocation.proceed(LifecyleInterceptorInvocation.java:117) at org.wildfly.extension.undertow.security.RunAsLifecycleInterceptor.init(RunAsLifecycleInterceptor.java:78) at io.undertow.servlet.core.LifecyleInterceptorInvocation.proceed(LifecyleInterceptorInvocation.java:103) at io.undertow.servlet.core.ManagedServlet$DefaultInstanceStrategy.start(ManagedServlet.java:231) at io.undertow.servlet.core.ManagedServlet.createServlet(ManagedServlet.java:132) at io.undertow.servlet.core.DeploymentManagerImpl.start(DeploymentManagerImpl.java:526) at org.wildfly.extension.undertow.deployment.UndertowDeploymentService.startContext(UndertowDeploymentService.java:101) at org.wildfly.extension.undertow.deployment.UndertowDeploymentService$1.run(UndertowDeploymentService.java:82) at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511) at java.util.concurrent.FutureTask.run(FutureTask.java:266) at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) at java.lang.Thread.run(Thread.java:745) at org.jboss.threads.JBossThread.run(JBossThread.java:320) Caused by: java.lang.NullPointerException at org.keycloak.models.sessions.infinispan.InfinispanUserSessionProvider.importClientSession(InfinispanUserSessionProvider.java:672) at org.keycloak.models.sessions.infinispan.InfinispanUserSessionProvider.importClientSession(InfinispanUserSessionProvider.java:66) at org.keycloak.models.sessions.infinispan.initializer.OfflineUserSessionLoader.loadSessions(OfflineUserSessionLoader.java:70) at org.keycloak.models.sessions.infinispan.initializer.SessionInitializerWorker$1.run(SessionInitializerWorker.java:74) at org.keycloak.models.utils.KeycloakModelUtils.runJobInTransaction(KeycloakModelUtils.java:219) at org.keycloak.models.sessions.infinispan.initializer.SessionInitializerWorker.call(SessionInitializerWorker.java:70) at org.keycloak.models.sessions.infinispan.initializer.SessionInitializerWorker.call(SessionInitializerWorker.java:34) at org.infinispan.commands.read.DistributedExecuteCommand.perform(DistributedExecuteCommand.java:103) at org.infinispan.distexec.DefaultExecutorService$LocalDistributedTaskPart$1.doLocalInvoke(DefaultExecutorService.java:1113) at org.infinispan.distexec.DefaultExecutorService$LocalDistributedTaskPart$1.call(DefaultExecutorService.java:1103) at java.util.concurrent.FutureTask.run(FutureTask.java:266) at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) at java.lang.Thread.run(Thread.java:745) Thanks, Chaminda

6 years, 1 month

1
0
0 / 0

Possible Bug in ProtectionService.java while retrieving ClientModel in resource_set endpoint

by Spike J

Hi there, I noticed an unfortunate HTTP 500 Server Error, when requesting the "/protection/resource_set" endpoint of Keycloak. After some debugging it showed, that the retrieval of the ClientModel returned null, because identity.getId() returns an User-ID and not the related Client-ID. Following lines show the current Code vs. my refactored version of org.keycloak.authorization.protection.ProtectionService.resource() (line 60, master-branch) This endpoint is requested by an endusers access-token. Current Code (master-branch), fails: ClientModel client = realm.getClientById(identity.getId()); --> client = null --> identity.getId() = user-ID of the user requesting the Endpoint Refactored Code (works): ClientModel client = realm.getClientByClientId(identity.getAccessToken(). getIssuedFor()); --> client != null --> identity.getAccessToken().getIssuedFor() = ClientID (name of the client) --> calling getClientByClientId() instead of getClientById() Documentation of this endpoint: https://www.keycloak.org/docs/latest/authorization_services/ index.html#_service_protection_resources_api What is the acual purpose of the method "getID()" of KeycloakIdentiy-Class? In my opinion this class should return the ID of a client and not the ID of an user. I am looking forward to your insights regarding this bug. Best regards

6 years, 1 month

1
0
0 / 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

keycloak-user April 2018