From rajkiran.k at inteqsolutions.com  Fri Jul  1 02:06:16 2016
From: rajkiran.k at inteqsolutions.com (Rajkiran K)
Date: Fri, 1 Jul 2016 11:36:16 +0530
Subject: [keycloak-user] Customize length of of user_attribute table value
	field
Message-ID: <1ef01d3b-b31f-932e-bc49-a827dde79c0a@inteqsolutions.com>

Hi,

I had a requirement for inserting 450 characters string in to keycloak 
custom attribute, but value field is 255 characters in user_attribute 
table. is there any provision to modify this value. Please let me know 
how can i do this.

Regards,

Raj Kiran K



From thomas.darimont at googlemail.com  Fri Jul  1 03:53:54 2016
From: thomas.darimont at googlemail.com (Thomas Darimont)
Date: Fri, 1 Jul 2016 09:53:54 +0200
Subject: [keycloak-user] Obtaining full profile from "userinfo" endpoint
In-Reply-To: <CAC9D9d9SW-Kzo8k1uFY_WDMUtmBQ2N_NrqqZJft4Mw4eZ5+1Ww@mail.gmail.com>
References: <CAC9D9d9SW-Kzo8k1uFY_WDMUtmBQ2N_NrqqZJft4Mw4eZ5+1Ww@mail.gmail.com>
Message-ID: <CAK-7U1g+_D7kRYc4sFJcEnucYM8rMrXh_8ybw1koPxkTRyqFvQ@mail.gmail.com>

Hello Brian,

I gave this a spin (with 1.9.x and master) and I think that currently the
only way to extend the information in the
userinfo endpoint is by defining a custom mapper and register that for the
client you use to get the
access-token.
The protocol mappers of this client will be used for the userinfo endpoint.
However the downside of this approach is that
this information is now also added to the access-token which you wanted to
avoid.

It would be great of one had an additional switchable option for custom
protocol mappers like "include in userinfo".
With this enabled one could control very explicitly what should go where.

I added a small curl command sequence below that can be used for testing.

Cheers,
Thomas

# Setup
KC_REALM=acme-test
KC_USERNAME=tester
KC_PASSWORD=test
KC_CLIENT=test-client
KC_CLIENT_SECRET=3ee678ac-b31b-4bb6-80fa-5f25c7817bf0
KC_SERVER=192.168.99.1:8080
KC_CONTEXT=auth
CURL_OPTS="-k -v --noproxy 192.168.99.1"

# Step 1 Request Tokens for credentials
KC_RESPONSE=$( \
   curl $CURL_OPTS -X POST \
        -H "Content-Type: application/x-www-form-urlencoded" \
        -d "username=$KC_USERNAME" \
        -d "password=$KC_PASSWORD" \
        -d 'grant_type=password' \
        -d "client_id=$KC_CLIENT" \
        -d "client_secret=$KC_CLIENT_SECRET" \
        "http://$KC_SERVER/$KC_CONTEXT/realms/$KC_REALM/protocol/openid-connect/token"
\
    | jq .
)

# Step 2 Split tokens
KC_ACCESS_TOKEN=$(echo $KC_RESPONSE| jq -r .access_token)
KC_ID_TOKEN=$(echo $KC_RESPONSE| jq -r .id_token)
KC_REFRESH_TOKEN=$(echo $KC_RESPONSE| jq -r .refresh_token)

# Step 3 (Debug) Show all keycloak env variables
set | grep KC_*

# Step 4 Access Keycloak User Info
curl $CURL_OPTS \
     -X POST \
     -H "Content-Type: application/x-www-form-urlencoded" \
     -d "access_token=$KC_ACCESS_TOKEN" \
   "http://$KC_SERVER/$KC_CONTEXT/realms/$KC_REALM/protocol/openid-connect/userinfo"
| jq .

# Step 5 Define a new protocol mapper for the client test-client in the
admin-console
# via clients -> test-client -> mappers -> new -> as an example map a
custom user attribute -> add to access token
# After that a request to the userinfo endpoint will show your custom
attribute.

# Step 6 Access Keycloak User Info
curl $CURL_OPTS \
     -X POST \
     -H "Content-Type: application/x-www-form-urlencoded" \
     -d "access_token=$KC_ACCESS_TOKEN" \
   "http://$KC_SERVER/$KC_CONTEXT/realms/$KC_REALM/protocol/openid-connect/userinfo"
| jq .



2016-06-30 16:41 GMT+02:00 Brian Watson <watson409 at gmail.com>:

> Hi all,
>
> Keycloak version: 1.9.8
>
> Here is my use case: I want to keep the access token JWS as lean as
> possible, only containing user roles and a few custom claims I have added.
> I want no PII in the access token. However, I would like my internal
> services to obtain the full user profile (name, email, etc...) from the
> OIDC "/userinfo" endpoint. Unfortunately, I can only seem to obtain the
> "sub" claim and the few custom claims that already exist in the access
> token. I don't see any support for adding scope values to the request.
>
> Is there any way to accomplish what I would like, or any other ways of
> obtaining this info that I may be missing?
>
> Thanks in advance
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160701/6d4a14a0/attachment.html 

From akaya at expedia.com  Fri Jul  1 04:16:36 2016
From: akaya at expedia.com (Sarp Kaya)
Date: Fri, 1 Jul 2016 08:16:36 +0000
Subject: [keycloak-user] Lost session when removing an instance off cluster
Message-ID: <D39C63FE.5FCC%akaya@expedia.com>

Hello,

I have tried various ways of configuring infinispan but it just seems like if I deploy a new instance to the cluster and remove one, then some sessions are lost and an exception is thrown saying that it was not handled. This is the Infinispan exception:

Exception handling request to /auth/realms/realmname/protocol/openid-connect/auth: org.jboss.resteasy.spi.UnhandledException: org.infinispan.util.concurrent.TimeoutException: Replication timeout for 79a0757ecab3 at org.jboss.resteasy.core.ExceptionHandler.handleException(ExceptionHandler.java:247) at org.jboss.resteasy.core.SynchronousDispatcher.writeException(SynchronousDispatcher.java:168) at org.jboss.resteasy.core.SynchronousDispatcher.writeResponse(SynchronousDispatcher.java:471) at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:415) at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:202) at org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.service(ServletContainerDispatcher.java:221) at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:56) at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:51) at javax.servlet.http.HttpServlet.service(HttpServlet.java:790) at io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:85) at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:129) at org.keycloak.services.filters.KeycloakSessionServletFilter.doFilter(KeycloakSessionServletFilter.java:88) at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:60) at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131) at io.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.java:84) at io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:62) at io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36) at org.wildfly.extension.undertow.security.SecurityContextAssociationHandler.handleRequest(SecurityContextAssociationHandler.java:78) at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) at io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:131) at io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:57) at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) at io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:46) at io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64) at io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:60) at io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:77) at io.undertow.security.handlers.NotificationReceiverHandler.handleRequest(NotificationReceiverHandler.java:50) at io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43) at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) at org.wildfly.extension.undertow.security.jacc.JACCContextIdHandler.handleRequest(JACCContextIdHandler.java:61) at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) at io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:284) at io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:263) at io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:81) at io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:174) at io.undertow.server.Connectors.executeRootHandler(Connectors.java:202) at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:793) at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) at java.lang.Thread.run(Thread.java:745) Caused by: org.infinispan.util.concurrent.TimeoutException: Replication timeout for 79a0757ecab3 at org.infinispan.remoting.transport.jgroups.JGroupsTransport.checkRsp(JGroupsTransport.java:765) at org.infinispan.remoting.transport.jgroups.JGroupsTransport.lambda$invokeRemotelyAsync$72(JGroupsTransport.java:599) at java.util.concurrent.CompletableFuture.uniApply(CompletableFuture.java:602) at java.util.concurrent.CompletableFuture$UniApply.tryFire(CompletableFuture.java:577) at java.util.concurrent.CompletableFuture.postComplete(CompletableFuture.java:474) at java.util.concurrent.CompletableFuture.complete(CompletableFuture.java:1962) at org.infinispan.remoting.transport.jgroups.SingleResponseFuture.call(SingleResponseFuture.java:46) at org.infinispan.remoting.transport.jgroups.SingleResponseFuture.call(SingleResponseFuture.java:17) at java.util.concurrent.FutureTask.run(FutureTask.java:266) at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$201(ScheduledThreadPoolExecutor.java:180)

This causes browsers to see Internal Server Error. Shouldn't that be handled in Keycloak as lost session, therefore KC should try to handle it rather than showing that it's an Internal Server Error?

My current infinispan configuration looks like this:


<distributed-cache name="sessions" mode="SYNC">
    <transaction mode="NON_DURABLE_XA"/>
</distributed-cache>

I use Keycloak version 1.9.5. My question is am I doing something wrong with my configuration? I tried both replicated-cache and distributed-cache and tried all transaction mode on both of them. None of them seems to solve the error that I've had above.

Kind Regards,
Sarp Kaya



-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160701/ebced1fe/attachment-0001.html 

From thomas.darimont at googlemail.com  Fri Jul  1 05:12:38 2016
From: thomas.darimont at googlemail.com (Thomas Darimont)
Date: Fri, 1 Jul 2016 11:12:38 +0200
Subject: [keycloak-user] Obtaining full profile from "userinfo" endpoint
In-Reply-To: <CAK-7U1g+_D7kRYc4sFJcEnucYM8rMrXh_8ybw1koPxkTRyqFvQ@mail.gmail.com>
References: <CAC9D9d9SW-Kzo8k1uFY_WDMUtmBQ2N_NrqqZJft4Mw4eZ5+1Ww@mail.gmail.com>
	<CAK-7U1g+_D7kRYc4sFJcEnucYM8rMrXh_8ybw1koPxkTRyqFvQ@mail.gmail.com>
Message-ID: <CAK-7U1j7qn7FmbSJ44xkjhD+irHpfNGW3Hi=C3TkoVoK84jVzQ@mail.gmail.com>

Hello Brian,

I gave this a quick spin - I introduced an additional option that allows to
configure whether a claim from a
client mapper should be included in userinfo or not.
With that in place one can now control whether a claim should be contained
in the access-token, id-token or userinfo
which helps to keep access-tokens lean.

For the sake of simplicity I only added support for controlling user
attributes but I think this could be a useful
for other mappers as well.

Branch is here:
https://github.com/thomasdarimont/keycloak/tree/poc/KEYCLOAK-XXX-use-mapper-only-for-userinfo-endpoint
relevant commit:
https://github.com/thomasdarimont/keycloak/commit/eb25e72060f75a00afd188fc3b2c242e7b21aa7f

Cheers,
Thomas

2016-07-01 9:53 GMT+02:00 Thomas Darimont <thomas.darimont at googlemail.com>:

> Hello Brian,
>
> I gave this a spin (with 1.9.x and master) and I think that currently the
> only way to extend the information in the
> userinfo endpoint is by defining a custom mapper and register that for the
> client you use to get the
> access-token.
> The protocol mappers of this client will be used for the userinfo
> endpoint. However the downside of this approach is that
> this information is now also added to the access-token which you wanted to
> avoid.
>
> It would be great of one had an additional switchable option for custom
> protocol mappers like "include in userinfo".
> With this enabled one could control very explicitly what should go where.
>
> I added a small curl command sequence below that can be used for testing.
>
> Cheers,
> Thomas
>
> # Setup
> KC_REALM=acme-test
> KC_USERNAME=tester
> KC_PASSWORD=test
> KC_CLIENT=test-client
> KC_CLIENT_SECRET=3ee678ac-b31b-4bb6-80fa-5f25c7817bf0
> KC_SERVER=192.168.99.1:8080
> KC_CONTEXT=auth
> CURL_OPTS="-k -v --noproxy 192.168.99.1"
>
> # Step 1 Request Tokens for credentials
> KC_RESPONSE=$( \
>    curl $CURL_OPTS -X POST \
>         -H "Content-Type: application/x-www-form-urlencoded" \
>         -d "username=$KC_USERNAME" \
>         -d "password=$KC_PASSWORD" \
>         -d 'grant_type=password' \
>         -d "client_id=$KC_CLIENT" \
>         -d "client_secret=$KC_CLIENT_SECRET" \
>         "http://$KC_SERVER/$KC_CONTEXT/realms/$KC_REALM/protocol/openid-connect/token"
> \
>     | jq .
> )
>
> # Step 2 Split tokens
> KC_ACCESS_TOKEN=$(echo $KC_RESPONSE| jq -r .access_token)
> KC_ID_TOKEN=$(echo $KC_RESPONSE| jq -r .id_token)
> KC_REFRESH_TOKEN=$(echo $KC_RESPONSE| jq -r .refresh_token)
>
> # Step 3 (Debug) Show all keycloak env variables
> set | grep KC_*
>
> # Step 4 Access Keycloak User Info
> curl $CURL_OPTS \
>      -X POST \
>      -H "Content-Type: application/x-www-form-urlencoded" \
>      -d "access_token=$KC_ACCESS_TOKEN" \
>    "http://$KC_SERVER/$KC_CONTEXT/realms/$KC_REALM/protocol/openid-connect/userinfo"
> | jq .
>
> # Step 5 Define a new protocol mapper for the client test-client in the
> admin-console
> # via clients -> test-client -> mappers -> new -> as an example map a
> custom user attribute -> add to access token
> # After that a request to the userinfo endpoint will show your custom
> attribute.
>
> # Step 6 Access Keycloak User Info
> curl $CURL_OPTS \
>      -X POST \
>      -H "Content-Type: application/x-www-form-urlencoded" \
>      -d "access_token=$KC_ACCESS_TOKEN" \
>    "http://$KC_SERVER/$KC_CONTEXT/realms/$KC_REALM/protocol/openid-connect/userinfo"
> | jq .
>
>
>
> 2016-06-30 16:41 GMT+02:00 Brian Watson <watson409 at gmail.com>:
>
>> Hi all,
>>
>> Keycloak version: 1.9.8
>>
>> Here is my use case: I want to keep the access token JWS as lean as
>> possible, only containing user roles and a few custom claims I have added.
>> I want no PII in the access token. However, I would like my internal
>> services to obtain the full user profile (name, email, etc...) from the
>> OIDC "/userinfo" endpoint. Unfortunately, I can only seem to obtain the
>> "sub" claim and the few custom claims that already exist in the access
>> token. I don't see any support for adding scope values to the request.
>>
>> Is there any way to accomplish what I would like, or any other ways of
>> obtaining this info that I may be missing?
>>
>> Thanks in advance
>>
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160701/c1441d4a/attachment.html 

From sthorger at redhat.com  Fri Jul  1 05:17:01 2016
From: sthorger at redhat.com (Stian Thorgersen)
Date: Fri, 1 Jul 2016 11:17:01 +0200
Subject: [keycloak-user] Lost session when removing an instance off
	cluster
In-Reply-To: <D39C63FE.5FCC%akaya@expedia.com>
References: <D39C63FE.5FCC%akaya@expedia.com>
Message-ID: <CAJgngAfJoYUzbtLtU1aAkVrBmE3s7_XOxCCTh8ywVBVth9ZprQ@mail.gmail.com>

Can you please include more details from the log if there is any, at least
a full stack trace and not just the bit you've included. We also need to
know details around how you've configured the caches and Infinispan.

On 1 July 2016 at 10:16, Sarp Kaya <akaya at expedia.com> wrote:

> Hello,
>
> I have tried various ways of configuring infinispan but it just seems like
> if I deploy a new instance to the cluster and remove one, then some
> sessions are lost and an exception is thrown saying that it was not
> handled. This is the Infinispan exception:
>
> Exception handling request to /auth/realms/realmname/protocol/openid-
> connect/auth: org.jboss.resteasy.spi.UnhandledException: org.infinispan.
> util.concurrent.TimeoutException: Replication timeout for 79a0757ecab3 at
> org.jboss.resteasy.core.ExceptionHandler.handleException(ExceptionHandler.
> java:247) at org.jboss.resteasy.core.SynchronousDispatcher.writeException(
> SynchronousDispatcher.java:168) at org.jboss.resteasy.core.
> SynchronousDispatcher.writeResponse(SynchronousDispatcher.java:471) at org
> .jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.
> java:415) at org.jboss.resteasy.core.SynchronousDispatcher.invoke(
> SynchronousDispatcher.java:202) at org.jboss.resteasy.plugins.server.
> servlet.ServletContainerDispatcher.service(ServletContainerDispatcher.java
> :221) at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.
> service(HttpServletDispatcher.java:56) at org.jboss.resteasy.plugins.
> server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:51)
> at javax.servlet.http.HttpServlet.service(HttpServlet.java:790) at io.
> undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java
> :85) at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.
> doFilter(FilterHandler.java:129) at org.keycloak.services.filters.
> KeycloakSessionServletFilter.doFilter(KeycloakSessionServletFilter.java:88)
> at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:60)
> at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(
> FilterHandler.java:131) at io.undertow.servlet.handlers.FilterHandler.
> handleRequest(FilterHandler.java:84) at io.undertow.servlet.handlers.
> security.ServletSecurityRoleHandler.handleRequest(
> ServletSecurityRoleHandler.java:62) at io.undertow.servlet.handlers.
> ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36)
> at org.wildfly.extension.undertow.security.
> SecurityContextAssociationHandler.handleRequest(
> SecurityContextAssociationHandler.java:78) at io.undertow.server.handlers.
> PredicateHandler.handleRequest(PredicateHandler.java:43) at io.undertow.
> servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(
> SSLInformationAssociationHandler.java:131) at io.undertow.servlet.handlers
> .security.ServletAuthenticationCallHandler.handleRequest(
> ServletAuthenticationCallHandler.java:57) at io.undertow.server.handlers.
> PredicateHandler.handleRequest(PredicateHandler.java:43) at io.undertow.
> security.handlers.AbstractConfidentialityHandler.handleRequest(
> AbstractConfidentialityHandler.java:46) at io.undertow.servlet.handlers.
> security.ServletConfidentialityConstraintHandler.handleRequest(
> ServletConfidentialityConstraintHandler.java:64) at io.undertow.security.
> handlers.AuthenticationMechanismsHandler.handleRequest(
> AuthenticationMechanismsHandler.java:60) at io.undertow.servlet.handlers.
> security.CachedAuthenticatedSessionHandler.handleRequest(
> CachedAuthenticatedSessionHandler.java:77) at io.undertow.security.
> handlers.NotificationReceiverHandler.handleRequest(
> NotificationReceiverHandler.java:50) at io.undertow.security.handlers.
> AbstractSecurityContextAssociationHandler.handleRequest(
> AbstractSecurityContextAssociationHandler.java:43) at io.undertow.server.
> handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) at org.
> wildfly.extension.undertow.security.jacc.JACCContextIdHandler.
> handleRequest(JACCContextIdHandler.java:61) at io.undertow.server.handlers
> .PredicateHandler.handleRequest(PredicateHandler.java:43) at io.undertow.
> server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
> at io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(
> ServletInitialHandler.java:284) at io.undertow.servlet.handlers.
> ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:263) at
> io.undertow.servlet.handlers.ServletInitialHandler.access$000(
> ServletInitialHandler.java:81) at io.undertow.servlet.handlers.
> ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:174) at
> io.undertow.server.Connectors.executeRootHandler(Connectors.java:202) at
> io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:793)
> at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.
> java:1142) at java.util.concurrent.ThreadPoolExecutor$Worker.run(
> ThreadPoolExecutor.java:617) at java.lang.Thread.run(Thread.java:745)
> Caused by: org.infinispan.util.concurrent.TimeoutException: Replication
> timeout for 79a0757ecab3 at org.infinispan.remoting.transport.jgroups.
> JGroupsTransport.checkRsp(JGroupsTransport.java:765) at org.infinispan.
> remoting.transport.jgroups.JGroupsTransport.lambda$invokeRemotelyAsync$72(
> JGroupsTransport.java:599) at java.util.concurrent.CompletableFuture.
> uniApply(CompletableFuture.java:602) at java.util.concurrent.
> CompletableFuture$UniApply.tryFire(CompletableFuture.java:577) at java.
> util.concurrent.CompletableFuture.postComplete(CompletableFuture.java:474)
> at java.util.concurrent.CompletableFuture.complete(CompletableFuture.java:
> 1962) at org.infinispan.remoting.transport.jgroups.SingleResponseFuture.
> call(SingleResponseFuture.java:46) at org.infinispan.remoting.transport.
> jgroups.SingleResponseFuture.call(SingleResponseFuture.java:17) at java.
> util.concurrent.FutureTask.run(FutureTask.java:266) at java.util.
> concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$201(
> ScheduledThreadPoolExecutor.java:180)
>
> This causes browsers to see Internal Server Error. Shouldn?t that be
> handled in Keycloak as lost session, therefore KC should try to handle it
> rather than showing that it?s an Internal Server Error?
>
> My current infinispan configuration looks like this:
>
> <distributed-cache name="sessions" mode="SYNC">
>     <transaction mode="NON_DURABLE_XA"/>
> </distributed-cache>
>
>
> I use Keycloak version 1.9.5. My question is am I doing something wrong
> with my configuration? I tried both replicated-cache and distributed-cache
> and tried all transaction mode on both of them. None of them seems to solve
> the error that I?ve had above.
>
> Kind Regards,
> Sarp Kaya
>
>
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160701/4a22c315/attachment-0001.html 

From sthorger at redhat.com  Fri Jul  1 05:18:32 2016
From: sthorger at redhat.com (Stian Thorgersen)
Date: Fri, 1 Jul 2016 11:18:32 +0200
Subject: [keycloak-user] Obtaining full profile from "userinfo" endpoint
In-Reply-To: <CAK-7U1j7qn7FmbSJ44xkjhD+irHpfNGW3Hi=C3TkoVoK84jVzQ@mail.gmail.com>
References: <CAC9D9d9SW-Kzo8k1uFY_WDMUtmBQ2N_NrqqZJft4Mw4eZ5+1Ww@mail.gmail.com>
	<CAK-7U1g+_D7kRYc4sFJcEnucYM8rMrXh_8ybw1koPxkTRyqFvQ@mail.gmail.com>
	<CAK-7U1j7qn7FmbSJ44xkjhD+irHpfNGW3Hi=C3TkoVoK84jVzQ@mail.gmail.com>
Message-ID: <CAJgngAeO76hTtCqDy55ykPnDaA43F0wF-1Ag0oTQEGY4eK3BVg@mail.gmail.com>

+1 To the user info toggle for mappers

On 1 July 2016 at 11:12, Thomas Darimont <thomas.darimont at googlemail.com>
wrote:

> Hello Brian,
>
> I gave this a quick spin - I introduced an additional option that allows
> to configure whether a claim from a
> client mapper should be included in userinfo or not.
> With that in place one can now control whether a claim should be contained
> in the access-token, id-token or userinfo
> which helps to keep access-tokens lean.
>
> For the sake of simplicity I only added support for controlling user
> attributes but I think this could be a useful
> for other mappers as well.
>
> Branch is here:
>
> https://github.com/thomasdarimont/keycloak/tree/poc/KEYCLOAK-XXX-use-mapper-only-for-userinfo-endpoint
> relevant commit:
>
> https://github.com/thomasdarimont/keycloak/commit/eb25e72060f75a00afd188fc3b2c242e7b21aa7f
>
> Cheers,
> Thomas
>
> 2016-07-01 9:53 GMT+02:00 Thomas Darimont <thomas.darimont at googlemail.com>
> :
>
>> Hello Brian,
>>
>> I gave this a spin (with 1.9.x and master) and I think that currently the
>> only way to extend the information in the
>> userinfo endpoint is by defining a custom mapper and register that for
>> the client you use to get the
>> access-token.
>> The protocol mappers of this client will be used for the userinfo
>> endpoint. However the downside of this approach is that
>> this information is now also added to the access-token which you wanted
>> to avoid.
>>
>> It would be great of one had an additional switchable option for custom
>> protocol mappers like "include in userinfo".
>> With this enabled one could control very explicitly what should go where.
>>
>> I added a small curl command sequence below that can be used for testing.
>>
>> Cheers,
>> Thomas
>>
>> # Setup
>> KC_REALM=acme-test
>> KC_USERNAME=tester
>> KC_PASSWORD=test
>> KC_CLIENT=test-client
>> KC_CLIENT_SECRET=3ee678ac-b31b-4bb6-80fa-5f25c7817bf0
>> KC_SERVER=192.168.99.1:8080
>> KC_CONTEXT=auth
>> CURL_OPTS="-k -v --noproxy 192.168.99.1"
>>
>> # Step 1 Request Tokens for credentials
>> KC_RESPONSE=$( \
>>    curl $CURL_OPTS -X POST \
>>         -H "Content-Type: application/x-www-form-urlencoded" \
>>         -d "username=$KC_USERNAME" \
>>         -d "password=$KC_PASSWORD" \
>>         -d 'grant_type=password' \
>>         -d "client_id=$KC_CLIENT" \
>>         -d "client_secret=$KC_CLIENT_SECRET" \
>>         "http://$KC_SERVER/$KC_CONTEXT/realms/$KC_REALM/protocol/openid-connect/token"
>> \
>>     | jq .
>> )
>>
>> # Step 2 Split tokens
>> KC_ACCESS_TOKEN=$(echo $KC_RESPONSE| jq -r .access_token)
>> KC_ID_TOKEN=$(echo $KC_RESPONSE| jq -r .id_token)
>> KC_REFRESH_TOKEN=$(echo $KC_RESPONSE| jq -r .refresh_token)
>>
>> # Step 3 (Debug) Show all keycloak env variables
>> set | grep KC_*
>>
>> # Step 4 Access Keycloak User Info
>> curl $CURL_OPTS \
>>      -X POST \
>>      -H "Content-Type: application/x-www-form-urlencoded" \
>>      -d "access_token=$KC_ACCESS_TOKEN" \
>>    "http://$KC_SERVER/$KC_CONTEXT/realms/$KC_REALM/protocol/openid-connect/userinfo"
>> | jq .
>>
>> # Step 5 Define a new protocol mapper for the client test-client in the
>> admin-console
>> # via clients -> test-client -> mappers -> new -> as an example map a
>> custom user attribute -> add to access token
>> # After that a request to the userinfo endpoint will show your custom
>> attribute.
>>
>> # Step 6 Access Keycloak User Info
>> curl $CURL_OPTS \
>>      -X POST \
>>      -H "Content-Type: application/x-www-form-urlencoded" \
>>      -d "access_token=$KC_ACCESS_TOKEN" \
>>    "http://$KC_SERVER/$KC_CONTEXT/realms/$KC_REALM/protocol/openid-connect/userinfo"
>> | jq .
>>
>>
>>
>> 2016-06-30 16:41 GMT+02:00 Brian Watson <watson409 at gmail.com>:
>>
>>> Hi all,
>>>
>>> Keycloak version: 1.9.8
>>>
>>> Here is my use case: I want to keep the access token JWS as lean as
>>> possible, only containing user roles and a few custom claims I have added.
>>> I want no PII in the access token. However, I would like my internal
>>> services to obtain the full user profile (name, email, etc...) from the
>>> OIDC "/userinfo" endpoint. Unfortunately, I can only seem to obtain the
>>> "sub" claim and the few custom claims that already exist in the access
>>> token. I don't see any support for adding scope values to the request.
>>>
>>> Is there any way to accomplish what I would like, or any other ways of
>>> obtaining this info that I may be missing?
>>>
>>> Thanks in advance
>>>
>>> _______________________________________________
>>> keycloak-user mailing list
>>> keycloak-user at lists.jboss.org
>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>
>>
>>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160701/851d6036/attachment.html 

From thomas.darimont at googlemail.com  Fri Jul  1 05:19:29 2016
From: thomas.darimont at googlemail.com (Thomas Darimont)
Date: Fri, 1 Jul 2016 11:19:29 +0200
Subject: [keycloak-user] Obtaining full profile from "userinfo" endpoint
In-Reply-To: <CAJgngAeO76hTtCqDy55ykPnDaA43F0wF-1Ag0oTQEGY4eK3BVg@mail.gmail.com>
References: <CAC9D9d9SW-Kzo8k1uFY_WDMUtmBQ2N_NrqqZJft4Mw4eZ5+1Ww@mail.gmail.com>
	<CAK-7U1g+_D7kRYc4sFJcEnucYM8rMrXh_8ybw1koPxkTRyqFvQ@mail.gmail.com>
	<CAK-7U1j7qn7FmbSJ44xkjhD+irHpfNGW3Hi=C3TkoVoK84jVzQ@mail.gmail.com>
	<CAJgngAeO76hTtCqDy55ykPnDaA43F0wF-1Ag0oTQEGY4eK3BVg@mail.gmail.com>
Message-ID: <CAK-7U1hccYdt3XFzsUZeTfM6F3wCR-H97UwTXx=Zm3oREV5POw@mail.gmail.com>

Cool - shall I file a jira and issue a PR? Then you can polish it a bit ;-)

Cheers,
Thomas

2016-07-01 11:18 GMT+02:00 Stian Thorgersen <sthorger at redhat.com>:

> +1 To the user info toggle for mappers
>
> On 1 July 2016 at 11:12, Thomas Darimont <thomas.darimont at googlemail.com>
> wrote:
>
>> Hello Brian,
>>
>> I gave this a quick spin - I introduced an additional option that allows
>> to configure whether a claim from a
>> client mapper should be included in userinfo or not.
>> With that in place one can now control whether a claim should be
>> contained in the access-token, id-token or userinfo
>> which helps to keep access-tokens lean.
>>
>> For the sake of simplicity I only added support for controlling user
>> attributes but I think this could be a useful
>> for other mappers as well.
>>
>> Branch is here:
>>
>> https://github.com/thomasdarimont/keycloak/tree/poc/KEYCLOAK-XXX-use-mapper-only-for-userinfo-endpoint
>> relevant commit:
>>
>> https://github.com/thomasdarimont/keycloak/commit/eb25e72060f75a00afd188fc3b2c242e7b21aa7f
>>
>> Cheers,
>> Thomas
>>
>> 2016-07-01 9:53 GMT+02:00 Thomas Darimont <thomas.darimont at googlemail.com
>> >:
>>
>>> Hello Brian,
>>>
>>> I gave this a spin (with 1.9.x and master) and I think that currently
>>> the only way to extend the information in the
>>> userinfo endpoint is by defining a custom mapper and register that for
>>> the client you use to get the
>>> access-token.
>>> The protocol mappers of this client will be used for the userinfo
>>> endpoint. However the downside of this approach is that
>>> this information is now also added to the access-token which you wanted
>>> to avoid.
>>>
>>> It would be great of one had an additional switchable option for custom
>>> protocol mappers like "include in userinfo".
>>> With this enabled one could control very explicitly what should go where.
>>>
>>> I added a small curl command sequence below that can be used for testing.
>>>
>>> Cheers,
>>> Thomas
>>>
>>> # Setup
>>> KC_REALM=acme-test
>>> KC_USERNAME=tester
>>> KC_PASSWORD=test
>>> KC_CLIENT=test-client
>>> KC_CLIENT_SECRET=3ee678ac-b31b-4bb6-80fa-5f25c7817bf0
>>> KC_SERVER=192.168.99.1:8080
>>> KC_CONTEXT=auth
>>> CURL_OPTS="-k -v --noproxy 192.168.99.1"
>>>
>>> # Step 1 Request Tokens for credentials
>>> KC_RESPONSE=$( \
>>>    curl $CURL_OPTS -X POST \
>>>         -H "Content-Type: application/x-www-form-urlencoded" \
>>>         -d "username=$KC_USERNAME" \
>>>         -d "password=$KC_PASSWORD" \
>>>         -d 'grant_type=password' \
>>>         -d "client_id=$KC_CLIENT" \
>>>         -d "client_secret=$KC_CLIENT_SECRET" \
>>>         "http://$KC_SERVER/$KC_CONTEXT/realms/$KC_REALM/protocol/openid-connect/token"
>>> \
>>>     | jq .
>>> )
>>>
>>> # Step 2 Split tokens
>>> KC_ACCESS_TOKEN=$(echo $KC_RESPONSE| jq -r .access_token)
>>> KC_ID_TOKEN=$(echo $KC_RESPONSE| jq -r .id_token)
>>> KC_REFRESH_TOKEN=$(echo $KC_RESPONSE| jq -r .refresh_token)
>>>
>>> # Step 3 (Debug) Show all keycloak env variables
>>> set | grep KC_*
>>>
>>> # Step 4 Access Keycloak User Info
>>> curl $CURL_OPTS \
>>>      -X POST \
>>>      -H "Content-Type: application/x-www-form-urlencoded" \
>>>      -d "access_token=$KC_ACCESS_TOKEN" \
>>>    "http://$KC_SERVER/$KC_CONTEXT/realms/$KC_REALM/protocol/openid-connect/userinfo"
>>> | jq .
>>>
>>> # Step 5 Define a new protocol mapper for the client test-client in the
>>> admin-console
>>> # via clients -> test-client -> mappers -> new -> as an example map a
>>> custom user attribute -> add to access token
>>> # After that a request to the userinfo endpoint will show your custom
>>> attribute.
>>>
>>> # Step 6 Access Keycloak User Info
>>> curl $CURL_OPTS \
>>>      -X POST \
>>>      -H "Content-Type: application/x-www-form-urlencoded" \
>>>      -d "access_token=$KC_ACCESS_TOKEN" \
>>>    "http://$KC_SERVER/$KC_CONTEXT/realms/$KC_REALM/protocol/openid-connect/userinfo"
>>> | jq .
>>>
>>>
>>>
>>> 2016-06-30 16:41 GMT+02:00 Brian Watson <watson409 at gmail.com>:
>>>
>>>> Hi all,
>>>>
>>>> Keycloak version: 1.9.8
>>>>
>>>> Here is my use case: I want to keep the access token JWS as lean as
>>>> possible, only containing user roles and a few custom claims I have added.
>>>> I want no PII in the access token. However, I would like my internal
>>>> services to obtain the full user profile (name, email, etc...) from the
>>>> OIDC "/userinfo" endpoint. Unfortunately, I can only seem to obtain the
>>>> "sub" claim and the few custom claims that already exist in the access
>>>> token. I don't see any support for adding scope values to the request.
>>>>
>>>> Is there any way to accomplish what I would like, or any other ways of
>>>> obtaining this info that I may be missing?
>>>>
>>>> Thanks in advance
>>>>
>>>> _______________________________________________
>>>> keycloak-user mailing list
>>>> keycloak-user at lists.jboss.org
>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>>
>>>
>>>
>>
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160701/3b22731f/attachment-0001.html 

From sthorger at redhat.com  Fri Jul  1 05:24:08 2016
From: sthorger at redhat.com (Stian Thorgersen)
Date: Fri, 1 Jul 2016 11:24:08 +0200
Subject: [keycloak-user] Mongo and 2.0.0.Final
In-Reply-To: <CABk1SXnpaey=6-RYerf2nkJ0s-u1qKzKeyJ4Yjx+eWFZBu12ag@mail.gmail.com>
References: <CABk1SXmVgBmySGU6qvEiyMgxSP=fBbhuf6DxMU8S-m=s68iyUQ@mail.gmail.com>
	<25333792.5332896.1467328788071.JavaMail.zimbra@redhat.com>
	<CABk1SXnpaey=6-RYerf2nkJ0s-u1qKzKeyJ4Yjx+eWFZBu12ag@mail.gmail.com>
Message-ID: <CAJgngAc-7Bfs_Z2CsO5PQTJK+wCfB2VU=b72vKoO1L4cwZxCkg@mail.gmail.com>

The latest image is rebuilt and includes the fix, so if you don't specify a
version when you run the cartridge it'll work fine.

On 1 July 2016 at 02:24, John Bartko <john.bartko at drillinginfo.com> wrote:

> Thanks! Here's an example workaround for running Keycloak
> 2.0.0.Final+MongoDB in the meantime:
>
> https://github.com/jbartko/keycloak/blob/feature/mongo-authpersister/server-mongo/changeDatabase.jq#L2
>
> On Thu, Jun 30, 2016 at 6:19 PM, Pedro Igor Silva <psilva at redhat.com>
> wrote:
>
>> There is an issue with keycloak-mongo image. It is missing the
>> configuration for 'authorizationPersister.provider' [2].
>>
>> [2] https://issues.jboss.org/browse/KEYCLOAK-3230
>>
>> ----- Original Message -----
>> From: "John Bartko" <john.bartko at drillinginfo.com>
>> To: keycloak-user at lists.jboss.org
>> Sent: Thursday, June 30, 2016 7:16:35 PM
>> Subject: [keycloak-user] Mongo and 2.0.0.Final
>>
>> Hello all,
>>
>> I get the following stack trace attempting to use 2.0.0.Final against a
>> MongoDB backend. Following the keycloak-mongo readme should reproduce the
>> behavior.
>>
>>
>>
>> 21:58:31,802 ERROR [org.jboss.msc.service.fail] (ServerService Thread
>> Pool -- 47) MSC000001: Failed to start service
>> jboss.undertow.deployment.default-server.default-host./auth:
>> org.jboss.msc.service.StartException in service
>> jboss.undertow.deployment.default-server.default-host./auth:
>> java.lang.RuntimeException: RESTEASY003325: Failed to construct public
>> org.keycloak.services.resources.KeycloakApplication(javax.servlet.ServletContext,org.jboss.resteasy.core.Dispatcher)
>> at
>> org.wildfly.extension.undertow.deployment.UndertowDeploymentService$1.run(UndertowDeploymentService.java:85)
>> at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
>> at java.util.concurrent.FutureTask.run(FutureTask.java:266)
>> at
>> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
>> at
>> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
>> at java.lang.Thread.run(Thread.java:745)
>> at org.jboss.threads.JBossThread.run(JBossThread.java:320)
>> Caused by: java.lang.RuntimeException: RESTEASY003325: Failed to
>> construct public
>> org.keycloak.services.resources.KeycloakApplication(javax.servlet.ServletContext,org.jboss.resteasy.core.Dispatcher)
>> at
>> org.jboss.resteasy.core.ConstructorInjectorImpl.construct(ConstructorInjectorImpl.java:162)
>> at
>> org.jboss.resteasy.spi.ResteasyProviderFactory.createProviderInstance(ResteasyProviderFactory.java:2209)
>> at
>> org.jboss.resteasy.spi.ResteasyDeployment.createApplication(ResteasyDeployment.java:299)
>> at
>> org.jboss.resteasy.spi.ResteasyDeployment.start(ResteasyDeployment.java:240)
>> at
>> org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.init(ServletContainerDispatcher.java:113)
>> at
>> org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.init(HttpServletDispatcher.java:36)
>> at
>> io.undertow.servlet.core.LifecyleInterceptorInvocation.proceed(LifecyleInterceptorInvocation.java:117)
>> at
>> org.wildfly.extension.undertow.security.RunAsLifecycleInterceptor.init(RunAsLifecycleInterceptor.java:78)
>> at
>> io.undertow.servlet.core.LifecyleInterceptorInvocation.proceed(LifecyleInterceptorInvocation.java:103)
>> at
>> io.undertow.servlet.core.ManagedServlet$DefaultInstanceStrategy.start(ManagedServlet.java:231)
>> at
>> io.undertow.servlet.core.ManagedServlet.createServlet(ManagedServlet.java:132)
>> at
>> io.undertow.servlet.core.DeploymentManagerImpl.start(DeploymentManagerImpl.java:526)
>> at
>> org.wildfly.extension.undertow.deployment.UndertowDeploymentService.startContext(UndertowDeploymentService.java:101)
>> at
>> org.wildfly.extension.undertow.deployment.UndertowDeploymentService$1.run(UndertowDeploymentService.java:82)
>> ... 6 more
>> Caused by: java.lang.RuntimeException: Property 'databaseSchema' needs to
>> be specified in the configuration
>> at
>> org.keycloak.connections.jpa.DefaultJpaConnectionProviderFactory.lazyInit(DefaultJpaConnectionProviderFactory.java:131)
>> at
>> org.keycloak.connections.jpa.DefaultJpaConnectionProviderFactory.create(DefaultJpaConnectionProviderFactory.java:60)
>> at
>> org.keycloak.connections.jpa.DefaultJpaConnectionProviderFactory.create(DefaultJpaConnectionProviderFactory.java:48)
>> at
>> org.keycloak.services.DefaultKeycloakSession.getProvider(DefaultKeycloakSession.java:103)
>> at
>> org.keycloak.authorization.jpa.store.JPAAuthorizationStoreFactory.getEntityManager(JPAAuthorizationStoreFactory.java:54)
>> at
>> org.keycloak.authorization.jpa.store.JPAAuthorizationStoreFactory.create(JPAAuthorizationStoreFactory.java:35)
>> at
>> org.keycloak.authorization.jpa.store.JPAAuthorizationStoreFactory.create(JPAAuthorizationStoreFactory.java:32)
>> at
>> org.keycloak.services.DefaultKeycloakSession.getProvider(DefaultKeycloakSession.java:103)
>> at
>> org.keycloak.models.authorization.infinispan.CachedPolicyStore.getStoreFactory(CachedPolicyStore.java:193)
>> at
>> org.keycloak.models.authorization.infinispan.CachedPolicyStore.getDelegate(CachedPolicyStore.java:201)
>> at
>> org.keycloak.models.authorization.infinispan.CachedPolicyStore.findByType(CachedPolicyStore.java:179)
>> at
>> org.keycloak.authorization.policy.provider.drools.DroolsPolicyProviderFactory$1.onEvent(DroolsPolicyProviderFactory.java:75)
>> at
>> org.keycloak.services.DefaultKeycloakSessionFactory.publish(DefaultKeycloakSessionFactory.java:64)
>> at
>> org.keycloak.services.resources.KeycloakApplication.<init>(KeycloakApplication.java:130)
>> at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
>> at
>> sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62)
>> at
>> sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
>> at java.lang.reflect.Constructor.newInstance(Constructor.java:423)
>> at
>> org.jboss.resteasy.core.ConstructorInjectorImpl.construct(ConstructorInjectorImpl.java:150)
>> ... 19 more
>>
>> 21:58:31,809 ERROR [org.jboss.as.controller.management-operation]
>> (Controller Boot Thread) WFLYCTL0013: Operation ("add") failed - address:
>> ([("deployment" => "keycloak-server.war")]) - failure description:
>> {"WFLYCTL0080: Failed services" =>
>> {"jboss.undertow.deployment.default-server.default-host./auth" =>
>> "org.jboss.msc.service.StartException in service
>> jboss.undertow.deployment.default-server.default-host./auth:
>> java.lang.RuntimeException: RESTEASY003325: Failed to construct public
>> org.keycloak.services.resources.KeycloakApplication(javax.servlet.ServletContext,org.jboss.resteasy.core.Dispatcher)
>> Caused by: java.lang.RuntimeException: RESTEASY003325: Failed to
>> construct public
>> org.keycloak.services.resources.KeycloakApplication(javax.servlet.ServletContext,org.jboss.resteasy.core.Dispatcher)
>> Caused by: java.lang.RuntimeException: Property 'databaseSchema' needs to
>> be specified in the configuration"}}
>>
>>
>> Any thoughts?
>>
>> Thanks,
>> -John Bartko
>>
>>
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160701/f748c04a/attachment.html 

From sthorger at redhat.com  Fri Jul  1 05:24:59 2016
From: sthorger at redhat.com (Stian Thorgersen)
Date: Fri, 1 Jul 2016 11:24:59 +0200
Subject: [keycloak-user] Obtaining full profile from "userinfo" endpoint
In-Reply-To: <CAK-7U1hccYdt3XFzsUZeTfM6F3wCR-H97UwTXx=Zm3oREV5POw@mail.gmail.com>
References: <CAC9D9d9SW-Kzo8k1uFY_WDMUtmBQ2N_NrqqZJft4Mw4eZ5+1Ww@mail.gmail.com>
	<CAK-7U1g+_D7kRYc4sFJcEnucYM8rMrXh_8ybw1koPxkTRyqFvQ@mail.gmail.com>
	<CAK-7U1j7qn7FmbSJ44xkjhD+irHpfNGW3Hi=C3TkoVoK84jVzQ@mail.gmail.com>
	<CAJgngAeO76hTtCqDy55ykPnDaA43F0wF-1Ag0oTQEGY4eK3BVg@mail.gmail.com>
	<CAK-7U1hccYdt3XFzsUZeTfM6F3wCR-H97UwTXx=Zm3oREV5POw@mail.gmail.com>
Message-ID: <CAJgngAejnJ1vRdTdQzT8RtSVBQpsgiYwdFo=RRr4rdfiLPtSHA@mail.gmail.com>

Ideally PR should come with polish and testing. Otherwise it'll just sit in
the queue ;)

On 1 July 2016 at 11:19, Thomas Darimont <thomas.darimont at googlemail.com>
wrote:

> Cool - shall I file a jira and issue a PR? Then you can polish it a bit ;-)
>
> Cheers,
> Thomas
>
> 2016-07-01 11:18 GMT+02:00 Stian Thorgersen <sthorger at redhat.com>:
>
>> +1 To the user info toggle for mappers
>>
>> On 1 July 2016 at 11:12, Thomas Darimont <thomas.darimont at googlemail.com>
>> wrote:
>>
>>> Hello Brian,
>>>
>>> I gave this a quick spin - I introduced an additional option that allows
>>> to configure whether a claim from a
>>> client mapper should be included in userinfo or not.
>>> With that in place one can now control whether a claim should be
>>> contained in the access-token, id-token or userinfo
>>> which helps to keep access-tokens lean.
>>>
>>> For the sake of simplicity I only added support for controlling user
>>> attributes but I think this could be a useful
>>> for other mappers as well.
>>>
>>> Branch is here:
>>>
>>> https://github.com/thomasdarimont/keycloak/tree/poc/KEYCLOAK-XXX-use-mapper-only-for-userinfo-endpoint
>>> relevant commit:
>>>
>>> https://github.com/thomasdarimont/keycloak/commit/eb25e72060f75a00afd188fc3b2c242e7b21aa7f
>>>
>>> Cheers,
>>> Thomas
>>>
>>> 2016-07-01 9:53 GMT+02:00 Thomas Darimont <
>>> thomas.darimont at googlemail.com>:
>>>
>>>> Hello Brian,
>>>>
>>>> I gave this a spin (with 1.9.x and master) and I think that currently
>>>> the only way to extend the information in the
>>>> userinfo endpoint is by defining a custom mapper and register that for
>>>> the client you use to get the
>>>> access-token.
>>>> The protocol mappers of this client will be used for the userinfo
>>>> endpoint. However the downside of this approach is that
>>>> this information is now also added to the access-token which you wanted
>>>> to avoid.
>>>>
>>>> It would be great of one had an additional switchable option for custom
>>>> protocol mappers like "include in userinfo".
>>>> With this enabled one could control very explicitly what should go
>>>> where.
>>>>
>>>> I added a small curl command sequence below that can be used for
>>>> testing.
>>>>
>>>> Cheers,
>>>> Thomas
>>>>
>>>> # Setup
>>>> KC_REALM=acme-test
>>>> KC_USERNAME=tester
>>>> KC_PASSWORD=test
>>>> KC_CLIENT=test-client
>>>> KC_CLIENT_SECRET=3ee678ac-b31b-4bb6-80fa-5f25c7817bf0
>>>> KC_SERVER=192.168.99.1:8080
>>>> KC_CONTEXT=auth
>>>> CURL_OPTS="-k -v --noproxy 192.168.99.1"
>>>>
>>>> # Step 1 Request Tokens for credentials
>>>> KC_RESPONSE=$( \
>>>>    curl $CURL_OPTS -X POST \
>>>>         -H "Content-Type: application/x-www-form-urlencoded" \
>>>>         -d "username=$KC_USERNAME" \
>>>>         -d "password=$KC_PASSWORD" \
>>>>         -d 'grant_type=password' \
>>>>         -d "client_id=$KC_CLIENT" \
>>>>         -d "client_secret=$KC_CLIENT_SECRET" \
>>>>         "http://$KC_SERVER/$KC_CONTEXT/realms/$KC_REALM/protocol/openid-connect/token"
>>>> \
>>>>     | jq .
>>>> )
>>>>
>>>> # Step 2 Split tokens
>>>> KC_ACCESS_TOKEN=$(echo $KC_RESPONSE| jq -r .access_token)
>>>> KC_ID_TOKEN=$(echo $KC_RESPONSE| jq -r .id_token)
>>>> KC_REFRESH_TOKEN=$(echo $KC_RESPONSE| jq -r .refresh_token)
>>>>
>>>> # Step 3 (Debug) Show all keycloak env variables
>>>> set | grep KC_*
>>>>
>>>> # Step 4 Access Keycloak User Info
>>>> curl $CURL_OPTS \
>>>>      -X POST \
>>>>      -H "Content-Type: application/x-www-form-urlencoded" \
>>>>      -d "access_token=$KC_ACCESS_TOKEN" \
>>>>    "http://$KC_SERVER/$KC_CONTEXT/realms/$KC_REALM/protocol/openid-connect/userinfo"
>>>> | jq .
>>>>
>>>> # Step 5 Define a new protocol mapper for the client test-client in the
>>>> admin-console
>>>> # via clients -> test-client -> mappers -> new -> as an example map a
>>>> custom user attribute -> add to access token
>>>> # After that a request to the userinfo endpoint will show your custom
>>>> attribute.
>>>>
>>>> # Step 6 Access Keycloak User Info
>>>> curl $CURL_OPTS \
>>>>      -X POST \
>>>>      -H "Content-Type: application/x-www-form-urlencoded" \
>>>>      -d "access_token=$KC_ACCESS_TOKEN" \
>>>>    "http://$KC_SERVER/$KC_CONTEXT/realms/$KC_REALM/protocol/openid-connect/userinfo"
>>>> | jq .
>>>>
>>>>
>>>>
>>>> 2016-06-30 16:41 GMT+02:00 Brian Watson <watson409 at gmail.com>:
>>>>
>>>>> Hi all,
>>>>>
>>>>> Keycloak version: 1.9.8
>>>>>
>>>>> Here is my use case: I want to keep the access token JWS as lean as
>>>>> possible, only containing user roles and a few custom claims I have added.
>>>>> I want no PII in the access token. However, I would like my internal
>>>>> services to obtain the full user profile (name, email, etc...) from the
>>>>> OIDC "/userinfo" endpoint. Unfortunately, I can only seem to obtain the
>>>>> "sub" claim and the few custom claims that already exist in the access
>>>>> token. I don't see any support for adding scope values to the request.
>>>>>
>>>>> Is there any way to accomplish what I would like, or any other ways of
>>>>> obtaining this info that I may be missing?
>>>>>
>>>>> Thanks in advance
>>>>>
>>>>> _______________________________________________
>>>>> keycloak-user mailing list
>>>>> keycloak-user at lists.jboss.org
>>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>>>
>>>>
>>>>
>>>
>>> _______________________________________________
>>> keycloak-user mailing list
>>> keycloak-user at lists.jboss.org
>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>
>>
>>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160701/887657ee/attachment-0001.html 

From sthorger at redhat.com  Fri Jul  1 05:28:33 2016
From: sthorger at redhat.com (Stian Thorgersen)
Date: Fri, 1 Jul 2016 11:28:33 +0200
Subject: [keycloak-user] Searching on Keycloak mailing list archive
In-Reply-To: <CAM5SUC7UEWTuvtNRj7LhU-pfTBtAoq8AQCB0Y8uJ-8=4Saw_dg@mail.gmail.com>
References: <57557345.2060409@redhat.com>
	<CAK-7U1hAUbwsQAafMuiuUpdCP6P3N2Fp17COyMTOoo6YV4aQWA@mail.gmail.com>
	<CAJgngAeDzRChYezuJYEMO2peC3+GEY7axgDxf7j_mboTBTE1YA@mail.gmail.com>
	<CAK-7U1jxx8fmYAYJdsvxRB7G8NwDy0tN-5s1OanbHWu=1YFyvA@mail.gmail.com>
	<CAJgngAdRb1QFqQVqYYB6nDFsR_zW6u8QF0LsBAjOYCYrbMHHAA@mail.gmail.com>
	<CAM5SUC4F5j6xpY3Gy6gdM9DReE_UzNfhzaBhQRuzv_NM1kaSAQ@mail.gmail.com>
	<CAJgngAfogCc2XN0X93HDjXjA1RgFF8D6C7_bZ2z8nGR8u_yM4Q@mail.gmail.com>
	<CAM5SUC7UEWTuvtNRj7LhU-pfTBtAoq8AQCB0Y8uJ-8=4Saw_dg@mail.gmail.com>
Message-ID: <CAJgngAdmE8gZ38tgC_PUK9D2k=HmNuNhDG_vMXKmSXjbDhK1nQ@mail.gmail.com>

Ok, trying Nabble with user mailing list now.

On 30 June 2016 at 19:54, Bruno Oliveira <bruno at abstractj.org> wrote:

> Not only for forums, aerogear is indexed with Nabble[1].
>
> That's just an alternative.
>
> [1] - http://aerogear-dev.1069024.n5.nabble.com
>
> On Wed, Jun 29, 2016, 11:10 PM Stian Thorgersen <sthorger at redhat.com>
> wrote:
>
>> MarkMail seems to limit what lists they index. I've sent an email asking
>> if they can add Keycloak lists.
>>
>> Nabble is a forum and we don't want to add a forum. The issue is that
>> we'd end up with people asking questions there as well and we can't handle
>> both locations.
>>
>> On 30 June 2016 at 06:51, Bruno Oliveira <bruno at abstractj.org> wrote:
>>
>>> In the worst case scenario, give http://markmail.org/ or
>>> http://www.nabble.com/ a try.
>>>
>>> On Wed, Jun 29, 2016 at 3:40 AM Stian Thorgersen <sthorger at redhat.com>
>>> wrote:
>>>
>>>> Waiting for response on the ticket.. Might be a bit delayed due to
>>>> DevNation/Summit.
>>>>
>>>> On 29 June 2016 at 11:51, Thomas Darimont <
>>>> thomas.darimont at googlemail.com> wrote:
>>>>
>>>>> Hello,
>>>>>
>>>>> any updates here?
>>>>>
>>>>> Keycloak Mailing-list is still not searchable via
>>>>> http://search.jboss.org/
>>>>>
>>>>> Cheers,
>>>>> Thomas
>>>>>
>>>>> 2016-06-07 14:59 GMT+02:00 Stian Thorgersen <sthorger at redhat.com>:
>>>>>
>>>>>> I sent an email to the JBoss.org guys to ask them to add our mailing
>>>>>> lists to search.jboss.org.
>>>>>>
>>>>>> On 7 June 2016 at 14:03, Thomas Darimont <
>>>>>> thomas.darimont at googlemail.com> wrote:
>>>>>>
>>>>>>> I asked for it here:
>>>>>>> https://developer.jboss.org/wiki/JBossCommunitySearchHelp
>>>>>>>
>>>>>>> Would be really useful to have - I downloaded the news archives
>>>>>>> locally and search through with thunderbird.
>>>>>>>
>>>>>>> 2016-06-06 14:57 GMT+02:00 Rafael T. C. Soares <rsoares at redhat.com>:
>>>>>>>
>>>>>>>> How can I search for something on keycloak mailing lists archive?
>>>>>>>> It appears keycloak lists are not indexed by JBoss Community Search
>>>>>>>> engine [1][2]
>>>>>>>>
>>>>>>>> [1] http://search.jboss.org
>>>>>>>> [2] https://developer.jboss.org/wiki/JBossCommunitySearchFAQ
>>>>>>>>
>>>>>>>> --
>>>>>>>> ___
>>>>>>>> Rafael T. C. Soares | Solution Architect
>>>>>>>> JBoss Enterprise Middleware | Red Hat Brazil
>>>>>>>> Mobile: +55 71 98181-3636
>>>>>>>> Phone:  +55 11 3529-6096
>>>>>>>>
>>>>>>>>
>>>>>>>> _______________________________________________
>>>>>>>> keycloak-user mailing list
>>>>>>>> keycloak-user at lists.jboss.org
>>>>>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>>>>>>
>>>>>>>
>>>>>>>
>>>>>>> _______________________________________________
>>>>>>> keycloak-user mailing list
>>>>>>> keycloak-user at lists.jboss.org
>>>>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>>>>>
>>>>>>
>>>>>>
>>>>>
>>>> _______________________________________________
>>>> keycloak-user mailing list
>>>> keycloak-user at lists.jboss.org
>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>
>>>
>>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160701/a8c68eac/attachment.html 

From watson409 at gmail.com  Fri Jul  1 08:49:38 2016
From: watson409 at gmail.com (Brian Watson)
Date: Fri, 1 Jul 2016 08:49:38 -0400
Subject: [keycloak-user] Obtaining full profile from "userinfo" endpoint
In-Reply-To: <CAJgngAejnJ1vRdTdQzT8RtSVBQpsgiYwdFo=RRr4rdfiLPtSHA@mail.gmail.com>
References: <CAC9D9d9SW-Kzo8k1uFY_WDMUtmBQ2N_NrqqZJft4Mw4eZ5+1Ww@mail.gmail.com>
	<CAK-7U1g+_D7kRYc4sFJcEnucYM8rMrXh_8ybw1koPxkTRyqFvQ@mail.gmail.com>
	<CAK-7U1j7qn7FmbSJ44xkjhD+irHpfNGW3Hi=C3TkoVoK84jVzQ@mail.gmail.com>
	<CAJgngAeO76hTtCqDy55ykPnDaA43F0wF-1Ag0oTQEGY4eK3BVg@mail.gmail.com>
	<CAK-7U1hccYdt3XFzsUZeTfM6F3wCR-H97UwTXx=Zm3oREV5POw@mail.gmail.com>
	<CAJgngAejnJ1vRdTdQzT8RtSVBQpsgiYwdFo=RRr4rdfiLPtSHA@mail.gmail.com>
Message-ID: <CAC9D9d8kp92XUZtEtAZghxXFmi5LHEc8nNUnVM8aB5+Hso_rnw@mail.gmail.com>

Great! Thank you all so much for the quick response and effort!

On Fri, Jul 1, 2016 at 5:24 AM, Stian Thorgersen <sthorger at redhat.com>
wrote:

> Ideally PR should come with polish and testing. Otherwise it'll just sit
> in the queue ;)
>
> On 1 July 2016 at 11:19, Thomas Darimont <thomas.darimont at googlemail.com>
> wrote:
>
>> Cool - shall I file a jira and issue a PR? Then you can polish it a bit
>> ;-)
>>
>> Cheers,
>> Thomas
>>
>> 2016-07-01 11:18 GMT+02:00 Stian Thorgersen <sthorger at redhat.com>:
>>
>>> +1 To the user info toggle for mappers
>>>
>>> On 1 July 2016 at 11:12, Thomas Darimont <thomas.darimont at googlemail.com
>>> > wrote:
>>>
>>>> Hello Brian,
>>>>
>>>> I gave this a quick spin - I introduced an additional option that
>>>> allows to configure whether a claim from a
>>>> client mapper should be included in userinfo or not.
>>>> With that in place one can now control whether a claim should be
>>>> contained in the access-token, id-token or userinfo
>>>> which helps to keep access-tokens lean.
>>>>
>>>> For the sake of simplicity I only added support for controlling user
>>>> attributes but I think this could be a useful
>>>> for other mappers as well.
>>>>
>>>> Branch is here:
>>>>
>>>> https://github.com/thomasdarimont/keycloak/tree/poc/KEYCLOAK-XXX-use-mapper-only-for-userinfo-endpoint
>>>> relevant commit:
>>>>
>>>> https://github.com/thomasdarimont/keycloak/commit/eb25e72060f75a00afd188fc3b2c242e7b21aa7f
>>>>
>>>> Cheers,
>>>> Thomas
>>>>
>>>> 2016-07-01 9:53 GMT+02:00 Thomas Darimont <
>>>> thomas.darimont at googlemail.com>:
>>>>
>>>>> Hello Brian,
>>>>>
>>>>> I gave this a spin (with 1.9.x and master) and I think that currently
>>>>> the only way to extend the information in the
>>>>> userinfo endpoint is by defining a custom mapper and register that for
>>>>> the client you use to get the
>>>>> access-token.
>>>>> The protocol mappers of this client will be used for the userinfo
>>>>> endpoint. However the downside of this approach is that
>>>>> this information is now also added to the access-token which you
>>>>> wanted to avoid.
>>>>>
>>>>> It would be great of one had an additional switchable option for
>>>>> custom protocol mappers like "include in userinfo".
>>>>> With this enabled one could control very explicitly what should go
>>>>> where.
>>>>>
>>>>> I added a small curl command sequence below that can be used for
>>>>> testing.
>>>>>
>>>>> Cheers,
>>>>> Thomas
>>>>>
>>>>> # Setup
>>>>> KC_REALM=acme-test
>>>>> KC_USERNAME=tester
>>>>> KC_PASSWORD=test
>>>>> KC_CLIENT=test-client
>>>>> KC_CLIENT_SECRET=3ee678ac-b31b-4bb6-80fa-5f25c7817bf0
>>>>> KC_SERVER=192.168.99.1:8080
>>>>> KC_CONTEXT=auth
>>>>> CURL_OPTS="-k -v --noproxy 192.168.99.1"
>>>>>
>>>>> # Step 1 Request Tokens for credentials
>>>>> KC_RESPONSE=$( \
>>>>>    curl $CURL_OPTS -X POST \
>>>>>         -H "Content-Type: application/x-www-form-urlencoded" \
>>>>>         -d "username=$KC_USERNAME" \
>>>>>         -d "password=$KC_PASSWORD" \
>>>>>         -d 'grant_type=password' \
>>>>>         -d "client_id=$KC_CLIENT" \
>>>>>         -d "client_secret=$KC_CLIENT_SECRET" \
>>>>>         "http://$KC_SERVER/$KC_CONTEXT/realms/$KC_REALM/protocol/openid-connect/token"
>>>>> \
>>>>>     | jq .
>>>>> )
>>>>>
>>>>> # Step 2 Split tokens
>>>>> KC_ACCESS_TOKEN=$(echo $KC_RESPONSE| jq -r .access_token)
>>>>> KC_ID_TOKEN=$(echo $KC_RESPONSE| jq -r .id_token)
>>>>> KC_REFRESH_TOKEN=$(echo $KC_RESPONSE| jq -r .refresh_token)
>>>>>
>>>>> # Step 3 (Debug) Show all keycloak env variables
>>>>> set | grep KC_*
>>>>>
>>>>> # Step 4 Access Keycloak User Info
>>>>> curl $CURL_OPTS \
>>>>>      -X POST \
>>>>>      -H "Content-Type: application/x-www-form-urlencoded" \
>>>>>      -d "access_token=$KC_ACCESS_TOKEN" \
>>>>>    "http://$KC_SERVER/$KC_CONTEXT/realms/$KC_REALM/protocol/openid-connect/userinfo"
>>>>> | jq .
>>>>>
>>>>> # Step 5 Define a new protocol mapper for the client test-client in
>>>>> the admin-console
>>>>> # via clients -> test-client -> mappers -> new -> as an example map a
>>>>> custom user attribute -> add to access token
>>>>> # After that a request to the userinfo endpoint will show your custom
>>>>> attribute.
>>>>>
>>>>> # Step 6 Access Keycloak User Info
>>>>> curl $CURL_OPTS \
>>>>>      -X POST \
>>>>>      -H "Content-Type: application/x-www-form-urlencoded" \
>>>>>      -d "access_token=$KC_ACCESS_TOKEN" \
>>>>>    "http://$KC_SERVER/$KC_CONTEXT/realms/$KC_REALM/protocol/openid-connect/userinfo"
>>>>> | jq .
>>>>>
>>>>>
>>>>>
>>>>> 2016-06-30 16:41 GMT+02:00 Brian Watson <watson409 at gmail.com>:
>>>>>
>>>>>> Hi all,
>>>>>>
>>>>>> Keycloak version: 1.9.8
>>>>>>
>>>>>> Here is my use case: I want to keep the access token JWS as lean as
>>>>>> possible, only containing user roles and a few custom claims I have added.
>>>>>> I want no PII in the access token. However, I would like my internal
>>>>>> services to obtain the full user profile (name, email, etc...) from the
>>>>>> OIDC "/userinfo" endpoint. Unfortunately, I can only seem to obtain the
>>>>>> "sub" claim and the few custom claims that already exist in the access
>>>>>> token. I don't see any support for adding scope values to the request.
>>>>>>
>>>>>> Is there any way to accomplish what I would like, or any other ways
>>>>>> of obtaining this info that I may be missing?
>>>>>>
>>>>>> Thanks in advance
>>>>>>
>>>>>> _______________________________________________
>>>>>> keycloak-user mailing list
>>>>>> keycloak-user at lists.jboss.org
>>>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>>>>
>>>>>
>>>>>
>>>>
>>>> _______________________________________________
>>>> keycloak-user mailing list
>>>> keycloak-user at lists.jboss.org
>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>>
>>>
>>>
>>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160701/bf0491df/attachment-0001.html 

From sthorger at redhat.com  Fri Jul  1 09:14:55 2016
From: sthorger at redhat.com (Stian Thorgersen)
Date: Fri, 1 Jul 2016 15:14:55 +0200
Subject: [keycloak-user] Want to work on Keycloak?
Message-ID: <CAJgngAfDbLfiftyJUugR3OrpmBvuQut_vnOTDxe8vXc5166dRw@mail.gmail.com>

We're looking for two people to join our team so if anyone is interested
you can contact me directly or apply online.

For more details about the positions take a look at the job descriptions:

* SDK and developer experience -
https://careers-redhat.icims.com/jobs/53428/senior-software-engineer/job
* Web Application developer -
https://careers-redhat.icims.com/jobs/51802/senior-software-engineer/job
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160701/f4e67635/attachment.html 

From asarathi at vizuri.com  Fri Jul  1 12:39:32 2016
From: asarathi at vizuri.com (Aswini Sarathi)
Date: Fri, 1 Jul 2016 12:39:32 -0400
Subject: [keycloak-user] OAuth Access Token Response in XML
Message-ID: <A9513265-319F-4E93-A040-1E33292FF3EB@vizuri.com>

Hi,

    I am trying to find out if there is a way to get response from token endpoint  /realms/{realm-name}/protocol/openid-connect/token in xml or json format based on the Accept header. If its not supported out of the box, what other options are available to do this? Should I look at creating a custom endpoint by implementing the SPI to do the mapping?

Thanks!!

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160701/f309e9c5/attachment.html 

From petervn1 at yahoo.com  Sat Jul  2 14:39:22 2016
From: petervn1 at yahoo.com (Peter Nalyvayko)
Date: Sat, 2 Jul 2016 18:39:22 +0000 (UTC)
Subject: [keycloak-user] Keycloak and Salesforce IdP identity brokering
In-Reply-To: <206335081.4376505.1467246580929.JavaMail.yahoo@mail.yahoo.com>
References: <206335081.4376505.1467246580929.JavaMail.yahoo.ref@mail.yahoo.com>
	<206335081.4376505.1467246580929.JavaMail.yahoo@mail.yahoo.com>
Message-ID: <1451986391.933009.1467484762648.JavaMail.yahoo@mail.yahoo.com>


After a bit of digging through the keycloak archives, I believe I've foundan answer to my own question. There is indeed a way to set up identitybrokering in keycloak with Salesforce, although the processis not as straightforward as one would expect. To get the values for?ACS URL and Entity Id one should create a SAML 2.0 external IdP,and then "Export" the IdP using the "Export" button.?
--Peter?


>Hello,

>I am trying to integrate keycloak and Salesforce using Salesforce?>as an identity provider. It seems some of the information required to?>properly set up the Salesforce as SAML IdP is ?missing in the keycloak's SAML?>identity provider configuration. For example, "Entity Id", according to the?>Salesforce documentation:?>"This value comes from the service provider.?>Each entity ID in an organization must be unique. If you?re accessing multiple?>apps from your service provider, you only need to define the service provider?>>once, and then use the?RelayState?parameter to append the URL values?>to direct the user to the correct app after signing in." (https://help.salesforce.com/HTViewHelpDoc?>id=service_provider_define.htm&language=en_US).?>The SAML identity provider configuration in keycloak does not have?>a setting to specify "Entity Id". Another missing attribute is "ACS URL"?>(The ACS, or assertion consumer service, URL comes from the SAML?>service provider.).?
>Has anyone been able to set up Salesforce as IdP and keycloak?>as SP using keycloak's SAML identity provider? Is this even possible?>given that some required parameters are missing?>Thx>Peter

  
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160702/a9ee1392/attachment.html 

From tema.voskoboynick at gmail.com  Sun Jul  3 15:16:38 2016
From: tema.voskoboynick at gmail.com (Artem Voskoboynick)
Date: Sun, 3 Jul 2016 23:16:38 +0400
Subject: [keycloak-user] Why scope permission denial affects the whole
	resource avaiability?
Message-ID: <CALKvs9w56UhA_voXPW4OuV-ATu6MONtOFdi08yvRj2ZPsGYZjA@mail.gmail.com>

I have a resource and a few scopes associated with the resource.
Both the resource and the scope have permissions associated with them.

It seems logical that if one of the resource permissions resolves to DENY,
the whole resource is denied for the user.
But why the same happens with scope permissions?

As I understood from the docuemntation, scopes are verbs that can act upon
a resource. So if an user isn't authorized to perform one of the verbs (one
of the scopes), the user still should have access to the resource itself,
if the resource permissions allow, but it doesn't to seem to work this way.
I expected to automaticlaly block users that are not authorized for the
resource. With the rest users I expected to check each scope
programmatically for avaiability of corresponding actions (resource:view,
resource:edit, etc).

I used the "hello-world-authz-service" example (Keycloak server
configuration and the application code) with a few changes (added scopes)
to check it. Didn't work - access denied if one of the scope permissions
fails.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160703/3c8bc7b5/attachment.html 

From tema.voskoboynick at gmail.com  Sun Jul  3 16:41:09 2016
From: tema.voskoboynick at gmail.com (Artem Voskoboynick)
Date: Mon, 4 Jul 2016 00:41:09 +0400
Subject: [keycloak-user] Why scope permission denial affects the whole
 resource avaiability?
In-Reply-To: <CALKvs9w56UhA_voXPW4OuV-ATu6MONtOFdi08yvRj2ZPsGYZjA@mail.gmail.com>
References: <CALKvs9w56UhA_voXPW4OuV-ATu6MONtOFdi08yvRj2ZPsGYZjA@mail.gmail.com>
Message-ID: <CALKvs9xkO9YD++RevUmrZKzTPbqW748SpFKowbvjhND2foRXag@mail.gmail.com>

Looks I've clarified the problem:
A resource with scopes won't be permitted if there are no permitted scopes.

This is a strange behavior - if there are no permitted scopes, the resource
should still be available, it just doesn't have any additional actions
(scopes) permitted.
In support, if you take a resource without scopes, the resource is
available (given all resource permissions are permitted). But following the
current logic Keycloak handles scopes, the resource shouldn't be available
then, since there are no available scopes.

Now, the only solution is to create a dummy scope and always assign it to
resources, so that they don't get blocked when no other scopes are
available.

I think, this behavior should be changed.
What do you think?
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160704/734ac0dd/attachment-0001.html 

From bradleybeddoes at aaf.edu.au  Mon Jul  4 00:37:46 2016
From: bradleybeddoes at aaf.edu.au (Bradley Beddoes)
Date: Mon, 4 Jul 2016 14:37:46 +1000
Subject: [keycloak-user] Fwd: functionality questions (Keycloak 2)
In-Reply-To: <CAKWmghQR-Wt52sGCy5Ej2Mw5kKUG0KzDKM3RFA8mS8NhUE+Y8g@mail.gmail.com>
References: <CAKWmghQR-Wt52sGCy5Ej2Mw5kKUG0KzDKM3RFA8mS8NhUE+Y8g@mail.gmail.com>
Message-ID: <CAKWmghSQffxYZ4MxcT-gSbJRKe6v041FrxJQyMgiM4jaOm4kRA@mail.gmail.com>

Hello,
I've been evaluating Keycloak 2 releases recently (documentation and local
deployment) to determine if Keycloak might be a suitable fit for a future
project we're considering.

A lot of the moving parts we require are present but I see a few
incompatibilities when it comes to the model we need vs my interpretation
of Keycloak functionality.

To help explain what I'm trying to achieve I've created two small diagrams:

1. https://drive.google.com/file/d/0B9Ye3fFQSfx-YWUtcEF2Z0MxSjA/view

This is the overall goal. On the far right 1 or more OIDC or SAML service
instances are grouped together and overseen by 1 or more local
administrators. Each group then relies on some
central process to handle authentication, sso and identity resolution by
some process it doesn't need to care about. In our case this would be
mostly by authentication against and identity transfer from
multiple SAML 2.x IdP (Shibboleth) from which we'd locally
store/update/augment as a single cache of identity data. Groups would have
the ability to translate/augment identity data before returning it back
to the service instance the end user was attempting to access.

End users would have the ability to:

   - Approve release of identity information to a service group (approval
   would apply to all service instances within a group);
   - Review all identity information which is held about them centrally and
   update if required;
   - View a list of previous release approvals across all service groups
   (and revoke if desired);
   - Undertake a range of standard session based actions, such as revoking
   currently active tokens, determining where active sessions are held etc.

2. https://drive.google.com/file/d/0B9Ye3fFQSfx-amJZVGF5QWZwdmM/view
This is my interpretation of Keycloak functionality. OIDC and SAML service
instances belong to realms and administrators are assigned to a realm. Each
realm can be configured to offload authentication
and identity resolution to a central realm which can be configured to talk
to 1 or more SAML 2.x IdP. This realm will cache identity data locally.
When an end user approves identity
release it applies to all service instances within the owning realm.

>From here though I believe the following differences are present:

   - Each realm duplicates identity data for every user who authenticates
   to a service within that realm
   - If user identity changes in the master realm those changes are not
      reflected in all service facing realms
      - Any augmentation of identity, such as role membership, is per realm
      - Users can only manage identity information, release approvals etc
   per realm
   - Session based actions are only per realm

Based on the above descriptions, any help the community could offer to
align my design goals with functionality present Keycloak would be
fantastic.

cheers,
Bradley

-- 
*Bradley Beddoes*
*Australian Access Federation Inc*
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160704/088af180/attachment.html 

From sthorger at redhat.com  Mon Jul  4 03:04:54 2016
From: sthorger at redhat.com (Stian Thorgersen)
Date: Mon, 4 Jul 2016 09:04:54 +0200
Subject: [keycloak-user] OAuth Access Token Response in XML
In-Reply-To: <A9513265-319F-4E93-A040-1E33292FF3EB@vizuri.com>
References: <A9513265-319F-4E93-A040-1E33292FF3EB@vizuri.com>
Message-ID: <CAJgngAcHUekh5=kYnP4TmwEV3ioBbh5gD6eoba=iy8UKX1miLg@mail.gmail.com>

We only support JWT with OpenID Connect. Can you elaborate on why you want
an XML token?

You could add a custom REST endpoint or a custom protocol to do this, but
not sure I'd recommend doing it as there's a fair bit of logic that goes
into the token endpoint.

On 1 July 2016 at 18:39, Aswini Sarathi <asarathi at vizuri.com> wrote:

> Hi,
>
>     I am trying to find out if there is a way to get response from token
> endpoint  /realms/{realm-name}/protocol/openid-connect/token in xml or
> json format based on the Accept header. If its not supported out of the
> box, what other options are available to do this? Should I look at creating
> a custom endpoint by implementing the SPI to do the mapping?
>
> Thanks!!
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160704/cb78301a/attachment.html 

From sthorger at redhat.com  Mon Jul  4 06:11:05 2016
From: sthorger at redhat.com (Stian Thorgersen)
Date: Mon, 4 Jul 2016 12:11:05 +0200
Subject: [keycloak-user] Customize length of of user_attribute table
	value field
In-Reply-To: <1ef01d3b-b31f-932e-bc49-a827dde79c0a@inteqsolutions.com>
References: <1ef01d3b-b31f-932e-bc49-a827dde79c0a@inteqsolutions.com>
Message-ID: <CAJgngAfCu-OOM8eCeFrnVO0=Y6yJi+vKmU58MJrBmwmQ3TV6TQ@mail.gmail.com>

We have an outstanding issue to increase this:
https://issues.jboss.org/browse/KEYCLOAK-2382. However, it's not so trivial
as we need to support many different DBs and it may also have some
performance impact.

You can manually change the size for the column directly in your database.
Once we incorporate KEYCLOAK-2382 it would then be changed to our new
setting for this column.

On 1 July 2016 at 08:06, Rajkiran K <rajkiran.k at inteqsolutions.com> wrote:

> Hi,
>
> I had a requirement for inserting 450 characters string in to keycloak
> custom attribute, but value field is 255 characters in user_attribute
> table. is there any provision to modify this value. Please let me know
> how can i do this.
>
> Regards,
>
> Raj Kiran K
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160704/7f876828/attachment.html 

From akaya at expedia.com  Mon Jul  4 07:59:21 2016
From: akaya at expedia.com (Sarp Kaya)
Date: Mon, 4 Jul 2016 11:59:21 +0000
Subject: [keycloak-user] Lost session when removing an instance off
 cluster
In-Reply-To: <CAJgngAfJoYUzbtLtU1aAkVrBmE3s7_XOxCCTh8ywVBVth9ZprQ@mail.gmail.com>
References: <D39C63FE.5FCC%akaya@expedia.com>
	<CAJgngAfJoYUzbtLtU1aAkVrBmE3s7_XOxCCTh8ywVBVth9ZprQ@mail.gmail.com>
Message-ID: <D3A01882.6050%akaya@expedia.com>

Hello,

Below is exactly how Infinispan is configured:


<subsystem xmlns="urn:jboss:domain:infinispan:4.0">
    <cache-container name="keycloak" jndi-name="infinispan/Keycloak">
    <transport lock-timeout="60000"/>
    <invalidation-cache name="realms" mode="SYNC"/>
    <invalidation-cache name="users" mode="SYNC">
        <eviction max-entries="10000" strategy="LRU"/>
    </invalidation-cache>
    <distributed-cache xmlns="" name="sessions" mode="SYNC">
        <transaction mode="NON_DURABLE_XA"/>
    </distributed-cache>
    <local-cache xmlns="" name="offlineSessions"/>
    <local-cache xmlns="" name="loginFailures"/>
    <replicated-cache name="work" mode="SYNC"/>
    <local-cache name="realmVersions">
        <transaction mode="BATCH" locking="PESSIMISTIC"/>
    </local-cache>
</cache-container>
<cache-container name="server" aliases="singleton cluster" default-cache="default" module="org.wildfly.clustering.server">
    <transport lock-timeout="60000"/>
    <replicated-cache name="default" mode="SYNC">
        <transaction mode="BATCH"/>
    </replicated-cache>
</cache-container>
<cache-container name="web" default-cache="dist" module="org.wildfly.clustering.web.infinispan">
    <transport lock-timeout="60000"/>
    <distributed-cache name="dist" mode="ASYNC" l1-lifespan="0" owners="2">
        <locking isolation="REPEATABLE_READ"/>
        <transaction mode="BATCH"/>
        <file-store/>
    </distributed-cache>
</cache-container>
<cache-container name="ejb" aliases="sfsb" default-cache="dist" module="org.wildfly.clustering.ejb.infinispan">
    <transport lock-timeout="60000"/>
    <distributed-cache name="dist" mode="ASYNC" l1-lifespan="0" owners="2">
        <locking isolation="REPEATABLE_READ"/>
        <transaction mode="BATCH"/>
        <file-store/>
    </distributed-cache>
</cache-container>
<cache-container name="hibernate" default-cache="local-query" module="org.hibernate.infinispan">
    <transport lock-timeout="60000"/>
    <invalidation-cache name="entity" mode="SYNC">
        <transaction mode="NON_XA"/>
        <eviction strategy="LRU" max-entries="10000"/>
        <expiration max-idle="100000"/>
    </invalidation-cache>
    <local-cache name="local-query">
        <eviction strategy="LRU" max-entries="10000"/>
        <expiration max-idle="100000"/>
    </local-cache>
    <replicated-cache name="timestamps" mode="ASYNC"/>
</cache-container>
</subsystem>




This is the complete exception:

03:49:40,241 ERROR [org.infinispan.interceptors.InvocationContextInterceptor] (default task-12) ISPN000136: Error executing command PutKeyValueCommand, writing keys [ba74e523-3299-42b3-801e-9f8cb5a0d81d]: org.infinispan.util.concurrent.TimeoutException: Replication timeout for kc2
        at org.infinispan.remoting.transport.jgroups.JGroupsTransport.checkRsp(JGroupsTransport.java:765)
        at org.infinispan.remoting.transport.jgroups.JGroupsTransport.lambda$invokeRemotelyAsync$73(JGroupsTransport.java:612)
        at java.util.concurrent.CompletableFuture.uniApply(CompletableFuture.java:602)
        at java.util.concurrent.CompletableFuture$UniApply.tryFire(CompletableFuture.java:577)
        at java.util.concurrent.CompletableFuture.postComplete(CompletableFuture.java:474)
        at java.util.concurrent.CompletableFuture.complete(CompletableFuture.java:1962)
        at org.infinispan.remoting.transport.jgroups.RspListFuture.call(RspListFuture.java:47)
        at org.infinispan.remoting.transport.jgroups.RspListFuture.call(RspListFuture.java:16)
        at java.util.concurrent.FutureTask.run(FutureTask.java:266)
        at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$201(ScheduledThreadPoolExecutor.java:180)
        at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:293)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
        at java.lang.Thread.run(Thread.java:745)

03:49:40,250 ERROR [org.jboss.resteasy.resteasy_jaxrs.i18n] (default task-12) RESTEASY002025: Unknown exception while executing GET /realms/partner-dmz/protocol/openid-connect/auth: org.infinispan.util.concurrent.TimeoutException: Replication timeout for kc2
        at org.infinispan.remoting.transport.jgroups.JGroupsTransport.checkRsp(JGroupsTransport.java:765)
        at org.infinispan.remoting.transport.jgroups.JGroupsTransport.lambda$invokeRemotelyAsync$73(JGroupsTransport.java:612)
        at java.util.concurrent.CompletableFuture.uniApply(CompletableFuture.java:602)
        at java.util.concurrent.CompletableFuture$UniApply.tryFire(CompletableFuture.java:577)
        at java.util.concurrent.CompletableFuture.postComplete(CompletableFuture.java:474)
        at java.util.concurrent.CompletableFuture.complete(CompletableFuture.java:1962)
        at org.infinispan.remoting.transport.jgroups.RspListFuture.call(RspListFuture.java:47)
        at org.infinispan.remoting.transport.jgroups.RspListFuture.call(RspListFuture.java:16)
        at java.util.concurrent.FutureTask.run(FutureTask.java:266)
        at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$201(ScheduledThreadPoolExecutor.java:180)
        at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:293)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
        at java.lang.Thread.run(Thread.java:745)

03:49:40,257 ERROR [io.undertow.request] (default task-12) UT005023: Exception handling request to /auth/realms/partner-dmz/protocol/openid-connect/auth: org.jboss.resteasy.spi.UnhandledException: org.infinispan.util.concurrent.TimeoutException: Replication timeout for kc2
        at org.jboss.resteasy.core.ExceptionHandler.handleException(ExceptionHandler.java:247)
        at org.jboss.resteasy.core.SynchronousDispatcher.writeException(SynchronousDispatcher.java:168)
        at org.jboss.resteasy.core.SynchronousDispatcher.writeResponse(SynchronousDispatcher.java:471)
        at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:415)
        at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:202)
        at org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.service(ServletContainerDispatcher.java:221)
        at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:56)
        at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:51)
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:790)
        at io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:85)
        at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:129)
        at org.keycloak.services.filters.KeycloakSessionServletFilter.doFilter(KeycloakSessionServletFilter.java:88)
        at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:60)
        at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
        at io.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.java:84)
        at io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:62)
        at io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36)
        at org.wildfly.extension.undertow.security.SecurityContextAssociationHandler.handleRequest(SecurityContextAssociationHandler.java:78)
        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
        at io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:131)
        at io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:57)
        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
        at io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:46)
        at io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64)
        at io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:60)
        at io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:77)
        at io.undertow.security.handlers.NotificationReceiverHandler.handleRequest(NotificationReceiverHandler.java:50)
        at io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43)
        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
        at org.wildfly.extension.undertow.security.jacc.JACCContextIdHandler.handleRequest(JACCContextIdHandler.java:61)
        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
        at io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:284)
        at io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:263)
        at io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:81)
        at io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:174)
        at io.undertow.server.Connectors.executeRootHandler(Connectors.java:202)
        at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:793)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
        at java.lang.Thread.run(Thread.java:745)
Caused by: org.infinispan.util.concurrent.TimeoutException: Replication timeout for kc2
        at org.infinispan.remoting.transport.jgroups.JGroupsTransport.checkRsp(JGroupsTransport.java:765)
        at org.infinispan.remoting.transport.jgroups.JGroupsTransport.lambda$invokeRemotelyAsync$73(JGroupsTransport.java:612)
        at java.util.concurrent.CompletableFuture.uniApply(CompletableFuture.java:602)
        at java.util.concurrent.CompletableFuture$UniApply.tryFire(CompletableFuture.java:577)
        at java.util.concurrent.CompletableFuture.postComplete(CompletableFuture.java:474)
        at java.util.concurrent.CompletableFuture.complete(CompletableFuture.java:1962)
        at org.infinispan.remoting.transport.jgroups.RspListFuture.call(RspListFuture.java:47)
        at org.infinispan.remoting.transport.jgroups.RspListFuture.call(RspListFuture.java:16)
        at java.util.concurrent.FutureTask.run(FutureTask.java:266)
        at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$201(ScheduledThreadPoolExecutor.java:180)
        at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:293)
        ... 3 more

03:49:41,251 ERROR [org.infinispan.interceptors.InvocationContextInterceptor] (default task-3) ISPN000136: Error executing command PrepareCommand, writing keys [02cff8bb-0ab9-4ab9-905f-17ffb3226050]: org.infinispan.util.concurrent.TimeoutException: Replication timeout for kc2
        at org.infinispan.remoting.transport.jgroups.JGroupsTransport.checkRsp(JGroupsTransport.java:765)
        at org.infinispan.remoting.transport.jgroups.JGroupsTransport.lambda$invokeRemotelyAsync$73(JGroupsTransport.java:612)
        at java.util.concurrent.CompletableFuture.uniApply(CompletableFuture.java:602)
        at java.util.concurrent.CompletableFuture$UniApply.tryFire(CompletableFuture.java:577)
        at java.util.concurrent.CompletableFuture.postComplete(CompletableFuture.java:474)
        at java.util.concurrent.CompletableFuture.complete(CompletableFuture.java:1962)
        at org.infinispan.remoting.transport.jgroups.RspListFuture.call(RspListFuture.java:47)
        at org.infinispan.remoting.transport.jgroups.RspListFuture.call(RspListFuture.java:16)
        at java.util.concurrent.FutureTask.run(FutureTask.java:266)
        at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$201(ScheduledThreadPoolExecutor.java:180)
        at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:293)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
        at java.lang.Thread.run(Thread.java:745)

03:49:41,258 ERROR [org.infinispan.transaction.impl.TransactionCoordinator] (default task-3) ISPN000097: Error while processing a prepare in a single-phase transaction: org.infinispan.util.concurrent.TimeoutException: Replication timeout for kc2
        at org.infinispan.remoting.transport.jgroups.JGroupsTransport.checkRsp(JGroupsTransport.java:765)
        at org.infinispan.remoting.transport.jgroups.JGroupsTransport.lambda$invokeRemotelyAsync$73(JGroupsTransport.java:612)
        at java.util.concurrent.CompletableFuture.uniApply(CompletableFuture.java:602)
        at java.util.concurrent.CompletableFuture$UniApply.tryFire(CompletableFuture.java:577)
        at java.util.concurrent.CompletableFuture.postComplete(CompletableFuture.java:474)
        at java.util.concurrent.CompletableFuture.complete(CompletableFuture.java:1962)
        at org.infinispan.remoting.transport.jgroups.RspListFuture.call(RspListFuture.java:47)
        at org.infinispan.remoting.transport.jgroups.RspListFuture.call(RspListFuture.java:16)
        at java.util.concurrent.FutureTask.run(FutureTask.java:266)
        at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$201(ScheduledThreadPoolExecutor.java:180)
        at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:293)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
        at java.lang.Thread.run(Thread.java:745)

03:49:45,504 INFO  [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (Incoming-3,dev,kc1) ISPN000094: Received new cluster view for channel server: [kc1|4] (1) [kc1]
03:49:45,507 INFO  [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (Incoming-3,dev,kc1) ISPN000094: Received new cluster view for channel keycloak: [kc1|4] (1) [kc1]
03:49:45,534 INFO  [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (Incoming-3,dev,kc1) ISPN000094: Received new cluster view for channel web: [kc1|4] (1) [kc1]
03:49:45,538 INFO  [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (Incoming-3,dev,kc1) ISPN000094: Received new cluster view for channel ejb: [kc1|4] (1) [kc1]
03:49:45,548 WARN  [com.arjuna.ats.jta] (default task-3) ARJUNA016039: onePhaseCommit on < formatId=131077, gtrid_length=29, bqual_length=36, tx_uid=0:ffffac110003:-7fcaa87f:5779dc60:f01, node_name=1, branch_uid=0:ffffac110003:-7fcaa87f:5779dc60:f02, subordinatenodename=null, eis_name=unknown eis name > (TransactionXaAdapter{localTransaction=LocalXaTransaction{xid=< formatId=131077, gtrid_length=29, bqual_length=36, tx_uid=0:ffffac110003:-7fcaa87f:5779dc60:f01, node_name=1, branch_uid=0:ffffac110003:-7fcaa87f:5779dc60:f02, subordinatenodename=null, eis_name=unknown eis name >} LocalTransaction{remoteLockedNodes=null, isMarkedForRollback=false, lockedKeys=null, backupKeyLocks=null, topologyId=6, stateTransferFlag=null} org.infinispan.transaction.xa.LocalXaTransaction at 3ef}) failed with exception XAException.XA_HEURRB: javax.transaction.xa.XAException
        at org.infinispan.transaction.impl.TransactionCoordinator.handleCommitFailure(TransactionCoordinator.java:213)
        at org.infinispan.transaction.impl.TransactionCoordinator.commit(TransactionCoordinator.java:159)
        at org.infinispan.transaction.xa.TransactionXaAdapter.commit(TransactionXaAdapter.java:112)
        at com.arjuna.ats.internal.jta.resources.arjunacore.XAResourceRecord.topLevelOnePhaseCommit(XAResourceRecord.java:704)
        at com.arjuna.ats.arjuna.coordinator.BasicAction.onePhaseCommit(BasicAction.java:2366)
        at com.arjuna.ats.arjuna.coordinator.BasicAction.End(BasicAction.java:1495)
        at com.arjuna.ats.arjuna.coordinator.TwoPhaseCoordinator.end(TwoPhaseCoordinator.java:96)
        at com.arjuna.ats.arjuna.AtomicAction.commit(AtomicAction.java:162)
        at com.arjuna.ats.internal.jta.transaction.arjunacore.TransactionImple.commitAndDisassociate(TransactionImple.java:1200)
        at com.arjuna.ats.internal.jta.transaction.arjunacore.BaseTransaction.commit(BaseTransaction.java:126)
        at com.arjuna.ats.jbossatx.BaseTransactionManagerDelegate.commit(BaseTransactionManagerDelegate.java:89)
        at org.infinispan.cache.impl.CacheImpl.tryCommit(CacheImpl.java:1722)
        at org.infinispan.cache.impl.CacheImpl.executeCommandAndCommitIfNeeded(CacheImpl.java:1679)
        at org.infinispan.cache.impl.CacheImpl.putInternal(CacheImpl.java:1121)
        at org.infinispan.cache.impl.CacheImpl.put(CacheImpl.java:1111)
        at org.infinispan.cache.impl.CacheImpl.put(CacheImpl.java:1742)
        at org.infinispan.cache.impl.CacheImpl.put(CacheImpl.java:248)
        at org.infinispan.cache.impl.AbstractDelegatingCache.put(AbstractDelegatingCache.java:291)
        at org.keycloak.models.sessions.infinispan.InfinispanUserSessionProvider$InfinispanKeycloakTransaction$CacheTask.execute(InfinispanUserSessionProvider.java:854)
        at org.keycloak.models.sessions.infinispan.InfinispanUserSessionProvider$InfinispanKeycloakTransaction.commit(InfinispanUserSessionProvider.java:750)
        at org.keycloak.services.DefaultKeycloakTransactionManager.commit(DefaultKeycloakTransactionManager.java:104)
        at org.keycloak.services.filters.KeycloakTransactionCommitter.filter(KeycloakTransactionCommitter.java:43)
        at org.jboss.resteasy.core.ServerResponseWriter.executeFilters(ServerResponseWriter.java:121)
        at org.jboss.resteasy.core.ServerResponseWriter.writeNomapResponse(ServerResponseWriter.java:48)
        at org.jboss.resteasy.core.SynchronousDispatcher.writeResponse(SynchronousDispatcher.java:466)
        at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:415)
        at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:202)
        at org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.service(ServletContainerDispatcher.java:221)
        at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:56)
        at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:51)
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:790)
        at io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:85)
        at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:129)
        at org.keycloak.services.filters.KeycloakSessionServletFilter.doFilter(KeycloakSessionServletFilter.java:88)
        at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:60)
        at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
        at io.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.java:84)
        at io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:62)
        at io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36)
        at org.wildfly.extension.undertow.security.SecurityContextAssociationHandler.handleRequest(SecurityContextAssociationHandler.java:78)
        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
        at io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:131)
        at io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:57)
        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
        at io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:46)
        at io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64)
        at io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:60)
        at io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:77)
        at io.undertow.security.handlers.NotificationReceiverHandler.handleRequest(NotificationReceiverHandler.java:50)
        at io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43)
        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
        at org.wildfly.extension.undertow.security.jacc.JACCContextIdHandler.handleRequest(JACCContextIdHandler.java:61)
        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
        at io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:284)
        at io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:263)
        at io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:81)
        at io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:174)
        at io.undertow.server.Connectors.executeRootHandler(Connectors.java:202)
        at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:793)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
        at java.lang.Thread.run(Thread.java:745)
Caused by: org.infinispan.util.concurrent.TimeoutException: Replication timeout for kc2
        at org.infinispan.remoting.transport.jgroups.JGroupsTransport.checkRsp(JGroupsTransport.java:765)
        at org.infinispan.remoting.transport.jgroups.JGroupsTransport.lambda$invokeRemotelyAsync$73(JGroupsTransport.java:612)
        at java.util.concurrent.CompletableFuture.uniApply(CompletableFuture.java:602)
        at java.util.concurrent.CompletableFuture$UniApply.tryFire(CompletableFuture.java:577)
        at java.util.concurrent.CompletableFuture.postComplete(CompletableFuture.java:474)
        at java.util.concurrent.CompletableFuture.complete(CompletableFuture.java:1962)
        at org.infinispan.remoting.transport.jgroups.RspListFuture.call(RspListFuture.java:47)
        at org.infinispan.remoting.transport.jgroups.RspListFuture.call(RspListFuture.java:16)
        at java.util.concurrent.FutureTask.run(FutureTask.java:266)
        at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$201(ScheduledThreadPoolExecutor.java:180)
        at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:293)
        ... 3 more

03:49:45,563 WARN  [org.infinispan.cache.impl.CacheImpl] (default task-3) ISPN000160: Could not complete injected transaction.: javax.transaction.RollbackException: ARJUNA016053: Could not commit transaction.
        at com.arjuna.ats.internal.jta.transaction.arjunacore.TransactionImple.commitAndDisassociate(TransactionImple.java:1212)
        at com.arjuna.ats.internal.jta.transaction.arjunacore.BaseTransaction.commit(BaseTransaction.java:126)
        at com.arjuna.ats.jbossatx.BaseTransactionManagerDelegate.commit(BaseTransactionManagerDelegate.java:89)
        at org.infinispan.cache.impl.CacheImpl.tryCommit(CacheImpl.java:1722)
        at org.infinispan.cache.impl.CacheImpl.executeCommandAndCommitIfNeeded(CacheImpl.java:1679)
        at org.infinispan.cache.impl.CacheImpl.putInternal(CacheImpl.java:1121)
        at org.infinispan.cache.impl.CacheImpl.put(CacheImpl.java:1111)
        at org.infinispan.cache.impl.CacheImpl.put(CacheImpl.java:1742)
        at org.infinispan.cache.impl.CacheImpl.put(CacheImpl.java:248)
        at org.infinispan.cache.impl.AbstractDelegatingCache.put(AbstractDelegatingCache.java:291)
        at org.keycloak.models.sessions.infinispan.InfinispanUserSessionProvider$InfinispanKeycloakTransaction$CacheTask.execute(InfinispanUserSessionProvider.java:854)
        at org.keycloak.models.sessions.infinispan.InfinispanUserSessionProvider$InfinispanKeycloakTransaction.commit(InfinispanUserSessionProvider.java:750)
        at org.keycloak.services.DefaultKeycloakTransactionManager.commit(DefaultKeycloakTransactionManager.java:104)
        at org.keycloak.services.filters.KeycloakTransactionCommitter.filter(KeycloakTransactionCommitter.java:43)
        at org.jboss.resteasy.core.ServerResponseWriter.executeFilters(ServerResponseWriter.java:121)
        at org.jboss.resteasy.core.ServerResponseWriter.writeNomapResponse(ServerResponseWriter.java:48)
        at org.jboss.resteasy.core.SynchronousDispatcher.writeResponse(SynchronousDispatcher.java:466)
        at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:415)
        at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:202)
        at org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.service(ServletContainerDispatcher.java:221)
        at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:56)
        at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:51)
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:790)
        at io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:85)
        at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:129)
        at org.keycloak.services.filters.KeycloakSessionServletFilter.doFilter(KeycloakSessionServletFilter.java:88)
        at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:60)
        at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
        at io.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.java:84)
        at io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:62)
        at io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36)
        at org.wildfly.extension.undertow.security.SecurityContextAssociationHandler.handleRequest(SecurityContextAssociationHandler.java:78)
        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
        at io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:131)
        at io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:57)
        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
        at io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:46)
        at io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64)
        at io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:60)
        at io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:77)
        at io.undertow.security.handlers.NotificationReceiverHandler.handleRequest(NotificationReceiverHandler.java:50)
        at io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43)
        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
        at org.wildfly.extension.undertow.security.jacc.JACCContextIdHandler.handleRequest(JACCContextIdHandler.java:61)
        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
        at io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:284)
        at io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:263)
        at io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:81)
        at io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:174)
        at io.undertow.server.Connectors.executeRootHandler(Connectors.java:202)
        at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:793)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
        at java.lang.Thread.run(Thread.java:745)
        Suppressed: javax.transaction.xa.XAException
                at org.infinispan.transaction.impl.TransactionCoordinator.handleCommitFailure(TransactionCoordinator.java:213)
                at org.infinispan.transaction.impl.TransactionCoordinator.commit(TransactionCoordinator.java:159)
                at org.infinispan.transaction.xa.TransactionXaAdapter.commit(TransactionXaAdapter.java:112)
                at com.arjuna.ats.internal.jta.resources.arjunacore.XAResourceRecord.topLevelOnePhaseCommit(XAResourceRecord.java:704)
                at com.arjuna.ats.arjuna.coordinator.BasicAction.onePhaseCommit(BasicAction.java:2366)
                at com.arjuna.ats.arjuna.coordinator.BasicAction.End(BasicAction.java:1495)
                at com.arjuna.ats.arjuna.coordinator.TwoPhaseCoordinator.end(TwoPhaseCoordinator.java:96)
                at com.arjuna.ats.arjuna.AtomicAction.commit(AtomicAction.java:162)
                at com.arjuna.ats.internal.jta.transaction.arjunacore.TransactionImple.commitAndDisassociate(TransactionImple.java:1200)
                ... 54 more
        Caused by: org.infinispan.util.concurrent.TimeoutException: Replication timeout for kc2
                at org.infinispan.remoting.transport.jgroups.JGroupsTransport.checkRsp(JGroupsTransport.java:765)
                at org.infinispan.remoting.transport.jgroups.JGroupsTransport.lambda$invokeRemotelyAsync$73(JGroupsTransport.java:612)
                at java.util.concurrent.CompletableFuture.uniApply(CompletableFuture.java:602)
                at java.util.concurrent.CompletableFuture$UniApply.tryFire(CompletableFuture.java:577)
                at java.util.concurrent.CompletableFuture.postComplete(CompletableFuture.java:474)
                at java.util.concurrent.CompletableFuture.complete(CompletableFuture.java:1962)
                at org.infinispan.remoting.transport.jgroups.RspListFuture.call(RspListFuture.java:47)
                at org.infinispan.remoting.transport.jgroups.RspListFuture.call(RspListFuture.java:16)
                at java.util.concurrent.FutureTask.run(FutureTask.java:266)
                at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$201(ScheduledThreadPoolExecutor.java:180)
                at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:293)
                ... 3 more

03:49:45,575 INFO  [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (Incoming-3,dev,kc1) ISPN000094: Received new cluster view for channel hibernate: [kc1|4] (1) [kc1]
03:49:45,575 ERROR [org.jboss.resteasy.resteasy_jaxrs.i18n] (default task-3) RESTEASY002025: Unknown exception while executing GET /realms/partner-dmz/protocol/openid-connect/auth: org.infinispan.commons.CacheException: Could not commit implicit transaction
        at org.infinispan.cache.impl.CacheImpl.tryCommit(CacheImpl.java:1725)
        at org.infinispan.cache.impl.CacheImpl.executeCommandAndCommitIfNeeded(CacheImpl.java:1679)
        at org.infinispan.cache.impl.CacheImpl.putInternal(CacheImpl.java:1121)
        at org.infinispan.cache.impl.CacheImpl.put(CacheImpl.java:1111)
        at org.infinispan.cache.impl.CacheImpl.put(CacheImpl.java:1742)
        at org.infinispan.cache.impl.CacheImpl.put(CacheImpl.java:248)
        at org.infinispan.cache.impl.AbstractDelegatingCache.put(AbstractDelegatingCache.java:291)
        at org.keycloak.models.sessions.infinispan.InfinispanUserSessionProvider$InfinispanKeycloakTransaction$CacheTask.execute(InfinispanUserSessionProvider.java:854)
        at org.keycloak.models.sessions.infinispan.InfinispanUserSessionProvider$InfinispanKeycloakTransaction.commit(InfinispanUserSessionProvider.java:750)
        at org.keycloak.services.DefaultKeycloakTransactionManager.commit(DefaultKeycloakTransactionManager.java:104)
        at org.keycloak.services.filters.KeycloakTransactionCommitter.filter(KeycloakTransactionCommitter.java:43)
        at org.jboss.resteasy.core.ServerResponseWriter.executeFilters(ServerResponseWriter.java:121)
        at org.jboss.resteasy.core.ServerResponseWriter.writeNomapResponse(ServerResponseWriter.java:48)
        at org.jboss.resteasy.core.SynchronousDispatcher.writeResponse(SynchronousDispatcher.java:466)
        at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:415)
        at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:202)
        at org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.service(ServletContainerDispatcher.java:221)
        at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:56)
        at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:51)
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:790)
        at io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:85)
        at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:129)
        at org.keycloak.services.filters.KeycloakSessionServletFilter.doFilter(KeycloakSessionServletFilter.java:88)
        at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:60)
        at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
        at io.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.java:84)
        at io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:62)
        at io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36)
        at org.wildfly.extension.undertow.security.SecurityContextAssociationHandler.handleRequest(SecurityContextAssociationHandler.java:78)
        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
        at io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:131)
        at io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:57)
        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
        at io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:46)
        at io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64)
        at io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:60)
        at io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:77)
        at io.undertow.security.handlers.NotificationReceiverHandler.handleRequest(NotificationReceiverHandler.java:50)
        at io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43)
        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
        at org.wildfly.extension.undertow.security.jacc.JACCContextIdHandler.handleRequest(JACCContextIdHandler.java:61)
        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
        at io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:284)
        at io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:263)
        at io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:81)
        at io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:174)
        at io.undertow.server.Connectors.executeRootHandler(Connectors.java:202)
        at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:793)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
        at java.lang.Thread.run(Thread.java:745)
Caused by: javax.transaction.RollbackException: ARJUNA016053: Could not commit transaction.
        at com.arjuna.ats.internal.jta.transaction.arjunacore.TransactionImple.commitAndDisassociate(TransactionImple.java:1212)
        at com.arjuna.ats.internal.jta.transaction.arjunacore.BaseTransaction.commit(BaseTransaction.java:126)
        at com.arjuna.ats.jbossatx.BaseTransactionManagerDelegate.commit(BaseTransactionManagerDelegate.java:89)
        at org.infinispan.cache.impl.CacheImpl.tryCommit(CacheImpl.java:1722)
        ... 51 more
        Suppressed: javax.transaction.xa.XAException
                at org.infinispan.transaction.impl.TransactionCoordinator.handleCommitFailure(TransactionCoordinator.java:213)
                at org.infinispan.transaction.impl.TransactionCoordinator.commit(TransactionCoordinator.java:159)
                at org.infinispan.transaction.xa.TransactionXaAdapter.commit(TransactionXaAdapter.java:112)
                at com.arjuna.ats.internal.jta.resources.arjunacore.XAResourceRecord.topLevelOnePhaseCommit(XAResourceRecord.java:704)
                at com.arjuna.ats.arjuna.coordinator.BasicAction.onePhaseCommit(BasicAction.java:2366)
                at com.arjuna.ats.arjuna.coordinator.BasicAction.End(BasicAction.java:1495)
                at com.arjuna.ats.arjuna.coordinator.TwoPhaseCoordinator.end(TwoPhaseCoordinator.java:96)
                at com.arjuna.ats.arjuna.AtomicAction.commit(AtomicAction.java:162)
                at com.arjuna.ats.internal.jta.transaction.arjunacore.TransactionImple.commitAndDisassociate(TransactionImple.java:1200)
                ... 54 more
        Caused by: org.infinispan.util.concurrent.TimeoutException: Replication timeout for kc2
                at org.infinispan.remoting.transport.jgroups.JGroupsTransport.checkRsp(JGroupsTransport.java:765)
                at org.infinispan.remoting.transport.jgroups.JGroupsTransport.lambda$invokeRemotelyAsync$73(JGroupsTransport.java:612)
                at java.util.concurrent.CompletableFuture.uniApply(CompletableFuture.java:602)
                at java.util.concurrent.CompletableFuture$UniApply.tryFire(CompletableFuture.java:577)
                at java.util.concurrent.CompletableFuture.postComplete(CompletableFuture.java:474)
                at java.util.concurrent.CompletableFuture.complete(CompletableFuture.java:1962)
                at org.infinispan.remoting.transport.jgroups.RspListFuture.call(RspListFuture.java:47)
                at org.infinispan.remoting.transport.jgroups.RspListFuture.call(RspListFuture.java:16)
                at java.util.concurrent.FutureTask.run(FutureTask.java:266)
                at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$201(ScheduledThreadPoolExecutor.java:180)
                at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:293)
                ... 3 more

03:49:45,596 ERROR [io.undertow.request] (default task-3) UT005023: Exception handling request to /auth/realms/partner-dmz/protocol/openid-connect/auth: org.jboss.resteasy.spi.UnhandledException: org.infinispan.commons.CacheException: Could not commit implicit transaction
        at org.jboss.resteasy.core.ExceptionHandler.handleException(ExceptionHandler.java:247)
        at org.jboss.resteasy.core.SynchronousDispatcher.writeException(SynchronousDispatcher.java:168)
        at org.jboss.resteasy.core.SynchronousDispatcher.writeResponse(SynchronousDispatcher.java:471)
        at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:415)
        at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:202)
        at org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.service(ServletContainerDispatcher.java:221)
        at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:56)
        at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:51)
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:790)
        at io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:85)
        at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:129)
        at org.keycloak.services.filters.KeycloakSessionServletFilter.doFilter(KeycloakSessionServletFilter.java:88)
        at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:60)
        at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
        at io.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.java:84)
        at io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:62)
        at io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36)
        at org.wildfly.extension.undertow.security.SecurityContextAssociationHandler.handleRequest(SecurityContextAssociationHandler.java:78)
        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
        at io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:131)
        at io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:57)
        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
        at io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:46)
        at io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64)
        at io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:60)
        at io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:77)
        at io.undertow.security.handlers.NotificationReceiverHandler.handleRequest(NotificationReceiverHandler.java:50)
        at io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43)
        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
        at org.wildfly.extension.undertow.security.jacc.JACCContextIdHandler.handleRequest(JACCContextIdHandler.java:61)
        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
        at io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:284)
        at io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:263)
        at io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:81)
        at io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:174)
        at io.undertow.server.Connectors.executeRootHandler(Connectors.java:202)
        at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:793)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
        at java.lang.Thread.run(Thread.java:745)
Caused by: org.infinispan.commons.CacheException: Could not commit implicit transaction
        at org.infinispan.cache.impl.CacheImpl.tryCommit(CacheImpl.java:1725)
        at org.infinispan.cache.impl.CacheImpl.executeCommandAndCommitIfNeeded(CacheImpl.java:1679)
        at org.infinispan.cache.impl.CacheImpl.putInternal(CacheImpl.java:1121)
        at org.infinispan.cache.impl.CacheImpl.put(CacheImpl.java:1111)
        at org.infinispan.cache.impl.CacheImpl.put(CacheImpl.java:1742)
        at org.infinispan.cache.impl.CacheImpl.put(CacheImpl.java:248)
        at org.infinispan.cache.impl.AbstractDelegatingCache.put(AbstractDelegatingCache.java:291)
        at org.keycloak.models.sessions.infinispan.InfinispanUserSessionProvider$InfinispanKeycloakTransaction$CacheTask.execute(InfinispanUserSessionProvider.java:854)
        at org.keycloak.models.sessions.infinispan.InfinispanUserSessionProvider$InfinispanKeycloakTransaction.commit(InfinispanUserSessionProvider.java:750)
        at org.keycloak.services.DefaultKeycloakTransactionManager.commit(DefaultKeycloakTransactionManager.java:104)
        at org.keycloak.services.filters.KeycloakTransactionCommitter.filter(KeycloakTransactionCommitter.java:43)
        at org.jboss.resteasy.core.ServerResponseWriter.executeFilters(ServerResponseWriter.java:121)
        at org.jboss.resteasy.core.ServerResponseWriter.writeNomapResponse(ServerResponseWriter.java:48)
        at org.jboss.resteasy.core.SynchronousDispatcher.writeResponse(SynchronousDispatcher.java:466)
        ... 38 more
Caused by: javax.transaction.RollbackException: ARJUNA016053: Could not commit transaction.
        at com.arjuna.ats.internal.jta.transaction.arjunacore.TransactionImple.commitAndDisassociate(TransactionImple.java:1212)
        at com.arjuna.ats.internal.jta.transaction.arjunacore.BaseTransaction.commit(BaseTransaction.java:126)
        at com.arjuna.ats.jbossatx.BaseTransactionManagerDelegate.commit(BaseTransactionManagerDelegate.java:89)
        at org.infinispan.cache.impl.CacheImpl.tryCommit(CacheImpl.java:1722)
        ... 51 more
        Suppressed: javax.transaction.xa.XAException
                at org.infinispan.transaction.impl.TransactionCoordinator.handleCommitFailure(TransactionCoordinator.java:213)
                at org.infinispan.transaction.impl.TransactionCoordinator.commit(TransactionCoordinator.java:159)
                at org.infinispan.transaction.xa.TransactionXaAdapter.commit(TransactionXaAdapter.java:112)
                at com.arjuna.ats.internal.jta.resources.arjunacore.XAResourceRecord.topLevelOnePhaseCommit(XAResourceRecord.java:704)
                at com.arjuna.ats.arjuna.coordinator.BasicAction.onePhaseCommit(BasicAction.java:2366)
                at com.arjuna.ats.arjuna.coordinator.BasicAction.End(BasicAction.java:1495)
                at com.arjuna.ats.arjuna.coordinator.TwoPhaseCoordinator.end(TwoPhaseCoordinator.java:96)
                at com.arjuna.ats.arjuna.AtomicAction.commit(AtomicAction.java:162)
                at com.arjuna.ats.internal.jta.transaction.arjunacore.TransactionImple.commitAndDisassociate(TransactionImple.java:1200)
                ... 54 more
        Caused by: org.infinispan.util.concurrent.TimeoutException: Replication timeout for kc2
                at org.infinispan.remoting.transport.jgroups.JGroupsTransport.checkRsp(JGroupsTransport.java:765)
                at org.infinispan.remoting.transport.jgroups.JGroupsTransport.lambda$invokeRemotelyAsync$73(JGroupsTransport.java:612)
                at java.util.concurrent.CompletableFuture.uniApply(CompletableFuture.java:602)
                at java.util.concurrent.CompletableFuture$UniApply.tryFire(CompletableFuture.java:577)
                at java.util.concurrent.CompletableFuture.postComplete(CompletableFuture.java:474)
                at java.util.concurrent.CompletableFuture.complete(CompletableFuture.java:1962)
                at org.infinispan.remoting.transport.jgroups.RspListFuture.call(RspListFuture.java:47)
                at org.infinispan.remoting.transport.jgroups.RspListFuture.call(RspListFuture.java:16)
                at java.util.concurrent.FutureTask.run(FutureTask.java:266)
                at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$201(ScheduledThreadPoolExecutor.java:180)
                at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:293)
                ... 3 more



Here kc2 is the removed instance.

Kind Regards,
Sarp Kaya


From: Stian Thorgersen <sthorger at redhat.com<mailto:sthorger at redhat.com>>
Reply-To: "stian at redhat.com<mailto:stian at redhat.com>" <stian at redhat.com<mailto:stian at redhat.com>>
Date: Friday, July 1, 2016 at 7:17 PM
To: Abdullah Sarp Kaya <akaya at expedia.com<mailto:akaya at expedia.com>>
Cc: "keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>" <keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>>
Subject: Re: [keycloak-user] Lost session when removing an instance off cluster

Can you please include more details from the log if there is any, at least a full stack trace and not just the bit you've included. We also need to know details around how you've configured the caches and Infinispan.

On 1 July 2016 at 10:16, Sarp Kaya <akaya at expedia.com<mailto:akaya at expedia.com>> wrote:
Hello,

I have tried various ways of configuring infinispan but it just seems like if I deploy a new instance to the cluster and remove one, then some sessions are lost and an exception is thrown saying that it was not handled. This is the Infinispan exception:

Exceptionhandlingrequestto/auth/realms/realmname/protocol/openid-connect/auth:org.jboss.resteasy.spi.UnhandledException:org.infinispan.util.concurrent.TimeoutException:Replicationtimeoutfor79a0757ecab3atorg.jboss.resteasy.core.ExceptionHandler.handleException(ExceptionHandler.java:247) atorg.jboss.resteasy.core.SynchronousDispatcher.writeException(SynchronousDispatcher.java:168) atorg.jboss.resteasy.core.SynchronousDispatcher.writeResponse(SynchronousDispatcher.java:471) atorg.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:415) atorg.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:202) atorg.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.service(ServletContainerDispatcher.java:221) atorg.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:56) atorg.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:51) atjavax.servlet.http.HttpServlet.service(HttpServlet.java:790) atio.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:85) atio.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:129) atorg.keycloak.services.filters.KeycloakSessionServletFilter.doFilter(KeycloakSessionServletFilter.java:88) atio.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:60) atio.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131) atio.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.java:84) atio.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:62) atio.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36) atorg.wildfly.extension.undertow.security.SecurityContextAssociationHandler.handleRequest(SecurityContextAssociationHandler.java:78) atio.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) atio.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:131) atio.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:57) atio.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) atio.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:46) atio.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64) atio.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:60) atio.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:77) atio.undertow.security.handlers.NotificationReceiverHandler.handleRequest(NotificationReceiverHandler.java:50) atio.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43) atio.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) atorg.wildfly.extension.undertow.security.jacc.JACCContextIdHandler.handleRequest(JACCContextIdHandler.java:61) atio.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) atio.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) atio.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:284) atio.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:263) atio.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:81) atio.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:174) atio.undertow.server.Connectors.executeRootHandler(Connectors.java:202) atio.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:793) atjava.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) atjava.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) atjava.lang.Thread.run(Thread.java:745) Causedby:org.infinispan.util.concurrent.TimeoutException:Replicationtimeoutfor79a0757ecab3atorg.infinispan.remoting.transport.jgroups.JGroupsTransport.checkRsp(JGroupsTransport.java:765) atorg.infinispan.remoting.transport.jgroups.JGroupsTransport.lambda$invokeRemotelyAsync$72(JGroupsTransport.java:599) atjava.util.concurrent.CompletableFuture.uniApply(CompletableFuture.java:602) atjava.util.concurrent.CompletableFuture$UniApply.tryFire(CompletableFuture.java:577) atjava.util.concurrent.CompletableFuture.postComplete(CompletableFuture.java:474) atjava.util.concurrent.CompletableFuture.complete(CompletableFuture.java:1962) atorg.infinispan.remoting.transport.jgroups.SingleResponseFuture.call(SingleResponseFuture.java:46) atorg.infinispan.remoting.transport.jgroups.SingleResponseFuture.call(SingleResponseFuture.java:17) atjava.util.concurrent.FutureTask.run(FutureTask.java:266) atjava.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$201(ScheduledThreadPoolExecutor.java:180)

This causes browsers to see Internal Server Error. Shouldn't that be handled in Keycloak as lost session, therefore KC should try to handle it rather than showing that it's an Internal Server Error?

My current infinispan configuration looks like this:


<distributed-cache name="sessions" mode="SYNC">
    <transaction mode="NON_DURABLE_XA"/>
</distributed-cache>

I use Keycloak version 1.9.5. My question is am I doing something wrong with my configuration? I tried both replicated-cache and distributed-cache and tried all transaction mode on both of them. None of them seems to solve the error that I've had above.

Kind Regards,
Sarp Kaya




_______________________________________________
keycloak-user mailing list
keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>
https://lists.jboss.org/mailman/listinfo/keycloak-user

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160704/903783fa/attachment-0001.html 

From akaya at expedia.com  Mon Jul  4 09:45:44 2016
From: akaya at expedia.com (Sarp Kaya)
Date: Mon, 4 Jul 2016 13:45:44 +0000
Subject: [keycloak-user] Lost session when removing an instance off
 cluster
In-Reply-To: <D3A01882.6050%akaya@expedia.com>
References: <D39C63FE.5FCC%akaya@expedia.com>
	<CAJgngAfJoYUzbtLtU1aAkVrBmE3s7_XOxCCTh8ywVBVth9ZprQ@mail.gmail.com>
	<D3A01882.6050%akaya@expedia.com>
Message-ID: <D3A0A0EA.60C9%akaya@expedia.com>

Just to add on this.

I think I misunderstood something or Keycloak does not really implement the infinispan caching lifetime correctly.

So first thing I did is to TRACE the infinispan logs. So I added this logger in standalone.xml:


<logger category="org.infinispan">
    <level name="TRACE"/>
</logger>

The next thing I did is to do the timing. Basically my test is that what happens when I log in. I also enabled events and printing the events as well.

What I found is:


  1.  Login event is triggered at 13:18:35,193 in Keycloak.
  2.  The browser got the full response at 13:18:35,273
  3.  Now the surprising part is the fact that there are whole a lot of infinispan logging out occurring for ?sessions? cache after the browser got the response. The last log message occurring is like this:

2016-07-04 13:18:35,345 TRACE [org.infinispan.remoting.rpc.RpcManagerImpl] (default task-4) Response(s) to TxCompletionNotificationCommand{ xid=null, internalId=0, topologyId=19, gtx=GlobalTransaction:<kc1>:239:local, cacheName=sessions}  is {}

To see the all the logs after event trigger please check here:
<http://pastebin.com/pkvYP07T><http://pastebin.com/pkvYP07T><http://pastebin.com/pkvYP07T><http://pastebin.com/pkvYP07T>http://pastebin.com/p4K2Ghff

So my understanding was that I marked sessions as SYNC, which meant to me that it is supposed to do all of the synchronization before it sends the response back to the browser. If it does the other way around then it should be ASYNC mode. Could you please clarify the intended/expected behavior?

Kind Regards,
Sarp Kaya


From: Abdullah Sarp Kaya <akaya at expedia.com<mailto:akaya at expedia.com>>
Date: Monday, July 4, 2016 at 9:59 PM
To: "stian at redhat.com<mailto:stian at redhat.com>" <stian at redhat.com<mailto:stian at redhat.com>>
Cc: "keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>" <keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>>
Subject: Re: [keycloak-user] Lost session when removing an instance off cluster

Hello,

Below is exactly how Infinispan is configured:


<subsystem xmlns="urn:jboss:domain:infinispan:4.0">
    <cache-container name="keycloak" jndi-name="infinispan/Keycloak">
    <transport lock-timeout="60000"/>
    <invalidation-cache name="realms" mode="SYNC"/>
    <invalidation-cache name="users" mode="SYNC">
        <eviction max-entries="10000" strategy="LRU"/>
    </invalidation-cache>
    <distributed-cache xmlns="" name="sessions" mode="SYNC">
        <transaction mode="NON_DURABLE_XA"/>
    </distributed-cache>
    <local-cache xmlns="" name="offlineSessions"/>
    <local-cache xmlns="" name="loginFailures"/>
    <replicated-cache name="work" mode="SYNC"/>
    <local-cache name="realmVersions">
        <transaction mode="BATCH" locking="PESSIMISTIC"/>
    </local-cache>
</cache-container>
<cache-container name="server" aliases="singleton cluster" default-cache="default" module="org.wildfly.clustering.server">
    <transport lock-timeout="60000"/>
    <replicated-cache name="default" mode="SYNC">
        <transaction mode="BATCH"/>
    </replicated-cache>
</cache-container>
<cache-container name="web" default-cache="dist" module="org.wildfly.clustering.web.infinispan">
    <transport lock-timeout="60000"/>
    <distributed-cache name="dist" mode="ASYNC" l1-lifespan="0" owners="2">
        <locking isolation="REPEATABLE_READ"/>
        <transaction mode="BATCH"/>
        <file-store/>
    </distributed-cache>
</cache-container>
<cache-container name="ejb" aliases="sfsb" default-cache="dist" module="org.wildfly.clustering.ejb.infinispan">
    <transport lock-timeout="60000"/>
    <distributed-cache name="dist" mode="ASYNC" l1-lifespan="0" owners="2">
        <locking isolation="REPEATABLE_READ"/>
        <transaction mode="BATCH"/>
        <file-store/>
    </distributed-cache>
</cache-container>
<cache-container name="hibernate" default-cache="local-query" module="org.hibernate.infinispan">
    <transport lock-timeout="60000"/>
    <invalidation-cache name="entity" mode="SYNC">
        <transaction mode="NON_XA"/>
        <eviction strategy="LRU" max-entries="10000"/>
        <expiration max-idle="100000"/>
    </invalidation-cache>
    <local-cache name="local-query">
        <eviction strategy="LRU" max-entries="10000"/>
        <expiration max-idle="100000"/>
    </local-cache>
    <replicated-cache name="timestamps" mode="ASYNC"/>
</cache-container>
</subsystem>




This is the complete exception:

03:49:40,241 ERROR [org.infinispan.interceptors.InvocationContextInterceptor] (default task-12) ISPN000136: Error executing command PutKeyValueCommand, writing keys [ba74e523-3299-42b3-801e-9f8cb5a0d81d]: org.infinispan.util.concurrent.TimeoutException: Replication timeout for kc2
        at org.infinispan.remoting.transport.jgroups.JGroupsTransport.checkRsp(JGroupsTransport.java:765)
        at org.infinispan.remoting.transport.jgroups.JGroupsTransport.lambda$invokeRemotelyAsync$73(JGroupsTransport.java:612)
        at java.util.concurrent.CompletableFuture.uniApply(CompletableFuture.java:602)
        at java.util.concurrent.CompletableFuture$UniApply.tryFire(CompletableFuture.java:577)
        at java.util.concurrent.CompletableFuture.postComplete(CompletableFuture.java:474)
        at java.util.concurrent.CompletableFuture.complete(CompletableFuture.java:1962)
        at org.infinispan.remoting.transport.jgroups.RspListFuture.call(RspListFuture.java:47)
        at org.infinispan.remoting.transport.jgroups.RspListFuture.call(RspListFuture.java:16)
        at java.util.concurrent.FutureTask.run(FutureTask.java:266)
        at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$201(ScheduledThreadPoolExecutor.java:180)
        at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:293)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
        at java.lang.Thread.run(Thread.java:745)

03:49:40,250 ERROR [org.jboss.resteasy.resteasy_jaxrs.i18n] (default task-12) RESTEASY002025: Unknown exception while executing GET /realms/partner-dmz/protocol/openid-connect/auth: org.infinispan.util.concurrent.TimeoutException: Replication timeout for kc2
        at org.infinispan.remoting.transport.jgroups.JGroupsTransport.checkRsp(JGroupsTransport.java:765)
        at org.infinispan.remoting.transport.jgroups.JGroupsTransport.lambda$invokeRemotelyAsync$73(JGroupsTransport.java:612)
        at java.util.concurrent.CompletableFuture.uniApply(CompletableFuture.java:602)
        at java.util.concurrent.CompletableFuture$UniApply.tryFire(CompletableFuture.java:577)
        at java.util.concurrent.CompletableFuture.postComplete(CompletableFuture.java:474)
        at java.util.concurrent.CompletableFuture.complete(CompletableFuture.java:1962)
        at org.infinispan.remoting.transport.jgroups.RspListFuture.call(RspListFuture.java:47)
        at org.infinispan.remoting.transport.jgroups.RspListFuture.call(RspListFuture.java:16)
        at java.util.concurrent.FutureTask.run(FutureTask.java:266)
        at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$201(ScheduledThreadPoolExecutor.java:180)
        at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:293)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
        at java.lang.Thread.run(Thread.java:745)

03:49:40,257 ERROR [io.undertow.request] (default task-12) UT005023: Exception handling request to /auth/realms/partner-dmz/protocol/openid-connect/auth: org.jboss.resteasy.spi.UnhandledException: org.infinispan.util.concurrent.TimeoutException: Replication timeout for kc2
        at org.jboss.resteasy.core.ExceptionHandler.handleException(ExceptionHandler.java:247)
        at org.jboss.resteasy.core.SynchronousDispatcher.writeException(SynchronousDispatcher.java:168)
        at org.jboss.resteasy.core.SynchronousDispatcher.writeResponse(SynchronousDispatcher.java:471)
        at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:415)
        at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:202)
        at org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.service(ServletContainerDispatcher.java:221)
        at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:56)
        at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:51)
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:790)
        at io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:85)
        at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:129)
        at org.keycloak.services.filters.KeycloakSessionServletFilter.doFilter(KeycloakSessionServletFilter.java:88)
        at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:60)
        at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
        at io.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.java:84)
        at io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:62)
        at io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36)
        at org.wildfly.extension.undertow.security.SecurityContextAssociationHandler.handleRequest(SecurityContextAssociationHandler.java:78)
        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
        at io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:131)
        at io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:57)
        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
        at io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:46)
        at io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64)
        at io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:60)
        at io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:77)
        at io.undertow.security.handlers.NotificationReceiverHandler.handleRequest(NotificationReceiverHandler.java:50)
        at io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43)
        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
        at org.wildfly.extension.undertow.security.jacc.JACCContextIdHandler.handleRequest(JACCContextIdHandler.java:61)
        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
        at io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:284)
        at io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:263)
        at io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:81)
        at io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:174)
        at io.undertow.server.Connectors.executeRootHandler(Connectors.java:202)
        at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:793)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
        at java.lang.Thread.run(Thread.java:745)
Caused by: org.infinispan.util.concurrent.TimeoutException: Replication timeout for kc2
        at org.infinispan.remoting.transport.jgroups.JGroupsTransport.checkRsp(JGroupsTransport.java:765)
        at org.infinispan.remoting.transport.jgroups.JGroupsTransport.lambda$invokeRemotelyAsync$73(JGroupsTransport.java:612)
        at java.util.concurrent.CompletableFuture.uniApply(CompletableFuture.java:602)
        at java.util.concurrent.CompletableFuture$UniApply.tryFire(CompletableFuture.java:577)
        at java.util.concurrent.CompletableFuture.postComplete(CompletableFuture.java:474)
        at java.util.concurrent.CompletableFuture.complete(CompletableFuture.java:1962)
        at org.infinispan.remoting.transport.jgroups.RspListFuture.call(RspListFuture.java:47)
        at org.infinispan.remoting.transport.jgroups.RspListFuture.call(RspListFuture.java:16)
        at java.util.concurrent.FutureTask.run(FutureTask.java:266)
        at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$201(ScheduledThreadPoolExecutor.java:180)
        at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:293)
        ... 3 more

03:49:41,251 ERROR [org.infinispan.interceptors.InvocationContextInterceptor] (default task-3) ISPN000136: Error executing command PrepareCommand, writing keys [02cff8bb-0ab9-4ab9-905f-17ffb3226050]: org.infinispan.util.concurrent.TimeoutException: Replication timeout for kc2
        at org.infinispan.remoting.transport.jgroups.JGroupsTransport.checkRsp(JGroupsTransport.java:765)
        at org.infinispan.remoting.transport.jgroups.JGroupsTransport.lambda$invokeRemotelyAsync$73(JGroupsTransport.java:612)
        at java.util.concurrent.CompletableFuture.uniApply(CompletableFuture.java:602)
        at java.util.concurrent.CompletableFuture$UniApply.tryFire(CompletableFuture.java:577)
        at java.util.concurrent.CompletableFuture.postComplete(CompletableFuture.java:474)
        at java.util.concurrent.CompletableFuture.complete(CompletableFuture.java:1962)
        at org.infinispan.remoting.transport.jgroups.RspListFuture.call(RspListFuture.java:47)
        at org.infinispan.remoting.transport.jgroups.RspListFuture.call(RspListFuture.java:16)
        at java.util.concurrent.FutureTask.run(FutureTask.java:266)
        at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$201(ScheduledThreadPoolExecutor.java:180)
        at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:293)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
        at java.lang.Thread.run(Thread.java:745)

03:49:41,258 ERROR [org.infinispan.transaction.impl.TransactionCoordinator] (default task-3) ISPN000097: Error while processing a prepare in a single-phase transaction: org.infinispan.util.concurrent.TimeoutException: Replication timeout for kc2
        at org.infinispan.remoting.transport.jgroups.JGroupsTransport.checkRsp(JGroupsTransport.java:765)
        at org.infinispan.remoting.transport.jgroups.JGroupsTransport.lambda$invokeRemotelyAsync$73(JGroupsTransport.java:612)
        at java.util.concurrent.CompletableFuture.uniApply(CompletableFuture.java:602)
        at java.util.concurrent.CompletableFuture$UniApply.tryFire(CompletableFuture.java:577)
        at java.util.concurrent.CompletableFuture.postComplete(CompletableFuture.java:474)
        at java.util.concurrent.CompletableFuture.complete(CompletableFuture.java:1962)
        at org.infinispan.remoting.transport.jgroups.RspListFuture.call(RspListFuture.java:47)
        at org.infinispan.remoting.transport.jgroups.RspListFuture.call(RspListFuture.java:16)
        at java.util.concurrent.FutureTask.run(FutureTask.java:266)
        at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$201(ScheduledThreadPoolExecutor.java:180)
        at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:293)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
        at java.lang.Thread.run(Thread.java:745)

03:49:45,504 INFO  [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (Incoming-3,dev,kc1) ISPN000094: Received new cluster view for channel server: [kc1|4] (1) [kc1]
03:49:45,507 INFO  [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (Incoming-3,dev,kc1) ISPN000094: Received new cluster view for channel keycloak: [kc1|4] (1) [kc1]
03:49:45,534 INFO  [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (Incoming-3,dev,kc1) ISPN000094: Received new cluster view for channel web: [kc1|4] (1) [kc1]
03:49:45,538 INFO  [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (Incoming-3,dev,kc1) ISPN000094: Received new cluster view for channel ejb: [kc1|4] (1) [kc1]
03:49:45,548 WARN  [com.arjuna.ats.jta] (default task-3) ARJUNA016039: onePhaseCommit on < formatId=131077, gtrid_length=29, bqual_length=36, tx_uid=0:ffffac110003:-7fcaa87f:5779dc60:f01, node_name=1, branch_uid=0:ffffac110003:-7fcaa87f:5779dc60:f02, subordinatenodename=null, eis_name=unknown eis name > (TransactionXaAdapter{localTransaction=LocalXaTransaction{xid=< formatId=131077, gtrid_length=29, bqual_length=36, tx_uid=0:ffffac110003:-7fcaa87f:5779dc60:f01, node_name=1, branch_uid=0:ffffac110003:-7fcaa87f:5779dc60:f02, subordinatenodename=null, eis_name=unknown eis name >} LocalTransaction{remoteLockedNodes=null, isMarkedForRollback=false, lockedKeys=null, backupKeyLocks=null, topologyId=6, stateTransferFlag=null} org.infinispan.transaction.xa.LocalXaTransaction at 3ef}) failed with exception XAException.XA_HEURRB: javax.transaction.xa.XAException
        at org.infinispan.transaction.impl.TransactionCoordinator.handleCommitFailure(TransactionCoordinator.java:213)
        at org.infinispan.transaction.impl.TransactionCoordinator.commit(TransactionCoordinator.java:159)
        at org.infinispan.transaction.xa.TransactionXaAdapter.commit(TransactionXaAdapter.java:112)
        at com.arjuna.ats.internal.jta.resources.arjunacore.XAResourceRecord.topLevelOnePhaseCommit(XAResourceRecord.java:704)
        at com.arjuna.ats.arjuna.coordinator.BasicAction.onePhaseCommit(BasicAction.java:2366)
        at com.arjuna.ats.arjuna.coordinator.BasicAction.End(BasicAction.java:1495)
        at com.arjuna.ats.arjuna.coordinator.TwoPhaseCoordinator.end(TwoPhaseCoordinator.java:96)
        at com.arjuna.ats.arjuna.AtomicAction.commit(AtomicAction.java:162)
        at com.arjuna.ats.internal.jta.transaction.arjunacore.TransactionImple.commitAndDisassociate(TransactionImple.java:1200)
        at com.arjuna.ats.internal.jta.transaction.arjunacore.BaseTransaction.commit(BaseTransaction.java:126)
        at com.arjuna.ats.jbossatx.BaseTransactionManagerDelegate.commit(BaseTransactionManagerDelegate.java:89)
        at org.infinispan.cache.impl.CacheImpl.tryCommit(CacheImpl.java:1722)
        at org.infinispan.cache.impl.CacheImpl.executeCommandAndCommitIfNeeded(CacheImpl.java:1679)
        at org.infinispan.cache.impl.CacheImpl.putInternal(CacheImpl.java:1121)
        at org.infinispan.cache.impl.CacheImpl.put(CacheImpl.java:1111)
        at org.infinispan.cache.impl.CacheImpl.put(CacheImpl.java:1742)
        at org.infinispan.cache.impl.CacheImpl.put(CacheImpl.java:248)
        at org.infinispan.cache.impl.AbstractDelegatingCache.put(AbstractDelegatingCache.java:291)
        at org.keycloak.models.sessions.infinispan.InfinispanUserSessionProvider$InfinispanKeycloakTransaction$CacheTask.execute(InfinispanUserSessionProvider.java:854)
        at org.keycloak.models.sessions.infinispan.InfinispanUserSessionProvider$InfinispanKeycloakTransaction.commit(InfinispanUserSessionProvider.java:750)
        at org.keycloak.services.DefaultKeycloakTransactionManager.commit(DefaultKeycloakTransactionManager.java:104)
        at org.keycloak.services.filters.KeycloakTransactionCommitter.filter(KeycloakTransactionCommitter.java:43)
        at org.jboss.resteasy.core.ServerResponseWriter.executeFilters(ServerResponseWriter.java:121)
        at org.jboss.resteasy.core.ServerResponseWriter.writeNomapResponse(ServerResponseWriter.java:48)
        at org.jboss.resteasy.core.SynchronousDispatcher.writeResponse(SynchronousDispatcher.java:466)
        at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:415)
        at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:202)
        at org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.service(ServletContainerDispatcher.java:221)
        at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:56)
        at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:51)
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:790)
        at io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:85)
        at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:129)
        at org.keycloak.services.filters.KeycloakSessionServletFilter.doFilter(KeycloakSessionServletFilter.java:88)
        at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:60)
        at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
        at io.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.java:84)
        at io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:62)
        at io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36)
        at org.wildfly.extension.undertow.security.SecurityContextAssociationHandler.handleRequest(SecurityContextAssociationHandler.java:78)
        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
        at io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:131)
        at io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:57)
        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
        at io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:46)
        at io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64)
        at io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:60)
        at io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:77)
        at io.undertow.security.handlers.NotificationReceiverHandler.handleRequest(NotificationReceiverHandler.java:50)
        at io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43)
        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
        at org.wildfly.extension.undertow.security.jacc.JACCContextIdHandler.handleRequest(JACCContextIdHandler.java:61)
        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
        at io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:284)
        at io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:263)
        at io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:81)
        at io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:174)
        at io.undertow.server.Connectors.executeRootHandler(Connectors.java:202)
        at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:793)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
        at java.lang.Thread.run(Thread.java:745)
Caused by: org.infinispan.util.concurrent.TimeoutException: Replication timeout for kc2
        at org.infinispan.remoting.transport.jgroups.JGroupsTransport.checkRsp(JGroupsTransport.java:765)
        at org.infinispan.remoting.transport.jgroups.JGroupsTransport.lambda$invokeRemotelyAsync$73(JGroupsTransport.java:612)
        at java.util.concurrent.CompletableFuture.uniApply(CompletableFuture.java:602)
        at java.util.concurrent.CompletableFuture$UniApply.tryFire(CompletableFuture.java:577)
        at java.util.concurrent.CompletableFuture.postComplete(CompletableFuture.java:474)
        at java.util.concurrent.CompletableFuture.complete(CompletableFuture.java:1962)
        at org.infinispan.remoting.transport.jgroups.RspListFuture.call(RspListFuture.java:47)
        at org.infinispan.remoting.transport.jgroups.RspListFuture.call(RspListFuture.java:16)
        at java.util.concurrent.FutureTask.run(FutureTask.java:266)
        at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$201(ScheduledThreadPoolExecutor.java:180)
        at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:293)
        ... 3 more

03:49:45,563 WARN  [org.infinispan.cache.impl.CacheImpl] (default task-3) ISPN000160: Could not complete injected transaction.: javax.transaction.RollbackException: ARJUNA016053: Could not commit transaction.
        at com.arjuna.ats.internal.jta.transaction.arjunacore.TransactionImple.commitAndDisassociate(TransactionImple.java:1212)
        at com.arjuna.ats.internal.jta.transaction.arjunacore.BaseTransaction.commit(BaseTransaction.java:126)
        at com.arjuna.ats.jbossatx.BaseTransactionManagerDelegate.commit(BaseTransactionManagerDelegate.java:89)
        at org.infinispan.cache.impl.CacheImpl.tryCommit(CacheImpl.java:1722)
        at org.infinispan.cache.impl.CacheImpl.executeCommandAndCommitIfNeeded(CacheImpl.java:1679)
        at org.infinispan.cache.impl.CacheImpl.putInternal(CacheImpl.java:1121)
        at org.infinispan.cache.impl.CacheImpl.put(CacheImpl.java:1111)
        at org.infinispan.cache.impl.CacheImpl.put(CacheImpl.java:1742)
        at org.infinispan.cache.impl.CacheImpl.put(CacheImpl.java:248)
        at org.infinispan.cache.impl.AbstractDelegatingCache.put(AbstractDelegatingCache.java:291)
        at org.keycloak.models.sessions.infinispan.InfinispanUserSessionProvider$InfinispanKeycloakTransaction$CacheTask.execute(InfinispanUserSessionProvider.java:854)
        at org.keycloak.models.sessions.infinispan.InfinispanUserSessionProvider$InfinispanKeycloakTransaction.commit(InfinispanUserSessionProvider.java:750)
        at org.keycloak.services.DefaultKeycloakTransactionManager.commit(DefaultKeycloakTransactionManager.java:104)
        at org.keycloak.services.filters.KeycloakTransactionCommitter.filter(KeycloakTransactionCommitter.java:43)
        at org.jboss.resteasy.core.ServerResponseWriter.executeFilters(ServerResponseWriter.java:121)
        at org.jboss.resteasy.core.ServerResponseWriter.writeNomapResponse(ServerResponseWriter.java:48)
        at org.jboss.resteasy.core.SynchronousDispatcher.writeResponse(SynchronousDispatcher.java:466)
        at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:415)
        at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:202)
        at org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.service(ServletContainerDispatcher.java:221)
        at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:56)
        at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:51)
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:790)
        at io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:85)
        at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:129)
        at org.keycloak.services.filters.KeycloakSessionServletFilter.doFilter(KeycloakSessionServletFilter.java:88)
        at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:60)
        at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
        at io.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.java:84)
        at io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:62)
        at io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36)
        at org.wildfly.extension.undertow.security.SecurityContextAssociationHandler.handleRequest(SecurityContextAssociationHandler.java:78)
        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
        at io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:131)
        at io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:57)
        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
        at io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:46)
        at io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64)
        at io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:60)
        at io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:77)
        at io.undertow.security.handlers.NotificationReceiverHandler.handleRequest(NotificationReceiverHandler.java:50)
        at io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43)
        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
        at org.wildfly.extension.undertow.security.jacc.JACCContextIdHandler.handleRequest(JACCContextIdHandler.java:61)
        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
        at io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:284)
        at io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:263)
        at io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:81)
        at io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:174)
        at io.undertow.server.Connectors.executeRootHandler(Connectors.java:202)
        at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:793)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
        at java.lang.Thread.run(Thread.java:745)
        Suppressed: javax.transaction.xa.XAException
                at org.infinispan.transaction.impl.TransactionCoordinator.handleCommitFailure(TransactionCoordinator.java:213)
                at org.infinispan.transaction.impl.TransactionCoordinator.commit(TransactionCoordinator.java:159)
                at org.infinispan.transaction.xa.TransactionXaAdapter.commit(TransactionXaAdapter.java:112)
                at com.arjuna.ats.internal.jta.resources.arjunacore.XAResourceRecord.topLevelOnePhaseCommit(XAResourceRecord.java:704)
                at com.arjuna.ats.arjuna.coordinator.BasicAction.onePhaseCommit(BasicAction.java:2366)
                at com.arjuna.ats.arjuna.coordinator.BasicAction.End(BasicAction.java:1495)
                at com.arjuna.ats.arjuna.coordinator.TwoPhaseCoordinator.end(TwoPhaseCoordinator.java:96)
                at com.arjuna.ats.arjuna.AtomicAction.commit(AtomicAction.java:162)
                at com.arjuna.ats.internal.jta.transaction.arjunacore.TransactionImple.commitAndDisassociate(TransactionImple.java:1200)
                ... 54 more
        Caused by: org.infinispan.util.concurrent.TimeoutException: Replication timeout for kc2
                at org.infinispan.remoting.transport.jgroups.JGroupsTransport.checkRsp(JGroupsTransport.java:765)
                at org.infinispan.remoting.transport.jgroups.JGroupsTransport.lambda$invokeRemotelyAsync$73(JGroupsTransport.java:612)
                at java.util.concurrent.CompletableFuture.uniApply(CompletableFuture.java:602)
                at java.util.concurrent.CompletableFuture$UniApply.tryFire(CompletableFuture.java:577)
                at java.util.concurrent.CompletableFuture.postComplete(CompletableFuture.java:474)
                at java.util.concurrent.CompletableFuture.complete(CompletableFuture.java:1962)
                at org.infinispan.remoting.transport.jgroups.RspListFuture.call(RspListFuture.java:47)
                at org.infinispan.remoting.transport.jgroups.RspListFuture.call(RspListFuture.java:16)
                at java.util.concurrent.FutureTask.run(FutureTask.java:266)
                at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$201(ScheduledThreadPoolExecutor.java:180)
                at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:293)
                ... 3 more

03:49:45,575 INFO  [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (Incoming-3,dev,kc1) ISPN000094: Received new cluster view for channel hibernate: [kc1|4] (1) [kc1]
03:49:45,575 ERROR [org.jboss.resteasy.resteasy_jaxrs.i18n] (default task-3) RESTEASY002025: Unknown exception while executing GET /realms/partner-dmz/protocol/openid-connect/auth: org.infinispan.commons.CacheException: Could not commit implicit transaction
        at org.infinispan.cache.impl.CacheImpl.tryCommit(CacheImpl.java:1725)
        at org.infinispan.cache.impl.CacheImpl.executeCommandAndCommitIfNeeded(CacheImpl.java:1679)
        at org.infinispan.cache.impl.CacheImpl.putInternal(CacheImpl.java:1121)
        at org.infinispan.cache.impl.CacheImpl.put(CacheImpl.java:1111)
        at org.infinispan.cache.impl.CacheImpl.put(CacheImpl.java:1742)
        at org.infinispan.cache.impl.CacheImpl.put(CacheImpl.java:248)
        at org.infinispan.cache.impl.AbstractDelegatingCache.put(AbstractDelegatingCache.java:291)
        at org.keycloak.models.sessions.infinispan.InfinispanUserSessionProvider$InfinispanKeycloakTransaction$CacheTask.execute(InfinispanUserSessionProvider.java:854)
        at org.keycloak.models.sessions.infinispan.InfinispanUserSessionProvider$InfinispanKeycloakTransaction.commit(InfinispanUserSessionProvider.java:750)
        at org.keycloak.services.DefaultKeycloakTransactionManager.commit(DefaultKeycloakTransactionManager.java:104)
        at org.keycloak.services.filters.KeycloakTransactionCommitter.filter(KeycloakTransactionCommitter.java:43)
        at org.jboss.resteasy.core.ServerResponseWriter.executeFilters(ServerResponseWriter.java:121)
        at org.jboss.resteasy.core.ServerResponseWriter.writeNomapResponse(ServerResponseWriter.java:48)
        at org.jboss.resteasy.core.SynchronousDispatcher.writeResponse(SynchronousDispatcher.java:466)
        at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:415)
        at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:202)
        at org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.service(ServletContainerDispatcher.java:221)
        at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:56)
        at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:51)
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:790)
        at io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:85)
        at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:129)
        at org.keycloak.services.filters.KeycloakSessionServletFilter.doFilter(KeycloakSessionServletFilter.java:88)
        at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:60)
        at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
        at io.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.java:84)
        at io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:62)
        at io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36)
        at org.wildfly.extension.undertow.security.SecurityContextAssociationHandler.handleRequest(SecurityContextAssociationHandler.java:78)
        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
        at io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:131)
        at io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:57)
        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
        at io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:46)
        at io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64)
        at io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:60)
        at io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:77)
        at io.undertow.security.handlers.NotificationReceiverHandler.handleRequest(NotificationReceiverHandler.java:50)
        at io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43)
        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
        at org.wildfly.extension.undertow.security.jacc.JACCContextIdHandler.handleRequest(JACCContextIdHandler.java:61)
        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
        at io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:284)
        at io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:263)
        at io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:81)
        at io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:174)
        at io.undertow.server.Connectors.executeRootHandler(Connectors.java:202)
        at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:793)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
        at java.lang.Thread.run(Thread.java:745)
Caused by: javax.transaction.RollbackException: ARJUNA016053: Could not commit transaction.
        at com.arjuna.ats.internal.jta.transaction.arjunacore.TransactionImple.commitAndDisassociate(TransactionImple.java:1212)
        at com.arjuna.ats.internal.jta.transaction.arjunacore.BaseTransaction.commit(BaseTransaction.java:126)
        at com.arjuna.ats.jbossatx.BaseTransactionManagerDelegate.commit(BaseTransactionManagerDelegate.java:89)
        at org.infinispan.cache.impl.CacheImpl.tryCommit(CacheImpl.java:1722)
        ... 51 more
        Suppressed: javax.transaction.xa.XAException
                at org.infinispan.transaction.impl.TransactionCoordinator.handleCommitFailure(TransactionCoordinator.java:213)
                at org.infinispan.transaction.impl.TransactionCoordinator.commit(TransactionCoordinator.java:159)
                at org.infinispan.transaction.xa.TransactionXaAdapter.commit(TransactionXaAdapter.java:112)
                at com.arjuna.ats.internal.jta.resources.arjunacore.XAResourceRecord.topLevelOnePhaseCommit(XAResourceRecord.java:704)
                at com.arjuna.ats.arjuna.coordinator.BasicAction.onePhaseCommit(BasicAction.java:2366)
                at com.arjuna.ats.arjuna.coordinator.BasicAction.End(BasicAction.java:1495)
                at com.arjuna.ats.arjuna.coordinator.TwoPhaseCoordinator.end(TwoPhaseCoordinator.java:96)
                at com.arjuna.ats.arjuna.AtomicAction.commit(AtomicAction.java:162)
                at com.arjuna.ats.internal.jta.transaction.arjunacore.TransactionImple.commitAndDisassociate(TransactionImple.java:1200)
                ... 54 more
        Caused by: org.infinispan.util.concurrent.TimeoutException: Replication timeout for kc2
                at org.infinispan.remoting.transport.jgroups.JGroupsTransport.checkRsp(JGroupsTransport.java:765)
                at org.infinispan.remoting.transport.jgroups.JGroupsTransport.lambda$invokeRemotelyAsync$73(JGroupsTransport.java:612)
                at java.util.concurrent.CompletableFuture.uniApply(CompletableFuture.java:602)
                at java.util.concurrent.CompletableFuture$UniApply.tryFire(CompletableFuture.java:577)
                at java.util.concurrent.CompletableFuture.postComplete(CompletableFuture.java:474)
                at java.util.concurrent.CompletableFuture.complete(CompletableFuture.java:1962)
                at org.infinispan.remoting.transport.jgroups.RspListFuture.call(RspListFuture.java:47)
                at org.infinispan.remoting.transport.jgroups.RspListFuture.call(RspListFuture.java:16)
                at java.util.concurrent.FutureTask.run(FutureTask.java:266)
                at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$201(ScheduledThreadPoolExecutor.java:180)
                at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:293)
                ... 3 more

03:49:45,596 ERROR [io.undertow.request] (default task-3) UT005023: Exception handling request to /auth/realms/partner-dmz/protocol/openid-connect/auth: org.jboss.resteasy.spi.UnhandledException: org.infinispan.commons.CacheException: Could not commit implicit transaction
        at org.jboss.resteasy.core.ExceptionHandler.handleException(ExceptionHandler.java:247)
        at org.jboss.resteasy.core.SynchronousDispatcher.writeException(SynchronousDispatcher.java:168)
        at org.jboss.resteasy.core.SynchronousDispatcher.writeResponse(SynchronousDispatcher.java:471)
        at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:415)
        at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:202)
        at org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.service(ServletContainerDispatcher.java:221)
        at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:56)
        at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:51)
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:790)
        at io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:85)
        at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:129)
        at org.keycloak.services.filters.KeycloakSessionServletFilter.doFilter(KeycloakSessionServletFilter.java:88)
        at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:60)
        at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
        at io.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.java:84)
        at io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:62)
        at io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36)
        at org.wildfly.extension.undertow.security.SecurityContextAssociationHandler.handleRequest(SecurityContextAssociationHandler.java:78)
        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
        at io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:131)
        at io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:57)
        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
        at io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:46)
        at io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64)
        at io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:60)
        at io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:77)
        at io.undertow.security.handlers.NotificationReceiverHandler.handleRequest(NotificationReceiverHandler.java:50)
        at io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43)
        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
        at org.wildfly.extension.undertow.security.jacc.JACCContextIdHandler.handleRequest(JACCContextIdHandler.java:61)
        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
        at io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:284)
        at io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:263)
        at io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:81)
        at io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:174)
        at io.undertow.server.Connectors.executeRootHandler(Connectors.java:202)
        at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:793)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
        at java.lang.Thread.run(Thread.java:745)
Caused by: org.infinispan.commons.CacheException: Could not commit implicit transaction
        at org.infinispan.cache.impl.CacheImpl.tryCommit(CacheImpl.java:1725)
        at org.infinispan.cache.impl.CacheImpl.executeCommandAndCommitIfNeeded(CacheImpl.java:1679)
        at org.infinispan.cache.impl.CacheImpl.putInternal(CacheImpl.java:1121)
        at org.infinispan.cache.impl.CacheImpl.put(CacheImpl.java:1111)
        at org.infinispan.cache.impl.CacheImpl.put(CacheImpl.java:1742)
        at org.infinispan.cache.impl.CacheImpl.put(CacheImpl.java:248)
        at org.infinispan.cache.impl.AbstractDelegatingCache.put(AbstractDelegatingCache.java:291)
        at org.keycloak.models.sessions.infinispan.InfinispanUserSessionProvider$InfinispanKeycloakTransaction$CacheTask.execute(InfinispanUserSessionProvider.java:854)
        at org.keycloak.models.sessions.infinispan.InfinispanUserSessionProvider$InfinispanKeycloakTransaction.commit(InfinispanUserSessionProvider.java:750)
        at org.keycloak.services.DefaultKeycloakTransactionManager.commit(DefaultKeycloakTransactionManager.java:104)
        at org.keycloak.services.filters.KeycloakTransactionCommitter.filter(KeycloakTransactionCommitter.java:43)
        at org.jboss.resteasy.core.ServerResponseWriter.executeFilters(ServerResponseWriter.java:121)
        at org.jboss.resteasy.core.ServerResponseWriter.writeNomapResponse(ServerResponseWriter.java:48)
        at org.jboss.resteasy.core.SynchronousDispatcher.writeResponse(SynchronousDispatcher.java:466)
        ... 38 more
Caused by: javax.transaction.RollbackException: ARJUNA016053: Could not commit transaction.
        at com.arjuna.ats.internal.jta.transaction.arjunacore.TransactionImple.commitAndDisassociate(TransactionImple.java:1212)
        at com.arjuna.ats.internal.jta.transaction.arjunacore.BaseTransaction.commit(BaseTransaction.java:126)
        at com.arjuna.ats.jbossatx.BaseTransactionManagerDelegate.commit(BaseTransactionManagerDelegate.java:89)
        at org.infinispan.cache.impl.CacheImpl.tryCommit(CacheImpl.java:1722)
        ... 51 more
        Suppressed: javax.transaction.xa.XAException
                at org.infinispan.transaction.impl.TransactionCoordinator.handleCommitFailure(TransactionCoordinator.java:213)
                at org.infinispan.transaction.impl.TransactionCoordinator.commit(TransactionCoordinator.java:159)
                at org.infinispan.transaction.xa.TransactionXaAdapter.commit(TransactionXaAdapter.java:112)
                at com.arjuna.ats.internal.jta.resources.arjunacore.XAResourceRecord.topLevelOnePhaseCommit(XAResourceRecord.java:704)
                at com.arjuna.ats.arjuna.coordinator.BasicAction.onePhaseCommit(BasicAction.java:2366)
                at com.arjuna.ats.arjuna.coordinator.BasicAction.End(BasicAction.java:1495)
                at com.arjuna.ats.arjuna.coordinator.TwoPhaseCoordinator.end(TwoPhaseCoordinator.java:96)
                at com.arjuna.ats.arjuna.AtomicAction.commit(AtomicAction.java:162)
                at com.arjuna.ats.internal.jta.transaction.arjunacore.TransactionImple.commitAndDisassociate(TransactionImple.java:1200)
                ... 54 more
        Caused by: org.infinispan.util.concurrent.TimeoutException: Replication timeout for kc2
                at org.infinispan.remoting.transport.jgroups.JGroupsTransport.checkRsp(JGroupsTransport.java:765)
                at org.infinispan.remoting.transport.jgroups.JGroupsTransport.lambda$invokeRemotelyAsync$73(JGroupsTransport.java:612)
                at java.util.concurrent.CompletableFuture.uniApply(CompletableFuture.java:602)
                at java.util.concurrent.CompletableFuture$UniApply.tryFire(CompletableFuture.java:577)
                at java.util.concurrent.CompletableFuture.postComplete(CompletableFuture.java:474)
                at java.util.concurrent.CompletableFuture.complete(CompletableFuture.java:1962)
                at org.infinispan.remoting.transport.jgroups.RspListFuture.call(RspListFuture.java:47)
                at org.infinispan.remoting.transport.jgroups.RspListFuture.call(RspListFuture.java:16)
                at java.util.concurrent.FutureTask.run(FutureTask.java:266)
                at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$201(ScheduledThreadPoolExecutor.java:180)
                at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:293)
                ... 3 more



Here kc2 is the removed instance.

Kind Regards,
Sarp Kaya


From: Stian Thorgersen <sthorger at redhat.com<mailto:sthorger at redhat.com>>
Reply-To: "stian at redhat.com<mailto:stian at redhat.com>" <stian at redhat.com<mailto:stian at redhat.com>>
Date: Friday, July 1, 2016 at 7:17 PM
To: Abdullah Sarp Kaya <akaya at expedia.com<mailto:akaya at expedia.com>>
Cc: "keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>" <keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>>
Subject: Re: [keycloak-user] Lost session when removing an instance off cluster

Can you please include more details from the log if there is any, at least a full stack trace and not just the bit you've included. We also need to know details around how you've configured the caches and Infinispan.

On 1 July 2016 at 10:16, Sarp Kaya <akaya at expedia.com<mailto:akaya at expedia.com>> wrote:
Hello,

I have tried various ways of configuring infinispan but it just seems like if I deploy a new instance to the cluster and remove one, then some sessions are lost and an exception is thrown saying that it was not handled. This is the Infinispan exception:

Exceptionhandlingrequestto/auth/realms/realmname/protocol/openid-connect/auth:org.jboss.resteasy.spi.UnhandledException:org.infinispan.util.concurrent.TimeoutException:Replicationtimeoutfor79a0757ecab3atorg.jboss.resteasy.core.ExceptionHandler.handleException(ExceptionHandler.java:247) atorg.jboss.resteasy.core.SynchronousDispatcher.writeException(SynchronousDispatcher.java:168) atorg.jboss.resteasy.core.SynchronousDispatcher.writeResponse(SynchronousDispatcher.java:471) atorg.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:415) atorg.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:202) atorg.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.service(ServletContainerDispatcher.java:221) atorg.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:56) atorg.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:51) atjavax.servlet.http.HttpServlet.service(HttpServlet.java:790) atio.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:85) atio.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:129) atorg.keycloak.services.filters.KeycloakSessionServletFilter.doFilter(KeycloakSessionServletFilter.java:88) atio.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:60) atio.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131) atio.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.java:84) atio.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:62) atio.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36) atorg.wildfly.extension.undertow.security.SecurityContextAssociationHandler.handleRequest(SecurityContextAssociationHandler.java:78) atio.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) atio.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:131) atio.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:57) atio.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) atio.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:46) atio.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64) atio.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:60) atio.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:77) atio.undertow.security.handlers.NotificationReceiverHandler.handleRequest(NotificationReceiverHandler.java:50) atio.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43) atio.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) atorg.wildfly.extension.undertow.security.jacc.JACCContextIdHandler.handleRequest(JACCContextIdHandler.java:61) atio.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) atio.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) atio.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:284) atio.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:263) atio.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:81) atio.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:174) atio.undertow.server.Connectors.executeRootHandler(Connectors.java:202) atio.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:793) atjava.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) atjava.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) atjava.lang.Thread.run(Thread.java:745) Causedby:org.infinispan.util.concurrent.TimeoutException:Replicationtimeoutfor79a0757ecab3atorg.infinispan.remoting.transport.jgroups.JGroupsTransport.checkRsp(JGroupsTransport.java:765) atorg.infinispan.remoting.transport.jgroups.JGroupsTransport.lambda$invokeRemotelyAsync$72(JGroupsTransport.java:599) atjava.util.concurrent.CompletableFuture.uniApply(CompletableFuture.java:602) atjava.util.concurrent.CompletableFuture$UniApply.tryFire(CompletableFuture.java:577) atjava.util.concurrent.CompletableFuture.postComplete(CompletableFuture.java:474) atjava.util.concurrent.CompletableFuture.complete(CompletableFuture.java:1962) atorg.infinispan.remoting.transport.jgroups.SingleResponseFuture.call(SingleResponseFuture.java:46) atorg.infinispan.remoting.transport.jgroups.SingleResponseFuture.call(SingleResponseFuture.java:17) atjava.util.concurrent.FutureTask.run(FutureTask.java:266) atjava.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$201(ScheduledThreadPoolExecutor.java:180)

This causes browsers to see Internal Server Error. Shouldn?t that be handled in Keycloak as lost session, therefore KC should try to handle it rather than showing that it?s an Internal Server Error?

My current infinispan configuration looks like this:


<distributed-cache name="sessions" mode="SYNC">
    <transaction mode="NON_DURABLE_XA"/>
</distributed-cache>

I use Keycloak version 1.9.5. My question is am I doing something wrong with my configuration? I tried both replicated-cache and distributed-cache and tried all transaction mode on both of them. None of them seems to solve the error that I?ve had above.

Kind Regards,
Sarp Kaya




_______________________________________________
keycloak-user mailing list
keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>
https://lists.jboss.org/mailman/listinfo/keycloak-user

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160704/22404003/attachment-0001.html 

From harrytpc at gmail.com  Mon Jul  4 12:52:15 2016
From: harrytpc at gmail.com (Harry Trinta)
Date: Mon, 4 Jul 2016 13:52:15 -0300
Subject: [keycloak-user] User impersonation - JWT
Message-ID: <CA+waeaUYJe2-Lje-DUGK_QPOwdi6_CSBAi+hY+Oi4wTknwsy3w@mail.gmail.com>

Dears,



I need a help with user impersonation on keycloak.



I am authenticating users through the
"/realms/test/protocol/openid-connect/token". As expected, it returns a
token JWT.

In my app, all requests go through apiman, which validates the JWT.



Now, I need to personification of user. I'm calling the service
"/admin/realms/test/users/USER_ID/impersonation", sending the token in the
header (Authorization = Bearer eyJhbGciOiJSUzI1NiJ9 ...).

The service /impersonation creates the user session on keycloak, however
doesnt return a JWT, but 3 cookies. *I'd like to get the JWT of personified
user instead of cookie.* It's possible?



Best regards

Harry Costa
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160704/bcfcf42f/attachment.html 

From sthorger at redhat.com  Mon Jul  4 13:11:19 2016
From: sthorger at redhat.com (Stian Thorgersen)
Date: Mon, 4 Jul 2016 19:11:19 +0200
Subject: [keycloak-user] OAuth Access Token Response in XML
In-Reply-To: <A796EE85-32EE-4FFF-93EE-F37FD174AD8D@vizuri.com>
References: <A9513265-319F-4E93-A040-1E33292FF3EB@vizuri.com>
	<CAJgngAcHUekh5=kYnP4TmwEV3ioBbh5gD6eoba=iy8UKX1miLg@mail.gmail.com>
	<A796EE85-32EE-4FFF-93EE-F37FD174AD8D@vizuri.com>
Message-ID: <CAJgngAeU+keACHUSJg-Ky6mHqG_Vpb8LKxRk=cb5AVTqjCGm9g@mail.gmail.com>

Adding list back - please use reply all

I'm not following. The response payload is the token, so not sure what it
is that you want in XML.

On 4 July 2016 at 15:41, <asarathi at vizuri.com> wrote:

> Sorry if I wasn't clear earlier. I don't want the token itself to be in
> xml. I just want the response payload from the token endpoint to be xml or
> Json based on the accept header.
>
>
> On Jul 4, 2016, at 3:04 AM, Stian Thorgersen <sthorger at redhat.com> wrote:
>
> We only support JWT with OpenID Connect. Can you elaborate on why you want
> an XML token?
>
> You could add a custom REST endpoint or a custom protocol to do this, but
> not sure I'd recommend doing it as there's a fair bit of logic that goes
> into the token endpoint.
>
> On 1 July 2016 at 18:39, Aswini Sarathi <asarathi at vizuri.com> wrote:
>
>> Hi,
>>
>>     I am trying to find out if there is a way to get response from token
>> endpoint  /realms/{realm-name}/protocol/openid-connect/token in xml or
>> json format based on the Accept header. If its not supported out of the
>> box, what other options are available to do this? Should I look at creating
>> a custom endpoint by implementing the SPI to do the mapping?
>>
>> Thanks!!
>>
>>
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160704/064becbe/attachment.html 

From asarathi at vizuri.com  Mon Jul  4 13:32:39 2016
From: asarathi at vizuri.com (Aswini Sarathi)
Date: Mon, 4 Jul 2016 13:32:39 -0400
Subject: [keycloak-user] OAuth Access Token Response in XML
In-Reply-To: <CAJgngAeU+keACHUSJg-Ky6mHqG_Vpb8LKxRk=cb5AVTqjCGm9g@mail.gmail.com>
References: <A9513265-319F-4E93-A040-1E33292FF3EB@vizuri.com>
	<CAJgngAcHUekh5=kYnP4TmwEV3ioBbh5gD6eoba=iy8UKX1miLg@mail.gmail.com>
	<A796EE85-32EE-4FFF-93EE-F37FD174AD8D@vizuri.com>
	<CAJgngAeU+keACHUSJg-Ky6mHqG_Vpb8LKxRk=cb5AVTqjCGm9g@mail.gmail.com>
Message-ID: <CADVfbmc1-k9+J34u+vYH=5mub=TFHM2YqRjEnBRDhd41hn5xew@mail.gmail.com>

 I tried getting a token using the token endpoint with grant type as
"password" and this is what I got in the response and the content-type was
set to application/json in the header. My question  is what would I need to
do if I want the below response in xml. I have a user who wants to parse a
XML response instead and get the access token. Please let me know if I am
not doing anything correctly.

{
  "access_token":
"eyJhbGciOiJSUzI1NiJ9.eyJqdGkiOiJjZWVjZmNiZS1lODJmLTQ2MWQtODljMi05MGY0NGZiNTcwNTIiLCJleHAiOjE0Njc2NTM1MDgsIm5iZiI6MCwiaWF0IjoxNDY3NjUzMjA4LCJpc3MiOiJodHRwOi8vdml6MDIubmV0MzIubmV0OjgwODAvYXV0aC9yZWFsbXMvTmV0MzIiLCJhdWQiOiJWZW5kb3JBUEkiLCJzdWIiOiIxYjhhZWJkNC1iNDU0LTQzYTYtODRlOS05MmQxMjc1NGFmNDUiLCJ0eXAiOiJCZWFyZXIiLCJhenAiOiJWZW5kb3JBUEkiLCJzZXNzaW9uX3N0YXRlIjoiOWNhOTYxYzktMWI4OC00NzhlLWI0OTEtNTE1YWZiMDYwZTY1IiwiY2xpZW50X3Nlc3Npb24iOiI1MDgxNGZjMi02NWIwLTQ4YmYtYWY3OS04ZDZmODlhMWFkODciLCJhbGxvd2VkLW9yaWdpbnMiOltdLCJyZWFsbV9hY2Nlc3MiOnsicm9sZXMiOlsidmVuZG9yIl19LCJyZXNvdXJjZV9hY2Nlc3MiOnsiYWNjb3VudCI6eyJyb2xlcyI6WyJtYW5hZ2UtYWNjb3VudCIsInZpZXctcHJvZmlsZSJdfX0sIm5hbWUiOiIiLCJ2ZW5kb3JJZCI6MTg5NTUsInByZWZlcnJlZF91c2VybmFtZSI6InRyYWRlYWx6In0.faGKCcK79sLrYRxCdXHo7iaROKDXJjXsUh83PdnbV2DVWJ5HlaA735zhCoM2XJ3Fn4HIg68zjQy4Q__eC8_UcXDi_qcVz3qcHLhKRHX3xZXMWwaSGrIgmcU--0ntH4Ot4qDayolzk4xOdXahMdRQW4u0Cwiwsfi715TipP0IgOK4B4VcsdbBFF5UlQFwUDTkaKiI8kST-XK6elZcbUGjheVo5qU5-_uVZX9c2DBTyPJ2BRn6UEGfpXigqXEoQS6MXWj4aLiI4vIo8cTQ0dfTbontQMsv17wUif-IikHwoYWkI9TFCBo0Knh3l7D2Z6rEZc8UvmQNeGqRaMVvWN0_TA",
  "expires_in": 300,
  "refresh_expires_in": 1800,
  "refresh_token":
"eyJhbGciOiJSUzI1NiJ9.eyJqdGkiOiJjNzZlMjcxZS1hNjYxLTQwMjEtOGNiOC0yOWM2MjRmMTE4ZDIiLCJleHAiOjE0Njc2NTUwMDgsIm5iZiI6MCwiaWF0IjoxNDY3NjUzMjA4LCJpc3MiOiJodHRwOi8vdml6MDIubmV0MzIubmV0OjgwODAvYXV0aC9yZWFsbXMvTmV0MzIiLCJhdWQiOiJWZW5kb3JBUEkiLCJzdWIiOiIxYjhhZWJkNC1iNDU0LTQzYTYtODRlOS05MmQxMjc1NGFmNDUiLCJ0eXAiOiJSZWZyZXNoIiwiYXpwIjoiVmVuZG9yQVBJIiwic2Vzc2lvbl9zdGF0ZSI6IjljYTk2MWM5LTFiODgtNDc4ZS1iNDkxLTUxNWFmYjA2MGU2NSIsImNsaWVudF9zZXNzaW9uIjoiNTA4MTRmYzItNjViMC00OGJmLWFmNzktOGQ2Zjg5YTFhZDg3IiwicmVhbG1fYWNjZXNzIjp7InJvbGVzIjpbInZlbmRvciJdfSwicmVzb3VyY2VfYWNjZXNzIjp7ImFjY291bnQiOnsicm9sZXMiOlsibWFuYWdlLWFjY291bnQiLCJ2aWV3LXByb2ZpbGUiXX19fQ.AcgsUMKH6Yczq6RxAxiwgViXRoiS2KuqFYdWOAYDmwL7_esy4E3guX9XR-8tBULiEspCNxCbgJca7t3_4jMxeIdhBq4DDqdecCe0XuU6HRugFD8nGDxHGMmotWarZn3mjj1jZmLCwYptoWgNVAJa6bILQafYFTHjb1Xzy_5j6lzk0waT9NMe0LFtVLFnW5xMqWs2gUMLUuY7XLlmNjarl_-LHsE3yiwWw1WR528JN3ld87tlQhGDv8FNfyK6jQ6VJwJbXgPuzfnVfoCVZOMx7K2fhSOTc8m8FgkCtVtX9noWqQt4DzI5N0LkycB9oIndLwZTQDklmuhaRCPkYOvU5g",
  "token_type": "bearer",
  "id_token":
"eyJhbGciOiJSUzI1NiJ9.eyJqdGkiOiI0NDMwYmVhMi0xN2FiLTQ3OTUtODNiMC0wYTVkYTc0YzdlNjIiLCJleHAiOjE0Njc2NTM1MDgsIm5iZiI6MCwiaWF0IjoxNDY3NjUzMjA4LCJpc3MiOiJodHRwOi8vdml6MDIubmV0MzIubmV0OjgwODAvYXV0aC9yZWFsbXMvTmV0MzIiLCJhdWQiOiJWZW5kb3JBUEkiLCJzdWIiOiIxYjhhZWJkNC1iNDU0LTQzYTYtODRlOS05MmQxMjc1NGFmNDUiLCJ0eXAiOiJJRCIsImF6cCI6IlZlbmRvckFQSSIsInNlc3Npb25fc3RhdGUiOiI5Y2E5NjFjOS0xYjg4LTQ3OGUtYjQ5MS01MTVhZmIwNjBlNjUiLCJuYW1lIjoiIiwidmVuZG9ySWQiOjE4OTU1LCJwcmVmZXJyZWRfdXNlcm5hbWUiOiJ0cmFkZWFseiJ9.hhCaW_naA6Agx4rYoP3YP_wYqwXG7oq6DIHFup6JRPG2YckZ0ups46tYRwXG-6DPrRRfCdD36YiGA3sggJZllMlBL-SI4XZ5amayi4J_Ktz_1IleOsQRG49DFflIyk9W4ZWMDSqut2ZYTE0Bfm_yc5XZUNKEY7quPQLGg2JdF2kT7Ka80aHQOIQPvC-Q0IkL7-uyT2Swq2sU8RO4OGMJziKY71UWPpn-ht1p5dOL1lKlZoULS-VCPeCupGoOuR9Y9t88N7vbjFDv3dw3zw67BCA9BwwtsGKCJkhopvaJWS4tiRqFsoSF-_O2IzkuoEjAW3LalMe3vusQjzuFOSdOMQ",
  "not-before-policy": 0,
  "session_state": "9ca961c9-1b88-478e-b491-515afb060e65"
}

On Mon, Jul 4, 2016 at 1:11 PM, Stian Thorgersen <sthorger at redhat.com>
wrote:

> Adding list back - please use reply all
>
> I'm not following. The response payload is the token, so not sure what it
> is that you want in XML.
>
> On 4 July 2016 at 15:41, <asarathi at vizuri.com> wrote:
>
>> Sorry if I wasn't clear earlier. I don't want the token itself to be in
>> xml. I just want the response payload from the token endpoint to be xml or
>> Json based on the accept header.
>>
>>
>> On Jul 4, 2016, at 3:04 AM, Stian Thorgersen <sthorger at redhat.com> wrote:
>>
>> We only support JWT with OpenID Connect. Can you elaborate on why you
>> want an XML token?
>>
>> You could add a custom REST endpoint or a custom protocol to do this, but
>> not sure I'd recommend doing it as there's a fair bit of logic that goes
>> into the token endpoint.
>>
>> On 1 July 2016 at 18:39, Aswini Sarathi <asarathi at vizuri.com> wrote:
>>
>>> Hi,
>>>
>>>     I am trying to find out if there is a way to get response from
>>> token endpoint  /realms/{realm-name}/protocol/openid-connect/token in
>>> xml or json format based on the Accept header. If its not supported out of
>>> the box, what other options are available to do this? Should I look at
>>> creating a custom endpoint by implementing the SPI to do the mapping?
>>>
>>> Thanks!!
>>>
>>>
>>> _______________________________________________
>>> keycloak-user mailing list
>>> keycloak-user at lists.jboss.org
>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>
>>
>>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160704/36fb34b8/attachment.html 

From sthorger at redhat.com  Mon Jul  4 13:42:20 2016
From: sthorger at redhat.com (Stian Thorgersen)
Date: Mon, 4 Jul 2016 19:42:20 +0200
Subject: [keycloak-user] OAuth Access Token Response in XML
In-Reply-To: <CADVfbmc1-k9+J34u+vYH=5mub=TFHM2YqRjEnBRDhd41hn5xew@mail.gmail.com>
References: <A9513265-319F-4E93-A040-1E33292FF3EB@vizuri.com>
	<CAJgngAcHUekh5=kYnP4TmwEV3ioBbh5gD6eoba=iy8UKX1miLg@mail.gmail.com>
	<A796EE85-32EE-4FFF-93EE-F37FD174AD8D@vizuri.com>
	<CAJgngAeU+keACHUSJg-Ky6mHqG_Vpb8LKxRk=cb5AVTqjCGm9g@mail.gmail.com>
	<CADVfbmc1-k9+J34u+vYH=5mub=TFHM2YqRjEnBRDhd41hn5xew@mail.gmail.com>
Message-ID: <CAJgngAeDFyHw1G=b7MvfTc30V03Q2j=dGX8tA7n_BZrOGOWutg@mail.gmail.com>

Well.. This is OpenID Connect and the response should be in JSON. You
should tell your user to parse the JSON and not expect XML.

If he really wants XML then maybe he'd be happy with using SAML instead.

I'd recommend against doing something custom, but you can in theory do that
with either the protocol SPI or the rest resource spi.

On 4 July 2016 at 19:32, Aswini Sarathi <asarathi at vizuri.com> wrote:

>  I tried getting a token using the token endpoint with grant type as
> "password" and this is what I got in the response and the content-type was
> set to application/json in the header. My question  is what would I need to
> do if I want the below response in xml. I have a user who wants to parse a
> XML response instead and get the access token. Please let me know if I am
> not doing anything correctly.
>
> {
>   "access_token":
> "eyJhbGciOiJSUzI1NiJ9.eyJqdGkiOiJjZWVjZmNiZS1lODJmLTQ2MWQtODljMi05MGY0NGZiNTcwNTIiLCJleHAiOjE0Njc2NTM1MDgsIm5iZiI6MCwiaWF0IjoxNDY3NjUzMjA4LCJpc3MiOiJodHRwOi8vdml6MDIubmV0MzIubmV0OjgwODAvYXV0aC9yZWFsbXMvTmV0MzIiLCJhdWQiOiJWZW5kb3JBUEkiLCJzdWIiOiIxYjhhZWJkNC1iNDU0LTQzYTYtODRlOS05MmQxMjc1NGFmNDUiLCJ0eXAiOiJCZWFyZXIiLCJhenAiOiJWZW5kb3JBUEkiLCJzZXNzaW9uX3N0YXRlIjoiOWNhOTYxYzktMWI4OC00NzhlLWI0OTEtNTE1YWZiMDYwZTY1IiwiY2xpZW50X3Nlc3Npb24iOiI1MDgxNGZjMi02NWIwLTQ4YmYtYWY3OS04ZDZmODlhMWFkODciLCJhbGxvd2VkLW9yaWdpbnMiOltdLCJyZWFsbV9hY2Nlc3MiOnsicm9sZXMiOlsidmVuZG9yIl19LCJyZXNvdXJjZV9hY2Nlc3MiOnsiYWNjb3VudCI6eyJyb2xlcyI6WyJtYW5hZ2UtYWNjb3VudCIsInZpZXctcHJvZmlsZSJdfX0sIm5hbWUiOiIiLCJ2ZW5kb3JJZCI6MTg5NTUsInByZWZlcnJlZF91c2VybmFtZSI6InRyYWRlYWx6In0.faGKCcK79sLrYRxCdXHo7iaROKDXJjXsUh83PdnbV2DVWJ5HlaA735zhCoM2XJ3Fn4HIg68zjQy4Q__eC8_UcXDi_qcVz3qcHLhKRHX3xZXMWwaSGrIgmcU--0ntH4Ot4qDayolzk4xOdXahMdRQW4u0Cwiwsfi715TipP0IgOK4B4VcsdbBFF5UlQFwUDTkaKiI8kST-XK6elZcbUGjheVo5qU5-_uVZX9c2DBTyPJ2BRn6UEGfpXigqXEoQS6MXWj4aLiI4vIo8cTQ0dfTbontQMsv17wUif-IikHwoYWkI9TFCBo0Knh3l7D2Z6rEZc8UvmQNeGqRaMVvWN0_TA",
>   "expires_in": 300,
>   "refresh_expires_in": 1800,
>   "refresh_token":
> "eyJhbGciOiJSUzI1NiJ9.eyJqdGkiOiJjNzZlMjcxZS1hNjYxLTQwMjEtOGNiOC0yOWM2MjRmMTE4ZDIiLCJleHAiOjE0Njc2NTUwMDgsIm5iZiI6MCwiaWF0IjoxNDY3NjUzMjA4LCJpc3MiOiJodHRwOi8vdml6MDIubmV0MzIubmV0OjgwODAvYXV0aC9yZWFsbXMvTmV0MzIiLCJhdWQiOiJWZW5kb3JBUEkiLCJzdWIiOiIxYjhhZWJkNC1iNDU0LTQzYTYtODRlOS05MmQxMjc1NGFmNDUiLCJ0eXAiOiJSZWZyZXNoIiwiYXpwIjoiVmVuZG9yQVBJIiwic2Vzc2lvbl9zdGF0ZSI6IjljYTk2MWM5LTFiODgtNDc4ZS1iNDkxLTUxNWFmYjA2MGU2NSIsImNsaWVudF9zZXNzaW9uIjoiNTA4MTRmYzItNjViMC00OGJmLWFmNzktOGQ2Zjg5YTFhZDg3IiwicmVhbG1fYWNjZXNzIjp7InJvbGVzIjpbInZlbmRvciJdfSwicmVzb3VyY2VfYWNjZXNzIjp7ImFjY291bnQiOnsicm9sZXMiOlsibWFuYWdlLWFjY291bnQiLCJ2aWV3LXByb2ZpbGUiXX19fQ.AcgsUMKH6Yczq6RxAxiwgViXRoiS2KuqFYdWOAYDmwL7_esy4E3guX9XR-8tBULiEspCNxCbgJca7t3_4jMxeIdhBq4DDqdecCe0XuU6HRugFD8nGDxHGMmotWarZn3mjj1jZmLCwYptoWgNVAJa6bILQafYFTHjb1Xzy_5j6lzk0waT9NMe0LFtVLFnW5xMqWs2gUMLUuY7XLlmNjarl_-LHsE3yiwWw1WR528JN3ld87tlQhGDv8FNfyK6jQ6VJwJbXgPuzfnVfoCVZOMx7K2fhSOTc8m8FgkCtVtX9noWqQt4DzI5N0LkycB9oIndLwZTQDklmuhaRCPkYOvU5g",
>   "token_type": "bearer",
>   "id_token":
> "eyJhbGciOiJSUzI1NiJ9.eyJqdGkiOiI0NDMwYmVhMi0xN2FiLTQ3OTUtODNiMC0wYTVkYTc0YzdlNjIiLCJleHAiOjE0Njc2NTM1MDgsIm5iZiI6MCwiaWF0IjoxNDY3NjUzMjA4LCJpc3MiOiJodHRwOi8vdml6MDIubmV0MzIubmV0OjgwODAvYXV0aC9yZWFsbXMvTmV0MzIiLCJhdWQiOiJWZW5kb3JBUEkiLCJzdWIiOiIxYjhhZWJkNC1iNDU0LTQzYTYtODRlOS05MmQxMjc1NGFmNDUiLCJ0eXAiOiJJRCIsImF6cCI6IlZlbmRvckFQSSIsInNlc3Npb25fc3RhdGUiOiI5Y2E5NjFjOS0xYjg4LTQ3OGUtYjQ5MS01MTVhZmIwNjBlNjUiLCJuYW1lIjoiIiwidmVuZG9ySWQiOjE4OTU1LCJwcmVmZXJyZWRfdXNlcm5hbWUiOiJ0cmFkZWFseiJ9.hhCaW_naA6Agx4rYoP3YP_wYqwXG7oq6DIHFup6JRPG2YckZ0ups46tYRwXG-6DPrRRfCdD36YiGA3sggJZllMlBL-SI4XZ5amayi4J_Ktz_1IleOsQRG49DFflIyk9W4ZWMDSqut2ZYTE0Bfm_yc5XZUNKEY7quPQLGg2JdF2kT7Ka80aHQOIQPvC-Q0IkL7-uyT2Swq2sU8RO4OGMJziKY71UWPpn-ht1p5dOL1lKlZoULS-VCPeCupGoOuR9Y9t88N7vbjFDv3dw3zw67BCA9BwwtsGKCJkhopvaJWS4tiRqFsoSF-_O2IzkuoEjAW3LalMe3vusQjzuFOSdOMQ",
>   "not-before-policy": 0,
>   "session_state": "9ca961c9-1b88-478e-b491-515afb060e65"
> }
>
> On Mon, Jul 4, 2016 at 1:11 PM, Stian Thorgersen <sthorger at redhat.com>
> wrote:
>
>> Adding list back - please use reply all
>>
>> I'm not following. The response payload is the token, so not sure what it
>> is that you want in XML.
>>
>> On 4 July 2016 at 15:41, <asarathi at vizuri.com> wrote:
>>
>>> Sorry if I wasn't clear earlier. I don't want the token itself to be in
>>> xml. I just want the response payload from the token endpoint to be xml or
>>> Json based on the accept header.
>>>
>>>
>>> On Jul 4, 2016, at 3:04 AM, Stian Thorgersen <sthorger at redhat.com>
>>> wrote:
>>>
>>> We only support JWT with OpenID Connect. Can you elaborate on why you
>>> want an XML token?
>>>
>>> You could add a custom REST endpoint or a custom protocol to do this,
>>> but not sure I'd recommend doing it as there's a fair bit of logic that
>>> goes into the token endpoint.
>>>
>>> On 1 July 2016 at 18:39, Aswini Sarathi <asarathi at vizuri.com> wrote:
>>>
>>>> Hi,
>>>>
>>>>     I am trying to find out if there is a way to get response from
>>>> token endpoint  /realms/{realm-name}/protocol/openid-connect/token in
>>>> xml or json format based on the Accept header. If its not supported out of
>>>> the box, what other options are available to do this? Should I look at
>>>> creating a custom endpoint by implementing the SPI to do the mapping?
>>>>
>>>> Thanks!!
>>>>
>>>>
>>>> _______________________________________________
>>>> keycloak-user mailing list
>>>> keycloak-user at lists.jboss.org
>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>>
>>>
>>>
>>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160704/11c387e8/attachment-0001.html 

From asarathi at vizuri.com  Mon Jul  4 13:49:02 2016
From: asarathi at vizuri.com (Aswini Sarathi)
Date: Mon, 4 Jul 2016 13:49:02 -0400
Subject: [keycloak-user] OAuth Access Token Response in XML
In-Reply-To: <CAJgngAeDFyHw1G=b7MvfTc30V03Q2j=dGX8tA7n_BZrOGOWutg@mail.gmail.com>
References: <A9513265-319F-4E93-A040-1E33292FF3EB@vizuri.com>
	<CAJgngAcHUekh5=kYnP4TmwEV3ioBbh5gD6eoba=iy8UKX1miLg@mail.gmail.com>
	<A796EE85-32EE-4FFF-93EE-F37FD174AD8D@vizuri.com>
	<CAJgngAeU+keACHUSJg-Ky6mHqG_Vpb8LKxRk=cb5AVTqjCGm9g@mail.gmail.com>
	<CADVfbmc1-k9+J34u+vYH=5mub=TFHM2YqRjEnBRDhd41hn5xew@mail.gmail.com>
	<CAJgngAeDFyHw1G=b7MvfTc30V03Q2j=dGX8tA7n_BZrOGOWutg@mail.gmail.com>
Message-ID: <C10B3D0D-4306-4A60-8E03-13DFF275795E@vizuri.com>

Appreciate the response.I wanted a confirmation before telling them. Thank you !


> On Jul 4, 2016, at 1:42 PM, Stian Thorgersen <sthorger at redhat.com> wrote:
> 
> Well.. This is OpenID Connect and the response should be in JSON. You should tell your user to parse the JSON and not expect XML.
> 
> If he really wants XML then maybe he'd be happy with using SAML instead.
> 
> I'd recommend against doing something custom, but you can in theory do that with either the protocol SPI or the rest resource spi.
> 
> On 4 July 2016 at 19:32, Aswini Sarathi <asarathi at vizuri.com <mailto:asarathi at vizuri.com>> wrote:
>  I tried getting a token using the token endpoint with grant type as "password" and this is what I got in the response and the content-type was set to application/json in the header. My question  is what would I need to do if I want the below response in xml. I have a user who wants to parse a XML response instead and get the access token. Please let me know if I am not doing anything correctly. 
> 
> {
>   "access_token": "eyJhbGciOiJSUzI1NiJ9.eyJqdGkiOiJjZWVjZmNiZS1lODJmLTQ2MWQtODljMi05MGY0NGZiNTcwNTIiLCJleHAiOjE0Njc2NTM1MDgsIm5iZiI6MCwiaWF0IjoxNDY3NjUzMjA4LCJpc3MiOiJodHRwOi8vdml6MDIubmV0MzIubmV0OjgwODAvYXV0aC9yZWFsbXMvTmV0MzIiLCJhdWQiOiJWZW5kb3JBUEkiLCJzdWIiOiIxYjhhZWJkNC1iNDU0LTQzYTYtODRlOS05MmQxMjc1NGFmNDUiLCJ0eXAiOiJCZWFyZXIiLCJhenAiOiJWZW5kb3JBUEkiLCJzZXNzaW9uX3N0YXRlIjoiOWNhOTYxYzktMWI4OC00NzhlLWI0OTEtNTE1YWZiMDYwZTY1IiwiY2xpZW50X3Nlc3Npb24iOiI1MDgxNGZjMi02NWIwLTQ4YmYtYWY3OS04ZDZmODlhMWFkODciLCJhbGxvd2VkLW9yaWdpbnMiOltdLCJyZWFsbV9hY2Nlc3MiOnsicm9sZXMiOlsidmVuZG9yIl19LCJyZXNvdXJjZV9hY2Nlc3MiOnsiYWNjb3VudCI6eyJyb2xlcyI6WyJtYW5hZ2UtYWNjb3VudCIsInZpZXctcHJvZmlsZSJdfX0sIm5hbWUiOiIiLCJ2ZW5kb3JJZCI6MTg5NTUsInByZWZlcnJlZF91c2VybmFtZSI6InRyYWRlYWx6In0.faGKCcK79sLrYRxCdXHo7iaROKDXJjXsUh83PdnbV2DVWJ5HlaA735zhCoM2XJ3Fn4HIg68zjQy4Q__eC8_UcXDi_qcVz3qcHLhKRHX3xZXMWwaSGrIgmcU--0ntH4Ot4qDayolzk4xOdXahMdRQW4u0Cwiwsfi715TipP0IgOK4B4VcsdbBFF5UlQFwUDTkaKiI8kST-XK6elZcbUGjheVo5qU5-_uVZX9c2DBTyPJ2BRn6UEGfpXigqXEoQS6MXWj4aLiI4vIo8cTQ0dfTbontQMsv17wUif-IikHwoYWkI9TFCBo0Knh3l7D2Z6rEZc8UvmQNeGqRaMVvWN0_TA",
>   "expires_in": 300,
>   "refresh_expires_in": 1800,
>   "refresh_token": "eyJhbGciOiJSUzI1NiJ9.eyJqdGkiOiJjNzZlMjcxZS1hNjYxLTQwMjEtOGNiOC0yOWM2MjRmMTE4ZDIiLCJleHAiOjE0Njc2NTUwMDgsIm5iZiI6MCwiaWF0IjoxNDY3NjUzMjA4LCJpc3MiOiJodHRwOi8vdml6MDIubmV0MzIubmV0OjgwODAvYXV0aC9yZWFsbXMvTmV0MzIiLCJhdWQiOiJWZW5kb3JBUEkiLCJzdWIiOiIxYjhhZWJkNC1iNDU0LTQzYTYtODRlOS05MmQxMjc1NGFmNDUiLCJ0eXAiOiJSZWZyZXNoIiwiYXpwIjoiVmVuZG9yQVBJIiwic2Vzc2lvbl9zdGF0ZSI6IjljYTk2MWM5LTFiODgtNDc4ZS1iNDkxLTUxNWFmYjA2MGU2NSIsImNsaWVudF9zZXNzaW9uIjoiNTA4MTRmYzItNjViMC00OGJmLWFmNzktOGQ2Zjg5YTFhZDg3IiwicmVhbG1fYWNjZXNzIjp7InJvbGVzIjpbInZlbmRvciJdfSwicmVzb3VyY2VfYWNjZXNzIjp7ImFjY291bnQiOnsicm9sZXMiOlsibWFuYWdlLWFjY291bnQiLCJ2aWV3LXByb2ZpbGUiXX19fQ.AcgsUMKH6Yczq6RxAxiwgViXRoiS2KuqFYdWOAYDmwL7_esy4E3guX9XR-8tBULiEspCNxCbgJca7t3_4jMxeIdhBq4DDqdecCe0XuU6HRugFD8nGDxHGMmotWarZn3mjj1jZmLCwYptoWgNVAJa6bILQafYFTHjb1Xzy_5j6lzk0waT9NMe0LFtVLFnW5xMqWs2gUMLUuY7XLlmNjarl_-LHsE3yiwWw1WR528JN3ld87tlQhGDv8FNfyK6jQ6VJwJbXgPuzfnVfoCVZOMx7K2fhSOTc8m8FgkCtVtX9noWqQt4DzI5N0LkycB9oIndLwZTQDklmuhaRCPkYOvU5g",
>   "token_type": "bearer",
>   "id_token": "eyJhbGciOiJSUzI1NiJ9.eyJqdGkiOiI0NDMwYmVhMi0xN2FiLTQ3OTUtODNiMC0wYTVkYTc0YzdlNjIiLCJleHAiOjE0Njc2NTM1MDgsIm5iZiI6MCwiaWF0IjoxNDY3NjUzMjA4LCJpc3MiOiJodHRwOi8vdml6MDIubmV0MzIubmV0OjgwODAvYXV0aC9yZWFsbXMvTmV0MzIiLCJhdWQiOiJWZW5kb3JBUEkiLCJzdWIiOiIxYjhhZWJkNC1iNDU0LTQzYTYtODRlOS05MmQxMjc1NGFmNDUiLCJ0eXAiOiJJRCIsImF6cCI6IlZlbmRvckFQSSIsInNlc3Npb25fc3RhdGUiOiI5Y2E5NjFjOS0xYjg4LTQ3OGUtYjQ5MS01MTVhZmIwNjBlNjUiLCJuYW1lIjoiIiwidmVuZG9ySWQiOjE4OTU1LCJwcmVmZXJyZWRfdXNlcm5hbWUiOiJ0cmFkZWFseiJ9.hhCaW_naA6Agx4rYoP3YP_wYqwXG7oq6DIHFup6JRPG2YckZ0ups46tYRwXG-6DPrRRfCdD36YiGA3sggJZllMlBL-SI4XZ5amayi4J_Ktz_1IleOsQRG49DFflIyk9W4ZWMDSqut2ZYTE0Bfm_yc5XZUNKEY7quPQLGg2JdF2kT7Ka80aHQOIQPvC-Q0IkL7-uyT2Swq2sU8RO4OGMJziKY71UWPpn-ht1p5dOL1lKlZoULS-VCPeCupGoOuR9Y9t88N7vbjFDv3dw3zw67BCA9BwwtsGKCJkhopvaJWS4tiRqFsoSF-_O2IzkuoEjAW3LalMe3vusQjzuFOSdOMQ",
>   "not-before-policy": 0,
>   "session_state": "9ca961c9-1b88-478e-b491-515afb060e65"
> }
> 
> On Mon, Jul 4, 2016 at 1:11 PM, Stian Thorgersen <sthorger at redhat.com <mailto:sthorger at redhat.com>> wrote:
> Adding list back - please use reply all
> 
> I'm not following. The response payload is the token, so not sure what it is that you want in XML.
> 
> On 4 July 2016 at 15:41, <asarathi at vizuri.com <mailto:asarathi at vizuri.com>> wrote:
> Sorry if I wasn't clear earlier. I don't want the token itself to be in xml. I just want the response payload from the token endpoint to be xml or Json based on the accept header. 
> 
> 
> On Jul 4, 2016, at 3:04 AM, Stian Thorgersen <sthorger at redhat.com <mailto:sthorger at redhat.com>> wrote:
> 
>> We only support JWT with OpenID Connect. Can you elaborate on why you want an XML token?
>> 
>> You could add a custom REST endpoint or a custom protocol to do this, but not sure I'd recommend doing it as there's a fair bit of logic that goes into the token endpoint.
>> 
>> On 1 July 2016 at 18:39, Aswini Sarathi <asarathi at vizuri.com <mailto:asarathi at vizuri.com>> wrote:
>> Hi,
>> 
>>     I am trying to find out if there is a way to get response from token endpoint  /realms/{realm-name}/protocol/openid-connect/token in xml or json format based on the Accept header. If its not supported out of the box, what other options are available to do this? Should I look at creating a custom endpoint by implementing the SPI to do the mapping?
>> 
>> Thanks!!
>> 
>> 
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.org <mailto:keycloak-user at lists.jboss.org>
>> https://lists.jboss.org/mailman/listinfo/keycloak-user <https://lists.jboss.org/mailman/listinfo/keycloak-user>
>> 
> 
> 
> 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160704/825ebd13/attachment.html 

From bruno at abstractj.org  Mon Jul  4 16:41:17 2016
From: bruno at abstractj.org (Bruno Oliveira)
Date: Mon, 4 Jul 2016 17:41:17 -0300
Subject: [keycloak-user] MDC log messages not showing up
In-Reply-To: <8B014D08-BE11-4942-8E9B-F710BBEEC2D3@smartling.com>
References: <8B014D08-BE11-4942-8E9B-F710BBEEC2D3@smartling.com>
Message-ID: <20160704204117.GA2556@abstractj.org>

Have you tried org.jboss.logmanager.MDC instead of
org.jboss.logging.MDC? It seems like that's your issue: https://issues.jboss.org/browse/JBLOGGING-54

Anyways I would definitely try to ask at WildFly user's forum[1]

[1] - http://wildfly.org/gethelp/

On 2016-06-24, Scott Rossillo wrote:
>
> I?m trying to use a use the Mapped Diagnostic Context (MDC) on org.jboss.logging.MDC to register a custom header for logging. I?m populating the MDC from an Undertow HttpHandler. This part is working, however, the value set in the MDC is never logged. I?m using %X{MDC_KEY} in standalone.xml.
>
> Does anyone know why MDC values aren?t logged?
>
>
> Scott Rossillo
> Smartling | Senior Software Engineer
> srossillo at smartling.com
>

> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user


--

abstractj
PGP: 0x84DC9914

From bvs78 at rediffmail.com  Tue Jul  5 00:43:31 2016
From: bvs78 at rediffmail.com (Subrahmanyam BV)
Date: 5 Jul 2016 04:43:31 -0000
Subject: [keycloak-user] =?utf-8?q?Keycloak-Headerbased_authentication?=
Message-ID: <20160705044331.16543.qmail@f4mail-235-189.rediffmail.com>

HI,&nbsp; &nbsp; Just wanted to know whether keycloak supports header-based authentication as supported by siteminder. Please let me know on this.
Regards,Subrahmanyam.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160705/8a5f4866/attachment.html 

From thomas.darimont at googlemail.com  Tue Jul  5 02:24:42 2016
From: thomas.darimont at googlemail.com (Thomas Darimont)
Date: Tue, 5 Jul 2016 08:24:42 +0200
Subject: [keycloak-user] Keycloak-Headerbased authentication
In-Reply-To: <20160705044331.16543.qmail@f4mail-235-189.rediffmail.com>
References: <20160705044331.16543.qmail@f4mail-235-189.rediffmail.com>
Message-ID: <CAK-7U1gfJamMR1BQiE-y7xwnKkrsHYWLyvadZT6KuWVD8jwYJQ@mail.gmail.com>

Hello,

I'm not familiar with siteminder and quickly googled
https://docops.ca.com/ca-single-sign-on-12-52-sp1/en/configuring/web-agent-configuration/web-application-protection/default-http-headers-used-by-the-product

Based on that I think that mod_auth_oidc might do what you want.

https://github.com/keycloak/securing_apps_guide/blob/master/topics/oidc/mod-auth-openidc.adoc

https://github.com/thomasdarimont/keycloak_mod_auth_oidc_example/blob/master/README.md

Cheers,
Thomas
Am 05.07.2016 6:44 vorm. schrieb "Subrahmanyam BV" <bvs78 at rediffmail.com>:

> HI,
>     Just wanted to know whether keycloak supports header-based
> authentication as supported by siteminder. Please let me know on this.
>
> Regards,
> Subrahmanyam.
>
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160705/9110c5a4/attachment-0001.html 

From sthorger at redhat.com  Tue Jul  5 02:29:25 2016
From: sthorger at redhat.com (Stian Thorgersen)
Date: Tue, 5 Jul 2016 08:29:25 +0200
Subject: [keycloak-user] Keycloak-Headerbased authentication
In-Reply-To: <CAK-7U1gfJamMR1BQiE-y7xwnKkrsHYWLyvadZT6KuWVD8jwYJQ@mail.gmail.com>
References: <20160705044331.16543.qmail@f4mail-235-189.rediffmail.com>
	<CAK-7U1gfJamMR1BQiE-y7xwnKkrsHYWLyvadZT6KuWVD8jwYJQ@mail.gmail.com>
Message-ID: <CAJgngAdsMct831F_LKfmvL2307MVsh+diho41FpvmDsxS++vZw@mail.gmail.com>

You can also use Keycloak Proxy or mod_auth_mellon.

On 5 July 2016 at 08:24, Thomas Darimont <thomas.darimont at googlemail.com>
wrote:

> Hello,
>
> I'm not familiar with siteminder and quickly googled
> https://docops.ca.com/ca-single-sign-on-12-52-sp1/en/configuring/web-agent-configuration/web-application-protection/default-http-headers-used-by-the-product
>
> Based on that I think that mod_auth_oidc might do what you want.
>
>
> https://github.com/keycloak/securing_apps_guide/blob/master/topics/oidc/mod-auth-openidc.adoc
>
>
> https://github.com/thomasdarimont/keycloak_mod_auth_oidc_example/blob/master/README.md
>
> Cheers,
> Thomas
> Am 05.07.2016 6:44 vorm. schrieb "Subrahmanyam BV" <bvs78 at rediffmail.com>:
>
>> HI,
>>     Just wanted to know whether keycloak supports header-based
>> authentication as supported by siteminder. Please let me know on this.
>>
>> Regards,
>> Subrahmanyam.
>>
>>
>>
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160705/950e539a/attachment.html 

From sthorger at redhat.com  Tue Jul  5 02:33:30 2016
From: sthorger at redhat.com (Stian Thorgersen)
Date: Tue, 5 Jul 2016 08:33:30 +0200
Subject: [keycloak-user] User impersonation - JWT
In-Reply-To: <CA+waeaUYJe2-Lje-DUGK_QPOwdi6_CSBAi+hY+Oi4wTknwsy3w@mail.gmail.com>
References: <CA+waeaUYJe2-Lje-DUGK_QPOwdi6_CSBAi+hY+Oi4wTknwsy3w@mail.gmail.com>
Message-ID: <CAJgngAcf7c0+-mjyw9b+WAsCC1UcNWic75QQR3BnedCjkkQjQA@mail.gmail.com>

The impersonation feature we have logs the admin in as the impersonated
user rather than generate tokens. We decided on this approach as it would
be transparent to applications and they wouldn't need to build-in special
impersonation. What you want is not possible at the moment, but you can
create a JIRA feature request for it. It would have to be a community
contribution if you want it added in a timely manner.

On 4 July 2016 at 18:52, Harry Trinta <harrytpc at gmail.com> wrote:

> Dears,
>
>
>
> I need a help with user impersonation on keycloak.
>
>
>
> I am authenticating users through the
> "/realms/test/protocol/openid-connect/token". As expected, it returns a
> token JWT.
>
> In my app, all requests go through apiman, which validates the JWT.
>
>
>
> Now, I need to personification of user. I'm calling the service
> "/admin/realms/test/users/USER_ID/impersonation", sending the token in the
> header (Authorization = Bearer eyJhbGciOiJSUzI1NiJ9 ...).
>
> The service /impersonation creates the user session on keycloak, however
> doesnt return a JWT, but 3 cookies. *I'd like to get the JWT of
> personified user instead of cookie.* It's possible?
>
>
>
> Best regards
>
> Harry Costa
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160705/fe680164/attachment.html 

From sthorger at redhat.com  Tue Jul  5 02:41:25 2016
From: sthorger at redhat.com (Stian Thorgersen)
Date: Tue, 5 Jul 2016 08:41:25 +0200
Subject: [keycloak-user] Lost session when removing an instance off
	cluster
In-Reply-To: <D3A0A0EA.60C9%akaya@expedia.com>
References: <D39C63FE.5FCC%akaya@expedia.com>
	<CAJgngAfJoYUzbtLtU1aAkVrBmE3s7_XOxCCTh8ywVBVth9ZprQ@mail.gmail.com>
	<D3A01882.6050%akaya@expedia.com> <D3A0A0EA.60C9%akaya@expedia.com>
Message-ID: <CAJgngAf9wEYCwzYWaQPqK7jXWdNwxEx9KHQZrryuWn0sfU=aTA@mail.gmail.com>

The sessions cache is a distributed-cache, but by default it only has 1
owner of each segment. This means that sessions are not replicated to
multiple nodes. So it's expected that you loose sessions when a node is
removed. If you want sessions to survive the removal of a node you should
increase the number of owners for the cache. For example:

    <distributed-cache name="sessions" mode="SYNC" owners="2"/>

We've not actually tried with enabling transactions on the sessions, but I
would say performance is more important. Worst case scenario is that a
session is lost and a user has to re-authenticate.

BTW the config you have for offlineSessions and loginFailures are wrong
they both need to be distributed caches as well in clustered mode:

    <distributed-cache name="offlineSessions" mode="SYNC" owners="1"/>
    <distributed-cache name="loginFailures" mode="SYNC" owners="1"/>


On 4 July 2016 at 15:45, Sarp Kaya <akaya at expedia.com> wrote:

> Just to add on this.
>
> I think I misunderstood something or Keycloak does not really implement
> the infinispan caching lifetime correctly.
>
> So first thing I did is to TRACE the infinispan logs. So I added this
> logger in standalone.xml:
>
> <logger category="org.infinispan">
>     <level name="TRACE"/>
> </logger>
>
>
> The next thing I did is to do the timing. Basically my test is that what
> happens when I log in. I also enabled events and printing the events as
> well.
>
> What I found is:
>
>
>    1. Login event is triggered at 13:18:35,193 in Keycloak.
>    2. The browser got the full response at 13:18:35,273
>    3. Now the surprising part is the fact that there are whole a lot of
>    infinispan logging out occurring for ?sessions? cache after the browser got
>    the response. The last log message occurring is like this:
>
> 2016-07-04 13:18:35,345 TRACE [org.infinispan.remoting.rpc.RpcManagerImpl] (default task-4) Response(s) to TxCompletionNotificationCommand{ xid=null, internalId=0, topologyId=19, gtx=GlobalTransaction:<kc1>:239:local, cacheName=sessions}  is {}
>
>
> To see the all the logs after event trigger please check here:
> <http://pastebin.com/pkvYP07T> <http://pastebin.com/pkvYP07T>
> <http://pastebin.com/pkvYP07T> <http://pastebin.com/pkvYP07T>
> http://pastebin.com/p4K2Ghff
>
> So my understanding was that I marked sessions as SYNC, which meant to me
> that it is supposed to do all of the synchronization before it sends the
> response back to the browser. If it does the other way around then it
> should be ASYNC mode. Could you please clarify the intended/expected
> behavior?
>
> Kind Regards,
> Sarp Kaya
>
>
> From: Abdullah Sarp Kaya <akaya at expedia.com>
> Date: Monday, July 4, 2016 at 9:59 PM
> To: "stian at redhat.com" <stian at redhat.com>
> Cc: "keycloak-user at lists.jboss.org" <keycloak-user at lists.jboss.org>
> Subject: Re: [keycloak-user] Lost session when removing an instance off
> cluster
>
> Hello,
>
> Below is exactly how Infinispan is configured:
>
> <subsystem xmlns="urn:jboss:domain:infinispan:4.0">
>     <cache-container name="keycloak" jndi-name="infinispan/Keycloak">
>     <transport lock-timeout="60000"/>
>     <invalidation-cache name="realms" mode="SYNC"/>
>     <invalidation-cache name="users" mode="SYNC">
>         <eviction max-entries="10000" strategy="LRU"/>
>     </invalidation-cache>
>     <distributed-cache xmlns="" name="sessions" mode="SYNC">
>         <transaction mode="NON_DURABLE_XA"/>
>     </distributed-cache>
>     <local-cache xmlns="" name="offlineSessions"/>
>     <local-cache xmlns="" name="loginFailures"/>
>     <replicated-cache name="work" mode="SYNC"/>
>     <local-cache name="realmVersions">
>         <transaction mode="BATCH" locking="PESSIMISTIC"/>
>     </local-cache>
> </cache-container>
> <cache-container name="server" aliases="singleton cluster" default-cache="default" module="org.wildfly.clustering.server">
>     <transport lock-timeout="60000"/>
>     <replicated-cache name="default" mode="SYNC">
>         <transaction mode="BATCH"/>
>     </replicated-cache>
> </cache-container>
> <cache-container name="web" default-cache="dist" module="org.wildfly.clustering.web.infinispan">
>     <transport lock-timeout="60000"/>
>     <distributed-cache name="dist" mode="ASYNC" l1-lifespan="0" owners="2">
>         <locking isolation="REPEATABLE_READ"/>
>         <transaction mode="BATCH"/>
>         <file-store/>
>     </distributed-cache>
> </cache-container>
> <cache-container name="ejb" aliases="sfsb" default-cache="dist" module="org.wildfly.clustering.ejb.infinispan">
>     <transport lock-timeout="60000"/>
>     <distributed-cache name="dist" mode="ASYNC" l1-lifespan="0" owners="2">
>         <locking isolation="REPEATABLE_READ"/>
>         <transaction mode="BATCH"/>
>         <file-store/>
>     </distributed-cache>
> </cache-container>
> <cache-container name="hibernate" default-cache="local-query" module="org.hibernate.infinispan">
>     <transport lock-timeout="60000"/>
>     <invalidation-cache name="entity" mode="SYNC">
>         <transaction mode="NON_XA"/>
>         <eviction strategy="LRU" max-entries="10000"/>
>         <expiration max-idle="100000"/>
>     </invalidation-cache>
>     <local-cache name="local-query">
>         <eviction strategy="LRU" max-entries="10000"/>
>         <expiration max-idle="100000"/>
>     </local-cache>
>     <replicated-cache name="timestamps" mode="ASYNC"/>
> </cache-container>
> </subsystem>
>
>
>
>
> This is the complete exception:
>
> 03:49:40,241 ERROR
> [org.infinispan.interceptors.InvocationContextInterceptor] (default
> task-12) ISPN000136: Error executing command PutKeyValueCommand, writing
> keys [ba74e523-3299-42b3-801e-9f8cb5a0d81d]:
> org.infinispan.util.concurrent.TimeoutException: Replication timeout for kc2
>         at
> org.infinispan.remoting.transport.jgroups.JGroupsTransport.checkRsp(JGroupsTransport.java:765)
>         at
> org.infinispan.remoting.transport.jgroups.JGroupsTransport.lambda$invokeRemotelyAsync$73(JGroupsTransport.java:612)
>         at
> java.util.concurrent.CompletableFuture.uniApply(CompletableFuture.java:602)
>         at
> java.util.concurrent.CompletableFuture$UniApply.tryFire(CompletableFuture.java:577)
>         at
> java.util.concurrent.CompletableFuture.postComplete(CompletableFuture.java:474)
>         at
> java.util.concurrent.CompletableFuture.complete(CompletableFuture.java:1962)
>         at
> org.infinispan.remoting.transport.jgroups.RspListFuture.call(RspListFuture.java:47)
>         at
> org.infinispan.remoting.transport.jgroups.RspListFuture.call(RspListFuture.java:16)
>         at java.util.concurrent.FutureTask.run(FutureTask.java:266)
>         at
> java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$201(ScheduledThreadPoolExecutor.java:180)
>         at
> java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:293)
>         at
> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
>         at
> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
>         at java.lang.Thread.run(Thread.java:745)
>
> 03:49:40,250 ERROR [org.jboss.resteasy.resteasy_jaxrs.i18n] (default
> task-12) RESTEASY002025: Unknown exception while executing GET
> /realms/partner-dmz/protocol/openid-connect/auth:
> org.infinispan.util.concurrent.TimeoutException: Replication timeout for kc2
>         at
> org.infinispan.remoting.transport.jgroups.JGroupsTransport.checkRsp(JGroupsTransport.java:765)
>         at
> org.infinispan.remoting.transport.jgroups.JGroupsTransport.lambda$invokeRemotelyAsync$73(JGroupsTransport.java:612)
>         at
> java.util.concurrent.CompletableFuture.uniApply(CompletableFuture.java:602)
>         at
> java.util.concurrent.CompletableFuture$UniApply.tryFire(CompletableFuture.java:577)
>         at
> java.util.concurrent.CompletableFuture.postComplete(CompletableFuture.java:474)
>         at
> java.util.concurrent.CompletableFuture.complete(CompletableFuture.java:1962)
>         at
> org.infinispan.remoting.transport.jgroups.RspListFuture.call(RspListFuture.java:47)
>         at
> org.infinispan.remoting.transport.jgroups.RspListFuture.call(RspListFuture.java:16)
>         at java.util.concurrent.FutureTask.run(FutureTask.java:266)
>         at
> java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$201(ScheduledThreadPoolExecutor.java:180)
>         at
> java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:293)
>         at
> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
>         at
> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
>         at java.lang.Thread.run(Thread.java:745)
>
> 03:49:40,257 ERROR [io.undertow.request] (default task-12) UT005023:
> Exception handling request to
> /auth/realms/partner-dmz/protocol/openid-connect/auth:
> org.jboss.resteasy.spi.UnhandledException:
> org.infinispan.util.concurrent.TimeoutException: Replication timeout for kc2
>         at
> org.jboss.resteasy.core.ExceptionHandler.handleException(ExceptionHandler.java:247)
>         at
> org.jboss.resteasy.core.SynchronousDispatcher.writeException(SynchronousDispatcher.java:168)
>         at
> org.jboss.resteasy.core.SynchronousDispatcher.writeResponse(SynchronousDispatcher.java:471)
>         at
> org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:415)
>         at
> org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:202)
>         at
> org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.service(ServletContainerDispatcher.java:221)
>         at
> org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:56)
>         at
> org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:51)
>         at javax.servlet.http.HttpServlet.service(HttpServlet.java:790)
>         at
> io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:85)
>         at
> io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:129)
>         at
> org.keycloak.services.filters.KeycloakSessionServletFilter.doFilter(KeycloakSessionServletFilter.java:88)
>         at
> io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:60)
>         at
> io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
>         at
> io.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.java:84)
>         at
> io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:62)
>         at
> io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36)
>         at
> org.wildfly.extension.undertow.security.SecurityContextAssociationHandler.handleRequest(SecurityContextAssociationHandler.java:78)
>         at
> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
>         at
> io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:131)
>         at
> io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:57)
>         at
> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
>         at
> io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:46)
>         at
> io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64)
>         at
> io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:60)
>         at
> io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:77)
>         at
> io.undertow.security.handlers.NotificationReceiverHandler.handleRequest(NotificationReceiverHandler.java:50)
>         at
> io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43)
>         at
> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
>         at
> org.wildfly.extension.undertow.security.jacc.JACCContextIdHandler.handleRequest(JACCContextIdHandler.java:61)
>         at
> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
>         at
> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
>         at
> io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:284)
>         at
> io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:263)
>         at
> io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:81)
>         at
> io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:174)
>         at
> io.undertow.server.Connectors.executeRootHandler(Connectors.java:202)
>         at
> io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:793)
>         at
> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
>         at
> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
>         at java.lang.Thread.run(Thread.java:745)
> Caused by: org.infinispan.util.concurrent.TimeoutException: Replication
> timeout for kc2
>         at
> org.infinispan.remoting.transport.jgroups.JGroupsTransport.checkRsp(JGroupsTransport.java:765)
>         at
> org.infinispan.remoting.transport.jgroups.JGroupsTransport.lambda$invokeRemotelyAsync$73(JGroupsTransport.java:612)
>         at
> java.util.concurrent.CompletableFuture.uniApply(CompletableFuture.java:602)
>         at
> java.util.concurrent.CompletableFuture$UniApply.tryFire(CompletableFuture.java:577)
>         at
> java.util.concurrent.CompletableFuture.postComplete(CompletableFuture.java:474)
>         at
> java.util.concurrent.CompletableFuture.complete(CompletableFuture.java:1962)
>         at
> org.infinispan.remoting.transport.jgroups.RspListFuture.call(RspListFuture.java:47)
>         at
> org.infinispan.remoting.transport.jgroups.RspListFuture.call(RspListFuture.java:16)
>         at java.util.concurrent.FutureTask.run(FutureTask.java:266)
>         at
> java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$201(ScheduledThreadPoolExecutor.java:180)
>         at
> java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:293)
>         ... 3 more
>
> 03:49:41,251 ERROR
> [org.infinispan.interceptors.InvocationContextInterceptor] (default task-3)
> ISPN000136: Error executing command PrepareCommand, writing keys
> [02cff8bb-0ab9-4ab9-905f-17ffb3226050]:
> org.infinispan.util.concurrent.TimeoutException: Replication timeout for kc2
>         at
> org.infinispan.remoting.transport.jgroups.JGroupsTransport.checkRsp(JGroupsTransport.java:765)
>         at
> org.infinispan.remoting.transport.jgroups.JGroupsTransport.lambda$invokeRemotelyAsync$73(JGroupsTransport.java:612)
>         at
> java.util.concurrent.CompletableFuture.uniApply(CompletableFuture.java:602)
>         at
> java.util.concurrent.CompletableFuture$UniApply.tryFire(CompletableFuture.java:577)
>         at
> java.util.concurrent.CompletableFuture.postComplete(CompletableFuture.java:474)
>         at
> java.util.concurrent.CompletableFuture.complete(CompletableFuture.java:1962)
>         at
> org.infinispan.remoting.transport.jgroups.RspListFuture.call(RspListFuture.java:47)
>         at
> org.infinispan.remoting.transport.jgroups.RspListFuture.call(RspListFuture.java:16)
>         at java.util.concurrent.FutureTask.run(FutureTask.java:266)
>         at
> java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$201(ScheduledThreadPoolExecutor.java:180)
>         at
> java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:293)
>         at
> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
>         at
> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
>         at java.lang.Thread.run(Thread.java:745)
>
> 03:49:41,258 ERROR
> [org.infinispan.transaction.impl.TransactionCoordinator] (default task-3)
> ISPN000097: Error while processing a prepare in a single-phase transaction:
> org.infinispan.util.concurrent.TimeoutException: Replication timeout for kc2
>         at
> org.infinispan.remoting.transport.jgroups.JGroupsTransport.checkRsp(JGroupsTransport.java:765)
>         at
> org.infinispan.remoting.transport.jgroups.JGroupsTransport.lambda$invokeRemotelyAsync$73(JGroupsTransport.java:612)
>         at
> java.util.concurrent.CompletableFuture.uniApply(CompletableFuture.java:602)
>         at
> java.util.concurrent.CompletableFuture$UniApply.tryFire(CompletableFuture.java:577)
>         at
> java.util.concurrent.CompletableFuture.postComplete(CompletableFuture.java:474)
>         at
> java.util.concurrent.CompletableFuture.complete(CompletableFuture.java:1962)
>         at
> org.infinispan.remoting.transport.jgroups.RspListFuture.call(RspListFuture.java:47)
>         at
> org.infinispan.remoting.transport.jgroups.RspListFuture.call(RspListFuture.java:16)
>         at java.util.concurrent.FutureTask.run(FutureTask.java:266)
>         at
> java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$201(ScheduledThreadPoolExecutor.java:180)
>         at
> java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:293)
>         at
> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
>         at
> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
>         at java.lang.Thread.run(Thread.java:745)
>
> 03:49:45,504 INFO
>  [org.infinispan.remoting.transport.jgroups.JGroupsTransport]
> (Incoming-3,dev,kc1) ISPN000094: Received new cluster view for channel
> server: [kc1|4] (1) [kc1]
> 03:49:45,507 INFO
>  [org.infinispan.remoting.transport.jgroups.JGroupsTransport]
> (Incoming-3,dev,kc1) ISPN000094: Received new cluster view for channel
> keycloak: [kc1|4] (1) [kc1]
> 03:49:45,534 INFO
>  [org.infinispan.remoting.transport.jgroups.JGroupsTransport]
> (Incoming-3,dev,kc1) ISPN000094: Received new cluster view for channel web:
> [kc1|4] (1) [kc1]
> 03:49:45,538 INFO
>  [org.infinispan.remoting.transport.jgroups.JGroupsTransport]
> (Incoming-3,dev,kc1) ISPN000094: Received new cluster view for channel ejb:
> [kc1|4] (1) [kc1]
> 03:49:45,548 WARN  [com.arjuna.ats.jta] (default task-3) ARJUNA016039:
> onePhaseCommit on < formatId=131077, gtrid_length=29, bqual_length=36,
> tx_uid=0:ffffac110003:-7fcaa87f:5779dc60:f01, node_name=1,
> branch_uid=0:ffffac110003:-7fcaa87f:5779dc60:f02, subordinatenodename=null,
> eis_name=unknown eis name >
> (TransactionXaAdapter{localTransaction=LocalXaTransaction{xid=<
> formatId=131077, gtrid_length=29, bqual_length=36,
> tx_uid=0:ffffac110003:-7fcaa87f:5779dc60:f01, node_name=1,
> branch_uid=0:ffffac110003:-7fcaa87f:5779dc60:f02, subordinatenodename=null,
> eis_name=unknown eis name >} LocalTransaction{remoteLockedNodes=null,
> isMarkedForRollback=false, lockedKeys=null, backupKeyLocks=null,
> topologyId=6, stateTransferFlag=null}
> org.infinispan.transaction.xa.LocalXaTransaction at 3ef}) failed with
> exception XAException.XA_HEURRB: javax.transaction.xa.XAException
>         at
> org.infinispan.transaction.impl.TransactionCoordinator.handleCommitFailure(TransactionCoordinator.java:213)
>         at
> org.infinispan.transaction.impl.TransactionCoordinator.commit(TransactionCoordinator.java:159)
>         at
> org.infinispan.transaction.xa.TransactionXaAdapter.commit(TransactionXaAdapter.java:112)
>         at
> com.arjuna.ats.internal.jta.resources.arjunacore.XAResourceRecord.topLevelOnePhaseCommit(XAResourceRecord.java:704)
>         at
> com.arjuna.ats.arjuna.coordinator.BasicAction.onePhaseCommit(BasicAction.java:2366)
>         at
> com.arjuna.ats.arjuna.coordinator.BasicAction.End(BasicAction.java:1495)
>         at
> com.arjuna.ats.arjuna.coordinator.TwoPhaseCoordinator.end(TwoPhaseCoordinator.java:96)
>         at com.arjuna.ats.arjuna.AtomicAction.commit(AtomicAction.java:162)
>         at
> com.arjuna.ats.internal.jta.transaction.arjunacore.TransactionImple.commitAndDisassociate(TransactionImple.java:1200)
>         at
> com.arjuna.ats.internal.jta.transaction.arjunacore.BaseTransaction.commit(BaseTransaction.java:126)
>         at
> com.arjuna.ats.jbossatx.BaseTransactionManagerDelegate.commit(BaseTransactionManagerDelegate.java:89)
>         at
> org.infinispan.cache.impl.CacheImpl.tryCommit(CacheImpl.java:1722)
>         at
> org.infinispan.cache.impl.CacheImpl.executeCommandAndCommitIfNeeded(CacheImpl.java:1679)
>         at
> org.infinispan.cache.impl.CacheImpl.putInternal(CacheImpl.java:1121)
>         at org.infinispan.cache.impl.CacheImpl.put(CacheImpl.java:1111)
>         at org.infinispan.cache.impl.CacheImpl.put(CacheImpl.java:1742)
>         at org.infinispan.cache.impl.CacheImpl.put(CacheImpl.java:248)
>         at
> org.infinispan.cache.impl.AbstractDelegatingCache.put(AbstractDelegatingCache.java:291)
>         at
> org.keycloak.models.sessions.infinispan.InfinispanUserSessionProvider$InfinispanKeycloakTransaction$CacheTask.execute(InfinispanUserSessionProvider.java:854)
>         at
> org.keycloak.models.sessions.infinispan.InfinispanUserSessionProvider$InfinispanKeycloakTransaction.commit(InfinispanUserSessionProvider.java:750)
>         at
> org.keycloak.services.DefaultKeycloakTransactionManager.commit(DefaultKeycloakTransactionManager.java:104)
>         at
> org.keycloak.services.filters.KeycloakTransactionCommitter.filter(KeycloakTransactionCommitter.java:43)
>         at
> org.jboss.resteasy.core.ServerResponseWriter.executeFilters(ServerResponseWriter.java:121)
>         at
> org.jboss.resteasy.core.ServerResponseWriter.writeNomapResponse(ServerResponseWriter.java:48)
>         at
> org.jboss.resteasy.core.SynchronousDispatcher.writeResponse(SynchronousDispatcher.java:466)
>         at
> org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:415)
>         at
> org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:202)
>         at
> org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.service(ServletContainerDispatcher.java:221)
>         at
> org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:56)
>         at
> org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:51)
>         at javax.servlet.http.HttpServlet.service(HttpServlet.java:790)
>         at
> io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:85)
>         at
> io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:129)
>         at
> org.keycloak.services.filters.KeycloakSessionServletFilter.doFilter(KeycloakSessionServletFilter.java:88)
>         at
> io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:60)
>         at
> io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
>         at
> io.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.java:84)
>         at
> io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:62)
>         at
> io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36)
>         at
> org.wildfly.extension.undertow.security.SecurityContextAssociationHandler.handleRequest(SecurityContextAssociationHandler.java:78)
>         at
> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
>         at
> io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:131)
>         at
> io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:57)
>         at
> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
>         at
> io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:46)
>         at
> io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64)
>         at
> io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:60)
>         at
> io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:77)
>         at
> io.undertow.security.handlers.NotificationReceiverHandler.handleRequest(NotificationReceiverHandler.java:50)
>         at
> io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43)
>         at
> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
>         at
> org.wildfly.extension.undertow.security.jacc.JACCContextIdHandler.handleRequest(JACCContextIdHandler.java:61)
>         at
> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
>         at
> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
>         at
> io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:284)
>         at
> io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:263)
>         at
> io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:81)
>         at
> io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:174)
>         at
> io.undertow.server.Connectors.executeRootHandler(Connectors.java:202)
>         at
> io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:793)
>         at
> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
>         at
> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
>         at java.lang.Thread.run(Thread.java:745)
> Caused by: org.infinispan.util.concurrent.TimeoutException: Replication
> timeout for kc2
>         at
> org.infinispan.remoting.transport.jgroups.JGroupsTransport.checkRsp(JGroupsTransport.java:765)
>         at
> org.infinispan.remoting.transport.jgroups.JGroupsTransport.lambda$invokeRemotelyAsync$73(JGroupsTransport.java:612)
>         at
> java.util.concurrent.CompletableFuture.uniApply(CompletableFuture.java:602)
>         at
> java.util.concurrent.CompletableFuture$UniApply.tryFire(CompletableFuture.java:577)
>         at
> java.util.concurrent.CompletableFuture.postComplete(CompletableFuture.java:474)
>         at
> java.util.concurrent.CompletableFuture.complete(CompletableFuture.java:1962)
>         at
> org.infinispan.remoting.transport.jgroups.RspListFuture.call(RspListFuture.java:47)
>         at
> org.infinispan.remoting.transport.jgroups.RspListFuture.call(RspListFuture.java:16)
>         at java.util.concurrent.FutureTask.run(FutureTask.java:266)
>         at
> java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$201(ScheduledThreadPoolExecutor.java:180)
>         at
> java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:293)
>         ... 3 more
>
> 03:49:45,563 WARN  [org.infinispan.cache.impl.CacheImpl] (default task-3)
> ISPN000160: Could not complete injected transaction.:
> javax.transaction.RollbackException: ARJUNA016053: Could not commit
> transaction.
>         at
> com.arjuna.ats.internal.jta.transaction.arjunacore.TransactionImple.commitAndDisassociate(TransactionImple.java:1212)
>         at
> com.arjuna.ats.internal.jta.transaction.arjunacore.BaseTransaction.commit(BaseTransaction.java:126)
>         at
> com.arjuna.ats.jbossatx.BaseTransactionManagerDelegate.commit(BaseTransactionManagerDelegate.java:89)
>         at
> org.infinispan.cache.impl.CacheImpl.tryCommit(CacheImpl.java:1722)
>         at
> org.infinispan.cache.impl.CacheImpl.executeCommandAndCommitIfNeeded(CacheImpl.java:1679)
>         at
> org.infinispan.cache.impl.CacheImpl.putInternal(CacheImpl.java:1121)
>         at org.infinispan.cache.impl.CacheImpl.put(CacheImpl.java:1111)
>         at org.infinispan.cache.impl.CacheImpl.put(CacheImpl.java:1742)
>         at org.infinispan.cache.impl.CacheImpl.put(CacheImpl.java:248)
>         at
> org.infinispan.cache.impl.AbstractDelegatingCache.put(AbstractDelegatingCache.java:291)
>         at
> org.keycloak.models.sessions.infinispan.InfinispanUserSessionProvider$InfinispanKeycloakTransaction$CacheTask.execute(InfinispanUserSessionProvider.java:854)
>         at
> org.keycloak.models.sessions.infinispan.InfinispanUserSessionProvider$InfinispanKeycloakTransaction.commit(InfinispanUserSessionProvider.java:750)
>         at
> org.keycloak.services.DefaultKeycloakTransactionManager.commit(DefaultKeycloakTransactionManager.java:104)
>         at
> org.keycloak.services.filters.KeycloakTransactionCommitter.filter(KeycloakTransactionCommitter.java:43)
>         at
> org.jboss.resteasy.core.ServerResponseWriter.executeFilters(ServerResponseWriter.java:121)
>         at
> org.jboss.resteasy.core.ServerResponseWriter.writeNomapResponse(ServerResponseWriter.java:48)
>         at
> org.jboss.resteasy.core.SynchronousDispatcher.writeResponse(SynchronousDispatcher.java:466)
>         at
> org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:415)
>         at
> org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:202)
>         at
> org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.service(ServletContainerDispatcher.java:221)
>         at
> org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:56)
>         at
> org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:51)
>         at javax.servlet.http.HttpServlet.service(HttpServlet.java:790)
>         at
> io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:85)
>         at
> io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:129)
>         at
> org.keycloak.services.filters.KeycloakSessionServletFilter.doFilter(KeycloakSessionServletFilter.java:88)
>         at
> io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:60)
>         at
> io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
>         at
> io.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.java:84)
>         at
> io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:62)
>         at
> io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36)
>         at
> org.wildfly.extension.undertow.security.SecurityContextAssociationHandler.handleRequest(SecurityContextAssociationHandler.java:78)
>         at
> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
>         at
> io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:131)
>         at
> io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:57)
>         at
> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
>         at
> io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:46)
>         at
> io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64)
>         at
> io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:60)
>         at
> io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:77)
>         at
> io.undertow.security.handlers.NotificationReceiverHandler.handleRequest(NotificationReceiverHandler.java:50)
>         at
> io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43)
>         at
> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
>         at
> org.wildfly.extension.undertow.security.jacc.JACCContextIdHandler.handleRequest(JACCContextIdHandler.java:61)
>         at
> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
>         at
> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
>         at
> io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:284)
>         at
> io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:263)
>         at
> io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:81)
>         at
> io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:174)
>         at
> io.undertow.server.Connectors.executeRootHandler(Connectors.java:202)
>         at
> io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:793)
>         at
> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
>         at
> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
>         at java.lang.Thread.run(Thread.java:745)
>         Suppressed: javax.transaction.xa.XAException
>                 at
> org.infinispan.transaction.impl.TransactionCoordinator.handleCommitFailure(TransactionCoordinator.java:213)
>                 at
> org.infinispan.transaction.impl.TransactionCoordinator.commit(TransactionCoordinator.java:159)
>                 at
> org.infinispan.transaction.xa.TransactionXaAdapter.commit(TransactionXaAdapter.java:112)
>                 at
> com.arjuna.ats.internal.jta.resources.arjunacore.XAResourceRecord.topLevelOnePhaseCommit(XAResourceRecord.java:704)
>                 at
> com.arjuna.ats.arjuna.coordinator.BasicAction.onePhaseCommit(BasicAction.java:2366)
>                 at
> com.arjuna.ats.arjuna.coordinator.BasicAction.End(BasicAction.java:1495)
>                 at
> com.arjuna.ats.arjuna.coordinator.TwoPhaseCoordinator.end(TwoPhaseCoordinator.java:96)
>                 at
> com.arjuna.ats.arjuna.AtomicAction.commit(AtomicAction.java:162)
>                 at
> com.arjuna.ats.internal.jta.transaction.arjunacore.TransactionImple.commitAndDisassociate(TransactionImple.java:1200)
>                 ... 54 more
>         Caused by: org.infinispan.util.concurrent.TimeoutException:
> Replication timeout for kc2
>                 at
> org.infinispan.remoting.transport.jgroups.JGroupsTransport.checkRsp(JGroupsTransport.java:765)
>                 at
> org.infinispan.remoting.transport.jgroups.JGroupsTransport.lambda$invokeRemotelyAsync$73(JGroupsTransport.java:612)
>                 at
> java.util.concurrent.CompletableFuture.uniApply(CompletableFuture.java:602)
>                 at
> java.util.concurrent.CompletableFuture$UniApply.tryFire(CompletableFuture.java:577)
>                 at
> java.util.concurrent.CompletableFuture.postComplete(CompletableFuture.java:474)
>                 at
> java.util.concurrent.CompletableFuture.complete(CompletableFuture.java:1962)
>                 at
> org.infinispan.remoting.transport.jgroups.RspListFuture.call(RspListFuture.java:47)
>                 at
> org.infinispan.remoting.transport.jgroups.RspListFuture.call(RspListFuture.java:16)
>                 at java.util.concurrent.FutureTask.run(FutureTask.java:266)
>                 at
> java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$201(ScheduledThreadPoolExecutor.java:180)
>                 at
> java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:293)
>                 ... 3 more
>
> 03:49:45,575 INFO
>  [org.infinispan.remoting.transport.jgroups.JGroupsTransport]
> (Incoming-3,dev,kc1) ISPN000094: Received new cluster view for channel
> hibernate: [kc1|4] (1) [kc1]
> 03:49:45,575 ERROR [org.jboss.resteasy.resteasy_jaxrs.i18n] (default
> task-3) RESTEASY002025: Unknown exception while executing GET
> /realms/partner-dmz/protocol/openid-connect/auth:
> org.infinispan.commons.CacheException: Could not commit implicit transaction
>         at
> org.infinispan.cache.impl.CacheImpl.tryCommit(CacheImpl.java:1725)
>         at
> org.infinispan.cache.impl.CacheImpl.executeCommandAndCommitIfNeeded(CacheImpl.java:1679)
>         at
> org.infinispan.cache.impl.CacheImpl.putInternal(CacheImpl.java:1121)
>         at org.infinispan.cache.impl.CacheImpl.put(CacheImpl.java:1111)
>         at org.infinispan.cache.impl.CacheImpl.put(CacheImpl.java:1742)
>         at org.infinispan.cache.impl.CacheImpl.put(CacheImpl.java:248)
>         at
> org.infinispan.cache.impl.AbstractDelegatingCache.put(AbstractDelegatingCache.java:291)
>         at
> org.keycloak.models.sessions.infinispan.InfinispanUserSessionProvider$InfinispanKeycloakTransaction$CacheTask.execute(InfinispanUserSessionProvider.java:854)
>         at
> org.keycloak.models.sessions.infinispan.InfinispanUserSessionProvider$InfinispanKeycloakTransaction.commit(InfinispanUserSessionProvider.java:750)
>         at
> org.keycloak.services.DefaultKeycloakTransactionManager.commit(DefaultKeycloakTransactionManager.java:104)
>         at
> org.keycloak.services.filters.KeycloakTransactionCommitter.filter(KeycloakTransactionCommitter.java:43)
>         at
> org.jboss.resteasy.core.ServerResponseWriter.executeFilters(ServerResponseWriter.java:121)
>         at
> org.jboss.resteasy.core.ServerResponseWriter.writeNomapResponse(ServerResponseWriter.java:48)
>         at
> org.jboss.resteasy.core.SynchronousDispatcher.writeResponse(SynchronousDispatcher.java:466)
>         at
> org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:415)
>         at
> org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:202)
>         at
> org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.service(ServletContainerDispatcher.java:221)
>         at
> org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:56)
>         at
> org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:51)
>         at javax.servlet.http.HttpServlet.service(HttpServlet.java:790)
>         at
> io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:85)
>         at
> io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:129)
>         at
> org.keycloak.services.filters.KeycloakSessionServletFilter.doFilter(KeycloakSessionServletFilter.java:88)
>         at
> io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:60)
>         at
> io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
>         at
> io.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.java:84)
>         at
> io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:62)
>         at
> io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36)
>         at
> org.wildfly.extension.undertow.security.SecurityContextAssociationHandler.handleRequest(SecurityContextAssociationHandler.java:78)
>         at
> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
>         at
> io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:131)
>         at
> io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:57)
>         at
> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
>         at
> io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:46)
>         at
> io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64)
>         at
> io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:60)
>         at
> io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:77)
>         at
> io.undertow.security.handlers.NotificationReceiverHandler.handleRequest(NotificationReceiverHandler.java:50)
>         at
> io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43)
>         at
> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
>         at
> org.wildfly.extension.undertow.security.jacc.JACCContextIdHandler.handleRequest(JACCContextIdHandler.java:61)
>         at
> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
>         at
> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
>         at
> io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:284)
>         at
> io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:263)
>         at
> io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:81)
>         at
> io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:174)
>         at
> io.undertow.server.Connectors.executeRootHandler(Connectors.java:202)
>         at
> io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:793)
>         at
> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
>         at
> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
>         at java.lang.Thread.run(Thread.java:745)
> Caused by: javax.transaction.RollbackException: ARJUNA016053: Could not
> commit transaction.
>         at
> com.arjuna.ats.internal.jta.transaction.arjunacore.TransactionImple.commitAndDisassociate(TransactionImple.java:1212)
>         at
> com.arjuna.ats.internal.jta.transaction.arjunacore.BaseTransaction.commit(BaseTransaction.java:126)
>         at
> com.arjuna.ats.jbossatx.BaseTransactionManagerDelegate.commit(BaseTransactionManagerDelegate.java:89)
>         at
> org.infinispan.cache.impl.CacheImpl.tryCommit(CacheImpl.java:1722)
>         ... 51 more
>         Suppressed: javax.transaction.xa.XAException
>                 at
> org.infinispan.transaction.impl.TransactionCoordinator.handleCommitFailure(TransactionCoordinator.java:213)
>                 at
> org.infinispan.transaction.impl.TransactionCoordinator.commit(TransactionCoordinator.java:159)
>                 at
> org.infinispan.transaction.xa.TransactionXaAdapter.commit(TransactionXaAdapter.java:112)
>                 at
> com.arjuna.ats.internal.jta.resources.arjunacore.XAResourceRecord.topLevelOnePhaseCommit(XAResourceRecord.java:704)
>                 at
> com.arjuna.ats.arjuna.coordinator.BasicAction.onePhaseCommit(BasicAction.java:2366)
>                 at
> com.arjuna.ats.arjuna.coordinator.BasicAction.End(BasicAction.java:1495)
>                 at
> com.arjuna.ats.arjuna.coordinator.TwoPhaseCoordinator.end(TwoPhaseCoordinator.java:96)
>                 at
> com.arjuna.ats.arjuna.AtomicAction.commit(AtomicAction.java:162)
>                 at
> com.arjuna.ats.internal.jta.transaction.arjunacore.TransactionImple.commitAndDisassociate(TransactionImple.java:1200)
>                 ... 54 more
>         Caused by: org.infinispan.util.concurrent.TimeoutException:
> Replication timeout for kc2
>                 at
> org.infinispan.remoting.transport.jgroups.JGroupsTransport.checkRsp(JGroupsTransport.java:765)
>                 at
> org.infinispan.remoting.transport.jgroups.JGroupsTransport.lambda$invokeRemotelyAsync$73(JGroupsTransport.java:612)
>                 at
> java.util.concurrent.CompletableFuture.uniApply(CompletableFuture.java:602)
>                 at
> java.util.concurrent.CompletableFuture$UniApply.tryFire(CompletableFuture.java:577)
>                 at
> java.util.concurrent.CompletableFuture.postComplete(CompletableFuture.java:474)
>                 at
> java.util.concurrent.CompletableFuture.complete(CompletableFuture.java:1962)
>                 at
> org.infinispan.remoting.transport.jgroups.RspListFuture.call(RspListFuture.java:47)
>                 at
> org.infinispan.remoting.transport.jgroups.RspListFuture.call(RspListFuture.java:16)
>                 at java.util.concurrent.FutureTask.run(FutureTask.java:266)
>                 at
> java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$201(ScheduledThreadPoolExecutor.java:180)
>                 at
> java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:293)
>                 ... 3 more
>
> 03:49:45,596 ERROR [io.undertow.request] (default task-3) UT005023:
> Exception handling request to
> /auth/realms/partner-dmz/protocol/openid-connect/auth:
> org.jboss.resteasy.spi.UnhandledException:
> org.infinispan.commons.CacheException: Could not commit implicit transaction
>         at
> org.jboss.resteasy.core.ExceptionHandler.handleException(ExceptionHandler.java:247)
>         at
> org.jboss.resteasy.core.SynchronousDispatcher.writeException(SynchronousDispatcher.java:168)
>         at
> org.jboss.resteasy.core.SynchronousDispatcher.writeResponse(SynchronousDispatcher.java:471)
>         at
> org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:415)
>         at
> org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:202)
>         at
> org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.service(ServletContainerDispatcher.java:221)
>         at
> org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:56)
>         at
> org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:51)
>         at javax.servlet.http.HttpServlet.service(HttpServlet.java:790)
>         at
> io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:85)
>         at
> io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:129)
>         at
> org.keycloak.services.filters.KeycloakSessionServletFilter.doFilter(KeycloakSessionServletFilter.java:88)
>         at
> io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:60)
>         at
> io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
>         at
> io.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.java:84)
>         at
> io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:62)
>         at
> io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36)
>         at
> org.wildfly.extension.undertow.security.SecurityContextAssociationHandler.handleRequest(SecurityContextAssociationHandler.java:78)
>         at
> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
>         at
> io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:131)
>         at
> io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:57)
>         at
> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
>         at
> io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:46)
>         at
> io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64)
>         at
> io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:60)
>         at
> io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:77)
>         at
> io.undertow.security.handlers.NotificationReceiverHandler.handleRequest(NotificationReceiverHandler.java:50)
>         at
> io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43)
>         at
> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
>         at
> org.wildfly.extension.undertow.security.jacc.JACCContextIdHandler.handleRequest(JACCContextIdHandler.java:61)
>         at
> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
>         at
> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
>         at
> io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:284)
>         at
> io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:263)
>         at
> io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:81)
>         at
> io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:174)
>         at
> io.undertow.server.Connectors.executeRootHandler(Connectors.java:202)
>         at
> io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:793)
>         at
> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
>         at
> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
>         at java.lang.Thread.run(Thread.java:745)
> Caused by: org.infinispan.commons.CacheException: Could not commit
> implicit transaction
>         at
> org.infinispan.cache.impl.CacheImpl.tryCommit(CacheImpl.java:1725)
>         at
> org.infinispan.cache.impl.CacheImpl.executeCommandAndCommitIfNeeded(CacheImpl.java:1679)
>         at
> org.infinispan.cache.impl.CacheImpl.putInternal(CacheImpl.java:1121)
>         at org.infinispan.cache.impl.CacheImpl.put(CacheImpl.java:1111)
>         at org.infinispan.cache.impl.CacheImpl.put(CacheImpl.java:1742)
>         at org.infinispan.cache.impl.CacheImpl.put(CacheImpl.java:248)
>         at
> org.infinispan.cache.impl.AbstractDelegatingCache.put(AbstractDelegatingCache.java:291)
>         at
> org.keycloak.models.sessions.infinispan.InfinispanUserSessionProvider$InfinispanKeycloakTransaction$CacheTask.execute(InfinispanUserSessionProvider.java:854)
>         at
> org.keycloak.models.sessions.infinispan.InfinispanUserSessionProvider$InfinispanKeycloakTransaction.commit(InfinispanUserSessionProvider.java:750)
>         at
> org.keycloak.services.DefaultKeycloakTransactionManager.commit(DefaultKeycloakTransactionManager.java:104)
>         at
> org.keycloak.services.filters.KeycloakTransactionCommitter.filter(KeycloakTransactionCommitter.java:43)
>         at
> org.jboss.resteasy.core.ServerResponseWriter.executeFilters(ServerResponseWriter.java:121)
>         at
> org.jboss.resteasy.core.ServerResponseWriter.writeNomapResponse(ServerResponseWriter.java:48)
>         at
> org.jboss.resteasy.core.SynchronousDispatcher.writeResponse(SynchronousDispatcher.java:466)
>         ... 38 more
> Caused by: javax.transaction.RollbackException: ARJUNA016053: Could not
> commit transaction.
>         at
> com.arjuna.ats.internal.jta.transaction.arjunacore.TransactionImple.commitAndDisassociate(TransactionImple.java:1212)
>         at
> com.arjuna.ats.internal.jta.transaction.arjunacore.BaseTransaction.commit(BaseTransaction.java:126)
>         at
> com.arjuna.ats.jbossatx.BaseTransactionManagerDelegate.commit(BaseTransactionManagerDelegate.java:89)
>         at
> org.infinispan.cache.impl.CacheImpl.tryCommit(CacheImpl.java:1722)
>         ... 51 more
>         Suppressed: javax.transaction.xa.XAException
>                 at
> org.infinispan.transaction.impl.TransactionCoordinator.handleCommitFailure(TransactionCoordinator.java:213)
>                 at
> org.infinispan.transaction.impl.TransactionCoordinator.commit(TransactionCoordinator.java:159)
>                 at
> org.infinispan.transaction.xa.TransactionXaAdapter.commit(TransactionXaAdapter.java:112)
>                 at
> com.arjuna.ats.internal.jta.resources.arjunacore.XAResourceRecord.topLevelOnePhaseCommit(XAResourceRecord.java:704)
>                 at
> com.arjuna.ats.arjuna.coordinator.BasicAction.onePhaseCommit(BasicAction.java:2366)
>                 at
> com.arjuna.ats.arjuna.coordinator.BasicAction.End(BasicAction.java:1495)
>                 at
> com.arjuna.ats.arjuna.coordinator.TwoPhaseCoordinator.end(TwoPhaseCoordinator.java:96)
>                 at
> com.arjuna.ats.arjuna.AtomicAction.commit(AtomicAction.java:162)
>                 at
> com.arjuna.ats.internal.jta.transaction.arjunacore.TransactionImple.commitAndDisassociate(TransactionImple.java:1200)
>                 ... 54 more
>         Caused by: org.infinispan.util.concurrent.TimeoutException:
> Replication timeout for kc2
>                 at
> org.infinispan.remoting.transport.jgroups.JGroupsTransport.checkRsp(JGroupsTransport.java:765)
>                 at
> org.infinispan.remoting.transport.jgroups.JGroupsTransport.lambda$invokeRemotelyAsync$73(JGroupsTransport.java:612)
>                 at
> java.util.concurrent.CompletableFuture.uniApply(CompletableFuture.java:602)
>                 at
> java.util.concurrent.CompletableFuture$UniApply.tryFire(CompletableFuture.java:577)
>                 at
> java.util.concurrent.CompletableFuture.postComplete(CompletableFuture.java:474)
>                 at
> java.util.concurrent.CompletableFuture.complete(CompletableFuture.java:1962)
>                 at
> org.infinispan.remoting.transport.jgroups.RspListFuture.call(RspListFuture.java:47)
>                 at
> org.infinispan.remoting.transport.jgroups.RspListFuture.call(RspListFuture.java:16)
>                 at java.util.concurrent.FutureTask.run(FutureTask.java:266)
>                 at
> java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$201(ScheduledThreadPoolExecutor.java:180)
>                 at
> java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:293)
>                 ... 3 more
>
>
>
> Here kc2 is the removed instance.
>
> Kind Regards,
> Sarp Kaya
>
>
> From: Stian Thorgersen <sthorger at redhat.com>
> Reply-To: "stian at redhat.com" <stian at redhat.com>
> Date: Friday, July 1, 2016 at 7:17 PM
> To: Abdullah Sarp Kaya <akaya at expedia.com>
> Cc: "keycloak-user at lists.jboss.org" <keycloak-user at lists.jboss.org>
> Subject: Re: [keycloak-user] Lost session when removing an instance off
> cluster
>
> Can you please include more details from the log if there is any, at least
> a full stack trace and not just the bit you've included. We also need to
> know details around how you've configured the caches and Infinispan.
>
> On 1 July 2016 at 10:16, Sarp Kaya <akaya at expedia.com> wrote:
>
>> Hello,
>>
>> I have tried various ways of configuring infinispan but it just seems
>> like if I deploy a new instance to the cluster and remove one, then some
>> sessions are lost and an exception is thrown saying that it was not
>> handled. This is the Infinispan exception:
>>
>> Exceptionhandlingrequestto/auth/realms/realmname/protocol/openid-connect/
>> auth:org.jboss.resteasy.spi.UnhandledException:org.infinispan.util.
>> concurrent.TimeoutException:Replicationtimeoutfor79a0757ecab3atorg.jboss.
>> resteasy.core.ExceptionHandler.handleException(ExceptionHandler.java:247)
>> atorg.jboss.resteasy.core.SynchronousDispatcher.writeException(
>> SynchronousDispatcher.java:168) atorg.jboss.resteasy.core.
>> SynchronousDispatcher.writeResponse(SynchronousDispatcher.java:471) atorg
>> .jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.
>> java:415) atorg.jboss.resteasy.core.SynchronousDispatcher.invoke(
>> SynchronousDispatcher.java:202) atorg.jboss.resteasy.plugins.server.
>> servlet.ServletContainerDispatcher.service(ServletContainerDispatcher.
>> java:221) atorg.jboss.resteasy.plugins.server.servlet.
>> HttpServletDispatcher.service(HttpServletDispatcher.java:56) atorg.jboss.
>> resteasy.plugins.server.servlet.HttpServletDispatcher.service(
>> HttpServletDispatcher.java:51) atjavax.servlet.http.HttpServlet.service(
>> HttpServlet.java:790) atio.undertow.servlet.handlers.ServletHandler.
>> handleRequest(ServletHandler.java:85) atio.undertow.servlet.handlers.
>> FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:129) atorg.
>> keycloak.services.filters.KeycloakSessionServletFilter.doFilter(
>> KeycloakSessionServletFilter.java:88) atio.undertow.servlet.core.
>> ManagedFilter.doFilter(ManagedFilter.java:60) atio.undertow.servlet.
>> handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
>> atio.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.
>> java:84) atio.undertow.servlet.handlers.security.
>> ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:
>> 62) atio.undertow.servlet.handlers.ServletDispatchingHandler.
>> handleRequest(ServletDispatchingHandler.java:36) atorg.wildfly.extension.
>> undertow.security.SecurityContextAssociationHandler.handleRequest(
>> SecurityContextAssociationHandler.java:78) atio.undertow.server.handlers.
>> PredicateHandler.handleRequest(PredicateHandler.java:43) atio.undertow.
>> servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(
>> SSLInformationAssociationHandler.java:131) atio.undertow.servlet.handlers
>> .security.ServletAuthenticationCallHandler.handleRequest(
>> ServletAuthenticationCallHandler.java:57) atio.undertow.server.handlers.
>> PredicateHandler.handleRequest(PredicateHandler.java:43) atio.undertow.
>> security.handlers.AbstractConfidentialityHandler.handleRequest(
>> AbstractConfidentialityHandler.java:46) atio.undertow.servlet.handlers.
>> security.ServletConfidentialityConstraintHandler.handleRequest(
>> ServletConfidentialityConstraintHandler.java:64) atio.undertow.security.
>> handlers.AuthenticationMechanismsHandler.handleRequest(
>> AuthenticationMechanismsHandler.java:60) atio.undertow.servlet.handlers.
>> security.CachedAuthenticatedSessionHandler.handleRequest(
>> CachedAuthenticatedSessionHandler.java:77) atio.undertow.security.
>> handlers.NotificationReceiverHandler.handleRequest(
>> NotificationReceiverHandler.java:50) atio.undertow.security.handlers.
>> AbstractSecurityContextAssociationHandler.handleRequest(
>> AbstractSecurityContextAssociationHandler.java:43) atio.undertow.server.
>> handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) atorg.
>> wildfly.extension.undertow.security.jacc.JACCContextIdHandler.
>> handleRequest(JACCContextIdHandler.java:61) atio.undertow.server.handlers
>> .PredicateHandler.handleRequest(PredicateHandler.java:43) atio.undertow.
>> server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
>> atio.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(
>> ServletInitialHandler.java:284) atio.undertow.servlet.handlers.
>> ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:263) at
>> io.undertow.servlet.handlers.ServletInitialHandler.access$000(
>> ServletInitialHandler.java:81) atio.undertow.servlet.handlers.
>> ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:174) at
>> io.undertow.server.Connectors.executeRootHandler(Connectors.java:202) at
>> io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:793)
>> atjava.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.
>> java:1142) atjava.util.concurrent.ThreadPoolExecutor$Worker.run(
>> ThreadPoolExecutor.java:617) atjava.lang.Thread.run(Thread.java:745)
>> Causedby:org.infinispan.util.concurrent.TimeoutException:Replication
>> timeoutfor79a0757ecab3atorg.infinispan.remoting.transport.jgroups.
>> JGroupsTransport.checkRsp(JGroupsTransport.java:765) atorg.infinispan.
>> remoting.transport.jgroups.JGroupsTransport.lambda$invokeRemotelyAsync$72
>> (JGroupsTransport.java:599) atjava.util.concurrent.CompletableFuture.
>> uniApply(CompletableFuture.java:602) atjava.util.concurrent.
>> CompletableFuture$UniApply.tryFire(CompletableFuture.java:577) atjava.
>> util.concurrent.CompletableFuture.postComplete(CompletableFuture.java:474)
>> atjava.util.concurrent.CompletableFuture.complete(CompletableFuture.java:
>> 1962) atorg.infinispan.remoting.transport.jgroups.SingleResponseFuture.
>> call(SingleResponseFuture.java:46) atorg.infinispan.remoting.transport.
>> jgroups.SingleResponseFuture.call(SingleResponseFuture.java:17) atjava.
>> util.concurrent.FutureTask.run(FutureTask.java:266) atjava.util.
>> concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$201(
>> ScheduledThreadPoolExecutor.java:180)
>>
>> This causes browsers to see Internal Server Error. Shouldn?t that be
>> handled in Keycloak as lost session, therefore KC should try to handle it
>> rather than showing that it?s an Internal Server Error?
>>
>> My current infinispan configuration looks like this:
>>
>> <distributed-cache name="sessions" mode="SYNC">
>>     <transaction mode="NON_DURABLE_XA"/>
>> </distributed-cache>
>>
>>
>> I use Keycloak version 1.9.5. My question is am I doing something wrong
>> with my configuration? I tried both replicated-cache and distributed-cache
>> and tried all transaction mode on both of them. None of them seems to solve
>> the error that I?ve had above.
>>
>> Kind Regards,
>> Sarp Kaya
>>
>>
>>
>>
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160705/629b6321/attachment-0001.html 

From akaya at expedia.com  Tue Jul  5 02:50:57 2016
From: akaya at expedia.com (Sarp Kaya)
Date: Tue, 5 Jul 2016 06:50:57 +0000
Subject: [keycloak-user] Lost session when removing an instance off
 cluster
In-Reply-To: <CAJgngAf9wEYCwzYWaQPqK7jXWdNwxEx9KHQZrryuWn0sfU=aTA@mail.gmail.com>
References: <D39C63FE.5FCC%akaya@expedia.com>
	<CAJgngAfJoYUzbtLtU1aAkVrBmE3s7_XOxCCTh8ywVBVth9ZprQ@mail.gmail.com>
	<D3A01882.6050%akaya@expedia.com> <D3A0A0EA.60C9%akaya@expedia.com>
	<CAJgngAf9wEYCwzYWaQPqK7jXWdNwxEx9KHQZrryuWn0sfU=aTA@mail.gmail.com>
Message-ID: <D3A19491.6122%akaya@expedia.com>

Hi Stian,

You are right, it needs to have owner. By default the configuration had owners but as I experimented I forgot to add it. However adding owners does not fix the problem.

Initially I also experimented this with offlineSessions and loginFailures being distributed-cache so logins were already failing with that (same issue, Internal Server Error being presented).

Anyway, if worse case user needs to re-authenticate, then Internal Server Error problem should be fixed right? (it?s the below exception I have pasted) Because whenever there is org.jboss.resteasy.spi.UnhandledException then browsers will see 500, instead of logging in again (there could be something added as such as handling this exception and asking user to log in again).

Kind Regards,
Sarp Kaya

From: Stian Thorgersen <sthorger at redhat.com<mailto:sthorger at redhat.com>>
Reply-To: "stian at redhat.com<mailto:stian at redhat.com>" <stian at redhat.com<mailto:stian at redhat.com>>
Date: Tuesday, July 5, 2016 at 4:41 PM
To: Abdullah Sarp Kaya <akaya at expedia.com<mailto:akaya at expedia.com>>
Cc: "keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>" <keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>>
Subject: Re: [keycloak-user] Lost session when removing an instance off cluster

The sessions cache is a distributed-cache, but by default it only has 1 owner of each segment. This means that sessions are not replicated to multiple nodes. So it's expected that you loose sessions when a node is removed. If you want sessions to survive the removal of a node you should increase the number of owners for the cache. For example:

    <distributed-cache name="sessions" mode="SYNC" owners="2"/>

We've not actually tried with enabling transactions on the sessions, but I would say performance is more important. Worst case scenario is that a session is lost and a user has to re-authenticate.

BTW the config you have for offlineSessions and loginFailures are wrong they both need to be distributed caches as well in clustered mode:

    <distributed-cache name="offlineSessions" mode="SYNC" owners="1"/>
    <distributed-cache name="loginFailures" mode="SYNC" owners="1"/>


On 4 July 2016 at 15:45, Sarp Kaya <akaya at expedia.com<mailto:akaya at expedia.com>> wrote:
Just to add on this.

I think I misunderstood something or Keycloak does not really implement the infinispan caching lifetime correctly.

So first thing I did is to TRACE the infinispan logs. So I added this logger in standalone.xml:


<logger category="org.infinispan">
    <level name="TRACE"/>
</logger>

The next thing I did is to do the timing. Basically my test is that what happens when I log in. I also enabled events and printing the events as well.

What I found is:


  1.  Login event is triggered at 13:18:35,193 in Keycloak.
  2.  The browser got the full response at 13:18:35,273
  3.  Now the surprising part is the fact that there are whole a lot of infinispan logging out occurring for ?sessions? cache after the browser got the response. The last log message occurring is like this:

2016-07-04 13:18:35,345 TRACE [org.infinispan.remoting.rpc.RpcManagerImpl] (default task-4) Response(s) to TxCompletionNotificationCommand{ xid=null, internalId=0, topologyId=19, gtx=GlobalTransaction:<kc1>:239:local, cacheName=sessions}  is {}

To see the all the logs after event trigger please check here:
<http://pastebin.com/pkvYP07T><http://pastebin.com/pkvYP07T><http://pastebin.com/pkvYP07T><http://pastebin.com/pkvYP07T>http://pastebin.com/p4K2Ghff

So my understanding was that I marked sessions as SYNC, which meant to me that it is supposed to do all of the synchronization before it sends the response back to the browser. If it does the other way around then it should be ASYNC mode. Could you please clarify the intended/expected behavior?

Kind Regards,
Sarp Kaya


From: Abdullah Sarp Kaya <akaya at expedia.com<mailto:akaya at expedia.com>>
Date: Monday, July 4, 2016 at 9:59 PM
To: "stian at redhat.com<mailto:stian at redhat.com>" <stian at redhat.com<mailto:stian at redhat.com>>
Cc: "keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>" <keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>>
Subject: Re: [keycloak-user] Lost session when removing an instance off cluster

Hello,

Below is exactly how Infinispan is configured:


<subsystem xmlns="urn:jboss:domain:infinispan:4.0">
    <cache-container name="keycloak" jndi-name="infinispan/Keycloak">
    <transport lock-timeout="60000"/>
    <invalidation-cache name="realms" mode="SYNC"/>
    <invalidation-cache name="users" mode="SYNC">
        <eviction max-entries="10000" strategy="LRU"/>
    </invalidation-cache>
    <distributed-cache xmlns="" name="sessions" mode="SYNC">
        <transaction mode="NON_DURABLE_XA"/>
    </distributed-cache>
    <local-cache xmlns="" name="offlineSessions"/>
    <local-cache xmlns="" name="loginFailures"/>
    <replicated-cache name="work" mode="SYNC"/>
    <local-cache name="realmVersions">
        <transaction mode="BATCH" locking="PESSIMISTIC"/>
    </local-cache>
</cache-container>
<cache-container name="server" aliases="singleton cluster" default-cache="default" module="org.wildfly.clustering.server">
    <transport lock-timeout="60000"/>
    <replicated-cache name="default" mode="SYNC">
        <transaction mode="BATCH"/>
    </replicated-cache>
</cache-container>
<cache-container name="web" default-cache="dist" module="org.wildfly.clustering.web.infinispan">
    <transport lock-timeout="60000"/>
    <distributed-cache name="dist" mode="ASYNC" l1-lifespan="0" owners="2">
        <locking isolation="REPEATABLE_READ"/>
        <transaction mode="BATCH"/>
        <file-store/>
    </distributed-cache>
</cache-container>
<cache-container name="ejb" aliases="sfsb" default-cache="dist" module="org.wildfly.clustering.ejb.infinispan">
    <transport lock-timeout="60000"/>
    <distributed-cache name="dist" mode="ASYNC" l1-lifespan="0" owners="2">
        <locking isolation="REPEATABLE_READ"/>
        <transaction mode="BATCH"/>
        <file-store/>
    </distributed-cache>
</cache-container>
<cache-container name="hibernate" default-cache="local-query" module="org.hibernate.infinispan">
    <transport lock-timeout="60000"/>
    <invalidation-cache name="entity" mode="SYNC">
        <transaction mode="NON_XA"/>
        <eviction strategy="LRU" max-entries="10000"/>
        <expiration max-idle="100000"/>
    </invalidation-cache>
    <local-cache name="local-query">
        <eviction strategy="LRU" max-entries="10000"/>
        <expiration max-idle="100000"/>
    </local-cache>
    <replicated-cache name="timestamps" mode="ASYNC"/>
</cache-container>
</subsystem>




This is the complete exception:

03:49:40,241 ERROR [org.infinispan.interceptors.InvocationContextInterceptor] (default task-12) ISPN000136: Error executing command PutKeyValueCommand, writing keys [ba74e523-3299-42b3-801e-9f8cb5a0d81d]: org.infinispan.util.concurrent.TimeoutException: Replication timeout for kc2
        at org.infinispan.remoting.transport.jgroups.JGroupsTransport.checkRsp(JGroupsTransport.java:765)
        at org.infinispan.remoting.transport.jgroups.JGroupsTransport.lambda$invokeRemotelyAsync$73(JGroupsTransport.java:612)
        at java.util.concurrent.CompletableFuture.uniApply(CompletableFuture.java:602)
        at java.util.concurrent.CompletableFuture$UniApply.tryFire(CompletableFuture.java:577)
        at java.util.concurrent.CompletableFuture.postComplete(CompletableFuture.java:474)
        at java.util.concurrent.CompletableFuture.complete(CompletableFuture.java:1962)
        at org.infinispan.remoting.transport.jgroups.RspListFuture.call(RspListFuture.java:47)
        at org.infinispan.remoting.transport.jgroups.RspListFuture.call(RspListFuture.java:16)
        at java.util.concurrent.FutureTask.run(FutureTask.java:266)
        at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$201(ScheduledThreadPoolExecutor.java:180)
        at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:293)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
        at java.lang.Thread.run(Thread.java:745)

03:49:40,250 ERROR [org.jboss.resteasy.resteasy_jaxrs.i18n] (default task-12) RESTEASY002025: Unknown exception while executing GET /realms/partner-dmz/protocol/openid-connect/auth: org.infinispan.util.concurrent.TimeoutException: Replication timeout for kc2
        at org.infinispan.remoting.transport.jgroups.JGroupsTransport.checkRsp(JGroupsTransport.java:765)
        at org.infinispan.remoting.transport.jgroups.JGroupsTransport.lambda$invokeRemotelyAsync$73(JGroupsTransport.java:612)
        at java.util.concurrent.CompletableFuture.uniApply(CompletableFuture.java:602)
        at java.util.concurrent.CompletableFuture$UniApply.tryFire(CompletableFuture.java:577)
        at java.util.concurrent.CompletableFuture.postComplete(CompletableFuture.java:474)
        at java.util.concurrent.CompletableFuture.complete(CompletableFuture.java:1962)
        at org.infinispan.remoting.transport.jgroups.RspListFuture.call(RspListFuture.java:47)
        at org.infinispan.remoting.transport.jgroups.RspListFuture.call(RspListFuture.java:16)
        at java.util.concurrent.FutureTask.run(FutureTask.java:266)
        at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$201(ScheduledThreadPoolExecutor.java:180)
        at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:293)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
        at java.lang.Thread.run(Thread.java:745)

03:49:40,257 ERROR [io.undertow.request] (default task-12) UT005023: Exception handling request to /auth/realms/partner-dmz/protocol/openid-connect/auth: org.jboss.resteasy.spi.UnhandledException: org.infinispan.util.concurrent.TimeoutException: Replication timeout for kc2
        at org.jboss.resteasy.core.ExceptionHandler.handleException(ExceptionHandler.java:247)
        at org.jboss.resteasy.core.SynchronousDispatcher.writeException(SynchronousDispatcher.java:168)
        at org.jboss.resteasy.core.SynchronousDispatcher.writeResponse(SynchronousDispatcher.java:471)
        at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:415)
        at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:202)
        at org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.service(ServletContainerDispatcher.java:221)
        at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:56)
        at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:51)
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:790)
        at io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:85)
        at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:129)
        at org.keycloak.services.filters.KeycloakSessionServletFilter.doFilter(KeycloakSessionServletFilter.java:88)
        at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:60)
        at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
        at io.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.java:84)
        at io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:62)
        at io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36)
        at org.wildfly.extension.undertow.security.SecurityContextAssociationHandler.handleRequest(SecurityContextAssociationHandler.java:78)
        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
        at io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:131)
        at io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:57)
        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
        at io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:46)
        at io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64)
        at io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:60)
        at io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:77)
        at io.undertow.security.handlers.NotificationReceiverHandler.handleRequest(NotificationReceiverHandler.java:50)
        at io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43)
        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
        at org.wildfly.extension.undertow.security.jacc.JACCContextIdHandler.handleRequest(JACCContextIdHandler.java:61)
        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
        at io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:284)
        at io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:263)
        at io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:81)
        at io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:174)
        at io.undertow.server.Connectors.executeRootHandler(Connectors.java:202)
        at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:793)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
        at java.lang.Thread.run(Thread.java:745)
Caused by: org.infinispan.util.concurrent.TimeoutException: Replication timeout for kc2
        at org.infinispan.remoting.transport.jgroups.JGroupsTransport.checkRsp(JGroupsTransport.java:765)
        at org.infinispan.remoting.transport.jgroups.JGroupsTransport.lambda$invokeRemotelyAsync$73(JGroupsTransport.java:612)
        at java.util.concurrent.CompletableFuture.uniApply(CompletableFuture.java:602)
        at java.util.concurrent.CompletableFuture$UniApply.tryFire(CompletableFuture.java:577)
        at java.util.concurrent.CompletableFuture.postComplete(CompletableFuture.java:474)
        at java.util.concurrent.CompletableFuture.complete(CompletableFuture.java:1962)
        at org.infinispan.remoting.transport.jgroups.RspListFuture.call(RspListFuture.java:47)
        at org.infinispan.remoting.transport.jgroups.RspListFuture.call(RspListFuture.java:16)
        at java.util.concurrent.FutureTask.run(FutureTask.java:266)
        at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$201(ScheduledThreadPoolExecutor.java:180)
        at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:293)
        ... 3 more

03:49:41,251 ERROR [org.infinispan.interceptors.InvocationContextInterceptor] (default task-3) ISPN000136: Error executing command PrepareCommand, writing keys [02cff8bb-0ab9-4ab9-905f-17ffb3226050]: org.infinispan.util.concurrent.TimeoutException: Replication timeout for kc2
        at org.infinispan.remoting.transport.jgroups.JGroupsTransport.checkRsp(JGroupsTransport.java:765)
        at org.infinispan.remoting.transport.jgroups.JGroupsTransport.lambda$invokeRemotelyAsync$73(JGroupsTransport.java:612)
        at java.util.concurrent.CompletableFuture.uniApply(CompletableFuture.java:602)
        at java.util.concurrent.CompletableFuture$UniApply.tryFire(CompletableFuture.java:577)
        at java.util.concurrent.CompletableFuture.postComplete(CompletableFuture.java:474)
        at java.util.concurrent.CompletableFuture.complete(CompletableFuture.java:1962)
        at org.infinispan.remoting.transport.jgroups.RspListFuture.call(RspListFuture.java:47)
        at org.infinispan.remoting.transport.jgroups.RspListFuture.call(RspListFuture.java:16)
        at java.util.concurrent.FutureTask.run(FutureTask.java:266)
        at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$201(ScheduledThreadPoolExecutor.java:180)
        at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:293)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
        at java.lang.Thread.run(Thread.java:745)

03:49:41,258 ERROR [org.infinispan.transaction.impl.TransactionCoordinator] (default task-3) ISPN000097: Error while processing a prepare in a single-phase transaction: org.infinispan.util.concurrent.TimeoutException: Replication timeout for kc2
        at org.infinispan.remoting.transport.jgroups.JGroupsTransport.checkRsp(JGroupsTransport.java:765)
        at org.infinispan.remoting.transport.jgroups.JGroupsTransport.lambda$invokeRemotelyAsync$73(JGroupsTransport.java:612)
        at java.util.concurrent.CompletableFuture.uniApply(CompletableFuture.java:602)
        at java.util.concurrent.CompletableFuture$UniApply.tryFire(CompletableFuture.java:577)
        at java.util.concurrent.CompletableFuture.postComplete(CompletableFuture.java:474)
        at java.util.concurrent.CompletableFuture.complete(CompletableFuture.java:1962)
        at org.infinispan.remoting.transport.jgroups.RspListFuture.call(RspListFuture.java:47)
        at org.infinispan.remoting.transport.jgroups.RspListFuture.call(RspListFuture.java:16)
        at java.util.concurrent.FutureTask.run(FutureTask.java:266)
        at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$201(ScheduledThreadPoolExecutor.java:180)
        at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:293)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
        at java.lang.Thread.run(Thread.java:745)

03:49:45,504 INFO  [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (Incoming-3,dev,kc1) ISPN000094: Received new cluster view for channel server: [kc1|4] (1) [kc1]
03:49:45,507 INFO  [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (Incoming-3,dev,kc1) ISPN000094: Received new cluster view for channel keycloak: [kc1|4] (1) [kc1]
03:49:45,534 INFO  [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (Incoming-3,dev,kc1) ISPN000094: Received new cluster view for channel web: [kc1|4] (1) [kc1]
03:49:45,538 INFO  [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (Incoming-3,dev,kc1) ISPN000094: Received new cluster view for channel ejb: [kc1|4] (1) [kc1]
03:49:45,548 WARN  [com.arjuna.ats.jta] (default task-3) ARJUNA016039: onePhaseCommit on < formatId=131077, gtrid_length=29, bqual_length=36, tx_uid=0:ffffac110003:-7fcaa87f:5779dc60:f01, node_name=1, branch_uid=0:ffffac110003:-7fcaa87f:5779dc60:f02, subordinatenodename=null, eis_name=unknown eis name > (TransactionXaAdapter{localTransaction=LocalXaTransaction{xid=< formatId=131077, gtrid_length=29, bqual_length=36, tx_uid=0:ffffac110003:-7fcaa87f:5779dc60:f01, node_name=1, branch_uid=0:ffffac110003:-7fcaa87f:5779dc60:f02, subordinatenodename=null, eis_name=unknown eis name >} LocalTransaction{remoteLockedNodes=null, isMarkedForRollback=false, lockedKeys=null, backupKeyLocks=null, topologyId=6, stateTransferFlag=null} org.infinispan.transaction.xa.LocalXaTransaction at 3ef}) failed with exception XAException.XA_HEURRB: javax.transaction.xa.XAException
        at org.infinispan.transaction.impl.TransactionCoordinator.handleCommitFailure(TransactionCoordinator.java:213)
        at org.infinispan.transaction.impl.TransactionCoordinator.commit(TransactionCoordinator.java:159)
        at org.infinispan.transaction.xa.TransactionXaAdapter.commit(TransactionXaAdapter.java:112)
        at com.arjuna.ats.internal.jta.resources.arjunacore.XAResourceRecord.topLevelOnePhaseCommit(XAResourceRecord.java:704)
        at com.arjuna.ats.arjuna.coordinator.BasicAction.onePhaseCommit(BasicAction.java:2366)
        at com.arjuna.ats.arjuna.coordinator.BasicAction.End(BasicAction.java:1495)
        at com.arjuna.ats.arjuna.coordinator.TwoPhaseCoordinator.end(TwoPhaseCoordinator.java:96)
        at com.arjuna.ats.arjuna.AtomicAction.commit(AtomicAction.java:162)
        at com.arjuna.ats.internal.jta.transaction.arjunacore.TransactionImple.commitAndDisassociate(TransactionImple.java:1200)
        at com.arjuna.ats.internal.jta.transaction.arjunacore.BaseTransaction.commit(BaseTransaction.java:126)
        at com.arjuna.ats.jbossatx.BaseTransactionManagerDelegate.commit(BaseTransactionManagerDelegate.java:89)
        at org.infinispan.cache.impl.CacheImpl.tryCommit(CacheImpl.java:1722)
        at org.infinispan.cache.impl.CacheImpl.executeCommandAndCommitIfNeeded(CacheImpl.java:1679)
        at org.infinispan.cache.impl.CacheImpl.putInternal(CacheImpl.java:1121)
        at org.infinispan.cache.impl.CacheImpl.put(CacheImpl.java:1111)
        at org.infinispan.cache.impl.CacheImpl.put(CacheImpl.java:1742)
        at org.infinispan.cache.impl.CacheImpl.put(CacheImpl.java:248)
        at org.infinispan.cache.impl.AbstractDelegatingCache.put(AbstractDelegatingCache.java:291)
        at org.keycloak.models.sessions.infinispan.InfinispanUserSessionProvider$InfinispanKeycloakTransaction$CacheTask.execute(InfinispanUserSessionProvider.java:854)
        at org.keycloak.models.sessions.infinispan.InfinispanUserSessionProvider$InfinispanKeycloakTransaction.commit(InfinispanUserSessionProvider.java:750)
        at org.keycloak.services.DefaultKeycloakTransactionManager.commit(DefaultKeycloakTransactionManager.java:104)
        at org.keycloak.services.filters.KeycloakTransactionCommitter.filter(KeycloakTransactionCommitter.java:43)
        at org.jboss.resteasy.core.ServerResponseWriter.executeFilters(ServerResponseWriter.java:121)
        at org.jboss.resteasy.core.ServerResponseWriter.writeNomapResponse(ServerResponseWriter.java:48)
        at org.jboss.resteasy.core.SynchronousDispatcher.writeResponse(SynchronousDispatcher.java:466)
        at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:415)
        at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:202)
        at org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.service(ServletContainerDispatcher.java:221)
        at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:56)
        at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:51)
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:790)
        at io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:85)
        at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:129)
        at org.keycloak.services.filters.KeycloakSessionServletFilter.doFilter(KeycloakSessionServletFilter.java:88)
        at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:60)
        at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
        at io.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.java:84)
        at io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:62)
        at io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36)
        at org.wildfly.extension.undertow.security.SecurityContextAssociationHandler.handleRequest(SecurityContextAssociationHandler.java:78)
        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
        at io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:131)
        at io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:57)
        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
        at io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:46)
        at io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64)
        at io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:60)
        at io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:77)
        at io.undertow.security.handlers.NotificationReceiverHandler.handleRequest(NotificationReceiverHandler.java:50)
        at io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43)
        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
        at org.wildfly.extension.undertow.security.jacc.JACCContextIdHandler.handleRequest(JACCContextIdHandler.java:61)
        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
        at io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:284)
        at io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:263)
        at io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:81)
        at io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:174)
        at io.undertow.server.Connectors.executeRootHandler(Connectors.java:202)
        at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:793)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
        at java.lang.Thread.run(Thread.java:745)
Caused by: org.infinispan.util.concurrent.TimeoutException: Replication timeout for kc2
        at org.infinispan.remoting.transport.jgroups.JGroupsTransport.checkRsp(JGroupsTransport.java:765)
        at org.infinispan.remoting.transport.jgroups.JGroupsTransport.lambda$invokeRemotelyAsync$73(JGroupsTransport.java:612)
        at java.util.concurrent.CompletableFuture.uniApply(CompletableFuture.java:602)
        at java.util.concurrent.CompletableFuture$UniApply.tryFire(CompletableFuture.java:577)
        at java.util.concurrent.CompletableFuture.postComplete(CompletableFuture.java:474)
        at java.util.concurrent.CompletableFuture.complete(CompletableFuture.java:1962)
        at org.infinispan.remoting.transport.jgroups.RspListFuture.call(RspListFuture.java:47)
        at org.infinispan.remoting.transport.jgroups.RspListFuture.call(RspListFuture.java:16)
        at java.util.concurrent.FutureTask.run(FutureTask.java:266)
        at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$201(ScheduledThreadPoolExecutor.java:180)
        at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:293)
        ... 3 more

03:49:45,563 WARN  [org.infinispan.cache.impl.CacheImpl] (default task-3) ISPN000160: Could not complete injected transaction.: javax.transaction.RollbackException: ARJUNA016053: Could not commit transaction.
        at com.arjuna.ats.internal.jta.transaction.arjunacore.TransactionImple.commitAndDisassociate(TransactionImple.java:1212)
        at com.arjuna.ats.internal.jta.transaction.arjunacore.BaseTransaction.commit(BaseTransaction.java:126)
        at com.arjuna.ats.jbossatx.BaseTransactionManagerDelegate.commit(BaseTransactionManagerDelegate.java:89)
        at org.infinispan.cache.impl.CacheImpl.tryCommit(CacheImpl.java:1722)
        at org.infinispan.cache.impl.CacheImpl.executeCommandAndCommitIfNeeded(CacheImpl.java:1679)
        at org.infinispan.cache.impl.CacheImpl.putInternal(CacheImpl.java:1121)
        at org.infinispan.cache.impl.CacheImpl.put(CacheImpl.java:1111)
        at org.infinispan.cache.impl.CacheImpl.put(CacheImpl.java:1742)
        at org.infinispan.cache.impl.CacheImpl.put(CacheImpl.java:248)
        at org.infinispan.cache.impl.AbstractDelegatingCache.put(AbstractDelegatingCache.java:291)
        at org.keycloak.models.sessions.infinispan.InfinispanUserSessionProvider$InfinispanKeycloakTransaction$CacheTask.execute(InfinispanUserSessionProvider.java:854)
        at org.keycloak.models.sessions.infinispan.InfinispanUserSessionProvider$InfinispanKeycloakTransaction.commit(InfinispanUserSessionProvider.java:750)
        at org.keycloak.services.DefaultKeycloakTransactionManager.commit(DefaultKeycloakTransactionManager.java:104)
        at org.keycloak.services.filters.KeycloakTransactionCommitter.filter(KeycloakTransactionCommitter.java:43)
        at org.jboss.resteasy.core.ServerResponseWriter.executeFilters(ServerResponseWriter.java:121)
        at org.jboss.resteasy.core.ServerResponseWriter.writeNomapResponse(ServerResponseWriter.java:48)
        at org.jboss.resteasy.core.SynchronousDispatcher.writeResponse(SynchronousDispatcher.java:466)
        at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:415)
        at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:202)
        at org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.service(ServletContainerDispatcher.java:221)
        at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:56)
        at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:51)
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:790)
        at io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:85)
        at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:129)
        at org.keycloak.services.filters.KeycloakSessionServletFilter.doFilter(KeycloakSessionServletFilter.java:88)
        at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:60)
        at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
        at io.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.java:84)
        at io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:62)
        at io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36)
        at org.wildfly.extension.undertow.security.SecurityContextAssociationHandler.handleRequest(SecurityContextAssociationHandler.java:78)
        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
        at io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:131)
        at io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:57)
        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
        at io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:46)
        at io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64)
        at io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:60)
        at io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:77)
        at io.undertow.security.handlers.NotificationReceiverHandler.handleRequest(NotificationReceiverHandler.java:50)
        at io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43)
        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
        at org.wildfly.extension.undertow.security.jacc.JACCContextIdHandler.handleRequest(JACCContextIdHandler.java:61)
        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
        at io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:284)
        at io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:263)
        at io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:81)
        at io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:174)
        at io.undertow.server.Connectors.executeRootHandler(Connectors.java:202)
        at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:793)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
        at java.lang.Thread.run(Thread.java:745)
        Suppressed: javax.transaction.xa.XAException
                at org.infinispan.transaction.impl.TransactionCoordinator.handleCommitFailure(TransactionCoordinator.java:213)
                at org.infinispan.transaction.impl.TransactionCoordinator.commit(TransactionCoordinator.java:159)
                at org.infinispan.transaction.xa.TransactionXaAdapter.commit(TransactionXaAdapter.java:112)
                at com.arjuna.ats.internal.jta.resources.arjunacore.XAResourceRecord.topLevelOnePhaseCommit(XAResourceRecord.java:704)
                at com.arjuna.ats.arjuna.coordinator.BasicAction.onePhaseCommit(BasicAction.java:2366)
                at com.arjuna.ats.arjuna.coordinator.BasicAction.End(BasicAction.java:1495)
                at com.arjuna.ats.arjuna.coordinator.TwoPhaseCoordinator.end(TwoPhaseCoordinator.java:96)
                at com.arjuna.ats.arjuna.AtomicAction.commit(AtomicAction.java:162)
                at com.arjuna.ats.internal.jta.transaction.arjunacore.TransactionImple.commitAndDisassociate(TransactionImple.java:1200)
                ... 54 more
        Caused by: org.infinispan.util.concurrent.TimeoutException: Replication timeout for kc2
                at org.infinispan.remoting.transport.jgroups.JGroupsTransport.checkRsp(JGroupsTransport.java:765)
                at org.infinispan.remoting.transport.jgroups.JGroupsTransport.lambda$invokeRemotelyAsync$73(JGroupsTransport.java:612)
                at java.util.concurrent.CompletableFuture.uniApply(CompletableFuture.java:602)
                at java.util.concurrent.CompletableFuture$UniApply.tryFire(CompletableFuture.java:577)
                at java.util.concurrent.CompletableFuture.postComplete(CompletableFuture.java:474)
                at java.util.concurrent.CompletableFuture.complete(CompletableFuture.java:1962)
                at org.infinispan.remoting.transport.jgroups.RspListFuture.call(RspListFuture.java:47)
                at org.infinispan.remoting.transport.jgroups.RspListFuture.call(RspListFuture.java:16)
                at java.util.concurrent.FutureTask.run(FutureTask.java:266)
                at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$201(ScheduledThreadPoolExecutor.java:180)
                at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:293)
                ... 3 more

03:49:45,575 INFO  [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (Incoming-3,dev,kc1) ISPN000094: Received new cluster view for channel hibernate: [kc1|4] (1) [kc1]
03:49:45,575 ERROR [org.jboss.resteasy.resteasy_jaxrs.i18n] (default task-3) RESTEASY002025: Unknown exception while executing GET /realms/partner-dmz/protocol/openid-connect/auth: org.infinispan.commons.CacheException: Could not commit implicit transaction
        at org.infinispan.cache.impl.CacheImpl.tryCommit(CacheImpl.java:1725)
        at org.infinispan.cache.impl.CacheImpl.executeCommandAndCommitIfNeeded(CacheImpl.java:1679)
        at org.infinispan.cache.impl.CacheImpl.putInternal(CacheImpl.java:1121)
        at org.infinispan.cache.impl.CacheImpl.put(CacheImpl.java:1111)
        at org.infinispan.cache.impl.CacheImpl.put(CacheImpl.java:1742)
        at org.infinispan.cache.impl.CacheImpl.put(CacheImpl.java:248)
        at org.infinispan.cache.impl.AbstractDelegatingCache.put(AbstractDelegatingCache.java:291)
        at org.keycloak.models.sessions.infinispan.InfinispanUserSessionProvider$InfinispanKeycloakTransaction$CacheTask.execute(InfinispanUserSessionProvider.java:854)
        at org.keycloak.models.sessions.infinispan.InfinispanUserSessionProvider$InfinispanKeycloakTransaction.commit(InfinispanUserSessionProvider.java:750)
        at org.keycloak.services.DefaultKeycloakTransactionManager.commit(DefaultKeycloakTransactionManager.java:104)
        at org.keycloak.services.filters.KeycloakTransactionCommitter.filter(KeycloakTransactionCommitter.java:43)
        at org.jboss.resteasy.core.ServerResponseWriter.executeFilters(ServerResponseWriter.java:121)
        at org.jboss.resteasy.core.ServerResponseWriter.writeNomapResponse(ServerResponseWriter.java:48)
        at org.jboss.resteasy.core.SynchronousDispatcher.writeResponse(SynchronousDispatcher.java:466)
        at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:415)
        at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:202)
        at org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.service(ServletContainerDispatcher.java:221)
        at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:56)
        at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:51)
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:790)
        at io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:85)
        at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:129)
        at org.keycloak.services.filters.KeycloakSessionServletFilter.doFilter(KeycloakSessionServletFilter.java:88)
        at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:60)
        at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
        at io.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.java:84)
        at io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:62)
        at io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36)
        at org.wildfly.extension.undertow.security.SecurityContextAssociationHandler.handleRequest(SecurityContextAssociationHandler.java:78)
        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
        at io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:131)
        at io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:57)
        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
        at io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:46)
        at io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64)
        at io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:60)
        at io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:77)
        at io.undertow.security.handlers.NotificationReceiverHandler.handleRequest(NotificationReceiverHandler.java:50)
        at io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43)
        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
        at org.wildfly.extension.undertow.security.jacc.JACCContextIdHandler.handleRequest(JACCContextIdHandler.java:61)
        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
        at io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:284)
        at io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:263)
        at io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:81)
        at io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:174)
        at io.undertow.server.Connectors.executeRootHandler(Connectors.java:202)
        at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:793)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
        at java.lang.Thread.run(Thread.java:745)
Caused by: javax.transaction.RollbackException: ARJUNA016053: Could not commit transaction.
        at com.arjuna.ats.internal.jta.transaction.arjunacore.TransactionImple.commitAndDisassociate(TransactionImple.java:1212)
        at com.arjuna.ats.internal.jta.transaction.arjunacore.BaseTransaction.commit(BaseTransaction.java:126)
        at com.arjuna.ats.jbossatx.BaseTransactionManagerDelegate.commit(BaseTransactionManagerDelegate.java:89)
        at org.infinispan.cache.impl.CacheImpl.tryCommit(CacheImpl.java:1722)
        ... 51 more
        Suppressed: javax.transaction.xa.XAException
                at org.infinispan.transaction.impl.TransactionCoordinator.handleCommitFailure(TransactionCoordinator.java:213)
                at org.infinispan.transaction.impl.TransactionCoordinator.commit(TransactionCoordinator.java:159)
                at org.infinispan.transaction.xa.TransactionXaAdapter.commit(TransactionXaAdapter.java:112)
                at com.arjuna.ats.internal.jta.resources.arjunacore.XAResourceRecord.topLevelOnePhaseCommit(XAResourceRecord.java:704)
                at com.arjuna.ats.arjuna.coordinator.BasicAction.onePhaseCommit(BasicAction.java:2366)
                at com.arjuna.ats.arjuna.coordinator.BasicAction.End(BasicAction.java:1495)
                at com.arjuna.ats.arjuna.coordinator.TwoPhaseCoordinator.end(TwoPhaseCoordinator.java:96)
                at com.arjuna.ats.arjuna.AtomicAction.commit(AtomicAction.java:162)
                at com.arjuna.ats.internal.jta.transaction.arjunacore.TransactionImple.commitAndDisassociate(TransactionImple.java:1200)
                ... 54 more
        Caused by: org.infinispan.util.concurrent.TimeoutException: Replication timeout for kc2
                at org.infinispan.remoting.transport.jgroups.JGroupsTransport.checkRsp(JGroupsTransport.java:765)
                at org.infinispan.remoting.transport.jgroups.JGroupsTransport.lambda$invokeRemotelyAsync$73(JGroupsTransport.java:612)
                at java.util.concurrent.CompletableFuture.uniApply(CompletableFuture.java:602)
                at java.util.concurrent.CompletableFuture$UniApply.tryFire(CompletableFuture.java:577)
                at java.util.concurrent.CompletableFuture.postComplete(CompletableFuture.java:474)
                at java.util.concurrent.CompletableFuture.complete(CompletableFuture.java:1962)
                at org.infinispan.remoting.transport.jgroups.RspListFuture.call(RspListFuture.java:47)
                at org.infinispan.remoting.transport.jgroups.RspListFuture.call(RspListFuture.java:16)
                at java.util.concurrent.FutureTask.run(FutureTask.java:266)
                at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$201(ScheduledThreadPoolExecutor.java:180)
                at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:293)
                ... 3 more

03:49:45,596 ERROR [io.undertow.request] (default task-3) UT005023: Exception handling request to /auth/realms/partner-dmz/protocol/openid-connect/auth: org.jboss.resteasy.spi.UnhandledException: org.infinispan.commons.CacheException: Could not commit implicit transaction
        at org.jboss.resteasy.core.ExceptionHandler.handleException(ExceptionHandler.java:247)
        at org.jboss.resteasy.core.SynchronousDispatcher.writeException(SynchronousDispatcher.java:168)
        at org.jboss.resteasy.core.SynchronousDispatcher.writeResponse(SynchronousDispatcher.java:471)
        at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:415)
        at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:202)
        at org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.service(ServletContainerDispatcher.java:221)
        at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:56)
        at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:51)
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:790)
        at io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:85)
        at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:129)
        at org.keycloak.services.filters.KeycloakSessionServletFilter.doFilter(KeycloakSessionServletFilter.java:88)
        at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:60)
        at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
        at io.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.java:84)
        at io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:62)
        at io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36)
        at org.wildfly.extension.undertow.security.SecurityContextAssociationHandler.handleRequest(SecurityContextAssociationHandler.java:78)
        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
        at io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:131)
        at io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:57)
        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
        at io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:46)
        at io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64)
        at io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:60)
        at io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:77)
        at io.undertow.security.handlers.NotificationReceiverHandler.handleRequest(NotificationReceiverHandler.java:50)
        at io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43)
        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
        at org.wildfly.extension.undertow.security.jacc.JACCContextIdHandler.handleRequest(JACCContextIdHandler.java:61)
        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
        at io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:284)
        at io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:263)
        at io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:81)
        at io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:174)
        at io.undertow.server.Connectors.executeRootHandler(Connectors.java:202)
        at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:793)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
        at java.lang.Thread.run(Thread.java:745)
Caused by: org.infinispan.commons.CacheException: Could not commit implicit transaction
        at org.infinispan.cache.impl.CacheImpl.tryCommit(CacheImpl.java:1725)
        at org.infinispan.cache.impl.CacheImpl.executeCommandAndCommitIfNeeded(CacheImpl.java:1679)
        at org.infinispan.cache.impl.CacheImpl.putInternal(CacheImpl.java:1121)
        at org.infinispan.cache.impl.CacheImpl.put(CacheImpl.java:1111)
        at org.infinispan.cache.impl.CacheImpl.put(CacheImpl.java:1742)
        at org.infinispan.cache.impl.CacheImpl.put(CacheImpl.java:248)
        at org.infinispan.cache.impl.AbstractDelegatingCache.put(AbstractDelegatingCache.java:291)
        at org.keycloak.models.sessions.infinispan.InfinispanUserSessionProvider$InfinispanKeycloakTransaction$CacheTask.execute(InfinispanUserSessionProvider.java:854)
        at org.keycloak.models.sessions.infinispan.InfinispanUserSessionProvider$InfinispanKeycloakTransaction.commit(InfinispanUserSessionProvider.java:750)
        at org.keycloak.services.DefaultKeycloakTransactionManager.commit(DefaultKeycloakTransactionManager.java:104)
        at org.keycloak.services.filters.KeycloakTransactionCommitter.filter(KeycloakTransactionCommitter.java:43)
        at org.jboss.resteasy.core.ServerResponseWriter.executeFilters(ServerResponseWriter.java:121)
        at org.jboss.resteasy.core.ServerResponseWriter.writeNomapResponse(ServerResponseWriter.java:48)
        at org.jboss.resteasy.core.SynchronousDispatcher.writeResponse(SynchronousDispatcher.java:466)
        ... 38 more
Caused by: javax.transaction.RollbackException: ARJUNA016053: Could not commit transaction.
        at com.arjuna.ats.internal.jta.transaction.arjunacore.TransactionImple.commitAndDisassociate(TransactionImple.java:1212)
        at com.arjuna.ats.internal.jta.transaction.arjunacore.BaseTransaction.commit(BaseTransaction.java:126)
        at com.arjuna.ats.jbossatx.BaseTransactionManagerDelegate.commit(BaseTransactionManagerDelegate.java:89)
        at org.infinispan.cache.impl.CacheImpl.tryCommit(CacheImpl.java:1722)
        ... 51 more
        Suppressed: javax.transaction.xa.XAException
                at org.infinispan.transaction.impl.TransactionCoordinator.handleCommitFailure(TransactionCoordinator.java:213)
                at org.infinispan.transaction.impl.TransactionCoordinator.commit(TransactionCoordinator.java:159)
                at org.infinispan.transaction.xa.TransactionXaAdapter.commit(TransactionXaAdapter.java:112)
                at com.arjuna.ats.internal.jta.resources.arjunacore.XAResourceRecord.topLevelOnePhaseCommit(XAResourceRecord.java:704)
                at com.arjuna.ats.arjuna.coordinator.BasicAction.onePhaseCommit(BasicAction.java:2366)
                at com.arjuna.ats.arjuna.coordinator.BasicAction.End(BasicAction.java:1495)
                at com.arjuna.ats.arjuna.coordinator.TwoPhaseCoordinator.end(TwoPhaseCoordinator.java:96)
                at com.arjuna.ats.arjuna.AtomicAction.commit(AtomicAction.java:162)
                at com.arjuna.ats.internal.jta.transaction.arjunacore.TransactionImple.commitAndDisassociate(TransactionImple.java:1200)
                ... 54 more
        Caused by: org.infinispan.util.concurrent.TimeoutException: Replication timeout for kc2
                at org.infinispan.remoting.transport.jgroups.JGroupsTransport.checkRsp(JGroupsTransport.java:765)
                at org.infinispan.remoting.transport.jgroups.JGroupsTransport.lambda$invokeRemotelyAsync$73(JGroupsTransport.java:612)
                at java.util.concurrent.CompletableFuture.uniApply(CompletableFuture.java:602)
                at java.util.concurrent.CompletableFuture$UniApply.tryFire(CompletableFuture.java:577)
                at java.util.concurrent.CompletableFuture.postComplete(CompletableFuture.java:474)
                at java.util.concurrent.CompletableFuture.complete(CompletableFuture.java:1962)
                at org.infinispan.remoting.transport.jgroups.RspListFuture.call(RspListFuture.java:47)
                at org.infinispan.remoting.transport.jgroups.RspListFuture.call(RspListFuture.java:16)
                at java.util.concurrent.FutureTask.run(FutureTask.java:266)
                at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$201(ScheduledThreadPoolExecutor.java:180)
                at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:293)
                ... 3 more



Here kc2 is the removed instance.

Kind Regards,
Sarp Kaya


From: Stian Thorgersen <sthorger at redhat.com<mailto:sthorger at redhat.com>>
Reply-To: "stian at redhat.com<mailto:stian at redhat.com>" <stian at redhat.com<mailto:stian at redhat.com>>
Date: Friday, July 1, 2016 at 7:17 PM
To: Abdullah Sarp Kaya <akaya at expedia.com<mailto:akaya at expedia.com>>
Cc: "keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>" <keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>>
Subject: Re: [keycloak-user] Lost session when removing an instance off cluster

Can you please include more details from the log if there is any, at least a full stack trace and not just the bit you've included. We also need to know details around how you've configured the caches and Infinispan.

On 1 July 2016 at 10:16, Sarp Kaya <akaya at expedia.com<mailto:akaya at expedia.com>> wrote:
Hello,

I have tried various ways of configuring infinispan but it just seems like if I deploy a new instance to the cluster and remove one, then some sessions are lost and an exception is thrown saying that it was not handled. This is the Infinispan exception:

Exceptionhandlingrequestto/auth/realms/realmname/protocol/openid-connect/auth:org.jboss.resteasy.spi.UnhandledException:org.infinispan.util.concurrent.TimeoutException:Replicationtimeoutfor79a0757ecab3atorg.jboss.resteasy.core.ExceptionHandler.handleException(ExceptionHandler.java:247) atorg.jboss.resteasy.core.SynchronousDispatcher.writeException(SynchronousDispatcher.java:168) atorg.jboss.resteasy.core.SynchronousDispatcher.writeResponse(SynchronousDispatcher.java:471) atorg.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:415) atorg.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:202) atorg.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.service(ServletContainerDispatcher.java:221) atorg.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:56) atorg.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:51) atjavax.servlet.http.HttpServlet.service(HttpServlet.java:790) atio.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:85) atio.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:129) atorg.keycloak.services.filters.KeycloakSessionServletFilter.doFilter(KeycloakSessionServletFilter.java:88) atio.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:60) atio.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131) atio.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.java:84) atio.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:62) atio.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36) atorg.wildfly.extension.undertow.security.SecurityContextAssociationHandler.handleRequest(SecurityContextAssociationHandler.java:78) atio.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) atio.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:131) atio.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:57) atio.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) atio.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:46) atio.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64) atio.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:60) atio.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:77) atio.undertow.security.handlers.NotificationReceiverHandler.handleRequest(NotificationReceiverHandler.java:50) atio.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43) atio.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) atorg.wildfly.extension.undertow.security.jacc.JACCContextIdHandler.handleRequest(JACCContextIdHandler.java:61) atio.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) atio.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) atio.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:284) atio.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:263) atio.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:81) atio.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:174) atio.undertow.server.Connectors.executeRootHandler(Connectors.java:202) atio.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:793) atjava.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) atjava.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) atjava.lang.Thread.run(Thread.java:745) Causedby:org.infinispan.util.concurrent.TimeoutException:Replicationtimeoutfor79a0757ecab3atorg.infinispan.remoting.transport.jgroups.JGroupsTransport.checkRsp(JGroupsTransport.java:765) atorg.infinispan.remoting.transport.jgroups.JGroupsTransport.lambda$invokeRemotelyAsync$72(JGroupsTransport.java:599) atjava.util.concurrent.CompletableFuture.uniApply(CompletableFuture.java:602) atjava.util.concurrent.CompletableFuture$UniApply.tryFire(CompletableFuture.java:577) atjava.util.concurrent.CompletableFuture.postComplete(CompletableFuture.java:474) atjava.util.concurrent.CompletableFuture.complete(CompletableFuture.java:1962) atorg.infinispan.remoting.transport.jgroups.SingleResponseFuture.call(SingleResponseFuture.java:46) atorg.infinispan.remoting.transport.jgroups.SingleResponseFuture.call(SingleResponseFuture.java:17) atjava.util.concurrent.FutureTask.run(FutureTask.java:266) atjava.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$201(ScheduledThreadPoolExecutor.java:180)

This causes browsers to see Internal Server Error. Shouldn?t that be handled in Keycloak as lost session, therefore KC should try to handle it rather than showing that it?s an Internal Server Error?

My current infinispan configuration looks like this:


<distributed-cache name="sessions" mode="SYNC">
    <transaction mode="NON_DURABLE_XA"/>
</distributed-cache>

I use Keycloak version 1.9.5. My question is am I doing something wrong with my configuration? I tried both replicated-cache and distributed-cache and tried all transaction mode on both of them. None of them seems to solve the error that I?ve had above.

Kind Regards,
Sarp Kaya




_______________________________________________
keycloak-user mailing list
keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>
https://lists.jboss.org/mailman/listinfo/keycloak-user


-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160705/7ff56054/attachment-0001.html 

From sthorger at redhat.com  Tue Jul  5 02:58:52 2016
From: sthorger at redhat.com (Stian Thorgersen)
Date: Tue, 5 Jul 2016 08:58:52 +0200
Subject: [keycloak-user] Lost session when removing an instance off
	cluster
In-Reply-To: <D3A19491.6122%akaya@expedia.com>
References: <D39C63FE.5FCC%akaya@expedia.com>
	<CAJgngAfJoYUzbtLtU1aAkVrBmE3s7_XOxCCTh8ywVBVth9ZprQ@mail.gmail.com>
	<D3A01882.6050%akaya@expedia.com> <D3A0A0EA.60C9%akaya@expedia.com>
	<CAJgngAf9wEYCwzYWaQPqK7jXWdNwxEx9KHQZrryuWn0sfU=aTA@mail.gmail.com>
	<D3A19491.6122%akaya@expedia.com>
Message-ID: <CAJgngAc9eWJz8tDhx8sVpaUoPhM5qec-TQ8z09Abpx_kU8e6PQ@mail.gmail.com>

There probably will be some errors from Infinispan when you remove a node
at least if there's ongoing replication/messages being sent to the cluster.

Can you try with the latest Keycloak and with the default clustering config
and only increasing owners? We have tested session failover ourselves and
it was working fine. So could be down to the way you've configured it or
could be an issue due to your network setup.

On 5 July 2016 at 08:50, Sarp Kaya <akaya at expedia.com> wrote:

> Hi Stian,
>
> You are right, it needs to have owner. By default the configuration had
> owners but as I experimented I forgot to add it. However adding owners does
> not fix the problem.
>
> Initially I also experimented this with offlineSessions and loginFailures
> being distributed-cache so logins were already failing with that (same
> issue, Internal Server Error being presented).
>
> Anyway, if worse case user needs to re-authenticate, then Internal Server
> Error problem should be fixed right? (it?s the below exception I have
> pasted) Because whenever there is org.jboss.resteasy.spi.UnhandledException
> then browsers will see 500, instead of logging in again (there could be
> something added as such as handling this exception and asking user to log
> in again).
>
> Kind Regards,
> Sarp Kaya
>
> From: Stian Thorgersen <sthorger at redhat.com>
> Reply-To: "stian at redhat.com" <stian at redhat.com>
> Date: Tuesday, July 5, 2016 at 4:41 PM
> To: Abdullah Sarp Kaya <akaya at expedia.com>
> Cc: "keycloak-user at lists.jboss.org" <keycloak-user at lists.jboss.org>
> Subject: Re: [keycloak-user] Lost session when removing an instance off
> cluster
>
> The sessions cache is a distributed-cache, but by default it only has 1
> owner of each segment. This means that sessions are not replicated to
> multiple nodes. So it's expected that you loose sessions when a node is
> removed. If you want sessions to survive the removal of a node you should
> increase the number of owners for the cache. For example:
>
>     <distributed-cache name="sessions" mode="SYNC" owners="2"/>
>
> We've not actually tried with enabling transactions on the sessions, but I
> would say performance is more important. Worst case scenario is that a
> session is lost and a user has to re-authenticate.
>
> BTW the config you have for offlineSessions and loginFailures are wrong
> they both need to be distributed caches as well in clustered mode:
>
>     <distributed-cache name="offlineSessions" mode="SYNC" owners="1"/>
>     <distributed-cache name="loginFailures" mode="SYNC" owners="1"/>
>
>
> On 4 July 2016 at 15:45, Sarp Kaya <akaya at expedia.com> wrote:
>
>> Just to add on this.
>>
>> I think I misunderstood something or Keycloak does not really implement
>> the infinispan caching lifetime correctly.
>>
>> So first thing I did is to TRACE the infinispan logs. So I added this
>> logger in standalone.xml:
>>
>> <logger category="org.infinispan">
>>     <level name="TRACE"/>
>> </logger>
>>
>>
>> The next thing I did is to do the timing. Basically my test is that what
>> happens when I log in. I also enabled events and printing the events as
>> well.
>>
>> What I found is:
>>
>>
>>    1. Login event is triggered at 13:18:35,193 in Keycloak.
>>    2. The browser got the full response at 13:18:35,273
>>    3. Now the surprising part is the fact that there are whole a lot of
>>    infinispan logging out occurring for ?sessions? cache after the browser got
>>    the response. The last log message occurring is like this:
>>
>> 2016-07-04 13:18:35,345 TRACE [org.infinispan.remoting.rpc.RpcManagerImpl] (default task-4) Response(s) to TxCompletionNotificationCommand{ xid=null, internalId=0, topologyId=19, gtx=GlobalTransaction:<kc1>:239:local, cacheName=sessions}  is {}
>>
>>
>> To see the all the logs after event trigger please check here:
>> <http://pastebin.com/pkvYP07T> <http://pastebin.com/pkvYP07T>
>> <http://pastebin.com/pkvYP07T> <http://pastebin.com/pkvYP07T>
>> http://pastebin.com/p4K2Ghff
>>
>> So my understanding was that I marked sessions as SYNC, which meant to me
>> that it is supposed to do all of the synchronization before it sends the
>> response back to the browser. If it does the other way around then it
>> should be ASYNC mode. Could you please clarify the intended/expected
>> behavior?
>>
>> Kind Regards,
>> Sarp Kaya
>>
>>
>> From: Abdullah Sarp Kaya <akaya at expedia.com>
>> Date: Monday, July 4, 2016 at 9:59 PM
>> To: "stian at redhat.com" <stian at redhat.com>
>> Cc: "keycloak-user at lists.jboss.org" <keycloak-user at lists.jboss.org>
>> Subject: Re: [keycloak-user] Lost session when removing an instance off
>> cluster
>>
>> Hello,
>>
>> Below is exactly how Infinispan is configured:
>>
>> <subsystem xmlns="urn:jboss:domain:infinispan:4.0">
>>     <cache-container name="keycloak" jndi-name="infinispan/Keycloak">
>>     <transport lock-timeout="60000"/>
>>     <invalidation-cache name="realms" mode="SYNC"/>
>>     <invalidation-cache name="users" mode="SYNC">
>>         <eviction max-entries="10000" strategy="LRU"/>
>>     </invalidation-cache>
>>     <distributed-cache xmlns="" name="sessions" mode="SYNC">
>>         <transaction mode="NON_DURABLE_XA"/>
>>     </distributed-cache>
>>     <local-cache xmlns="" name="offlineSessions"/>
>>     <local-cache xmlns="" name="loginFailures"/>
>>     <replicated-cache name="work" mode="SYNC"/>
>>     <local-cache name="realmVersions">
>>         <transaction mode="BATCH" locking="PESSIMISTIC"/>
>>     </local-cache>
>> </cache-container>
>> <cache-container name="server" aliases="singleton cluster" default-cache="default" module="org.wildfly.clustering.server">
>>     <transport lock-timeout="60000"/>
>>     <replicated-cache name="default" mode="SYNC">
>>         <transaction mode="BATCH"/>
>>     </replicated-cache>
>> </cache-container>
>> <cache-container name="web" default-cache="dist" module="org.wildfly.clustering.web.infinispan">
>>     <transport lock-timeout="60000"/>
>>     <distributed-cache name="dist" mode="ASYNC" l1-lifespan="0" owners="2">
>>         <locking isolation="REPEATABLE_READ"/>
>>         <transaction mode="BATCH"/>
>>         <file-store/>
>>     </distributed-cache>
>> </cache-container>
>> <cache-container name="ejb" aliases="sfsb" default-cache="dist" module="org.wildfly.clustering.ejb.infinispan">
>>     <transport lock-timeout="60000"/>
>>     <distributed-cache name="dist" mode="ASYNC" l1-lifespan="0" owners="2">
>>         <locking isolation="REPEATABLE_READ"/>
>>         <transaction mode="BATCH"/>
>>         <file-store/>
>>     </distributed-cache>
>> </cache-container>
>> <cache-container name="hibernate" default-cache="local-query" module="org.hibernate.infinispan">
>>     <transport lock-timeout="60000"/>
>>     <invalidation-cache name="entity" mode="SYNC">
>>         <transaction mode="NON_XA"/>
>>         <eviction strategy="LRU" max-entries="10000"/>
>>         <expiration max-idle="100000"/>
>>     </invalidation-cache>
>>     <local-cache name="local-query">
>>         <eviction strategy="LRU" max-entries="10000"/>
>>         <expiration max-idle="100000"/>
>>     </local-cache>
>>     <replicated-cache name="timestamps" mode="ASYNC"/>
>> </cache-container>
>> </subsystem>
>>
>>
>>
>>
>> This is the complete exception:
>>
>> 03:49:40,241 ERROR
>> [org.infinispan.interceptors.InvocationContextInterceptor] (default
>> task-12) ISPN000136: Error executing command PutKeyValueCommand, writing
>> keys [ba74e523-3299-42b3-801e-9f8cb5a0d81d]:
>> org.infinispan.util.concurrent.TimeoutException: Replication timeout for kc2
>>         at
>> org.infinispan.remoting.transport.jgroups.JGroupsTransport.checkRsp(JGroupsTransport.java:765)
>>         at
>> org.infinispan.remoting.transport.jgroups.JGroupsTransport.lambda$invokeRemotelyAsync$73(JGroupsTransport.java:612)
>>         at
>> java.util.concurrent.CompletableFuture.uniApply(CompletableFuture.java:602)
>>         at
>> java.util.concurrent.CompletableFuture$UniApply.tryFire(CompletableFuture.java:577)
>>         at
>> java.util.concurrent.CompletableFuture.postComplete(CompletableFuture.java:474)
>>         at
>> java.util.concurrent.CompletableFuture.complete(CompletableFuture.java:1962)
>>         at
>> org.infinispan.remoting.transport.jgroups.RspListFuture.call(RspListFuture.java:47)
>>         at
>> org.infinispan.remoting.transport.jgroups.RspListFuture.call(RspListFuture.java:16)
>>         at java.util.concurrent.FutureTask.run(FutureTask.java:266)
>>         at
>> java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$201(ScheduledThreadPoolExecutor.java:180)
>>         at
>> java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:293)
>>         at
>> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
>>         at
>> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
>>         at java.lang.Thread.run(Thread.java:745)
>>
>> 03:49:40,250 ERROR [org.jboss.resteasy.resteasy_jaxrs.i18n] (default
>> task-12) RESTEASY002025: Unknown exception while executing GET
>> /realms/partner-dmz/protocol/openid-connect/auth:
>> org.infinispan.util.concurrent.TimeoutException: Replication timeout for kc2
>>         at
>> org.infinispan.remoting.transport.jgroups.JGroupsTransport.checkRsp(JGroupsTransport.java:765)
>>         at
>> org.infinispan.remoting.transport.jgroups.JGroupsTransport.lambda$invokeRemotelyAsync$73(JGroupsTransport.java:612)
>>         at
>> java.util.concurrent.CompletableFuture.uniApply(CompletableFuture.java:602)
>>         at
>> java.util.concurrent.CompletableFuture$UniApply.tryFire(CompletableFuture.java:577)
>>         at
>> java.util.concurrent.CompletableFuture.postComplete(CompletableFuture.java:474)
>>         at
>> java.util.concurrent.CompletableFuture.complete(CompletableFuture.java:1962)
>>         at
>> org.infinispan.remoting.transport.jgroups.RspListFuture.call(RspListFuture.java:47)
>>         at
>> org.infinispan.remoting.transport.jgroups.RspListFuture.call(RspListFuture.java:16)
>>         at java.util.concurrent.FutureTask.run(FutureTask.java:266)
>>         at
>> java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$201(ScheduledThreadPoolExecutor.java:180)
>>         at
>> java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:293)
>>         at
>> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
>>         at
>> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
>>         at java.lang.Thread.run(Thread.java:745)
>>
>> 03:49:40,257 ERROR [io.undertow.request] (default task-12) UT005023:
>> Exception handling request to
>> /auth/realms/partner-dmz/protocol/openid-connect/auth:
>> org.jboss.resteasy.spi.UnhandledException:
>> org.infinispan.util.concurrent.TimeoutException: Replication timeout for kc2
>>         at
>> org.jboss.resteasy.core.ExceptionHandler.handleException(ExceptionHandler.java:247)
>>         at
>> org.jboss.resteasy.core.SynchronousDispatcher.writeException(SynchronousDispatcher.java:168)
>>         at
>> org.jboss.resteasy.core.SynchronousDispatcher.writeResponse(SynchronousDispatcher.java:471)
>>         at
>> org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:415)
>>         at
>> org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:202)
>>         at
>> org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.service(ServletContainerDispatcher.java:221)
>>         at
>> org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:56)
>>         at
>> org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:51)
>>         at javax.servlet.http.HttpServlet.service(HttpServlet.java:790)
>>         at
>> io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:85)
>>         at
>> io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:129)
>>         at
>> org.keycloak.services.filters.KeycloakSessionServletFilter.doFilter(KeycloakSessionServletFilter.java:88)
>>         at
>> io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:60)
>>         at
>> io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
>>         at
>> io.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.java:84)
>>         at
>> io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:62)
>>         at
>> io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36)
>>         at
>> org.wildfly.extension.undertow.security.SecurityContextAssociationHandler.handleRequest(SecurityContextAssociationHandler.java:78)
>>         at
>> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
>>         at
>> io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:131)
>>         at
>> io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:57)
>>         at
>> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
>>         at
>> io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:46)
>>         at
>> io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64)
>>         at
>> io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:60)
>>         at
>> io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:77)
>>         at
>> io.undertow.security.handlers.NotificationReceiverHandler.handleRequest(NotificationReceiverHandler.java:50)
>>         at
>> io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43)
>>         at
>> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
>>         at
>> org.wildfly.extension.undertow.security.jacc.JACCContextIdHandler.handleRequest(JACCContextIdHandler.java:61)
>>         at
>> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
>>         at
>> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
>>         at
>> io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:284)
>>         at
>> io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:263)
>>         at
>> io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:81)
>>         at
>> io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:174)
>>         at
>> io.undertow.server.Connectors.executeRootHandler(Connectors.java:202)
>>         at
>> io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:793)
>>         at
>> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
>>         at
>> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
>>         at java.lang.Thread.run(Thread.java:745)
>> Caused by: org.infinispan.util.concurrent.TimeoutException: Replication
>> timeout for kc2
>>         at
>> org.infinispan.remoting.transport.jgroups.JGroupsTransport.checkRsp(JGroupsTransport.java:765)
>>         at
>> org.infinispan.remoting.transport.jgroups.JGroupsTransport.lambda$invokeRemotelyAsync$73(JGroupsTransport.java:612)
>>         at
>> java.util.concurrent.CompletableFuture.uniApply(CompletableFuture.java:602)
>>         at
>> java.util.concurrent.CompletableFuture$UniApply.tryFire(CompletableFuture.java:577)
>>         at
>> java.util.concurrent.CompletableFuture.postComplete(CompletableFuture.java:474)
>>         at
>> java.util.concurrent.CompletableFuture.complete(CompletableFuture.java:1962)
>>         at
>> org.infinispan.remoting.transport.jgroups.RspListFuture.call(RspListFuture.java:47)
>>         at
>> org.infinispan.remoting.transport.jgroups.RspListFuture.call(RspListFuture.java:16)
>>         at java.util.concurrent.FutureTask.run(FutureTask.java:266)
>>         at
>> java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$201(ScheduledThreadPoolExecutor.java:180)
>>         at
>> java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:293)
>>         ... 3 more
>>
>> 03:49:41,251 ERROR
>> [org.infinispan.interceptors.InvocationContextInterceptor] (default task-3)
>> ISPN000136: Error executing command PrepareCommand, writing keys
>> [02cff8bb-0ab9-4ab9-905f-17ffb3226050]:
>> org.infinispan.util.concurrent.TimeoutException: Replication timeout for kc2
>>         at
>> org.infinispan.remoting.transport.jgroups.JGroupsTransport.checkRsp(JGroupsTransport.java:765)
>>         at
>> org.infinispan.remoting.transport.jgroups.JGroupsTransport.lambda$invokeRemotelyAsync$73(JGroupsTransport.java:612)
>>         at
>> java.util.concurrent.CompletableFuture.uniApply(CompletableFuture.java:602)
>>         at
>> java.util.concurrent.CompletableFuture$UniApply.tryFire(CompletableFuture.java:577)
>>         at
>> java.util.concurrent.CompletableFuture.postComplete(CompletableFuture.java:474)
>>         at
>> java.util.concurrent.CompletableFuture.complete(CompletableFuture.java:1962)
>>         at
>> org.infinispan.remoting.transport.jgroups.RspListFuture.call(RspListFuture.java:47)
>>         at
>> org.infinispan.remoting.transport.jgroups.RspListFuture.call(RspListFuture.java:16)
>>         at java.util.concurrent.FutureTask.run(FutureTask.java:266)
>>         at
>> java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$201(ScheduledThreadPoolExecutor.java:180)
>>         at
>> java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:293)
>>         at
>> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
>>         at
>> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
>>         at java.lang.Thread.run(Thread.java:745)
>>
>> 03:49:41,258 ERROR
>> [org.infinispan.transaction.impl.TransactionCoordinator] (default task-3)
>> ISPN000097: Error while processing a prepare in a single-phase transaction:
>> org.infinispan.util.concurrent.TimeoutException: Replication timeout for kc2
>>         at
>> org.infinispan.remoting.transport.jgroups.JGroupsTransport.checkRsp(JGroupsTransport.java:765)
>>         at
>> org.infinispan.remoting.transport.jgroups.JGroupsTransport.lambda$invokeRemotelyAsync$73(JGroupsTransport.java:612)
>>         at
>> java.util.concurrent.CompletableFuture.uniApply(CompletableFuture.java:602)
>>         at
>> java.util.concurrent.CompletableFuture$UniApply.tryFire(CompletableFuture.java:577)
>>         at
>> java.util.concurrent.CompletableFuture.postComplete(CompletableFuture.java:474)
>>         at
>> java.util.concurrent.CompletableFuture.complete(CompletableFuture.java:1962)
>>         at
>> org.infinispan.remoting.transport.jgroups.RspListFuture.call(RspListFuture.java:47)
>>         at
>> org.infinispan.remoting.transport.jgroups.RspListFuture.call(RspListFuture.java:16)
>>         at java.util.concurrent.FutureTask.run(FutureTask.java:266)
>>         at
>> java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$201(ScheduledThreadPoolExecutor.java:180)
>>         at
>> java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:293)
>>         at
>> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
>>         at
>> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
>>         at java.lang.Thread.run(Thread.java:745)
>>
>> 03:49:45,504 INFO
>>  [org.infinispan.remoting.transport.jgroups.JGroupsTransport]
>> (Incoming-3,dev,kc1) ISPN000094: Received new cluster view for channel
>> server: [kc1|4] (1) [kc1]
>> 03:49:45,507 INFO
>>  [org.infinispan.remoting.transport.jgroups.JGroupsTransport]
>> (Incoming-3,dev,kc1) ISPN000094: Received new cluster view for channel
>> keycloak: [kc1|4] (1) [kc1]
>> 03:49:45,534 INFO
>>  [org.infinispan.remoting.transport.jgroups.JGroupsTransport]
>> (Incoming-3,dev,kc1) ISPN000094: Received new cluster view for channel web:
>> [kc1|4] (1) [kc1]
>> 03:49:45,538 INFO
>>  [org.infinispan.remoting.transport.jgroups.JGroupsTransport]
>> (Incoming-3,dev,kc1) ISPN000094: Received new cluster view for channel ejb:
>> [kc1|4] (1) [kc1]
>> 03:49:45,548 WARN  [com.arjuna.ats.jta] (default task-3) ARJUNA016039:
>> onePhaseCommit on < formatId=131077, gtrid_length=29, bqual_length=36,
>> tx_uid=0:ffffac110003:-7fcaa87f:5779dc60:f01, node_name=1,
>> branch_uid=0:ffffac110003:-7fcaa87f:5779dc60:f02, subordinatenodename=null,
>> eis_name=unknown eis name >
>> (TransactionXaAdapter{localTransaction=LocalXaTransaction{xid=<
>> formatId=131077, gtrid_length=29, bqual_length=36,
>> tx_uid=0:ffffac110003:-7fcaa87f:5779dc60:f01, node_name=1,
>> branch_uid=0:ffffac110003:-7fcaa87f:5779dc60:f02, subordinatenodename=null,
>> eis_name=unknown eis name >} LocalTransaction{remoteLockedNodes=null,
>> isMarkedForRollback=false, lockedKeys=null, backupKeyLocks=null,
>> topologyId=6, stateTransferFlag=null}
>> org.infinispan.transaction.xa.LocalXaTransaction at 3ef}) failed with
>> exception XAException.XA_HEURRB: javax.transaction.xa.XAException
>>         at
>> org.infinispan.transaction.impl.TransactionCoordinator.handleCommitFailure(TransactionCoordinator.java:213)
>>         at
>> org.infinispan.transaction.impl.TransactionCoordinator.commit(TransactionCoordinator.java:159)
>>         at
>> org.infinispan.transaction.xa.TransactionXaAdapter.commit(TransactionXaAdapter.java:112)
>>         at
>> com.arjuna.ats.internal.jta.resources.arjunacore.XAResourceRecord.topLevelOnePhaseCommit(XAResourceRecord.java:704)
>>         at
>> com.arjuna.ats.arjuna.coordinator.BasicAction.onePhaseCommit(BasicAction.java:2366)
>>         at
>> com.arjuna.ats.arjuna.coordinator.BasicAction.End(BasicAction.java:1495)
>>         at
>> com.arjuna.ats.arjuna.coordinator.TwoPhaseCoordinator.end(TwoPhaseCoordinator.java:96)
>>         at
>> com.arjuna.ats.arjuna.AtomicAction.commit(AtomicAction.java:162)
>>         at
>> com.arjuna.ats.internal.jta.transaction.arjunacore.TransactionImple.commitAndDisassociate(TransactionImple.java:1200)
>>         at
>> com.arjuna.ats.internal.jta.transaction.arjunacore.BaseTransaction.commit(BaseTransaction.java:126)
>>         at
>> com.arjuna.ats.jbossatx.BaseTransactionManagerDelegate.commit(BaseTransactionManagerDelegate.java:89)
>>         at
>> org.infinispan.cache.impl.CacheImpl.tryCommit(CacheImpl.java:1722)
>>         at
>> org.infinispan.cache.impl.CacheImpl.executeCommandAndCommitIfNeeded(CacheImpl.java:1679)
>>         at
>> org.infinispan.cache.impl.CacheImpl.putInternal(CacheImpl.java:1121)
>>         at org.infinispan.cache.impl.CacheImpl.put(CacheImpl.java:1111)
>>         at org.infinispan.cache.impl.CacheImpl.put(CacheImpl.java:1742)
>>         at org.infinispan.cache.impl.CacheImpl.put(CacheImpl.java:248)
>>         at
>> org.infinispan.cache.impl.AbstractDelegatingCache.put(AbstractDelegatingCache.java:291)
>>         at
>> org.keycloak.models.sessions.infinispan.InfinispanUserSessionProvider$InfinispanKeycloakTransaction$CacheTask.execute(InfinispanUserSessionProvider.java:854)
>>         at
>> org.keycloak.models.sessions.infinispan.InfinispanUserSessionProvider$InfinispanKeycloakTransaction.commit(InfinispanUserSessionProvider.java:750)
>>         at
>> org.keycloak.services.DefaultKeycloakTransactionManager.commit(DefaultKeycloakTransactionManager.java:104)
>>         at
>> org.keycloak.services.filters.KeycloakTransactionCommitter.filter(KeycloakTransactionCommitter.java:43)
>>         at
>> org.jboss.resteasy.core.ServerResponseWriter.executeFilters(ServerResponseWriter.java:121)
>>         at
>> org.jboss.resteasy.core.ServerResponseWriter.writeNomapResponse(ServerResponseWriter.java:48)
>>         at
>> org.jboss.resteasy.core.SynchronousDispatcher.writeResponse(SynchronousDispatcher.java:466)
>>         at
>> org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:415)
>>         at
>> org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:202)
>>         at
>> org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.service(ServletContainerDispatcher.java:221)
>>         at
>> org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:56)
>>         at
>> org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:51)
>>         at javax.servlet.http.HttpServlet.service(HttpServlet.java:790)
>>         at
>> io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:85)
>>         at
>> io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:129)
>>         at
>> org.keycloak.services.filters.KeycloakSessionServletFilter.doFilter(KeycloakSessionServletFilter.java:88)
>>         at
>> io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:60)
>>         at
>> io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
>>         at
>> io.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.java:84)
>>         at
>> io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:62)
>>         at
>> io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36)
>>         at
>> org.wildfly.extension.undertow.security.SecurityContextAssociationHandler.handleRequest(SecurityContextAssociationHandler.java:78)
>>         at
>> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
>>         at
>> io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:131)
>>         at
>> io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:57)
>>         at
>> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
>>         at
>> io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:46)
>>         at
>> io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64)
>>         at
>> io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:60)
>>         at
>> io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:77)
>>         at
>> io.undertow.security.handlers.NotificationReceiverHandler.handleRequest(NotificationReceiverHandler.java:50)
>>         at
>> io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43)
>>         at
>> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
>>         at
>> org.wildfly.extension.undertow.security.jacc.JACCContextIdHandler.handleRequest(JACCContextIdHandler.java:61)
>>         at
>> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
>>         at
>> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
>>         at
>> io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:284)
>>         at
>> io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:263)
>>         at
>> io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:81)
>>         at
>> io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:174)
>>         at
>> io.undertow.server.Connectors.executeRootHandler(Connectors.java:202)
>>         at
>> io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:793)
>>         at
>> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
>>         at
>> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
>>         at java.lang.Thread.run(Thread.java:745)
>> Caused by: org.infinispan.util.concurrent.TimeoutException: Replication
>> timeout for kc2
>>         at
>> org.infinispan.remoting.transport.jgroups.JGroupsTransport.checkRsp(JGroupsTransport.java:765)
>>         at
>> org.infinispan.remoting.transport.jgroups.JGroupsTransport.lambda$invokeRemotelyAsync$73(JGroupsTransport.java:612)
>>         at
>> java.util.concurrent.CompletableFuture.uniApply(CompletableFuture.java:602)
>>         at
>> java.util.concurrent.CompletableFuture$UniApply.tryFire(CompletableFuture.java:577)
>>         at
>> java.util.concurrent.CompletableFuture.postComplete(CompletableFuture.java:474)
>>         at
>> java.util.concurrent.CompletableFuture.complete(CompletableFuture.java:1962)
>>         at
>> org.infinispan.remoting.transport.jgroups.RspListFuture.call(RspListFuture.java:47)
>>         at
>> org.infinispan.remoting.transport.jgroups.RspListFuture.call(RspListFuture.java:16)
>>         at java.util.concurrent.FutureTask.run(FutureTask.java:266)
>>         at
>> java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$201(ScheduledThreadPoolExecutor.java:180)
>>         at
>> java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:293)
>>         ... 3 more
>>
>> 03:49:45,563 WARN  [org.infinispan.cache.impl.CacheImpl] (default task-3)
>> ISPN000160: Could not complete injected transaction.:
>> javax.transaction.RollbackException: ARJUNA016053: Could not commit
>> transaction.
>>         at
>> com.arjuna.ats.internal.jta.transaction.arjunacore.TransactionImple.commitAndDisassociate(TransactionImple.java:1212)
>>         at
>> com.arjuna.ats.internal.jta.transaction.arjunacore.BaseTransaction.commit(BaseTransaction.java:126)
>>         at
>> com.arjuna.ats.jbossatx.BaseTransactionManagerDelegate.commit(BaseTransactionManagerDelegate.java:89)
>>         at
>> org.infinispan.cache.impl.CacheImpl.tryCommit(CacheImpl.java:1722)
>>         at
>> org.infinispan.cache.impl.CacheImpl.executeCommandAndCommitIfNeeded(CacheImpl.java:1679)
>>         at
>> org.infinispan.cache.impl.CacheImpl.putInternal(CacheImpl.java:1121)
>>         at org.infinispan.cache.impl.CacheImpl.put(CacheImpl.java:1111)
>>         at org.infinispan.cache.impl.CacheImpl.put(CacheImpl.java:1742)
>>         at org.infinispan.cache.impl.CacheImpl.put(CacheImpl.java:248)
>>         at
>> org.infinispan.cache.impl.AbstractDelegatingCache.put(AbstractDelegatingCache.java:291)
>>         at
>> org.keycloak.models.sessions.infinispan.InfinispanUserSessionProvider$InfinispanKeycloakTransaction$CacheTask.execute(InfinispanUserSessionProvider.java:854)
>>         at
>> org.keycloak.models.sessions.infinispan.InfinispanUserSessionProvider$InfinispanKeycloakTransaction.commit(InfinispanUserSessionProvider.java:750)
>>         at
>> org.keycloak.services.DefaultKeycloakTransactionManager.commit(DefaultKeycloakTransactionManager.java:104)
>>         at
>> org.keycloak.services.filters.KeycloakTransactionCommitter.filter(KeycloakTransactionCommitter.java:43)
>>         at
>> org.jboss.resteasy.core.ServerResponseWriter.executeFilters(ServerResponseWriter.java:121)
>>         at
>> org.jboss.resteasy.core.ServerResponseWriter.writeNomapResponse(ServerResponseWriter.java:48)
>>         at
>> org.jboss.resteasy.core.SynchronousDispatcher.writeResponse(SynchronousDispatcher.java:466)
>>         at
>> org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:415)
>>         at
>> org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:202)
>>         at
>> org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.service(ServletContainerDispatcher.java:221)
>>         at
>> org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:56)
>>         at
>> org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:51)
>>         at javax.servlet.http.HttpServlet.service(HttpServlet.java:790)
>>         at
>> io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:85)
>>         at
>> io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:129)
>>         at
>> org.keycloak.services.filters.KeycloakSessionServletFilter.doFilter(KeycloakSessionServletFilter.java:88)
>>         at
>> io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:60)
>>         at
>> io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
>>         at
>> io.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.java:84)
>>         at
>> io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:62)
>>         at
>> io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36)
>>         at
>> org.wildfly.extension.undertow.security.SecurityContextAssociationHandler.handleRequest(SecurityContextAssociationHandler.java:78)
>>         at
>> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
>>         at
>> io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:131)
>>         at
>> io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:57)
>>         at
>> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
>>         at
>> io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:46)
>>         at
>> io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64)
>>         at
>> io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:60)
>>         at
>> io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:77)
>>         at
>> io.undertow.security.handlers.NotificationReceiverHandler.handleRequest(NotificationReceiverHandler.java:50)
>>         at
>> io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43)
>>         at
>> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
>>         at
>> org.wildfly.extension.undertow.security.jacc.JACCContextIdHandler.handleRequest(JACCContextIdHandler.java:61)
>>         at
>> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
>>         at
>> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
>>         at
>> io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:284)
>>         at
>> io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:263)
>>         at
>> io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:81)
>>         at
>> io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:174)
>>         at
>> io.undertow.server.Connectors.executeRootHandler(Connectors.java:202)
>>         at
>> io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:793)
>>         at
>> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
>>         at
>> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
>>         at java.lang.Thread.run(Thread.java:745)
>>         Suppressed: javax.transaction.xa.XAException
>>                 at
>> org.infinispan.transaction.impl.TransactionCoordinator.handleCommitFailure(TransactionCoordinator.java:213)
>>                 at
>> org.infinispan.transaction.impl.TransactionCoordinator.commit(TransactionCoordinator.java:159)
>>                 at
>> org.infinispan.transaction.xa.TransactionXaAdapter.commit(TransactionXaAdapter.java:112)
>>                 at
>> com.arjuna.ats.internal.jta.resources.arjunacore.XAResourceRecord.topLevelOnePhaseCommit(XAResourceRecord.java:704)
>>                 at
>> com.arjuna.ats.arjuna.coordinator.BasicAction.onePhaseCommit(BasicAction.java:2366)
>>                 at
>> com.arjuna.ats.arjuna.coordinator.BasicAction.End(BasicAction.java:1495)
>>                 at
>> com.arjuna.ats.arjuna.coordinator.TwoPhaseCoordinator.end(TwoPhaseCoordinator.java:96)
>>                 at
>> com.arjuna.ats.arjuna.AtomicAction.commit(AtomicAction.java:162)
>>                 at
>> com.arjuna.ats.internal.jta.transaction.arjunacore.TransactionImple.commitAndDisassociate(TransactionImple.java:1200)
>>                 ... 54 more
>>         Caused by: org.infinispan.util.concurrent.TimeoutException:
>> Replication timeout for kc2
>>                 at
>> org.infinispan.remoting.transport.jgroups.JGroupsTransport.checkRsp(JGroupsTransport.java:765)
>>                 at
>> org.infinispan.remoting.transport.jgroups.JGroupsTransport.lambda$invokeRemotelyAsync$73(JGroupsTransport.java:612)
>>                 at
>> java.util.concurrent.CompletableFuture.uniApply(CompletableFuture.java:602)
>>                 at
>> java.util.concurrent.CompletableFuture$UniApply.tryFire(CompletableFuture.java:577)
>>                 at
>> java.util.concurrent.CompletableFuture.postComplete(CompletableFuture.java:474)
>>                 at
>> java.util.concurrent.CompletableFuture.complete(CompletableFuture.java:1962)
>>                 at
>> org.infinispan.remoting.transport.jgroups.RspListFuture.call(RspListFuture.java:47)
>>                 at
>> org.infinispan.remoting.transport.jgroups.RspListFuture.call(RspListFuture.java:16)
>>                 at
>> java.util.concurrent.FutureTask.run(FutureTask.java:266)
>>                 at
>> java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$201(ScheduledThreadPoolExecutor.java:180)
>>                 at
>> java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:293)
>>                 ... 3 more
>>
>> 03:49:45,575 INFO
>>  [org.infinispan.remoting.transport.jgroups.JGroupsTransport]
>> (Incoming-3,dev,kc1) ISPN000094: Received new cluster view for channel
>> hibernate: [kc1|4] (1) [kc1]
>> 03:49:45,575 ERROR [org.jboss.resteasy.resteasy_jaxrs.i18n] (default
>> task-3) RESTEASY002025: Unknown exception while executing GET
>> /realms/partner-dmz/protocol/openid-connect/auth:
>> org.infinispan.commons.CacheException: Could not commit implicit transaction
>>         at
>> org.infinispan.cache.impl.CacheImpl.tryCommit(CacheImpl.java:1725)
>>         at
>> org.infinispan.cache.impl.CacheImpl.executeCommandAndCommitIfNeeded(CacheImpl.java:1679)
>>         at
>> org.infinispan.cache.impl.CacheImpl.putInternal(CacheImpl.java:1121)
>>         at org.infinispan.cache.impl.CacheImpl.put(CacheImpl.java:1111)
>>         at org.infinispan.cache.impl.CacheImpl.put(CacheImpl.java:1742)
>>         at org.infinispan.cache.impl.CacheImpl.put(CacheImpl.java:248)
>>         at
>> org.infinispan.cache.impl.AbstractDelegatingCache.put(AbstractDelegatingCache.java:291)
>>         at
>> org.keycloak.models.sessions.infinispan.InfinispanUserSessionProvider$InfinispanKeycloakTransaction$CacheTask.execute(InfinispanUserSessionProvider.java:854)
>>         at
>> org.keycloak.models.sessions.infinispan.InfinispanUserSessionProvider$InfinispanKeycloakTransaction.commit(InfinispanUserSessionProvider.java:750)
>>         at
>> org.keycloak.services.DefaultKeycloakTransactionManager.commit(DefaultKeycloakTransactionManager.java:104)
>>         at
>> org.keycloak.services.filters.KeycloakTransactionCommitter.filter(KeycloakTransactionCommitter.java:43)
>>         at
>> org.jboss.resteasy.core.ServerResponseWriter.executeFilters(ServerResponseWriter.java:121)
>>         at
>> org.jboss.resteasy.core.ServerResponseWriter.writeNomapResponse(ServerResponseWriter.java:48)
>>         at
>> org.jboss.resteasy.core.SynchronousDispatcher.writeResponse(SynchronousDispatcher.java:466)
>>         at
>> org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:415)
>>         at
>> org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:202)
>>         at
>> org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.service(ServletContainerDispatcher.java:221)
>>         at
>> org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:56)
>>         at
>> org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:51)
>>         at javax.servlet.http.HttpServlet.service(HttpServlet.java:790)
>>         at
>> io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:85)
>>         at
>> io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:129)
>>         at
>> org.keycloak.services.filters.KeycloakSessionServletFilter.doFilter(KeycloakSessionServletFilter.java:88)
>>         at
>> io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:60)
>>         at
>> io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
>>         at
>> io.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.java:84)
>>         at
>> io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:62)
>>         at
>> io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36)
>>         at
>> org.wildfly.extension.undertow.security.SecurityContextAssociationHandler.handleRequest(SecurityContextAssociationHandler.java:78)
>>         at
>> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
>>         at
>> io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:131)
>>         at
>> io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:57)
>>         at
>> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
>>         at
>> io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:46)
>>         at
>> io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64)
>>         at
>> io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:60)
>>         at
>> io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:77)
>>         at
>> io.undertow.security.handlers.NotificationReceiverHandler.handleRequest(NotificationReceiverHandler.java:50)
>>         at
>> io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43)
>>         at
>> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
>>         at
>> org.wildfly.extension.undertow.security.jacc.JACCContextIdHandler.handleRequest(JACCContextIdHandler.java:61)
>>         at
>> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
>>         at
>> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
>>         at
>> io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:284)
>>         at
>> io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:263)
>>         at
>> io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:81)
>>         at
>> io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:174)
>>         at
>> io.undertow.server.Connectors.executeRootHandler(Connectors.java:202)
>>         at
>> io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:793)
>>         at
>> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
>>         at
>> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
>>         at java.lang.Thread.run(Thread.java:745)
>> Caused by: javax.transaction.RollbackException: ARJUNA016053: Could not
>> commit transaction.
>>         at
>> com.arjuna.ats.internal.jta.transaction.arjunacore.TransactionImple.commitAndDisassociate(TransactionImple.java:1212)
>>         at
>> com.arjuna.ats.internal.jta.transaction.arjunacore.BaseTransaction.commit(BaseTransaction.java:126)
>>         at
>> com.arjuna.ats.jbossatx.BaseTransactionManagerDelegate.commit(BaseTransactionManagerDelegate.java:89)
>>         at
>> org.infinispan.cache.impl.CacheImpl.tryCommit(CacheImpl.java:1722)
>>         ... 51 more
>>         Suppressed: javax.transaction.xa.XAException
>>                 at
>> org.infinispan.transaction.impl.TransactionCoordinator.handleCommitFailure(TransactionCoordinator.java:213)
>>                 at
>> org.infinispan.transaction.impl.TransactionCoordinator.commit(TransactionCoordinator.java:159)
>>                 at
>> org.infinispan.transaction.xa.TransactionXaAdapter.commit(TransactionXaAdapter.java:112)
>>                 at
>> com.arjuna.ats.internal.jta.resources.arjunacore.XAResourceRecord.topLevelOnePhaseCommit(XAResourceRecord.java:704)
>>                 at
>> com.arjuna.ats.arjuna.coordinator.BasicAction.onePhaseCommit(BasicAction.java:2366)
>>                 at
>> com.arjuna.ats.arjuna.coordinator.BasicAction.End(BasicAction.java:1495)
>>                 at
>> com.arjuna.ats.arjuna.coordinator.TwoPhaseCoordinator.end(TwoPhaseCoordinator.java:96)
>>                 at
>> com.arjuna.ats.arjuna.AtomicAction.commit(AtomicAction.java:162)
>>                 at
>> com.arjuna.ats.internal.jta.transaction.arjunacore.TransactionImple.commitAndDisassociate(TransactionImple.java:1200)
>>                 ... 54 more
>>         Caused by: org.infinispan.util.concurrent.TimeoutException:
>> Replication timeout for kc2
>>                 at
>> org.infinispan.remoting.transport.jgroups.JGroupsTransport.checkRsp(JGroupsTransport.java:765)
>>                 at
>> org.infinispan.remoting.transport.jgroups.JGroupsTransport.lambda$invokeRemotelyAsync$73(JGroupsTransport.java:612)
>>                 at
>> java.util.concurrent.CompletableFuture.uniApply(CompletableFuture.java:602)
>>                 at
>> java.util.concurrent.CompletableFuture$UniApply.tryFire(CompletableFuture.java:577)
>>                 at
>> java.util.concurrent.CompletableFuture.postComplete(CompletableFuture.java:474)
>>                 at
>> java.util.concurrent.CompletableFuture.complete(CompletableFuture.java:1962)
>>                 at
>> org.infinispan.remoting.transport.jgroups.RspListFuture.call(RspListFuture.java:47)
>>                 at
>> org.infinispan.remoting.transport.jgroups.RspListFuture.call(RspListFuture.java:16)
>>                 at
>> java.util.concurrent.FutureTask.run(FutureTask.java:266)
>>                 at
>> java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$201(ScheduledThreadPoolExecutor.java:180)
>>                 at
>> java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:293)
>>                 ... 3 more
>>
>> 03:49:45,596 ERROR [io.undertow.request] (default task-3) UT005023:
>> Exception handling request to
>> /auth/realms/partner-dmz/protocol/openid-connect/auth:
>> org.jboss.resteasy.spi.UnhandledException:
>> org.infinispan.commons.CacheException: Could not commit implicit transaction
>>         at
>> org.jboss.resteasy.core.ExceptionHandler.handleException(ExceptionHandler.java:247)
>>         at
>> org.jboss.resteasy.core.SynchronousDispatcher.writeException(SynchronousDispatcher.java:168)
>>         at
>> org.jboss.resteasy.core.SynchronousDispatcher.writeResponse(SynchronousDispatcher.java:471)
>>         at
>> org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:415)
>>         at
>> org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:202)
>>         at
>> org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.service(ServletContainerDispatcher.java:221)
>>         at
>> org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:56)
>>         at
>> org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:51)
>>         at javax.servlet.http.HttpServlet.service(HttpServlet.java:790)
>>         at
>> io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:85)
>>         at
>> io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:129)
>>         at
>> org.keycloak.services.filters.KeycloakSessionServletFilter.doFilter(KeycloakSessionServletFilter.java:88)
>>         at
>> io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:60)
>>         at
>> io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
>>         at
>> io.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.java:84)
>>         at
>> io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:62)
>>         at
>> io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36)
>>         at
>> org.wildfly.extension.undertow.security.SecurityContextAssociationHandler.handleRequest(SecurityContextAssociationHandler.java:78)
>>         at
>> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
>>         at
>> io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:131)
>>         at
>> io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:57)
>>         at
>> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
>>         at
>> io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:46)
>>         at
>> io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64)
>>         at
>> io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:60)
>>         at
>> io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:77)
>>         at
>> io.undertow.security.handlers.NotificationReceiverHandler.handleRequest(NotificationReceiverHandler.java:50)
>>         at
>> io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43)
>>         at
>> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
>>         at
>> org.wildfly.extension.undertow.security.jacc.JACCContextIdHandler.handleRequest(JACCContextIdHandler.java:61)
>>         at
>> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
>>         at
>> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
>>         at
>> io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:284)
>>         at
>> io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:263)
>>         at
>> io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:81)
>>         at
>> io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:174)
>>         at
>> io.undertow.server.Connectors.executeRootHandler(Connectors.java:202)
>>         at
>> io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:793)
>>         at
>> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
>>         at
>> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
>>         at java.lang.Thread.run(Thread.java:745)
>> Caused by: org.infinispan.commons.CacheException: Could not commit
>> implicit transaction
>>         at
>> org.infinispan.cache.impl.CacheImpl.tryCommit(CacheImpl.java:1725)
>>         at
>> org.infinispan.cache.impl.CacheImpl.executeCommandAndCommitIfNeeded(CacheImpl.java:1679)
>>         at
>> org.infinispan.cache.impl.CacheImpl.putInternal(CacheImpl.java:1121)
>>         at org.infinispan.cache.impl.CacheImpl.put(CacheImpl.java:1111)
>>         at org.infinispan.cache.impl.CacheImpl.put(CacheImpl.java:1742)
>>         at org.infinispan.cache.impl.CacheImpl.put(CacheImpl.java:248)
>>         at
>> org.infinispan.cache.impl.AbstractDelegatingCache.put(AbstractDelegatingCache.java:291)
>>         at
>> org.keycloak.models.sessions.infinispan.InfinispanUserSessionProvider$InfinispanKeycloakTransaction$CacheTask.execute(InfinispanUserSessionProvider.java:854)
>>         at
>> org.keycloak.models.sessions.infinispan.InfinispanUserSessionProvider$InfinispanKeycloakTransaction.commit(InfinispanUserSessionProvider.java:750)
>>         at
>> org.keycloak.services.DefaultKeycloakTransactionManager.commit(DefaultKeycloakTransactionManager.java:104)
>>         at
>> org.keycloak.services.filters.KeycloakTransactionCommitter.filter(KeycloakTransactionCommitter.java:43)
>>         at
>> org.jboss.resteasy.core.ServerResponseWriter.executeFilters(ServerResponseWriter.java:121)
>>         at
>> org.jboss.resteasy.core.ServerResponseWriter.writeNomapResponse(ServerResponseWriter.java:48)
>>         at
>> org.jboss.resteasy.core.SynchronousDispatcher.writeResponse(SynchronousDispatcher.java:466)
>>         ... 38 more
>> Caused by: javax.transaction.RollbackException: ARJUNA016053: Could not
>> commit transaction.
>>         at
>> com.arjuna.ats.internal.jta.transaction.arjunacore.TransactionImple.commitAndDisassociate(TransactionImple.java:1212)
>>         at
>> com.arjuna.ats.internal.jta.transaction.arjunacore.BaseTransaction.commit(BaseTransaction.java:126)
>>         at
>> com.arjuna.ats.jbossatx.BaseTransactionManagerDelegate.commit(BaseTransactionManagerDelegate.java:89)
>>         at
>> org.infinispan.cache.impl.CacheImpl.tryCommit(CacheImpl.java:1722)
>>         ... 51 more
>>         Suppressed: javax.transaction.xa.XAException
>>                 at
>> org.infinispan.transaction.impl.TransactionCoordinator.handleCommitFailure(TransactionCoordinator.java:213)
>>                 at
>> org.infinispan.transaction.impl.TransactionCoordinator.commit(TransactionCoordinator.java:159)
>>                 at
>> org.infinispan.transaction.xa.TransactionXaAdapter.commit(TransactionXaAdapter.java:112)
>>                 at
>> com.arjuna.ats.internal.jta.resources.arjunacore.XAResourceRecord.topLevelOnePhaseCommit(XAResourceRecord.java:704)
>>                 at
>> com.arjuna.ats.arjuna.coordinator.BasicAction.onePhaseCommit(BasicAction.java:2366)
>>                 at
>> com.arjuna.ats.arjuna.coordinator.BasicAction.End(BasicAction.java:1495)
>>                 at
>> com.arjuna.ats.arjuna.coordinator.TwoPhaseCoordinator.end(TwoPhaseCoordinator.java:96)
>>                 at
>> com.arjuna.ats.arjuna.AtomicAction.commit(AtomicAction.java:162)
>>                 at
>> com.arjuna.ats.internal.jta.transaction.arjunacore.TransactionImple.commitAndDisassociate(TransactionImple.java:1200)
>>                 ... 54 more
>>         Caused by: org.infinispan.util.concurrent.TimeoutException:
>> Replication timeout for kc2
>>                 at
>> org.infinispan.remoting.transport.jgroups.JGroupsTransport.checkRsp(JGroupsTransport.java:765)
>>                 at
>> org.infinispan.remoting.transport.jgroups.JGroupsTransport.lambda$invokeRemotelyAsync$73(JGroupsTransport.java:612)
>>                 at
>> java.util.concurrent.CompletableFuture.uniApply(CompletableFuture.java:602)
>>                 at
>> java.util.concurrent.CompletableFuture$UniApply.tryFire(CompletableFuture.java:577)
>>                 at
>> java.util.concurrent.CompletableFuture.postComplete(CompletableFuture.java:474)
>>                 at
>> java.util.concurrent.CompletableFuture.complete(CompletableFuture.java:1962)
>>                 at
>> org.infinispan.remoting.transport.jgroups.RspListFuture.call(RspListFuture.java:47)
>>                 at
>> org.infinispan.remoting.transport.jgroups.RspListFuture.call(RspListFuture.java:16)
>>                 at
>> java.util.concurrent.FutureTask.run(FutureTask.java:266)
>>                 at
>> java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$201(ScheduledThreadPoolExecutor.java:180)
>>                 at
>> java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:293)
>>                 ... 3 more
>>
>>
>>
>> Here kc2 is the removed instance.
>>
>> Kind Regards,
>> Sarp Kaya
>>
>>
>> From: Stian Thorgersen <sthorger at redhat.com>
>> Reply-To: "stian at redhat.com" <stian at redhat.com>
>> Date: Friday, July 1, 2016 at 7:17 PM
>> To: Abdullah Sarp Kaya <akaya at expedia.com>
>> Cc: "keycloak-user at lists.jboss.org" <keycloak-user at lists.jboss.org>
>> Subject: Re: [keycloak-user] Lost session when removing an instance off
>> cluster
>>
>> Can you please include more details from the log if there is any, at
>> least a full stack trace and not just the bit you've included. We also need
>> to know details around how you've configured the caches and Infinispan.
>>
>> On 1 July 2016 at 10:16, Sarp Kaya <akaya at expedia.com> wrote:
>>
>>> Hello,
>>>
>>> I have tried various ways of configuring infinispan but it just seems
>>> like if I deploy a new instance to the cluster and remove one, then some
>>> sessions are lost and an exception is thrown saying that it was not
>>> handled. This is the Infinispan exception:
>>>
>>> Exceptionhandlingrequestto/auth/realms/realmname/protocol/openid-connect
>>> /auth:org.jboss.resteasy.spi.UnhandledException:org.infinispan.util.
>>> concurrent.TimeoutException:Replicationtimeoutfor79a0757ecab3atorg.jboss
>>> .resteasy.core.ExceptionHandler.handleException(ExceptionHandler.java:
>>> 247) atorg.jboss.resteasy.core.SynchronousDispatcher.writeException(
>>> SynchronousDispatcher.java:168) atorg.jboss.resteasy.core.
>>> SynchronousDispatcher.writeResponse(SynchronousDispatcher.java:471) at
>>> org.jboss.resteasy.core.SynchronousDispatcher.invoke(
>>> SynchronousDispatcher.java:415) atorg.jboss.resteasy.core.
>>> SynchronousDispatcher.invoke(SynchronousDispatcher.java:202) atorg.jboss
>>> .resteasy.plugins.server.servlet.ServletContainerDispatcher.service(
>>> ServletContainerDispatcher.java:221) atorg.jboss.resteasy.plugins.server
>>> .servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:56) at
>>> org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(
>>> HttpServletDispatcher.java:51) atjavax.servlet.http.HttpServlet.service(
>>> HttpServlet.java:790) atio.undertow.servlet.handlers.ServletHandler.
>>> handleRequest(ServletHandler.java:85) atio.undertow.servlet.handlers.
>>> FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:129) atorg.
>>> keycloak.services.filters.KeycloakSessionServletFilter.doFilter(
>>> KeycloakSessionServletFilter.java:88) atio.undertow.servlet.core.
>>> ManagedFilter.doFilter(ManagedFilter.java:60) atio.undertow.servlet.
>>> handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
>>> atio.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler
>>> .java:84) atio.undertow.servlet.handlers.security.
>>> ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java
>>> :62) atio.undertow.servlet.handlers.ServletDispatchingHandler.
>>> handleRequest(ServletDispatchingHandler.java:36) atorg.wildfly.extension
>>> .undertow.security.SecurityContextAssociationHandler.handleRequest(
>>> SecurityContextAssociationHandler.java:78) atio.undertow.server.handlers
>>> .PredicateHandler.handleRequest(PredicateHandler.java:43) atio.undertow.
>>> servlet.handlers.security.SSLInformationAssociationHandler.handleRequest
>>> (SSLInformationAssociationHandler.java:131) atio.undertow.servlet.
>>> handlers.security.ServletAuthenticationCallHandler.handleRequest(
>>> ServletAuthenticationCallHandler.java:57) atio.undertow.server.handlers.
>>> PredicateHandler.handleRequest(PredicateHandler.java:43) atio.undertow.
>>> security.handlers.AbstractConfidentialityHandler.handleRequest(
>>> AbstractConfidentialityHandler.java:46) atio.undertow.servlet.handlers.
>>> security.ServletConfidentialityConstraintHandler.handleRequest(
>>> ServletConfidentialityConstraintHandler.java:64) atio.undertow.security.
>>> handlers.AuthenticationMechanismsHandler.handleRequest(
>>> AuthenticationMechanismsHandler.java:60) atio.undertow.servlet.handlers.
>>> security.CachedAuthenticatedSessionHandler.handleRequest(
>>> CachedAuthenticatedSessionHandler.java:77) atio.undertow.security.
>>> handlers.NotificationReceiverHandler.handleRequest(
>>> NotificationReceiverHandler.java:50) atio.undertow.security.handlers.
>>> AbstractSecurityContextAssociationHandler.handleRequest(
>>> AbstractSecurityContextAssociationHandler.java:43) atio.undertow.server.
>>> handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) atorg.
>>> wildfly.extension.undertow.security.jacc.JACCContextIdHandler.
>>> handleRequest(JACCContextIdHandler.java:61) atio.undertow.server.
>>> handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) atio.
>>> undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler
>>> .java:43) atio.undertow.servlet.handlers.ServletInitialHandler.
>>> handleFirstRequest(ServletInitialHandler.java:284) atio.undertow.servlet
>>> .handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.
>>> java:263) atio.undertow.servlet.handlers.ServletInitialHandler.access$
>>> 000(ServletInitialHandler.java:81) atio.undertow.servlet.handlers.
>>> ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:174) at
>>> io.undertow.server.Connectors.executeRootHandler(Connectors.java:202) at
>>> io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:793)
>>> atjava.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.
>>> java:1142) atjava.util.concurrent.ThreadPoolExecutor$Worker.run(
>>> ThreadPoolExecutor.java:617) atjava.lang.Thread.run(Thread.java:745)
>>> Causedby:org.infinispan.util.concurrent.TimeoutException:Replication
>>> timeoutfor79a0757ecab3atorg.infinispan.remoting.transport.jgroups.
>>> JGroupsTransport.checkRsp(JGroupsTransport.java:765) atorg.infinispan.
>>> remoting.transport.jgroups.JGroupsTransport.lambda$invokeRemotelyAsync$
>>> 72(JGroupsTransport.java:599) atjava.util.concurrent.CompletableFuture.
>>> uniApply(CompletableFuture.java:602) atjava.util.concurrent.
>>> CompletableFuture$UniApply.tryFire(CompletableFuture.java:577) atjava.
>>> util.concurrent.CompletableFuture.postComplete(CompletableFuture.java:
>>> 474) atjava.util.concurrent.CompletableFuture.complete(CompletableFuture
>>> .java:1962) atorg.infinispan.remoting.transport.jgroups.
>>> SingleResponseFuture.call(SingleResponseFuture.java:46) atorg.infinispan
>>> .remoting.transport.jgroups.SingleResponseFuture.call(
>>> SingleResponseFuture.java:17) atjava.util.concurrent.FutureTask.run(
>>> FutureTask.java:266) atjava.util.concurrent.ScheduledThreadPoolExecutor$
>>> ScheduledFutureTask.access$201(ScheduledThreadPoolExecutor.java:180)
>>>
>>> This causes browsers to see Internal Server Error. Shouldn?t that be
>>> handled in Keycloak as lost session, therefore KC should try to handle it
>>> rather than showing that it?s an Internal Server Error?
>>>
>>> My current infinispan configuration looks like this:
>>>
>>> <distributed-cache name="sessions" mode="SYNC">
>>>     <transaction mode="NON_DURABLE_XA"/>
>>> </distributed-cache>
>>>
>>>
>>> I use Keycloak version 1.9.5. My question is am I doing something wrong
>>> with my configuration? I tried both replicated-cache and distributed-cache
>>> and tried all transaction mode on both of them. None of them seems to solve
>>> the error that I?ve had above.
>>>
>>> Kind Regards,
>>> Sarp Kaya
>>>
>>>
>>>
>>>
>>> _______________________________________________
>>> keycloak-user mailing list
>>> keycloak-user at lists.jboss.org
>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>
>>
>>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160705/dd12c2d3/attachment-0001.html 

From akaya at expedia.com  Tue Jul  5 03:10:41 2016
From: akaya at expedia.com (Sarp Kaya)
Date: Tue, 5 Jul 2016 07:10:41 +0000
Subject: [keycloak-user] Lost session when removing an instance off
 cluster
In-Reply-To: <CAJgngAc9eWJz8tDhx8sVpaUoPhM5qec-TQ8z09Abpx_kU8e6PQ@mail.gmail.com>
References: <D39C63FE.5FCC%akaya@expedia.com>
	<CAJgngAfJoYUzbtLtU1aAkVrBmE3s7_XOxCCTh8ywVBVth9ZprQ@mail.gmail.com>
	<D3A01882.6050%akaya@expedia.com> <D3A0A0EA.60C9%akaya@expedia.com>
	<CAJgngAf9wEYCwzYWaQPqK7jXWdNwxEx9KHQZrryuWn0sfU=aTA@mail.gmail.com>
	<D3A19491.6122%akaya@expedia.com>
	<CAJgngAc9eWJz8tDhx8sVpaUoPhM5qec-TQ8z09Abpx_kU8e6PQ@mail.gmail.com>
Message-ID: <D3A199E2.6133%akaya@expedia.com>

Hi Stian,

I have tested with owners being 4 and had 4 instances, removed 1 off and still had the issue. I?ll try it with version 2.0.0 with 4 owners in sessions and the rest with 1 owners. I don?t have any network issues because it?s all tested locally.

Kind Regards,
Sarp Kaya

From: Stian Thorgersen <sthorger at redhat.com<mailto:sthorger at redhat.com>>
Reply-To: "stian at redhat.com<mailto:stian at redhat.com>" <stian at redhat.com<mailto:stian at redhat.com>>
Date: Tuesday, July 5, 2016 at 4:58 PM
To: Abdullah Sarp Kaya <akaya at expedia.com<mailto:akaya at expedia.com>>
Cc: "keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>" <keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>>
Subject: Re: [keycloak-user] Lost session when removing an instance off cluster

There probably will be some errors from Infinispan when you remove a node at least if there's ongoing replication/messages being sent to the cluster.

Can you try with the latest Keycloak and with the default clustering config and only increasing owners? We have tested session failover ourselves and it was working fine. So could be down to the way you've configured it or could be an issue due to your network setup.

On 5 July 2016 at 08:50, Sarp Kaya <akaya at expedia.com<mailto:akaya at expedia.com>> wrote:
Hi Stian,

You are right, it needs to have owner. By default the configuration had owners but as I experimented I forgot to add it. However adding owners does not fix the problem.

Initially I also experimented this with offlineSessions and loginFailures being distributed-cache so logins were already failing with that (same issue, Internal Server Error being presented).

Anyway, if worse case user needs to re-authenticate, then Internal Server Error problem should be fixed right? (it?s the below exception I have pasted) Because whenever there is org.jboss.resteasy.spi.UnhandledException then browsers will see 500, instead of logging in again (there could be something added as such as handling this exception and asking user to log in again).

Kind Regards,
Sarp Kaya

From: Stian Thorgersen <sthorger at redhat.com<mailto:sthorger at redhat.com>>
Reply-To: "stian at redhat.com<mailto:stian at redhat.com>" <stian at redhat.com<mailto:stian at redhat.com>>
Date: Tuesday, July 5, 2016 at 4:41 PM
To: Abdullah Sarp Kaya <akaya at expedia.com<mailto:akaya at expedia.com>>
Cc: "keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>" <keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>>
Subject: Re: [keycloak-user] Lost session when removing an instance off cluster

The sessions cache is a distributed-cache, but by default it only has 1 owner of each segment. This means that sessions are not replicated to multiple nodes. So it's expected that you loose sessions when a node is removed. If you want sessions to survive the removal of a node you should increase the number of owners for the cache. For example:

    <distributed-cache name="sessions" mode="SYNC" owners="2"/>

We've not actually tried with enabling transactions on the sessions, but I would say performance is more important. Worst case scenario is that a session is lost and a user has to re-authenticate.

BTW the config you have for offlineSessions and loginFailures are wrong they both need to be distributed caches as well in clustered mode:

    <distributed-cache name="offlineSessions" mode="SYNC" owners="1"/>
    <distributed-cache name="loginFailures" mode="SYNC" owners="1"/>


On 4 July 2016 at 15:45, Sarp Kaya <akaya at expedia.com<mailto:akaya at expedia.com>> wrote:
Just to add on this.

I think I misunderstood something or Keycloak does not really implement the infinispan caching lifetime correctly.

So first thing I did is to TRACE the infinispan logs. So I added this logger in standalone.xml:


<logger category="org.infinispan">
    <level name="TRACE"/>
</logger>

The next thing I did is to do the timing. Basically my test is that what happens when I log in. I also enabled events and printing the events as well.

What I found is:


  1.  Login event is triggered at 13:18:35,193 in Keycloak.
  2.  The browser got the full response at 13:18:35,273
  3.  Now the surprising part is the fact that there are whole a lot of infinispan logging out occurring for ?sessions? cache after the browser got the response. The last log message occurring is like this:

2016-07-04 13:18:35,345 TRACE [org.infinispan.remoting.rpc.RpcManagerImpl] (default task-4) Response(s) to TxCompletionNotificationCommand{ xid=null, internalId=0, topologyId=19, gtx=GlobalTransaction:<kc1>:239:local, cacheName=sessions}  is {}

To see the all the logs after event trigger please check here:
<http://pastebin.com/pkvYP07T><http://pastebin.com/pkvYP07T><http://pastebin.com/pkvYP07T><http://pastebin.com/pkvYP07T>http://pastebin.com/p4K2Ghff

So my understanding was that I marked sessions as SYNC, which meant to me that it is supposed to do all of the synchronization before it sends the response back to the browser. If it does the other way around then it should be ASYNC mode. Could you please clarify the intended/expected behavior?

Kind Regards,
Sarp Kaya


From: Abdullah Sarp Kaya <akaya at expedia.com<mailto:akaya at expedia.com>>
Date: Monday, July 4, 2016 at 9:59 PM
To: "stian at redhat.com<mailto:stian at redhat.com>" <stian at redhat.com<mailto:stian at redhat.com>>
Cc: "keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>" <keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>>
Subject: Re: [keycloak-user] Lost session when removing an instance off cluster

Hello,

Below is exactly how Infinispan is configured:


<subsystem xmlns="urn:jboss:domain:infinispan:4.0">
    <cache-container name="keycloak" jndi-name="infinispan/Keycloak">
    <transport lock-timeout="60000"/>
    <invalidation-cache name="realms" mode="SYNC"/>
    <invalidation-cache name="users" mode="SYNC">
        <eviction max-entries="10000" strategy="LRU"/>
    </invalidation-cache>
    <distributed-cache xmlns="" name="sessions" mode="SYNC">
        <transaction mode="NON_DURABLE_XA"/>
    </distributed-cache>
    <local-cache xmlns="" name="offlineSessions"/>
    <local-cache xmlns="" name="loginFailures"/>
    <replicated-cache name="work" mode="SYNC"/>
    <local-cache name="realmVersions">
        <transaction mode="BATCH" locking="PESSIMISTIC"/>
    </local-cache>
</cache-container>
<cache-container name="server" aliases="singleton cluster" default-cache="default" module="org.wildfly.clustering.server">
    <transport lock-timeout="60000"/>
    <replicated-cache name="default" mode="SYNC">
        <transaction mode="BATCH"/>
    </replicated-cache>
</cache-container>
<cache-container name="web" default-cache="dist" module="org.wildfly.clustering.web.infinispan">
    <transport lock-timeout="60000"/>
    <distributed-cache name="dist" mode="ASYNC" l1-lifespan="0" owners="2">
        <locking isolation="REPEATABLE_READ"/>
        <transaction mode="BATCH"/>
        <file-store/>
    </distributed-cache>
</cache-container>
<cache-container name="ejb" aliases="sfsb" default-cache="dist" module="org.wildfly.clustering.ejb.infinispan">
    <transport lock-timeout="60000"/>
    <distributed-cache name="dist" mode="ASYNC" l1-lifespan="0" owners="2">
        <locking isolation="REPEATABLE_READ"/>
        <transaction mode="BATCH"/>
        <file-store/>
    </distributed-cache>
</cache-container>
<cache-container name="hibernate" default-cache="local-query" module="org.hibernate.infinispan">
    <transport lock-timeout="60000"/>
    <invalidation-cache name="entity" mode="SYNC">
        <transaction mode="NON_XA"/>
        <eviction strategy="LRU" max-entries="10000"/>
        <expiration max-idle="100000"/>
    </invalidation-cache>
    <local-cache name="local-query">
        <eviction strategy="LRU" max-entries="10000"/>
        <expiration max-idle="100000"/>
    </local-cache>
    <replicated-cache name="timestamps" mode="ASYNC"/>
</cache-container>
</subsystem>




This is the complete exception:

03:49:40,241 ERROR [org.infinispan.interceptors.InvocationContextInterceptor] (default task-12) ISPN000136: Error executing command PutKeyValueCommand, writing keys [ba74e523-3299-42b3-801e-9f8cb5a0d81d]: org.infinispan.util.concurrent.TimeoutException: Replication timeout for kc2
        at org.infinispan.remoting.transport.jgroups.JGroupsTransport.checkRsp(JGroupsTransport.java:765)
        at org.infinispan.remoting.transport.jgroups.JGroupsTransport.lambda$invokeRemotelyAsync$73(JGroupsTransport.java:612)
        at java.util.concurrent.CompletableFuture.uniApply(CompletableFuture.java:602)
        at java.util.concurrent.CompletableFuture$UniApply.tryFire(CompletableFuture.java:577)
        at java.util.concurrent.CompletableFuture.postComplete(CompletableFuture.java:474)
        at java.util.concurrent.CompletableFuture.complete(CompletableFuture.java:1962)
        at org.infinispan.remoting.transport.jgroups.RspListFuture.call(RspListFuture.java:47)
        at org.infinispan.remoting.transport.jgroups.RspListFuture.call(RspListFuture.java:16)
        at java.util.concurrent.FutureTask.run(FutureTask.java:266)
        at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$201(ScheduledThreadPoolExecutor.java:180)
        at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:293)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
        at java.lang.Thread.run(Thread.java:745)

03:49:40,250 ERROR [org.jboss.resteasy.resteasy_jaxrs.i18n] (default task-12) RESTEASY002025: Unknown exception while executing GET /realms/partner-dmz/protocol/openid-connect/auth: org.infinispan.util.concurrent.TimeoutException: Replication timeout for kc2
        at org.infinispan.remoting.transport.jgroups.JGroupsTransport.checkRsp(JGroupsTransport.java:765)
        at org.infinispan.remoting.transport.jgroups.JGroupsTransport.lambda$invokeRemotelyAsync$73(JGroupsTransport.java:612)
        at java.util.concurrent.CompletableFuture.uniApply(CompletableFuture.java:602)
        at java.util.concurrent.CompletableFuture$UniApply.tryFire(CompletableFuture.java:577)
        at java.util.concurrent.CompletableFuture.postComplete(CompletableFuture.java:474)
        at java.util.concurrent.CompletableFuture.complete(CompletableFuture.java:1962)
        at org.infinispan.remoting.transport.jgroups.RspListFuture.call(RspListFuture.java:47)
        at org.infinispan.remoting.transport.jgroups.RspListFuture.call(RspListFuture.java:16)
        at java.util.concurrent.FutureTask.run(FutureTask.java:266)
        at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$201(ScheduledThreadPoolExecutor.java:180)
        at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:293)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
        at java.lang.Thread.run(Thread.java:745)

03:49:40,257 ERROR [io.undertow.request] (default task-12) UT005023: Exception handling request to /auth/realms/partner-dmz/protocol/openid-connect/auth: org.jboss.resteasy.spi.UnhandledException: org.infinispan.util.concurrent.TimeoutException: Replication timeout for kc2
        at org.jboss.resteasy.core.ExceptionHandler.handleException(ExceptionHandler.java:247)
        at org.jboss.resteasy.core.SynchronousDispatcher.writeException(SynchronousDispatcher.java:168)
        at org.jboss.resteasy.core.SynchronousDispatcher.writeResponse(SynchronousDispatcher.java:471)
        at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:415)
        at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:202)
        at org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.service(ServletContainerDispatcher.java:221)
        at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:56)
        at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:51)
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:790)
        at io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:85)
        at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:129)
        at org.keycloak.services.filters.KeycloakSessionServletFilter.doFilter(KeycloakSessionServletFilter.java:88)
        at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:60)
        at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
        at io.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.java:84)
        at io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:62)
        at io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36)
        at org.wildfly.extension.undertow.security.SecurityContextAssociationHandler.handleRequest(SecurityContextAssociationHandler.java:78)
        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
        at io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:131)
        at io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:57)
        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
        at io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:46)
        at io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64)
        at io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:60)
        at io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:77)
        at io.undertow.security.handlers.NotificationReceiverHandler.handleRequest(NotificationReceiverHandler.java:50)
        at io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43)
        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
        at org.wildfly.extension.undertow.security.jacc.JACCContextIdHandler.handleRequest(JACCContextIdHandler.java:61)
        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
        at io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:284)
        at io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:263)
        at io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:81)
        at io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:174)
        at io.undertow.server.Connectors.executeRootHandler(Connectors.java:202)
        at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:793)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
        at java.lang.Thread.run(Thread.java:745)
Caused by: org.infinispan.util.concurrent.TimeoutException: Replication timeout for kc2
        at org.infinispan.remoting.transport.jgroups.JGroupsTransport.checkRsp(JGroupsTransport.java:765)
        at org.infinispan.remoting.transport.jgroups.JGroupsTransport.lambda$invokeRemotelyAsync$73(JGroupsTransport.java:612)
        at java.util.concurrent.CompletableFuture.uniApply(CompletableFuture.java:602)
        at java.util.concurrent.CompletableFuture$UniApply.tryFire(CompletableFuture.java:577)
        at java.util.concurrent.CompletableFuture.postComplete(CompletableFuture.java:474)
        at java.util.concurrent.CompletableFuture.complete(CompletableFuture.java:1962)
        at org.infinispan.remoting.transport.jgroups.RspListFuture.call(RspListFuture.java:47)
        at org.infinispan.remoting.transport.jgroups.RspListFuture.call(RspListFuture.java:16)
        at java.util.concurrent.FutureTask.run(FutureTask.java:266)
        at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$201(ScheduledThreadPoolExecutor.java:180)
        at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:293)
        ... 3 more

03:49:41,251 ERROR [org.infinispan.interceptors.InvocationContextInterceptor] (default task-3) ISPN000136: Error executing command PrepareCommand, writing keys [02cff8bb-0ab9-4ab9-905f-17ffb3226050]: org.infinispan.util.concurrent.TimeoutException: Replication timeout for kc2
        at org.infinispan.remoting.transport.jgroups.JGroupsTransport.checkRsp(JGroupsTransport.java:765)
        at org.infinispan.remoting.transport.jgroups.JGroupsTransport.lambda$invokeRemotelyAsync$73(JGroupsTransport.java:612)
        at java.util.concurrent.CompletableFuture.uniApply(CompletableFuture.java:602)
        at java.util.concurrent.CompletableFuture$UniApply.tryFire(CompletableFuture.java:577)
        at java.util.concurrent.CompletableFuture.postComplete(CompletableFuture.java:474)
        at java.util.concurrent.CompletableFuture.complete(CompletableFuture.java:1962)
        at org.infinispan.remoting.transport.jgroups.RspListFuture.call(RspListFuture.java:47)
        at org.infinispan.remoting.transport.jgroups.RspListFuture.call(RspListFuture.java:16)
        at java.util.concurrent.FutureTask.run(FutureTask.java:266)
        at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$201(ScheduledThreadPoolExecutor.java:180)
        at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:293)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
        at java.lang.Thread.run(Thread.java:745)

03:49:41,258 ERROR [org.infinispan.transaction.impl.TransactionCoordinator] (default task-3) ISPN000097: Error while processing a prepare in a single-phase transaction: org.infinispan.util.concurrent.TimeoutException: Replication timeout for kc2
        at org.infinispan.remoting.transport.jgroups.JGroupsTransport.checkRsp(JGroupsTransport.java:765)
        at org.infinispan.remoting.transport.jgroups.JGroupsTransport.lambda$invokeRemotelyAsync$73(JGroupsTransport.java:612)
        at java.util.concurrent.CompletableFuture.uniApply(CompletableFuture.java:602)
        at java.util.concurrent.CompletableFuture$UniApply.tryFire(CompletableFuture.java:577)
        at java.util.concurrent.CompletableFuture.postComplete(CompletableFuture.java:474)
        at java.util.concurrent.CompletableFuture.complete(CompletableFuture.java:1962)
        at org.infinispan.remoting.transport.jgroups.RspListFuture.call(RspListFuture.java:47)
        at org.infinispan.remoting.transport.jgroups.RspListFuture.call(RspListFuture.java:16)
        at java.util.concurrent.FutureTask.run(FutureTask.java:266)
        at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$201(ScheduledThreadPoolExecutor.java:180)
        at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:293)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
        at java.lang.Thread.run(Thread.java:745)

03:49:45,504 INFO  [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (Incoming-3,dev,kc1) ISPN000094: Received new cluster view for channel server: [kc1|4] (1) [kc1]
03:49:45,507 INFO  [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (Incoming-3,dev,kc1) ISPN000094: Received new cluster view for channel keycloak: [kc1|4] (1) [kc1]
03:49:45,534 INFO  [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (Incoming-3,dev,kc1) ISPN000094: Received new cluster view for channel web: [kc1|4] (1) [kc1]
03:49:45,538 INFO  [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (Incoming-3,dev,kc1) ISPN000094: Received new cluster view for channel ejb: [kc1|4] (1) [kc1]
03:49:45,548 WARN  [com.arjuna.ats.jta] (default task-3) ARJUNA016039: onePhaseCommit on < formatId=131077, gtrid_length=29, bqual_length=36, tx_uid=0:ffffac110003:-7fcaa87f:5779dc60:f01, node_name=1, branch_uid=0:ffffac110003:-7fcaa87f:5779dc60:f02, subordinatenodename=null, eis_name=unknown eis name > (TransactionXaAdapter{localTransaction=LocalXaTransaction{xid=< formatId=131077, gtrid_length=29, bqual_length=36, tx_uid=0:ffffac110003:-7fcaa87f:5779dc60:f01, node_name=1, branch_uid=0:ffffac110003:-7fcaa87f:5779dc60:f02, subordinatenodename=null, eis_name=unknown eis name >} LocalTransaction{remoteLockedNodes=null, isMarkedForRollback=false, lockedKeys=null, backupKeyLocks=null, topologyId=6, stateTransferFlag=null} org.infinispan.transaction.xa.LocalXaTransaction at 3ef}) failed with exception XAException.XA_HEURRB: javax.transaction.xa.XAException
        at org.infinispan.transaction.impl.TransactionCoordinator.handleCommitFailure(TransactionCoordinator.java:213)
        at org.infinispan.transaction.impl.TransactionCoordinator.commit(TransactionCoordinator.java:159)
        at org.infinispan.transaction.xa.TransactionXaAdapter.commit(TransactionXaAdapter.java:112)
        at com.arjuna.ats.internal.jta.resources.arjunacore.XAResourceRecord.topLevelOnePhaseCommit(XAResourceRecord.java:704)
        at com.arjuna.ats.arjuna.coordinator.BasicAction.onePhaseCommit(BasicAction.java:2366)
        at com.arjuna.ats.arjuna.coordinator.BasicAction.End(BasicAction.java:1495)
        at com.arjuna.ats.arjuna.coordinator.TwoPhaseCoordinator.end(TwoPhaseCoordinator.java:96)
        at com.arjuna.ats.arjuna.AtomicAction.commit(AtomicAction.java:162)
        at com.arjuna.ats.internal.jta.transaction.arjunacore.TransactionImple.commitAndDisassociate(TransactionImple.java:1200)
        at com.arjuna.ats.internal.jta.transaction.arjunacore.BaseTransaction.commit(BaseTransaction.java:126)
        at com.arjuna.ats.jbossatx.BaseTransactionManagerDelegate.commit(BaseTransactionManagerDelegate.java:89)
        at org.infinispan.cache.impl.CacheImpl.tryCommit(CacheImpl.java:1722)
        at org.infinispan.cache.impl.CacheImpl.executeCommandAndCommitIfNeeded(CacheImpl.java:1679)
        at org.infinispan.cache.impl.CacheImpl.putInternal(CacheImpl.java:1121)
        at org.infinispan.cache.impl.CacheImpl.put(CacheImpl.java:1111)
        at org.infinispan.cache.impl.CacheImpl.put(CacheImpl.java:1742)
        at org.infinispan.cache.impl.CacheImpl.put(CacheImpl.java:248)
        at org.infinispan.cache.impl.AbstractDelegatingCache.put(AbstractDelegatingCache.java:291)
        at org.keycloak.models.sessions.infinispan.InfinispanUserSessionProvider$InfinispanKeycloakTransaction$CacheTask.execute(InfinispanUserSessionProvider.java:854)
        at org.keycloak.models.sessions.infinispan.InfinispanUserSessionProvider$InfinispanKeycloakTransaction.commit(InfinispanUserSessionProvider.java:750)
        at org.keycloak.services.DefaultKeycloakTransactionManager.commit(DefaultKeycloakTransactionManager.java:104)
        at org.keycloak.services.filters.KeycloakTransactionCommitter.filter(KeycloakTransactionCommitter.java:43)
        at org.jboss.resteasy.core.ServerResponseWriter.executeFilters(ServerResponseWriter.java:121)
        at org.jboss.resteasy.core.ServerResponseWriter.writeNomapResponse(ServerResponseWriter.java:48)
        at org.jboss.resteasy.core.SynchronousDispatcher.writeResponse(SynchronousDispatcher.java:466)
        at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:415)
        at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:202)
        at org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.service(ServletContainerDispatcher.java:221)
        at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:56)
        at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:51)
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:790)
        at io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:85)
        at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:129)
        at org.keycloak.services.filters.KeycloakSessionServletFilter.doFilter(KeycloakSessionServletFilter.java:88)
        at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:60)
        at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
        at io.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.java:84)
        at io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:62)
        at io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36)
        at org.wildfly.extension.undertow.security.SecurityContextAssociationHandler.handleRequest(SecurityContextAssociationHandler.java:78)
        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
        at io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:131)
        at io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:57)
        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
        at io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:46)
        at io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64)
        at io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:60)
        at io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:77)
        at io.undertow.security.handlers.NotificationReceiverHandler.handleRequest(NotificationReceiverHandler.java:50)
        at io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43)
        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
        at org.wildfly.extension.undertow.security.jacc.JACCContextIdHandler.handleRequest(JACCContextIdHandler.java:61)
        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
        at io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:284)
        at io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:263)
        at io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:81)
        at io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:174)
        at io.undertow.server.Connectors.executeRootHandler(Connectors.java:202)
        at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:793)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
        at java.lang.Thread.run(Thread.java:745)
Caused by: org.infinispan.util.concurrent.TimeoutException: Replication timeout for kc2
        at org.infinispan.remoting.transport.jgroups.JGroupsTransport.checkRsp(JGroupsTransport.java:765)
        at org.infinispan.remoting.transport.jgroups.JGroupsTransport.lambda$invokeRemotelyAsync$73(JGroupsTransport.java:612)
        at java.util.concurrent.CompletableFuture.uniApply(CompletableFuture.java:602)
        at java.util.concurrent.CompletableFuture$UniApply.tryFire(CompletableFuture.java:577)
        at java.util.concurrent.CompletableFuture.postComplete(CompletableFuture.java:474)
        at java.util.concurrent.CompletableFuture.complete(CompletableFuture.java:1962)
        at org.infinispan.remoting.transport.jgroups.RspListFuture.call(RspListFuture.java:47)
        at org.infinispan.remoting.transport.jgroups.RspListFuture.call(RspListFuture.java:16)
        at java.util.concurrent.FutureTask.run(FutureTask.java:266)
        at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$201(ScheduledThreadPoolExecutor.java:180)
        at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:293)
        ... 3 more

03:49:45,563 WARN  [org.infinispan.cache.impl.CacheImpl] (default task-3) ISPN000160: Could not complete injected transaction.: javax.transaction.RollbackException: ARJUNA016053: Could not commit transaction.
        at com.arjuna.ats.internal.jta.transaction.arjunacore.TransactionImple.commitAndDisassociate(TransactionImple.java:1212)
        at com.arjuna.ats.internal.jta.transaction.arjunacore.BaseTransaction.commit(BaseTransaction.java:126)
        at com.arjuna.ats.jbossatx.BaseTransactionManagerDelegate.commit(BaseTransactionManagerDelegate.java:89)
        at org.infinispan.cache.impl.CacheImpl.tryCommit(CacheImpl.java:1722)
        at org.infinispan.cache.impl.CacheImpl.executeCommandAndCommitIfNeeded(CacheImpl.java:1679)
        at org.infinispan.cache.impl.CacheImpl.putInternal(CacheImpl.java:1121)
        at org.infinispan.cache.impl.CacheImpl.put(CacheImpl.java:1111)
        at org.infinispan.cache.impl.CacheImpl.put(CacheImpl.java:1742)
        at org.infinispan.cache.impl.CacheImpl.put(CacheImpl.java:248)
        at org.infinispan.cache.impl.AbstractDelegatingCache.put(AbstractDelegatingCache.java:291)
        at org.keycloak.models.sessions.infinispan.InfinispanUserSessionProvider$InfinispanKeycloakTransaction$CacheTask.execute(InfinispanUserSessionProvider.java:854)
        at org.keycloak.models.sessions.infinispan.InfinispanUserSessionProvider$InfinispanKeycloakTransaction.commit(InfinispanUserSessionProvider.java:750)
        at org.keycloak.services.DefaultKeycloakTransactionManager.commit(DefaultKeycloakTransactionManager.java:104)
        at org.keycloak.services.filters.KeycloakTransactionCommitter.filter(KeycloakTransactionCommitter.java:43)
        at org.jboss.resteasy.core.ServerResponseWriter.executeFilters(ServerResponseWriter.java:121)
        at org.jboss.resteasy.core.ServerResponseWriter.writeNomapResponse(ServerResponseWriter.java:48)
        at org.jboss.resteasy.core.SynchronousDispatcher.writeResponse(SynchronousDispatcher.java:466)
        at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:415)
        at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:202)
        at org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.service(ServletContainerDispatcher.java:221)
        at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:56)
        at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:51)
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:790)
        at io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:85)
        at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:129)
        at org.keycloak.services.filters.KeycloakSessionServletFilter.doFilter(KeycloakSessionServletFilter.java:88)
        at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:60)
        at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
        at io.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.java:84)
        at io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:62)
        at io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36)
        at org.wildfly.extension.undertow.security.SecurityContextAssociationHandler.handleRequest(SecurityContextAssociationHandler.java:78)
        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
        at io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:131)
        at io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:57)
        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
        at io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:46)
        at io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64)
        at io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:60)
        at io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:77)
        at io.undertow.security.handlers.NotificationReceiverHandler.handleRequest(NotificationReceiverHandler.java:50)
        at io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43)
        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
        at org.wildfly.extension.undertow.security.jacc.JACCContextIdHandler.handleRequest(JACCContextIdHandler.java:61)
        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
        at io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:284)
        at io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:263)
        at io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:81)
        at io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:174)
        at io.undertow.server.Connectors.executeRootHandler(Connectors.java:202)
        at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:793)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
        at java.lang.Thread.run(Thread.java:745)
        Suppressed: javax.transaction.xa.XAException
                at org.infinispan.transaction.impl.TransactionCoordinator.handleCommitFailure(TransactionCoordinator.java:213)
                at org.infinispan.transaction.impl.TransactionCoordinator.commit(TransactionCoordinator.java:159)
                at org.infinispan.transaction.xa.TransactionXaAdapter.commit(TransactionXaAdapter.java:112)
                at com.arjuna.ats.internal.jta.resources.arjunacore.XAResourceRecord.topLevelOnePhaseCommit(XAResourceRecord.java:704)
                at com.arjuna.ats.arjuna.coordinator.BasicAction.onePhaseCommit(BasicAction.java:2366)
                at com.arjuna.ats.arjuna.coordinator.BasicAction.End(BasicAction.java:1495)
                at com.arjuna.ats.arjuna.coordinator.TwoPhaseCoordinator.end(TwoPhaseCoordinator.java:96)
                at com.arjuna.ats.arjuna.AtomicAction.commit(AtomicAction.java:162)
                at com.arjuna.ats.internal.jta.transaction.arjunacore.TransactionImple.commitAndDisassociate(TransactionImple.java:1200)
                ... 54 more
        Caused by: org.infinispan.util.concurrent.TimeoutException: Replication timeout for kc2
                at org.infinispan.remoting.transport.jgroups.JGroupsTransport.checkRsp(JGroupsTransport.java:765)
                at org.infinispan.remoting.transport.jgroups.JGroupsTransport.lambda$invokeRemotelyAsync$73(JGroupsTransport.java:612)
                at java.util.concurrent.CompletableFuture.uniApply(CompletableFuture.java:602)
                at java.util.concurrent.CompletableFuture$UniApply.tryFire(CompletableFuture.java:577)
                at java.util.concurrent.CompletableFuture.postComplete(CompletableFuture.java:474)
                at java.util.concurrent.CompletableFuture.complete(CompletableFuture.java:1962)
                at org.infinispan.remoting.transport.jgroups.RspListFuture.call(RspListFuture.java:47)
                at org.infinispan.remoting.transport.jgroups.RspListFuture.call(RspListFuture.java:16)
                at java.util.concurrent.FutureTask.run(FutureTask.java:266)
                at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$201(ScheduledThreadPoolExecutor.java:180)
                at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:293)
                ... 3 more

03:49:45,575 INFO  [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (Incoming-3,dev,kc1) ISPN000094: Received new cluster view for channel hibernate: [kc1|4] (1) [kc1]
03:49:45,575 ERROR [org.jboss.resteasy.resteasy_jaxrs.i18n] (default task-3) RESTEASY002025: Unknown exception while executing GET /realms/partner-dmz/protocol/openid-connect/auth: org.infinispan.commons.CacheException: Could not commit implicit transaction
        at org.infinispan.cache.impl.CacheImpl.tryCommit(CacheImpl.java:1725)
        at org.infinispan.cache.impl.CacheImpl.executeCommandAndCommitIfNeeded(CacheImpl.java:1679)
        at org.infinispan.cache.impl.CacheImpl.putInternal(CacheImpl.java:1121)
        at org.infinispan.cache.impl.CacheImpl.put(CacheImpl.java:1111)
        at org.infinispan.cache.impl.CacheImpl.put(CacheImpl.java:1742)
        at org.infinispan.cache.impl.CacheImpl.put(CacheImpl.java:248)
        at org.infinispan.cache.impl.AbstractDelegatingCache.put(AbstractDelegatingCache.java:291)
        at org.keycloak.models.sessions.infinispan.InfinispanUserSessionProvider$InfinispanKeycloakTransaction$CacheTask.execute(InfinispanUserSessionProvider.java:854)
        at org.keycloak.models.sessions.infinispan.InfinispanUserSessionProvider$InfinispanKeycloakTransaction.commit(InfinispanUserSessionProvider.java:750)
        at org.keycloak.services.DefaultKeycloakTransactionManager.commit(DefaultKeycloakTransactionManager.java:104)
        at org.keycloak.services.filters.KeycloakTransactionCommitter.filter(KeycloakTransactionCommitter.java:43)
        at org.jboss.resteasy.core.ServerResponseWriter.executeFilters(ServerResponseWriter.java:121)
        at org.jboss.resteasy.core.ServerResponseWriter.writeNomapResponse(ServerResponseWriter.java:48)
        at org.jboss.resteasy.core.SynchronousDispatcher.writeResponse(SynchronousDispatcher.java:466)
        at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:415)
        at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:202)
        at org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.service(ServletContainerDispatcher.java:221)
        at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:56)
        at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:51)
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:790)
        at io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:85)
        at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:129)
        at org.keycloak.services.filters.KeycloakSessionServletFilter.doFilter(KeycloakSessionServletFilter.java:88)
        at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:60)
        at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
        at io.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.java:84)
        at io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:62)
        at io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36)
        at org.wildfly.extension.undertow.security.SecurityContextAssociationHandler.handleRequest(SecurityContextAssociationHandler.java:78)
        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
        at io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:131)
        at io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:57)
        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
        at io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:46)
        at io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64)
        at io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:60)
        at io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:77)
        at io.undertow.security.handlers.NotificationReceiverHandler.handleRequest(NotificationReceiverHandler.java:50)
        at io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43)
        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
        at org.wildfly.extension.undertow.security.jacc.JACCContextIdHandler.handleRequest(JACCContextIdHandler.java:61)
        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
        at io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:284)
        at io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:263)
        at io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:81)
        at io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:174)
        at io.undertow.server.Connectors.executeRootHandler(Connectors.java:202)
        at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:793)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
        at java.lang.Thread.run(Thread.java:745)
Caused by: javax.transaction.RollbackException: ARJUNA016053: Could not commit transaction.
        at com.arjuna.ats.internal.jta.transaction.arjunacore.TransactionImple.commitAndDisassociate(TransactionImple.java:1212)
        at com.arjuna.ats.internal.jta.transaction.arjunacore.BaseTransaction.commit(BaseTransaction.java:126)
        at com.arjuna.ats.jbossatx.BaseTransactionManagerDelegate.commit(BaseTransactionManagerDelegate.java:89)
        at org.infinispan.cache.impl.CacheImpl.tryCommit(CacheImpl.java:1722)
        ... 51 more
        Suppressed: javax.transaction.xa.XAException
                at org.infinispan.transaction.impl.TransactionCoordinator.handleCommitFailure(TransactionCoordinator.java:213)
                at org.infinispan.transaction.impl.TransactionCoordinator.commit(TransactionCoordinator.java:159)
                at org.infinispan.transaction.xa.TransactionXaAdapter.commit(TransactionXaAdapter.java:112)
                at com.arjuna.ats.internal.jta.resources.arjunacore.XAResourceRecord.topLevelOnePhaseCommit(XAResourceRecord.java:704)
                at com.arjuna.ats.arjuna.coordinator.BasicAction.onePhaseCommit(BasicAction.java:2366)
                at com.arjuna.ats.arjuna.coordinator.BasicAction.End(BasicAction.java:1495)
                at com.arjuna.ats.arjuna.coordinator.TwoPhaseCoordinator.end(TwoPhaseCoordinator.java:96)
                at com.arjuna.ats.arjuna.AtomicAction.commit(AtomicAction.java:162)
                at com.arjuna.ats.internal.jta.transaction.arjunacore.TransactionImple.commitAndDisassociate(TransactionImple.java:1200)
                ... 54 more
        Caused by: org.infinispan.util.concurrent.TimeoutException: Replication timeout for kc2
                at org.infinispan.remoting.transport.jgroups.JGroupsTransport.checkRsp(JGroupsTransport.java:765)
                at org.infinispan.remoting.transport.jgroups.JGroupsTransport.lambda$invokeRemotelyAsync$73(JGroupsTransport.java:612)
                at java.util.concurrent.CompletableFuture.uniApply(CompletableFuture.java:602)
                at java.util.concurrent.CompletableFuture$UniApply.tryFire(CompletableFuture.java:577)
                at java.util.concurrent.CompletableFuture.postComplete(CompletableFuture.java:474)
                at java.util.concurrent.CompletableFuture.complete(CompletableFuture.java:1962)
                at org.infinispan.remoting.transport.jgroups.RspListFuture.call(RspListFuture.java:47)
                at org.infinispan.remoting.transport.jgroups.RspListFuture.call(RspListFuture.java:16)
                at java.util.concurrent.FutureTask.run(FutureTask.java:266)
                at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$201(ScheduledThreadPoolExecutor.java:180)
                at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:293)
                ... 3 more

03:49:45,596 ERROR [io.undertow.request] (default task-3) UT005023: Exception handling request to /auth/realms/partner-dmz/protocol/openid-connect/auth: org.jboss.resteasy.spi.UnhandledException: org.infinispan.commons.CacheException: Could not commit implicit transaction
        at org.jboss.resteasy.core.ExceptionHandler.handleException(ExceptionHandler.java:247)
        at org.jboss.resteasy.core.SynchronousDispatcher.writeException(SynchronousDispatcher.java:168)
        at org.jboss.resteasy.core.SynchronousDispatcher.writeResponse(SynchronousDispatcher.java:471)
        at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:415)
        at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:202)
        at org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.service(ServletContainerDispatcher.java:221)
        at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:56)
        at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:51)
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:790)
        at io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:85)
        at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:129)
        at org.keycloak.services.filters.KeycloakSessionServletFilter.doFilter(KeycloakSessionServletFilter.java:88)
        at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:60)
        at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
        at io.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.java:84)
        at io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:62)
        at io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36)
        at org.wildfly.extension.undertow.security.SecurityContextAssociationHandler.handleRequest(SecurityContextAssociationHandler.java:78)
        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
        at io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:131)
        at io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:57)
        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
        at io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:46)
        at io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64)
        at io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:60)
        at io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:77)
        at io.undertow.security.handlers.NotificationReceiverHandler.handleRequest(NotificationReceiverHandler.java:50)
        at io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43)
        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
        at org.wildfly.extension.undertow.security.jacc.JACCContextIdHandler.handleRequest(JACCContextIdHandler.java:61)
        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
        at io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:284)
        at io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:263)
        at io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:81)
        at io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:174)
        at io.undertow.server.Connectors.executeRootHandler(Connectors.java:202)
        at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:793)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
        at java.lang.Thread.run(Thread.java:745)
Caused by: org.infinispan.commons.CacheException: Could not commit implicit transaction
        at org.infinispan.cache.impl.CacheImpl.tryCommit(CacheImpl.java:1725)
        at org.infinispan.cache.impl.CacheImpl.executeCommandAndCommitIfNeeded(CacheImpl.java:1679)
        at org.infinispan.cache.impl.CacheImpl.putInternal(CacheImpl.java:1121)
        at org.infinispan.cache.impl.CacheImpl.put(CacheImpl.java:1111)
        at org.infinispan.cache.impl.CacheImpl.put(CacheImpl.java:1742)
        at org.infinispan.cache.impl.CacheImpl.put(CacheImpl.java:248)
        at org.infinispan.cache.impl.AbstractDelegatingCache.put(AbstractDelegatingCache.java:291)
        at org.keycloak.models.sessions.infinispan.InfinispanUserSessionProvider$InfinispanKeycloakTransaction$CacheTask.execute(InfinispanUserSessionProvider.java:854)
        at org.keycloak.models.sessions.infinispan.InfinispanUserSessionProvider$InfinispanKeycloakTransaction.commit(InfinispanUserSessionProvider.java:750)
        at org.keycloak.services.DefaultKeycloakTransactionManager.commit(DefaultKeycloakTransactionManager.java:104)
        at org.keycloak.services.filters.KeycloakTransactionCommitter.filter(KeycloakTransactionCommitter.java:43)
        at org.jboss.resteasy.core.ServerResponseWriter.executeFilters(ServerResponseWriter.java:121)
        at org.jboss.resteasy.core.ServerResponseWriter.writeNomapResponse(ServerResponseWriter.java:48)
        at org.jboss.resteasy.core.SynchronousDispatcher.writeResponse(SynchronousDispatcher.java:466)
        ... 38 more
Caused by: javax.transaction.RollbackException: ARJUNA016053: Could not commit transaction.
        at com.arjuna.ats.internal.jta.transaction.arjunacore.TransactionImple.commitAndDisassociate(TransactionImple.java:1212)
        at com.arjuna.ats.internal.jta.transaction.arjunacore.BaseTransaction.commit(BaseTransaction.java:126)
        at com.arjuna.ats.jbossatx.BaseTransactionManagerDelegate.commit(BaseTransactionManagerDelegate.java:89)
        at org.infinispan.cache.impl.CacheImpl.tryCommit(CacheImpl.java:1722)
        ... 51 more
        Suppressed: javax.transaction.xa.XAException
                at org.infinispan.transaction.impl.TransactionCoordinator.handleCommitFailure(TransactionCoordinator.java:213)
                at org.infinispan.transaction.impl.TransactionCoordinator.commit(TransactionCoordinator.java:159)
                at org.infinispan.transaction.xa.TransactionXaAdapter.commit(TransactionXaAdapter.java:112)
                at com.arjuna.ats.internal.jta.resources.arjunacore.XAResourceRecord.topLevelOnePhaseCommit(XAResourceRecord.java:704)
                at com.arjuna.ats.arjuna.coordinator.BasicAction.onePhaseCommit(BasicAction.java:2366)
                at com.arjuna.ats.arjuna.coordinator.BasicAction.End(BasicAction.java:1495)
                at com.arjuna.ats.arjuna.coordinator.TwoPhaseCoordinator.end(TwoPhaseCoordinator.java:96)
                at com.arjuna.ats.arjuna.AtomicAction.commit(AtomicAction.java:162)
                at com.arjuna.ats.internal.jta.transaction.arjunacore.TransactionImple.commitAndDisassociate(TransactionImple.java:1200)
                ... 54 more
        Caused by: org.infinispan.util.concurrent.TimeoutException: Replication timeout for kc2
                at org.infinispan.remoting.transport.jgroups.JGroupsTransport.checkRsp(JGroupsTransport.java:765)
                at org.infinispan.remoting.transport.jgroups.JGroupsTransport.lambda$invokeRemotelyAsync$73(JGroupsTransport.java:612)
                at java.util.concurrent.CompletableFuture.uniApply(CompletableFuture.java:602)
                at java.util.concurrent.CompletableFuture$UniApply.tryFire(CompletableFuture.java:577)
                at java.util.concurrent.CompletableFuture.postComplete(CompletableFuture.java:474)
                at java.util.concurrent.CompletableFuture.complete(CompletableFuture.java:1962)
                at org.infinispan.remoting.transport.jgroups.RspListFuture.call(RspListFuture.java:47)
                at org.infinispan.remoting.transport.jgroups.RspListFuture.call(RspListFuture.java:16)
                at java.util.concurrent.FutureTask.run(FutureTask.java:266)
                at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$201(ScheduledThreadPoolExecutor.java:180)
                at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:293)
                ... 3 more



Here kc2 is the removed instance.

Kind Regards,
Sarp Kaya


From: Stian Thorgersen <sthorger at redhat.com<mailto:sthorger at redhat.com>>
Reply-To: "stian at redhat.com<mailto:stian at redhat.com>" <stian at redhat.com<mailto:stian at redhat.com>>
Date: Friday, July 1, 2016 at 7:17 PM
To: Abdullah Sarp Kaya <akaya at expedia.com<mailto:akaya at expedia.com>>
Cc: "keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>" <keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>>
Subject: Re: [keycloak-user] Lost session when removing an instance off cluster

Can you please include more details from the log if there is any, at least a full stack trace and not just the bit you've included. We also need to know details around how you've configured the caches and Infinispan.

On 1 July 2016 at 10:16, Sarp Kaya <akaya at expedia.com<mailto:akaya at expedia.com>> wrote:
Hello,

I have tried various ways of configuring infinispan but it just seems like if I deploy a new instance to the cluster and remove one, then some sessions are lost and an exception is thrown saying that it was not handled. This is the Infinispan exception:

Exceptionhandlingrequestto/auth/realms/realmname/protocol/openid-connect/auth:org.jboss.resteasy.spi.UnhandledException:org.infinispan.util.concurrent.TimeoutException:Replicationtimeoutfor79a0757ecab3atorg.jboss.resteasy.core.ExceptionHandler.handleException(ExceptionHandler.java:247) atorg.jboss.resteasy.core.SynchronousDispatcher.writeException(SynchronousDispatcher.java:168) atorg.jboss.resteasy.core.SynchronousDispatcher.writeResponse(SynchronousDispatcher.java:471) atorg.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:415) atorg.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:202) atorg.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.service(ServletContainerDispatcher.java:221) atorg.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:56) atorg.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:51) atjavax.servlet.http.HttpServlet.service(HttpServlet.java:790) atio.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:85) atio.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:129) atorg.keycloak.services.filters.KeycloakSessionServletFilter.doFilter(KeycloakSessionServletFilter.java:88) atio.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:60) atio.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131) atio.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.java:84) atio.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:62) atio.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36) atorg.wildfly.extension.undertow.security.SecurityContextAssociationHandler.handleRequest(SecurityContextAssociationHandler.java:78) atio.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) atio.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:131) atio.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:57) atio.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) atio.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:46) atio.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64) atio.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:60) atio.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:77) atio.undertow.security.handlers.NotificationReceiverHandler.handleRequest(NotificationReceiverHandler.java:50) atio.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43) atio.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) atorg.wildfly.extension.undertow.security.jacc.JACCContextIdHandler.handleRequest(JACCContextIdHandler.java:61) atio.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) atio.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) atio.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:284) atio.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:263) atio.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:81) atio.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:174) atio.undertow.server.Connectors.executeRootHandler(Connectors.java:202) atio.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:793) atjava.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) atjava.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) atjava.lang.Thread.run(Thread.java:745) Causedby:org.infinispan.util.concurrent.TimeoutException:Replicationtimeoutfor79a0757ecab3atorg.infinispan.remoting.transport.jgroups.JGroupsTransport.checkRsp(JGroupsTransport.java:765) atorg.infinispan.remoting.transport.jgroups.JGroupsTransport.lambda$invokeRemotelyAsync$72(JGroupsTransport.java:599) atjava.util.concurrent.CompletableFuture.uniApply(CompletableFuture.java:602) atjava.util.concurrent.CompletableFuture$UniApply.tryFire(CompletableFuture.java:577) atjava.util.concurrent.CompletableFuture.postComplete(CompletableFuture.java:474) atjava.util.concurrent.CompletableFuture.complete(CompletableFuture.java:1962) atorg.infinispan.remoting.transport.jgroups.SingleResponseFuture.call(SingleResponseFuture.java:46) atorg.infinispan.remoting.transport.jgroups.SingleResponseFuture.call(SingleResponseFuture.java:17) atjava.util.concurrent.FutureTask.run(FutureTask.java:266) atjava.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$201(ScheduledThreadPoolExecutor.java:180)

This causes browsers to see Internal Server Error. Shouldn?t that be handled in Keycloak as lost session, therefore KC should try to handle it rather than showing that it?s an Internal Server Error?

My current infinispan configuration looks like this:


<distributed-cache name="sessions" mode="SYNC">
    <transaction mode="NON_DURABLE_XA"/>
</distributed-cache>

I use Keycloak version 1.9.5. My question is am I doing something wrong with my configuration? I tried both replicated-cache and distributed-cache and tried all transaction mode on both of them. None of them seems to solve the error that I?ve had above.

Kind Regards,
Sarp Kaya




_______________________________________________
keycloak-user mailing list
keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>
https://lists.jboss.org/mailman/listinfo/keycloak-user



-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160705/0a82bb21/attachment-0001.html 

From max.allan+keycloak at surevine.com  Tue Jul  5 05:05:15 2016
From: max.allan+keycloak at surevine.com (Max Allan)
Date: Tue, 5 Jul 2016 10:05:15 +0100
Subject: [keycloak-user] Upload SP metadata to keycloak??
Message-ID: <CADNp1Ba-LsL5kQHC7rY+tt1X+13DvRe2LR2CFVBS6SwWmoDA2Q@mail.gmail.com>

I've asked this question on Stackoverflow and not had an answer yet. I
thought I should ask in the right place as well!
(
http://stackoverflow.com/questions/38190982/where-do-i-upload-sps-xml-in-keycloak
)

Where do I upload the XML metadata from a SAML SP?
I've seen a few people saying they've done it and had other problems but I
can't even find the page/button you need to upload it. I'm assuming in the
client configuration windows somewhere??

Thanks,
Max
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160705/fc0fb39a/attachment.html 

From sthorger at redhat.com  Tue Jul  5 05:28:02 2016
From: sthorger at redhat.com (Stian Thorgersen)
Date: Tue, 5 Jul 2016 11:28:02 +0200
Subject: [keycloak-user] Upload SP metadata to keycloak??
In-Reply-To: <CADNp1Ba-LsL5kQHC7rY+tt1X+13DvRe2LR2CFVBS6SwWmoDA2Q@mail.gmail.com>
References: <CADNp1Ba-LsL5kQHC7rY+tt1X+13DvRe2LR2CFVBS6SwWmoDA2Q@mail.gmail.com>
Message-ID: <CAJgngAcXz-fCdLtzn=LTzO3sC2_ZJUq1Gz58-DXiUPO5+67=ag@mail.gmail.com>

You can do this through the admin console (Clients -> Create -> Click on
Select File next to Import) or use the client registration services [1]

[1]
https://keycloak.gitbooks.io/securing-client-applications-guide/content/v/2.0/topics/client-registration.html

On 5 July 2016 at 11:05, Max Allan <max.allan+keycloak at surevine.com> wrote:

> I've asked this question on Stackoverflow and not had an answer yet. I
> thought I should ask in the right place as well!
> (
> http://stackoverflow.com/questions/38190982/where-do-i-upload-sps-xml-in-keycloak
> )
>
> Where do I upload the XML metadata from a SAML SP?
> I've seen a few people saying they've done it and had other problems but I
> can't even find the page/button you need to upload it. I'm assuming in the
> client configuration windows somewhere??
>
> Thanks,
> Max
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160705/896dd474/attachment.html 

From guus.der.kinderen at gmail.com  Tue Jul  5 05:31:21 2016
From: guus.der.kinderen at gmail.com (Guus der Kinderen)
Date: Tue, 5 Jul 2016 11:31:21 +0200
Subject: [keycloak-user] Import / restore a custom required action
Message-ID: <CAMJaV9n2NiNVZxR=X_DhmWQL4o_YR38hZmS5-WcgGFH2C0wayg@mail.gmail.com>

Hello,

We have created a custom required action, in the form of a provider. It
appears to behave as expected (we're using Keycloak 1.9.2)

We are facing a challenge when trying to provision a new/empty server with
Keycloak. We are trying to install Keycloak, and restore a pre-existing
user base in it. Using the guidelines from chapter 25 "export and import"
of the manual, we're able to do most of what we'd like to achieve.

However, we're unable to restore users that have defined a required action
as provided by our custom code. When we start up Keycloak, and look at the
realm configuration for authentication, the 'required action'  is missing,
but can be registered. After we manually do that, everything appears to be
fine.

Is there a way in which we can have a registered custom required action,
without the need for manual intervention?

We've tried adding a JSON snippet to the 'requiredActions' array property
in the realm.json file that's being imported, but that does not appear to
have any effect.

An alternative would perhaps be registering the action through the REST
endpoint that appears to be available, but that would require us to start
Keycloak, before we've provisioned the users, which if possible, would be
pretty messy (we'd have to wait for Keycloak to have started, invoke the
REST endpoint, shut the instance down, and restart it with the user import,
as far as I can tell).

I'm hoping I'm simply missing an obvious option. Any help is much
appreciated!

Regards,

  Guus
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160705/4fb0b491/attachment.html 

From bvs78 at rediffmail.com  Tue Jul  5 05:33:47 2016
From: bvs78 at rediffmail.com (Subrahmanyam BV)
Date: 5 Jul 2016 09:33:47 -0000
Subject: [keycloak-user] =?utf-8?q?Keycloak-Headerbased_authentication?=
Message-ID: <1467699884.S.6380.545.f4-234-194.1467711227.26773@webmail.rediffmail.com>


Hi Thomas,&nbsp;&nbsp; &nbsp; Thanks for the quick reply . Here is the scenario that I am looking for. Once the user gets authenticated, is there a way to pass some attributes of the user (say for example, company, emailid, status of the user etc...) as a part of the response headers?&nbsp;
Regards,Subrahmanyam.



From: Thomas Darimont &lt;thomas.darimont at googlemail.com&gt;
Sent: Tue, 05 Jul 2016 11:54:44 
To: Subrahmanyam BV &lt;bvs78 at rediffmail.com&gt;
Cc: keycloak-user &lt;keycloak-user at lists.jboss.org&gt;
Subject: Re: [keycloak-user] Keycloak-Headerbased authentication
Hello,
I'm not familiar with siteminder and quickly googled https://docops.ca.com/ca-single-sign-on-12-52-sp1/en/configuring/web-agent-configuration/web-application-protection/default-http-headers-used-by-the-product
Based on that I think that mod_auth_oidc might do what you want.
https://github.com/keycloak/securing_apps_guide/blob/master/topics/oidc/mod-auth-openidc.adoc
https://github.com/thomasdarimont/keycloak_mod_auth_oidc_example/blob/master/README.md
Cheers,

Thomas
Am 05.07.2016 6:44 vorm. schrieb "Subrahmanyam BV" &lt;bvs78 at rediffmail.com&gt;:HI,&nbsp; &nbsp; Just wanted to know whether keycloak supports header-based authentication as supported by siteminder. Please let me know on this.
Regards,Subrahmanyam.


_______________________________________________

keycloak-user mailing list

keycloak-user at lists.jboss.org

https://lists.jboss.org/mailman/listinfo/keycloak-user

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160705/37a68b1f/attachment.html 

From charlee.ch at gmail.com  Tue Jul  5 06:12:40 2016
From: charlee.ch at gmail.com (Charlee Chitsuk)
Date: Tue, 5 Jul 2016 17:12:40 +0700
Subject: [keycloak-user] Cannot import the json for photoz authorization
	example.
Message-ID: <CAFBJWv7rumJ_RsR+NOML5YEicMF=EaxuTOxm_f_hEgDG675nJQ@mail.gmail.com>

Hi,

I try to follow the authorization photoz example[1]. I can import the
realm[2] to the keycloak properly.

Anyhow when importing the authorization json[3] there is a misconfiguration
about the drools policy as the "mavenArtifactVersion" should be
"2.0.0.Final".

After correcting the version, sadly there is another failure during the
importing  the authorization json[3] as

ERROR [io.undertow.request] (default task-100) UT005023:
Exception handling request to
/auth/admin/realms/photoz/clients/001e0705-8bc6-47de-b408-dd07a5ebba9b/authz/resource-server:
org.jboss.resteasy.spi.UnhandledException: java.lang.IllegalStateException:
Not found in database
at
org.jboss.resteasy.core.ExceptionHandler.handleApplicationException(ExceptionHandler.java:76)
        .....
Caused by: java.lang.IllegalStateException: Not found in database
at
org.keycloak.models.authorization.infinispan.CachedScopeStore$1.getDelegateForUpdate(CachedScopeStore.java:175)

Could you please help to advise how to fix this issue? Thank you very much
for your help in advance. I'm looking forward to hearing from you soon.


[1] https://github.com/keycloak/keycloak/tree/master/examples/authz/photoz

[2]
https://github.com/keycloak/keycloak/blob/master/examples/authz/photoz/photoz-realm.json

[3]
https://github.com/keycloak/keycloak/blob/master/examples/authz/photoz/photoz-restful-api-authz-service.json

--
   Best Regards,

   Charlee Ch
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160705/3ca9c76d/attachment-0001.html 

From thomas.darimont at googlemail.com  Tue Jul  5 06:20:15 2016
From: thomas.darimont at googlemail.com (Thomas Darimont)
Date: Tue, 5 Jul 2016 12:20:15 +0200
Subject: [keycloak-user] Keycloak-Headerbased authentication
In-Reply-To: <1467699884.S.6380.545.f4-234-194.1467711227.26773@webmail.rediffmail.com>
References: <1467699884.S.6380.545.f4-234-194.1467711227.26773@webmail.rediffmail.com>
Message-ID: <CAK-7U1jf5zAL1NV9-_tMW_5XmN0pY83FUa-fjkicN0V6sQCh+g@mail.gmail.com>

I think you can add claim mappers in the client configuration in Keycloak
which can then be exposed as headers.

See mod_auth_oidc configuration for claim mapping.

Cheers,
Thomas
Am 05.07.2016 11:33 vorm. schrieb "Subrahmanyam BV" <bvs78 at rediffmail.com>:

>
> Hi Thomas,
>     Thanks for the quick reply . Here is the scenario that I am looking
> for. Once the user gets authenticated, is there a way to pass some
> attributes of the user (say for example, company, emailid, status of the
> user etc...) as a part of the response headers?
>
> Regards,
> Subrahmanyam.
>
>
>
> From: Thomas Darimont <thomas.darimont at googlemail.com>
> Sent: Tue, 05 Jul 2016 11:54:44
> To: Subrahmanyam BV <bvs78 at rediffmail.com>
> Cc: keycloak-user <keycloak-user at lists.jboss.org>
> Subject: Re: [keycloak-user] Keycloak-Headerbased authentication
>
> Hello,
>
> I'm not familiar with siteminder and quickly googled
> https://docops.ca.com/ca-single-sign-on-12-52-sp1/en/configuring/web-agent-configuration/web-application-protection/default-http-headers-used-by-the-product
>
> Based on that I think that mod_auth_oidc might do what you want.
>
>
> https://github.com/keycloak/securing_apps_guide/blob/master/topics/oidc/mod-auth-openidc.adoc
>
>
> https://github.com/thomasdarimont/keycloak_mod_auth_oidc_example/blob/master/README.md
>
> Cheers,
> Thomas
> Am 05.07.2016 6:44 vorm. schrieb "Subrahmanyam BV" <bvs78 at rediffmail.com>:
>
>> HI,
>>     Just wanted to know whether keycloak supports header-based
>> authentication as supported by siteminder. Please let me know on this.
>>
>> Regards,
>> Subrahmanyam.
>>
>>
>>
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160705/a2014a55/attachment.html 

From charlee.ch at gmail.com  Tue Jul  5 06:33:32 2016
From: charlee.ch at gmail.com (Charlee Chitsuk)
Date: Tue, 5 Jul 2016 17:33:32 +0700
Subject: [keycloak-user] Cannot import the json for photoz authorization
	example.
In-Reply-To: <CAFBJWv7rumJ_RsR+NOML5YEicMF=EaxuTOxm_f_hEgDG675nJQ@mail.gmail.com>
References: <CAFBJWv7rumJ_RsR+NOML5YEicMF=EaxuTOxm_f_hEgDG675nJQ@mail.gmail.com>
Message-ID: <CAFBJWv6iZNihsW8ansTzkrUw7Tje7P+sKjFV0ZMR4iYEhyO_wA@mail.gmail.com>

Hi,

Regarding to this issue, I've tried to create the "authorization scope" via
the admin GUI manually and found strange behavior as the following:-

1. Create the scope with name as urn:photoz.com:scopes:album:view
2. Click save
3. The system should the success, the scope has been created.
4. Go back to the "authorization scope", there is no any displayed scope.

Then I've tried to create again as the following:-

1. Create the scope with name as aaa
2. Click save
3. The system should the success, the scope has been created.
4. Go back to the "authorization scope", the aaa is displayed.
5. Click the aaa to edit
6. Change name from aaa to urn:photoz.com:scopes:album:view
7. The system should the success, the scope has been created.
8. Go back to the "authorization scope", the
urn:photoz.com:scopes:album:view is
displayed.

Anyhow I cannot find how to delete the created scoped as well.


I'm not sure if I'm doing something wrong or not. Could you please help to
advise further?


--
   Best Regards,

   Charlee Ch

2016-07-05 17:12 GMT+07:00 Charlee Chitsuk <charlee.ch at gmail.com>:

>
> Hi,
>
> I try to follow the authorization photoz example[1]. I can import the
> realm[2] to the keycloak properly.
>
> Anyhow when importing the authorization json[3] there is a
> misconfiguration about the drools policy as the "mavenArtifactVersion"
> should be "2.0.0.Final".
>
> After correcting the version, sadly there is another failure during the
> importing  the authorization json[3] as
>
> ERROR [io.undertow.request] (default task-100) UT005023:
> Exception handling request to
> /auth/admin/realms/photoz/clients/001e0705-8bc6-47de-b408-dd07a5ebba9b/authz/resource-server:
> org.jboss.resteasy.spi.UnhandledException:
> java.lang.IllegalStateException: Not found in database
> at
> org.jboss.resteasy.core.ExceptionHandler.handleApplicationException(ExceptionHandler.java:76)
>         .....
> Caused by: java.lang.IllegalStateException: Not found in database
> at
> org.keycloak.models.authorization.infinispan.CachedScopeStore$1.getDelegateForUpdate(CachedScopeStore.java:175)
>
> Could you please help to advise how to fix this issue? Thank you very much
> for your help in advance. I'm looking forward to hearing from you soon.
>
>
> [1] https://github.com/keycloak/keycloak/tree/master/examples/authz/photoz
>
> [2]
> https://github.com/keycloak/keycloak/blob/master/examples/authz/photoz/photoz-realm.json
>
> [3]
> https://github.com/keycloak/keycloak/blob/master/examples/authz/photoz/photoz-restful-api-authz-service.json
>
> --
>    Best Regards,
>
>    Charlee Ch
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160705/55d30e50/attachment.html 

From harrytpc at gmail.com  Tue Jul  5 08:47:07 2016
From: harrytpc at gmail.com (Harry Trinta)
Date: Tue, 5 Jul 2016 09:47:07 -0300
Subject: [keycloak-user] User impersonation - JWT
In-Reply-To: <CAJgngAcf7c0+-mjyw9b+WAsCC1UcNWic75QQR3BnedCjkkQjQA@mail.gmail.com>
References: <CA+waeaUYJe2-Lje-DUGK_QPOwdi6_CSBAi+hY+Oi4wTknwsy3w@mail.gmail.com>
	<CAJgngAcf7c0+-mjyw9b+WAsCC1UcNWic75QQR3BnedCjkkQjQA@mail.gmail.com>
Message-ID: <CA+waeaVd35zy5+M-wt6yRT1OMpj7BQ9mGXS1m9xRZwf=AnUA9w@mail.gmail.com>

Stian, thanks for the reply!

There is no service to retrieve a token passing the cookies as a parameter?
I was looking at TokenEndpoint.java, but I have not found a way.

Thanks

2016-07-05 3:33 GMT-03:00 Stian Thorgersen <sthorger at redhat.com>:

> The impersonation feature we have logs the admin in as the impersonated
> user rather than generate tokens. We decided on this approach as it would
> be transparent to applications and they wouldn't need to build-in special
> impersonation. What you want is not possible at the moment, but you can
> create a JIRA feature request for it. It would have to be a community
> contribution if you want it added in a timely manner.
>
> On 4 July 2016 at 18:52, Harry Trinta <harrytpc at gmail.com> wrote:
>
>> Dears,
>>
>>
>>
>> I need a help with user impersonation on keycloak.
>>
>>
>>
>> I am authenticating users through the
>> "/realms/test/protocol/openid-connect/token". As expected, it returns a
>> token JWT.
>>
>> In my app, all requests go through apiman, which validates the JWT.
>>
>>
>>
>> Now, I need to personification of user. I'm calling the service
>> "/admin/realms/test/users/USER_ID/impersonation", sending the token in the
>> header (Authorization = Bearer eyJhbGciOiJSUzI1NiJ9 ...).
>>
>> The service /impersonation creates the user session on keycloak, however
>> doesnt return a JWT, but 3 cookies. *I'd like to get the JWT of
>> personified user instead of cookie.* It's possible?
>>
>>
>>
>> Best regards
>>
>> Harry Costa
>>
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160705/56fbb754/attachment.html 

From valerij.timofeev at gmail.com  Tue Jul  5 08:54:31 2016
From: valerij.timofeev at gmail.com (Valerij Timofeev)
Date: Tue, 5 Jul 2016 14:54:31 +0200
Subject: [keycloak-user] Brute Force Detection breaks Social login
Message-ID: <CAOy2obE1_FgK6h=NjkM6GB2ixeERu9ZA0nR8fG2-e+-j866-6A@mail.gmail.com>

Hi all,

it looks like the Brute Force Detection breaks Social login.

I've:
1) downloaded keycloak-demo-1.9.8.Final
2) setup Facebook Identity provider
3) successfully tested Facebook login
4) activated Brute Force Detection with default values
5) tested Facebook login: it fails with the error message: "Account is
disabled, contact admin."

I wonder whether somebody has ever tested this combination.


Kind regards
Valerij Timofeev
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160705/804984d8/attachment-0001.html 

From bruno at abstractj.org  Tue Jul  5 09:59:10 2016
From: bruno at abstractj.org (Bruno Oliveira)
Date: Tue, 5 Jul 2016 10:59:10 -0300
Subject: [keycloak-user] Brute Force Detection breaks Social login
In-Reply-To: <CAOy2obE1_FgK6h=NjkM6GB2ixeERu9ZA0nR8fG2-e+-j866-6A@mail.gmail.com>
References: <CAOy2obE1_FgK6h=NjkM6GB2ixeERu9ZA0nR8fG2-e+-j866-6A@mail.gmail.com>
Message-ID: <20160705135910.GB10833@abstractj.org>

Hi Valerij,

I've tested against 2.0.0.Final right now and I couldn't reproduce your
issue.

I have brute force enabled by default here and Facebook configured
exactly like described at the docs.

Not sure how to reproduce your issue :/ Maybe, give 2.0.0.Final a try?

On 2016-07-05, Valerij Timofeev wrote:
> Hi all,
>
> it looks like the Brute Force Detection breaks Social login.
>
> I've:
> 1) downloaded keycloak-demo-1.9.8.Final
> 2) setup Facebook Identity provider
> 3) successfully tested Facebook login
> 4) activated Brute Force Detection with default values
> 5) tested Facebook login: it fails with the error message: "Account is
> disabled, contact admin."
>
> I wonder whether somebody has ever tested this combination.
>
>
> Kind regards
> Valerij Timofeev

> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user


--

abstractj
PGP: 0x84DC9914

From valerij.timofeev at gmail.com  Tue Jul  5 10:40:14 2016
From: valerij.timofeev at gmail.com (Valerij Timofeev)
Date: Tue, 5 Jul 2016 16:40:14 +0200
Subject: [keycloak-user] Brute Force Detection breaks Social login
In-Reply-To: <20160705135910.GB10833@abstractj.org>
References: <CAOy2obE1_FgK6h=NjkM6GB2ixeERu9ZA0nR8fG2-e+-j866-6A@mail.gmail.com>
	<20160705135910.GB10833@abstractj.org>
Message-ID: <CAOy2obHLS1mDi7DQHpPeCZgAzOxfSVDTLHsbUsa27LARP+ddJQ@mail.gmail.com>

Hi Bruno,

thank you for the check.
We are going to migrate our production setup from Keycloak 1.9.4 to Red Hat
SSO 7.0, which is based on Keycloak 1.9.8.
Direct migration to 2.0.0.Final would be for us too risky, but still an
option somewhen later.

@All,
any ideas for Keycloak 1.9.x? May be there is some setting we miss allowing
us to use both "peacefully".

Kind regards
Valerij

2016-07-05 15:59 GMT+02:00 Bruno Oliveira <bruno at abstractj.org>:

> Hi Valerij,
>
> I've tested against 2.0.0.Final right now and I couldn't reproduce your
> issue.
>
> I have brute force enabled by default here and Facebook configured
> exactly like described at the docs.
>
> Not sure how to reproduce your issue :/ Maybe, give 2.0.0.Final a try?
>
> On 2016-07-05, Valerij Timofeev wrote:
> > Hi all,
> >
> > it looks like the Brute Force Detection breaks Social login.
> >
> > I've:
> > 1) downloaded keycloak-demo-1.9.8.Final
> > 2) setup Facebook Identity provider
> > 3) successfully tested Facebook login
> > 4) activated Brute Force Detection with default values
> > 5) tested Facebook login: it fails with the error message: "Account is
> > disabled, contact admin."
> >
> > I wonder whether somebody has ever tested this combination.
> >
> >
> > Kind regards
> > Valerij Timofeev
>
> > _______________________________________________
> > keycloak-user mailing list
> > keycloak-user at lists.jboss.org
> > https://lists.jboss.org/mailman/listinfo/keycloak-user
>
>
> --
>
> abstractj
> PGP: 0x84DC9914
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160705/0e8863b8/attachment.html 

From bruno at abstractj.org  Tue Jul  5 10:51:43 2016
From: bruno at abstractj.org (Bruno Oliveira)
Date: Tue, 5 Jul 2016 11:51:43 -0300
Subject: [keycloak-user] Brute Force Detection breaks Social login
In-Reply-To: <CAOy2obHLS1mDi7DQHpPeCZgAzOxfSVDTLHsbUsa27LARP+ddJQ@mail.gmail.com>
References: <CAOy2obE1_FgK6h=NjkM6GB2ixeERu9ZA0nR8fG2-e+-j866-6A@mail.gmail.com>
	<20160705135910.GB10833@abstractj.org>
	<CAOy2obHLS1mDi7DQHpPeCZgAzOxfSVDTLHsbUsa27LARP+ddJQ@mail.gmail.com>
Message-ID: <20160705145143.GA18957@abstractj.org>

I've just downloaded and tried with 1.9.8 too, it works. Is this happening with
all users? Have you considered to setup an isolated environment from
scratch?

On 2016-07-05, Valerij Timofeev wrote:
> Hi Bruno,
>
> thank you for the check.
> We are going to migrate our production setup from Keycloak 1.9.4 to Red Hat
> SSO 7.0, which is based on Keycloak 1.9.8.
> Direct migration to 2.0.0.Final would be for us too risky, but still an
> option somewhen later.
>
> @All,
> any ideas for Keycloak 1.9.x? May be there is some setting we miss allowing
> us to use both "peacefully".
>
> Kind regards
> Valerij
>
> 2016-07-05 15:59 GMT+02:00 Bruno Oliveira <bruno at abstractj.org>:
>
> > Hi Valerij,
> >
> > I've tested against 2.0.0.Final right now and I couldn't reproduce your
> > issue.
> >
> > I have brute force enabled by default here and Facebook configured
> > exactly like described at the docs.
> >
> > Not sure how to reproduce your issue :/ Maybe, give 2.0.0.Final a try?
> >
> > On 2016-07-05, Valerij Timofeev wrote:
> > > Hi all,
> > >
> > > it looks like the Brute Force Detection breaks Social login.
> > >
> > > I've:
> > > 1) downloaded keycloak-demo-1.9.8.Final
> > > 2) setup Facebook Identity provider
> > > 3) successfully tested Facebook login
> > > 4) activated Brute Force Detection with default values
> > > 5) tested Facebook login: it fails with the error message: "Account is
> > > disabled, contact admin."
> > >
> > > I wonder whether somebody has ever tested this combination.
> > >
> > >
> > > Kind regards
> > > Valerij Timofeev
> >
> > > _______________________________________________
> > > keycloak-user mailing list
> > > keycloak-user at lists.jboss.org
> > > https://lists.jboss.org/mailman/listinfo/keycloak-user
> >
> >
> > --
> >
> > abstractj
> > PGP: 0x84DC9914
> >

--

abstractj
PGP: 0x84DC9914

From bruno at abstractj.org  Tue Jul  5 10:59:02 2016
From: bruno at abstractj.org (Bruno Oliveira)
Date: Tue, 5 Jul 2016 11:59:02 -0300
Subject: [keycloak-user] Brute Force Detection breaks Social login
In-Reply-To: <20160705145143.GA18957@abstractj.org>
References: <CAOy2obE1_FgK6h=NjkM6GB2ixeERu9ZA0nR8fG2-e+-j866-6A@mail.gmail.com>
	<20160705135910.GB10833@abstractj.org>
	<CAOy2obHLS1mDi7DQHpPeCZgAzOxfSVDTLHsbUsa27LARP+ddJQ@mail.gmail.com>
	<20160705145143.GA18957@abstractj.org>
Message-ID: <20160705145902.GA19930@abstractj.org>

I just completely tried in a fresh new browser profile and managed to
reproduce your issue. It happens with 1.9.x and Facebook accounts.

I've create da Jira for this: https://issues.jboss.org/browse/KEYCLOAK-3267


On 2016-07-05, Bruno Oliveira wrote:
> I've just downloaded and tried with 1.9.8 too, it works. Is this happening with
> all users? Have you considered to setup an isolated environment from
> scratch?
>
> On 2016-07-05, Valerij Timofeev wrote:
> > Hi Bruno,
> >
> > thank you for the check.
> > We are going to migrate our production setup from Keycloak 1.9.4 to Red Hat
> > SSO 7.0, which is based on Keycloak 1.9.8.
> > Direct migration to 2.0.0.Final would be for us too risky, but still an
> > option somewhen later.
> >
> > @All,
> > any ideas for Keycloak 1.9.x? May be there is some setting we miss allowing
> > us to use both "peacefully".
> >
> > Kind regards
> > Valerij
> >
> > 2016-07-05 15:59 GMT+02:00 Bruno Oliveira <bruno at abstractj.org>:
> >
> > > Hi Valerij,
> > >
> > > I've tested against 2.0.0.Final right now and I couldn't reproduce your
> > > issue.
> > >
> > > I have brute force enabled by default here and Facebook configured
> > > exactly like described at the docs.
> > >
> > > Not sure how to reproduce your issue :/ Maybe, give 2.0.0.Final a try?
> > >
> > > On 2016-07-05, Valerij Timofeev wrote:
> > > > Hi all,
> > > >
> > > > it looks like the Brute Force Detection breaks Social login.
> > > >
> > > > I've:
> > > > 1) downloaded keycloak-demo-1.9.8.Final
> > > > 2) setup Facebook Identity provider
> > > > 3) successfully tested Facebook login
> > > > 4) activated Brute Force Detection with default values
> > > > 5) tested Facebook login: it fails with the error message: "Account is
> > > > disabled, contact admin."
> > > >
> > > > I wonder whether somebody has ever tested this combination.
> > > >
> > > >
> > > > Kind regards
> > > > Valerij Timofeev
> > >
> > > > _______________________________________________
> > > > keycloak-user mailing list
> > > > keycloak-user at lists.jboss.org
> > > > https://lists.jboss.org/mailman/listinfo/keycloak-user
> > >
> > >
> > > --
> > >
> > > abstractj
> > > PGP: 0x84DC9914
> > >
>
> --
>
> abstractj
> PGP: 0x84DC9914

--

abstractj
PGP: 0x84DC9914

From sthorger at redhat.com  Tue Jul  5 13:22:59 2016
From: sthorger at redhat.com (Stian Thorgersen)
Date: Tue, 5 Jul 2016 19:22:59 +0200
Subject: [keycloak-user] Brute Force Detection breaks Social login
In-Reply-To: <20160705145902.GA19930@abstractj.org>
References: <CAOy2obE1_FgK6h=NjkM6GB2ixeERu9ZA0nR8fG2-e+-j866-6A@mail.gmail.com>
	<20160705135910.GB10833@abstractj.org>
	<CAOy2obHLS1mDi7DQHpPeCZgAzOxfSVDTLHsbUsa27LARP+ddJQ@mail.gmail.com>
	<20160705145143.GA18957@abstractj.org>
	<20160705145902.GA19930@abstractj.org>
Message-ID: <CAJgngAd2fLJ-hzEa9Lv_cvYkCKztC+TJHR7tQMekZEGQZ2BdCg@mail.gmail.com>

Thanks Bruno.

I've added an RH-SSO issue and scheduled it to be included in RH-SSO 7.0.1.

On 5 July 2016 at 16:59, Bruno Oliveira <bruno at abstractj.org> wrote:

> I just completely tried in a fresh new browser profile and managed to
> reproduce your issue. It happens with 1.9.x and Facebook accounts.
>
> I've create da Jira for this:
> https://issues.jboss.org/browse/KEYCLOAK-3267
>
>
> On 2016-07-05, Bruno Oliveira wrote:
> > I've just downloaded and tried with 1.9.8 too, it works. Is this
> happening with
> > all users? Have you considered to setup an isolated environment from
> > scratch?
> >
> > On 2016-07-05, Valerij Timofeev wrote:
> > > Hi Bruno,
> > >
> > > thank you for the check.
> > > We are going to migrate our production setup from Keycloak 1.9.4 to
> Red Hat
> > > SSO 7.0, which is based on Keycloak 1.9.8.
> > > Direct migration to 2.0.0.Final would be for us too risky, but still an
> > > option somewhen later.
> > >
> > > @All,
> > > any ideas for Keycloak 1.9.x? May be there is some setting we miss
> allowing
> > > us to use both "peacefully".
> > >
> > > Kind regards
> > > Valerij
> > >
> > > 2016-07-05 15:59 GMT+02:00 Bruno Oliveira <bruno at abstractj.org>:
> > >
> > > > Hi Valerij,
> > > >
> > > > I've tested against 2.0.0.Final right now and I couldn't reproduce
> your
> > > > issue.
> > > >
> > > > I have brute force enabled by default here and Facebook configured
> > > > exactly like described at the docs.
> > > >
> > > > Not sure how to reproduce your issue :/ Maybe, give 2.0.0.Final a
> try?
> > > >
> > > > On 2016-07-05, Valerij Timofeev wrote:
> > > > > Hi all,
> > > > >
> > > > > it looks like the Brute Force Detection breaks Social login.
> > > > >
> > > > > I've:
> > > > > 1) downloaded keycloak-demo-1.9.8.Final
> > > > > 2) setup Facebook Identity provider
> > > > > 3) successfully tested Facebook login
> > > > > 4) activated Brute Force Detection with default values
> > > > > 5) tested Facebook login: it fails with the error message:
> "Account is
> > > > > disabled, contact admin."
> > > > >
> > > > > I wonder whether somebody has ever tested this combination.
> > > > >
> > > > >
> > > > > Kind regards
> > > > > Valerij Timofeev
> > > >
> > > > > _______________________________________________
> > > > > keycloak-user mailing list
> > > > > keycloak-user at lists.jboss.org
> > > > > https://lists.jboss.org/mailman/listinfo/keycloak-user
> > > >
> > > >
> > > > --
> > > >
> > > > abstractj
> > > > PGP: 0x84DC9914
> > > >
> >
> > --
> >
> > abstractj
> > PGP: 0x84DC9914
>
> --
>
> abstractj
> PGP: 0x84DC9914
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160705/35c57491/attachment-0001.html 

From charlee.ch at gmail.com  Wed Jul  6 03:48:35 2016
From: charlee.ch at gmail.com (Charlee Chitsuk)
Date: Wed, 6 Jul 2016 14:48:35 +0700
Subject: [keycloak-user] Cannot create Drolls policy.
Message-ID: <CAFBJWv76+cb5L3CdB1+Sj96+jCnATgf+Udq9HrAnOic3-HcZvA@mail.gmail.com>

Hi,

I'm using the keycloak version 2.0.0.Final with default standalone. I've
build and install the maven artifact, the
"org.keycloak:photoz-authz-policy:2.0.0.Final" and tried to create the
Drools policy. as the following

mavenArtifactGroupId = org.keycloak
mavenArtifactId = photoz-authz-policy
mavenArtifactVersion = 2.0.0.Final"



When I click the "Resolve" button, the system shows me as "Error! An
unexpected server error has occurred"

The "standalone/log/server.log" also shows as

[io.undertow.request] (default task-80) UT005023: Exception handling
request to
/auth/admin/realms/photoz/clients/001e0705-8bc6-47de-b408-dd07a5ebba9b/authz/resource-server/policy/drools/resolveModules:
 org.jboss.resteasy.spi.UnhandledException: java.lang.NoClassDefFoundError:
org/apache/commons/codec/binary/Base64
at
org.jboss.resteasy.core.ExceptionHandler.handleApplicationException(ExceptionHandler.java:76)
...
Caused by: java.lang.NoClassDefFoundError:
org/apache/commons/codec/binary/Base64
at org.apache.http.impl.auth.BasicScheme.authenticate(BasicScheme.java:168)

I can ensure that

1. The "commons-codec-1.10.jar" is existed at
"modules/system/layers/base/org/apache/commons/codec/main"

2. The "org.keycloak:photoz-authz-policy:2.0.0.Final" is existed at my
local repository at

"some/drive/m2/repo/org/keycloak/photoz-authz-policy/2.0.0.Final/photoz-authz-policy-2.0.0.Final.jar".

Could you please help to advise further?

--
   Best Regards,

   Charlee Ch
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160706/24232e81/attachment.html 

From valerij.timofeev at gmail.com  Wed Jul  6 05:18:56 2016
From: valerij.timofeev at gmail.com (Valerij Timofeev)
Date: Wed, 6 Jul 2016 11:18:56 +0200
Subject: [keycloak-user] Brute Force Detection breaks Social login
In-Reply-To: <CAJgngAd2fLJ-hzEa9Lv_cvYkCKztC+TJHR7tQMekZEGQZ2BdCg@mail.gmail.com>
References: <CAOy2obE1_FgK6h=NjkM6GB2ixeERu9ZA0nR8fG2-e+-j866-6A@mail.gmail.com>
	<20160705135910.GB10833@abstractj.org>
	<CAOy2obHLS1mDi7DQHpPeCZgAzOxfSVDTLHsbUsa27LARP+ddJQ@mail.gmail.com>
	<20160705145143.GA18957@abstractj.org>
	<20160705145902.GA19930@abstractj.org>
	<CAJgngAd2fLJ-hzEa9Lv_cvYkCKztC+TJHR7tQMekZEGQZ2BdCg@mail.gmail.com>
Message-ID: <CAOy2obFYvhfD+ZA=W46OmSQaRgw1Dv2ouQ5YESZ1nX31CBAqig@mail.gmail.com>

Hi Stian,

https://access.redhat.com/products/red-hat-single-sign-on
http://blog.keycloak.org/2016/06/productized-keycloak-now-available-from.html

We are able to download RH SSO 7.0.0 via our RH EAP account.
But there is no information whether RH SSO is included in the EAP licence.
We've contacted sales of the RH Partner in Germany, where we purchased the
EAP licence: they said that they will be able to give clear answer
approximately in 1-2 months.

As already mentioned in this thread we would like to migrate our production
setup from Keycloak 1.9.4 to RH SSO 7.0.x
But I won't get OK for migration from my boss as long as the situation with
the licence is not clear.

Could you please clarify this point?

Kind regards
Valerij


2016-07-05 19:22 GMT+02:00 Stian Thorgersen <sthorger at redhat.com>:

> Thanks Bruno.
>
> I've added an RH-SSO issue and scheduled it to be included in RH-SSO 7.0.1.
>
> On 5 July 2016 at 16:59, Bruno Oliveira <bruno at abstractj.org> wrote:
>
>> I just completely tried in a fresh new browser profile and managed to
>> reproduce your issue. It happens with 1.9.x and Facebook accounts.
>>
>> I've create da Jira for this:
>> https://issues.jboss.org/browse/KEYCLOAK-3267
>>
>>
>> On 2016-07-05, Bruno Oliveira wrote:
>> > I've just downloaded and tried with 1.9.8 too, it works. Is this
>> happening with
>> > all users? Have you considered to setup an isolated environment from
>> > scratch?
>> >
>> > On 2016-07-05, Valerij Timofeev wrote:
>> > > Hi Bruno,
>> > >
>> > > thank you for the check.
>> > > We are going to migrate our production setup from Keycloak 1.9.4 to
>> Red Hat
>> > > SSO 7.0, which is based on Keycloak 1.9.8.
>> > > Direct migration to 2.0.0.Final would be for us too risky, but still
>> an
>> > > option somewhen later.
>> > >
>> > > @All,
>> > > any ideas for Keycloak 1.9.x? May be there is some setting we miss
>> allowing
>> > > us to use both "peacefully".
>> > >
>> > > Kind regards
>> > > Valerij
>> > >
>> > > 2016-07-05 15:59 GMT+02:00 Bruno Oliveira <bruno at abstractj.org>:
>> > >
>> > > > Hi Valerij,
>> > > >
>> > > > I've tested against 2.0.0.Final right now and I couldn't reproduce
>> your
>> > > > issue.
>> > > >
>> > > > I have brute force enabled by default here and Facebook configured
>> > > > exactly like described at the docs.
>> > > >
>> > > > Not sure how to reproduce your issue :/ Maybe, give 2.0.0.Final a
>> try?
>> > > >
>> > > > On 2016-07-05, Valerij Timofeev wrote:
>> > > > > Hi all,
>> > > > >
>> > > > > it looks like the Brute Force Detection breaks Social login.
>> > > > >
>> > > > > I've:
>> > > > > 1) downloaded keycloak-demo-1.9.8.Final
>> > > > > 2) setup Facebook Identity provider
>> > > > > 3) successfully tested Facebook login
>> > > > > 4) activated Brute Force Detection with default values
>> > > > > 5) tested Facebook login: it fails with the error message:
>> "Account is
>> > > > > disabled, contact admin."
>> > > > >
>> > > > > I wonder whether somebody has ever tested this combination.
>> > > > >
>> > > > >
>> > > > > Kind regards
>> > > > > Valerij Timofeev
>> > > >
>> > > > > _______________________________________________
>> > > > > keycloak-user mailing list
>> > > > > keycloak-user at lists.jboss.org
>> > > > > https://lists.jboss.org/mailman/listinfo/keycloak-user
>> > > >
>> > > >
>> > > > --
>> > > >
>> > > > abstractj
>> > > > PGP: 0x84DC9914
>> > > >
>> >
>> > --
>> >
>> > abstractj
>> > PGP: 0x84DC9914
>>
>> --
>>
>> abstractj
>> PGP: 0x84DC9914
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160706/f9347332/attachment.html 

From thomas.raehalme at aitiofinland.com  Wed Jul  6 05:57:33 2016
From: thomas.raehalme at aitiofinland.com (Thomas Raehalme)
Date: Wed, 6 Jul 2016 12:57:33 +0300
Subject: [keycloak-user] Brute Force Detection breaks Social login
In-Reply-To: <CAOy2obFYvhfD+ZA=W46OmSQaRgw1Dv2ouQ5YESZ1nX31CBAqig@mail.gmail.com>
References: <CAOy2obE1_FgK6h=NjkM6GB2ixeERu9ZA0nR8fG2-e+-j866-6A@mail.gmail.com>
	<20160705135910.GB10833@abstractj.org>
	<CAOy2obHLS1mDi7DQHpPeCZgAzOxfSVDTLHsbUsa27LARP+ddJQ@mail.gmail.com>
	<20160705145143.GA18957@abstractj.org>
	<20160705145902.GA19930@abstractj.org>
	<CAJgngAd2fLJ-hzEa9Lv_cvYkCKztC+TJHR7tQMekZEGQZ2BdCg@mail.gmail.com>
	<CAOy2obFYvhfD+ZA=W46OmSQaRgw1Dv2ouQ5YESZ1nX31CBAqig@mail.gmail.com>
Message-ID: <CAPyAMoagRN-1uK6A9XhfBR1H-K1ADnSp8Y+rMpLZ2tuz2ywHAw@mail.gmail.com>

Hi!

I was told just last week by our local RedHat distributor that RH SSO 7.0
is part of the JBoss Core Services and that JBoss Core Services
subscriptions are included at no additional charge with subscriptions for
JBoss EAP, JBoss Data Grid, JBoss Fuse, JBoss A-MQ, JBoss Data
Virtualization, JBoss BRMS and JBoss BPM Suite. Subscribers to these
products receive full entitlement to all the components within JBoss Core
Services Collection.

Best regards,
Thomas


On Wed, Jul 6, 2016 at 12:18 PM, Valerij Timofeev <
valerij.timofeev at gmail.com> wrote:

> Hi Stian,
>
> https://access.redhat.com/products/red-hat-single-sign-on
>
> http://blog.keycloak.org/2016/06/productized-keycloak-now-available-from.html
>
> We are able to download RH SSO 7.0.0 via our RH EAP account.
> But there is no information whether RH SSO is included in the EAP licence.
> We've contacted sales of the RH Partner in Germany, where we purchased the
> EAP licence: they said that they will be able to give clear answer
> approximately in 1-2 months.
>
> As already mentioned in this thread we would like to migrate our
> production setup from Keycloak 1.9.4 to RH SSO 7.0.x
> But I won't get OK for migration from my boss as long as the situation
> with the licence is not clear.
>
> Could you please clarify this point?
>
> Kind regards
> Valerij
>
>
> 2016-07-05 19:22 GMT+02:00 Stian Thorgersen <sthorger at redhat.com>:
>
>> Thanks Bruno.
>>
>> I've added an RH-SSO issue and scheduled it to be included in RH-SSO
>> 7.0.1.
>>
>> On 5 July 2016 at 16:59, Bruno Oliveira <bruno at abstractj.org> wrote:
>>
>>> I just completely tried in a fresh new browser profile and managed to
>>> reproduce your issue. It happens with 1.9.x and Facebook accounts.
>>>
>>> I've create da Jira for this:
>>> https://issues.jboss.org/browse/KEYCLOAK-3267
>>>
>>>
>>> On 2016-07-05, Bruno Oliveira wrote:
>>> > I've just downloaded and tried with 1.9.8 too, it works. Is this
>>> happening with
>>> > all users? Have you considered to setup an isolated environment from
>>> > scratch?
>>> >
>>> > On 2016-07-05, Valerij Timofeev wrote:
>>> > > Hi Bruno,
>>> > >
>>> > > thank you for the check.
>>> > > We are going to migrate our production setup from Keycloak 1.9.4 to
>>> Red Hat
>>> > > SSO 7.0, which is based on Keycloak 1.9.8.
>>> > > Direct migration to 2.0.0.Final would be for us too risky, but still
>>> an
>>> > > option somewhen later.
>>> > >
>>> > > @All,
>>> > > any ideas for Keycloak 1.9.x? May be there is some setting we miss
>>> allowing
>>> > > us to use both "peacefully".
>>> > >
>>> > > Kind regards
>>> > > Valerij
>>> > >
>>> > > 2016-07-05 15:59 GMT+02:00 Bruno Oliveira <bruno at abstractj.org>:
>>> > >
>>> > > > Hi Valerij,
>>> > > >
>>> > > > I've tested against 2.0.0.Final right now and I couldn't reproduce
>>> your
>>> > > > issue.
>>> > > >
>>> > > > I have brute force enabled by default here and Facebook configured
>>> > > > exactly like described at the docs.
>>> > > >
>>> > > > Not sure how to reproduce your issue :/ Maybe, give 2.0.0.Final a
>>> try?
>>> > > >
>>> > > > On 2016-07-05, Valerij Timofeev wrote:
>>> > > > > Hi all,
>>> > > > >
>>> > > > > it looks like the Brute Force Detection breaks Social login.
>>> > > > >
>>> > > > > I've:
>>> > > > > 1) downloaded keycloak-demo-1.9.8.Final
>>> > > > > 2) setup Facebook Identity provider
>>> > > > > 3) successfully tested Facebook login
>>> > > > > 4) activated Brute Force Detection with default values
>>> > > > > 5) tested Facebook login: it fails with the error message:
>>> "Account is
>>> > > > > disabled, contact admin."
>>> > > > >
>>> > > > > I wonder whether somebody has ever tested this combination.
>>> > > > >
>>> > > > >
>>> > > > > Kind regards
>>> > > > > Valerij Timofeev
>>> > > >
>>> > > > > _______________________________________________
>>> > > > > keycloak-user mailing list
>>> > > > > keycloak-user at lists.jboss.org
>>> > > > > https://lists.jboss.org/mailman/listinfo/keycloak-user
>>> > > >
>>> > > >
>>> > > > --
>>> > > >
>>> > > > abstractj
>>> > > > PGP: 0x84DC9914
>>> > > >
>>> >
>>> > --
>>> >
>>> > abstractj
>>> > PGP: 0x84DC9914
>>>
>>> --
>>>
>>> abstractj
>>> PGP: 0x84DC9914
>>> _______________________________________________
>>> keycloak-user mailing list
>>> keycloak-user at lists.jboss.org
>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>
>>
>>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160706/368e3d36/attachment-0001.html 

From dradzikowski at bluesoft.net.pl  Wed Jul  6 08:17:39 2016
From: dradzikowski at bluesoft.net.pl (Daniel Radzikowski)
Date: Wed, 6 Jul 2016 14:17:39 +0200
Subject: [keycloak-user] Storing attributes in Keycloak session
Message-ID: <CADjp3v_ukse3OZ-19JJG=jMTxy87Rzu8OjJ4mwDBTGvJhOYsfg@mail.gmail.com>

Hi,

I'm using Direct Grant API to manage sessions in my application. Is it
possible to store some session attributes for logged in user using this API?

-- 
Pozdrawiam,
Daniel Radzikowski.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160706/6daa3b38/attachment.html 

From psilva at redhat.com  Wed Jul  6 09:13:04 2016
From: psilva at redhat.com (Pedro Igor Silva)
Date: Wed, 6 Jul 2016 09:13:04 -0400 (EDT)
Subject: [keycloak-user] Cannot create Drolls policy.
In-Reply-To: <CAFBJWv76+cb5L3CdB1+Sj96+jCnATgf+Udq9HrAnOic3-HcZvA@mail.gmail.com>
References: <CAFBJWv76+cb5L3CdB1+Sj96+jCnATgf+Udq9HrAnOic3-HcZvA@mail.gmail.com>
Message-ID: <844087401.6969673.1467810784671.JavaMail.zimbra@redhat.com>

Hi,

    Could not reproduce that issue in my environment. Here is what I did:

        - Download standalone server distribution [1]
        - Download examples [2]
        - Extract both server and examples
        - Build examples
        - Run server
        - Import keycloak-examples-2.0.0.Final/authz/photoz/photoz-realm.json
        - Create a Drools Policy just like you did after selecting the "photoz-restful-api" client application.

    Could you send the full stack trace ? Am I'm missing any step in order to reproduce this ?

    Btw, I have also tested using the demo distribution.

Regards.
Pedro Igor

[1] https://downloads.jboss.org/keycloak/2.0.0.Final/keycloak-2.0.0.Final.zip
[2] https://downloads.jboss.org/keycloak/2.0.0.Final/keycloak-examples-2.0.0.Final.zip

----- Original Message -----
From: "Charlee Chitsuk" <charlee.ch at gmail.com>
To: keycloak-user at lists.jboss.org
Sent: Wednesday, July 6, 2016 4:48:35 AM
Subject: [keycloak-user] Cannot create Drolls policy.

Hi, 

I'm using the keycloak version 2.0.0.Final with default standalone. I've build and install the maven artifact, the "org.keycloak:photoz-authz-policy:2.0.0.Final" and tried to create the Drools policy. as the following 

mavenArtifactGroupId = org.keycloak 
mavenArtifactId = photoz-authz-policy 
mavenArtifactVersion = 2.0.0.Final" 



When I click the "Resolve" button, the system shows me as "Error! An unexpected server error has occurred" 

The "standalone/log/server.log" also shows as 

[io.undertow.request] (default task-80) UT005023: Exception handling request to 
/auth/admin/realms/photoz/clients/001e0705-8bc6-47de-b408-dd07a5ebba9b/authz/resource-server/policy/drools/resolveModules: 
org.jboss.resteasy.spi.UnhandledException: java.lang.NoClassDefFoundError: 
org/apache/commons/codec/binary/Base64 
at org.jboss.resteasy.core.ExceptionHandler.handleApplicationException(ExceptionHandler.java:76) 
... 
Caused by: java.lang.NoClassDefFoundError: org/apache/commons/codec/binary/Base64 
at org.apache.http.impl.auth.BasicScheme.authenticate(BasicScheme.java:168) 

I can ensure that 

1. The "commons-codec-1.10.jar" is existed at "modules/system/layers/base/org/apache/commons/codec/main" 

2. The "org.keycloak:photoz-authz-policy:2.0.0.Final" is existed at my local repository at 
"some/drive/m2/repo/org/keycloak/photoz-authz-policy/2.0.0.Final/photoz-authz-policy-2.0.0.Final.jar". 

Could you please help to advise further? 

-- 
Best Regards, 

Charlee Ch 

_______________________________________________
keycloak-user mailing list
keycloak-user at lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user

From bburke at redhat.com  Wed Jul  6 11:00:03 2016
From: bburke at redhat.com (Bill Burke)
Date: Wed, 6 Jul 2016 11:00:03 -0400
Subject: [keycloak-user] Storing attributes in Keycloak session
In-Reply-To: <CADjp3v_ukse3OZ-19JJG=jMTxy87Rzu8OjJ4mwDBTGvJhOYsfg@mail.gmail.com>
References: <CADjp3v_ukse3OZ-19JJG=jMTxy87Rzu8OjJ4mwDBTGvJhOYsfg@mail.gmail.com>
Message-ID: <14561877-89e1-36c3-231a-64bbd1a2fc5a@redhat.com>

No.  Sounds interesting, but no.


On 7/6/16 8:17 AM, Daniel Radzikowski wrote:
> Hi,
>
> I'm using Direct Grant API to manage sessions in my application. Is it 
> possible to store some session attributes for logged in user using 
> this API?
>
> -- 
> Pozdrawiam,
> Daniel Radzikowski.
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160706/cbc38121/attachment.html 

From charlee.ch at gmail.com  Wed Jul  6 23:31:34 2016
From: charlee.ch at gmail.com (Charlee Chitsuk)
Date: Thu, 7 Jul 2016 10:31:34 +0700
Subject: [keycloak-user] Cannot create Drolls policy.
In-Reply-To: <844087401.6969673.1467810784671.JavaMail.zimbra@redhat.com>
References: <CAFBJWv76+cb5L3CdB1+Sj96+jCnATgf+Udq9HrAnOic3-HcZvA@mail.gmail.com>
	<844087401.6969673.1467810784671.JavaMail.zimbra@redhat.com>
Message-ID: <CAFBJWv6DwzF=C1om-4tm3bUswotsx6Ud+=ahvyVoOxRN4vnBAg@mail.gmail.com>

Hi,

Thank you very much for your guide. I've tried to follow your step, but
there is no luck. The stacktrace show me as

Caused by: java.lang.ClassNotFoundException:
org.apache.commons.codec.binary.Base64 from
[Module "org.drools:main" from local module loader @33e5ccce (finder: local
module finder @5a42bbf4 (

roots: C:\Java.Application\jboss\keycloak-2.0.0.Final\modules,
C:\Java.Application\jboss\keycloak-2.0.0.Final\modules\system\layers\keycloak,
C:\Java.Application\jboss\keycloak-2.0.0.Final\modules\system\layers\base

))]

Then I decided to copy the "commons-codec-1.10.jar" from "
modules/system/layers/base/org/apache/commons/codec/main" to "modules"
directly. At the moment I can resolve that maven artifact for Drools. I'm
not sure if it is a suitable way or not. Could you please help to advise
how to put the dependency jars, e.g. the "commons-codec-1.10.jar", to the
proper location?

--
   Best Regards,

   Charlee Ch

2016-07-06 20:13 GMT+07:00 Pedro Igor Silva <psilva at redhat.com>:

> Hi,
>
>     Could not reproduce that issue in my environment. Here is what I did:
>
>         - Download standalone server distribution [1]
>         - Download examples [2]
>         - Extract both server and examples
>         - Build examples
>         - Run server
>         - Import
> keycloak-examples-2.0.0.Final/authz/photoz/photoz-realm.json
>         - Create a Drools Policy just like you did after selecting the
> "photoz-restful-api" client application.
>
>     Could you send the full stack trace ? Am I'm missing any step in order
> to reproduce this ?
>
>     Btw, I have also tested using the demo distribution.
>
> Regards.
> Pedro Igor
>
> [1]
> https://downloads.jboss.org/keycloak/2.0.0.Final/keycloak-2.0.0.Final.zip
> [2]
> https://downloads.jboss.org/keycloak/2.0.0.Final/keycloak-examples-2.0.0.Final.zip
>
> ----- Original Message -----
> From: "Charlee Chitsuk" <charlee.ch at gmail.com>
> To: keycloak-user at lists.jboss.org
> Sent: Wednesday, July 6, 2016 4:48:35 AM
> Subject: [keycloak-user] Cannot create Drolls policy.
>
> Hi,
>
> I'm using the keycloak version 2.0.0.Final with default standalone. I've
> build and install the maven artifact, the
> "org.keycloak:photoz-authz-policy:2.0.0.Final" and tried to create the
> Drools policy. as the following
>
> mavenArtifactGroupId = org.keycloak
> mavenArtifactId = photoz-authz-policy
> mavenArtifactVersion = 2.0.0.Final"
>
>
>
> When I click the "Resolve" button, the system shows me as "Error! An
> unexpected server error has occurred"
>
> The "standalone/log/server.log" also shows as
>
> [io.undertow.request] (default task-80) UT005023: Exception handling
> request to
>
> /auth/admin/realms/photoz/clients/001e0705-8bc6-47de-b408-dd07a5ebba9b/authz/resource-server/policy/drools/resolveModules:
> org.jboss.resteasy.spi.UnhandledException: java.lang.NoClassDefFoundError:
> org/apache/commons/codec/binary/Base64
> at
> org.jboss.resteasy.core.ExceptionHandler.handleApplicationException(ExceptionHandler.java:76)
> ...
> Caused by: java.lang.NoClassDefFoundError:
> org/apache/commons/codec/binary/Base64
> at org.apache.http.impl.auth.BasicScheme.authenticate(BasicScheme.java:168)
>
> I can ensure that
>
> 1. The "commons-codec-1.10.jar" is existed at
> "modules/system/layers/base/org/apache/commons/codec/main"
>
> 2. The "org.keycloak:photoz-authz-policy:2.0.0.Final" is existed at my
> local repository at
>
> "some/drive/m2/repo/org/keycloak/photoz-authz-policy/2.0.0.Final/photoz-authz-policy-2.0.0.Final.jar".
>
> Could you please help to advise further?
>
> --
> Best Regards,
>
> Charlee Ch
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160707/08a6b8f9/attachment.html 

From sthorger at redhat.com  Thu Jul  7 00:49:50 2016
From: sthorger at redhat.com (Stian Thorgersen)
Date: Thu, 7 Jul 2016 06:49:50 +0200
Subject: [keycloak-user] Brute Force Detection breaks Social login
In-Reply-To: <CAPyAMoagRN-1uK6A9XhfBR1H-K1ADnSp8Y+rMpLZ2tuz2ywHAw@mail.gmail.com>
References: <CAOy2obE1_FgK6h=NjkM6GB2ixeERu9ZA0nR8fG2-e+-j866-6A@mail.gmail.com>
	<20160705135910.GB10833@abstractj.org>
	<CAOy2obHLS1mDi7DQHpPeCZgAzOxfSVDTLHsbUsa27LARP+ddJQ@mail.gmail.com>
	<20160705145143.GA18957@abstractj.org>
	<20160705145902.GA19930@abstractj.org>
	<CAJgngAd2fLJ-hzEa9Lv_cvYkCKztC+TJHR7tQMekZEGQZ2BdCg@mail.gmail.com>
	<CAOy2obFYvhfD+ZA=W46OmSQaRgw1Dv2ouQ5YESZ1nX31CBAqig@mail.gmail.com>
	<CAPyAMoagRN-1uK6A9XhfBR1H-K1ADnSp8Y+rMpLZ2tuz2ywHAw@mail.gmail.com>
Message-ID: <CAJgngAeXCcZg2C2qZ2=S4teko3c0rb8Xdu8z49wQMQ9WKgpm=A@mail.gmail.com>

Valerij - What Thomas said is correct and you should be able to use your
JBoss EAP license for any of the services that are included in the JBoss
Core Services. Unless there's something specific about your license since
it was purchased through a RH Partner. You can get more details about JBoss
Core Services here https://access.redhat.com/articles/2294961, maybe ask
the RH Partner directly about JBoss Core Services?

On 6 July 2016 at 11:57, Thomas Raehalme <thomas.raehalme at aitiofinland.com>
wrote:

> Hi!
>
> I was told just last week by our local RedHat distributor that RH SSO 7.0
> is part of the JBoss Core Services and that JBoss Core Services
> subscriptions are included at no additional charge with subscriptions for
> JBoss EAP, JBoss Data Grid, JBoss Fuse, JBoss A-MQ, JBoss Data
> Virtualization, JBoss BRMS and JBoss BPM Suite. Subscribers to these
> products receive full entitlement to all the components within JBoss Core
> Services Collection.
>
> Best regards,
> Thomas
>
>
> On Wed, Jul 6, 2016 at 12:18 PM, Valerij Timofeev <
> valerij.timofeev at gmail.com> wrote:
>
>> Hi Stian,
>>
>> https://access.redhat.com/products/red-hat-single-sign-on
>>
>> http://blog.keycloak.org/2016/06/productized-keycloak-now-available-from.html
>>
>> We are able to download RH SSO 7.0.0 via our RH EAP account.
>> But there is no information whether RH SSO is included in the EAP licence.
>> We've contacted sales of the RH Partner in Germany, where we purchased
>> the EAP licence: they said that they will be able to give clear answer
>> approximately in 1-2 months.
>>
>> As already mentioned in this thread we would like to migrate our
>> production setup from Keycloak 1.9.4 to RH SSO 7.0.x
>> But I won't get OK for migration from my boss as long as the situation
>> with the licence is not clear.
>>
>> Could you please clarify this point?
>>
>> Kind regards
>> Valerij
>>
>>
>> 2016-07-05 19:22 GMT+02:00 Stian Thorgersen <sthorger at redhat.com>:
>>
>>> Thanks Bruno.
>>>
>>> I've added an RH-SSO issue and scheduled it to be included in RH-SSO
>>> 7.0.1.
>>>
>>> On 5 July 2016 at 16:59, Bruno Oliveira <bruno at abstractj.org> wrote:
>>>
>>>> I just completely tried in a fresh new browser profile and managed to
>>>> reproduce your issue. It happens with 1.9.x and Facebook accounts.
>>>>
>>>> I've create da Jira for this:
>>>> https://issues.jboss.org/browse/KEYCLOAK-3267
>>>>
>>>>
>>>> On 2016-07-05, Bruno Oliveira wrote:
>>>> > I've just downloaded and tried with 1.9.8 too, it works. Is this
>>>> happening with
>>>> > all users? Have you considered to setup an isolated environment from
>>>> > scratch?
>>>> >
>>>> > On 2016-07-05, Valerij Timofeev wrote:
>>>> > > Hi Bruno,
>>>> > >
>>>> > > thank you for the check.
>>>> > > We are going to migrate our production setup from Keycloak 1.9.4 to
>>>> Red Hat
>>>> > > SSO 7.0, which is based on Keycloak 1.9.8.
>>>> > > Direct migration to 2.0.0.Final would be for us too risky, but
>>>> still an
>>>> > > option somewhen later.
>>>> > >
>>>> > > @All,
>>>> > > any ideas for Keycloak 1.9.x? May be there is some setting we miss
>>>> allowing
>>>> > > us to use both "peacefully".
>>>> > >
>>>> > > Kind regards
>>>> > > Valerij
>>>> > >
>>>> > > 2016-07-05 15:59 GMT+02:00 Bruno Oliveira <bruno at abstractj.org>:
>>>> > >
>>>> > > > Hi Valerij,
>>>> > > >
>>>> > > > I've tested against 2.0.0.Final right now and I couldn't
>>>> reproduce your
>>>> > > > issue.
>>>> > > >
>>>> > > > I have brute force enabled by default here and Facebook configured
>>>> > > > exactly like described at the docs.
>>>> > > >
>>>> > > > Not sure how to reproduce your issue :/ Maybe, give 2.0.0.Final a
>>>> try?
>>>> > > >
>>>> > > > On 2016-07-05, Valerij Timofeev wrote:
>>>> > > > > Hi all,
>>>> > > > >
>>>> > > > > it looks like the Brute Force Detection breaks Social login.
>>>> > > > >
>>>> > > > > I've:
>>>> > > > > 1) downloaded keycloak-demo-1.9.8.Final
>>>> > > > > 2) setup Facebook Identity provider
>>>> > > > > 3) successfully tested Facebook login
>>>> > > > > 4) activated Brute Force Detection with default values
>>>> > > > > 5) tested Facebook login: it fails with the error message:
>>>> "Account is
>>>> > > > > disabled, contact admin."
>>>> > > > >
>>>> > > > > I wonder whether somebody has ever tested this combination.
>>>> > > > >
>>>> > > > >
>>>> > > > > Kind regards
>>>> > > > > Valerij Timofeev
>>>> > > >
>>>> > > > > _______________________________________________
>>>> > > > > keycloak-user mailing list
>>>> > > > > keycloak-user at lists.jboss.org
>>>> > > > > https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>> > > >
>>>> > > >
>>>> > > > --
>>>> > > >
>>>> > > > abstractj
>>>> > > > PGP: 0x84DC9914
>>>> > > >
>>>> >
>>>> > --
>>>> >
>>>> > abstractj
>>>> > PGP: 0x84DC9914
>>>>
>>>> --
>>>>
>>>> abstractj
>>>> PGP: 0x84DC9914
>>>> _______________________________________________
>>>> keycloak-user mailing list
>>>> keycloak-user at lists.jboss.org
>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>>
>>>
>>>
>>
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160707/e26d6da2/attachment-0001.html 

From valerij.timofeev at gmail.com  Thu Jul  7 06:38:42 2016
From: valerij.timofeev at gmail.com (Valerij Timofeev)
Date: Thu, 7 Jul 2016 12:38:42 +0200
Subject: [keycloak-user] Brute Force Detection breaks Social login
In-Reply-To: <CAJgngAeXCcZg2C2qZ2=S4teko3c0rb8Xdu8z49wQMQ9WKgpm=A@mail.gmail.com>
References: <CAOy2obE1_FgK6h=NjkM6GB2ixeERu9ZA0nR8fG2-e+-j866-6A@mail.gmail.com>
	<20160705135910.GB10833@abstractj.org>
	<CAOy2obHLS1mDi7DQHpPeCZgAzOxfSVDTLHsbUsa27LARP+ddJQ@mail.gmail.com>
	<20160705145143.GA18957@abstractj.org>
	<20160705145902.GA19930@abstractj.org>
	<CAJgngAd2fLJ-hzEa9Lv_cvYkCKztC+TJHR7tQMekZEGQZ2BdCg@mail.gmail.com>
	<CAOy2obFYvhfD+ZA=W46OmSQaRgw1Dv2ouQ5YESZ1nX31CBAqig@mail.gmail.com>
	<CAPyAMoagRN-1uK6A9XhfBR1H-K1ADnSp8Y+rMpLZ2tuz2ywHAw@mail.gmail.com>
	<CAJgngAeXCcZg2C2qZ2=S4teko3c0rb8Xdu8z49wQMQ9WKgpm=A@mail.gmail.com>
Message-ID: <CAOy2obEA9d0fhxN9qCVrQ_epFypbrUqnnF-G-Sbm7feuhf7foA@mail.gmail.com>

Thank you Stian,

> https://access.redhat.com/articles/2294961,
this was the missing piece in the puzzle ;-)

We have full access to RH SSO product (download and submit support cases).
But it was unclear before your answer whether we are legitimated to do this.


2016-07-07 6:49 GMT+02:00 Stian Thorgersen <sthorger at redhat.com>:

> Valerij - What Thomas said is correct and you should be able to use your
> JBoss EAP license for any of the services that are included in the JBoss
> Core Services. Unless there's something specific about your license since
> it was purchased through a RH Partner. You can get more details about JBoss
> Core Services here https://access.redhat.com/articles/2294961, maybe ask
> the RH Partner directly about JBoss Core Services?
>
> On 6 July 2016 at 11:57, Thomas Raehalme <thomas.raehalme at aitiofinland.com
> > wrote:
>
>> Hi!
>>
>> I was told just last week by our local RedHat distributor that RH SSO 7.0
>> is part of the JBoss Core Services and that JBoss Core Services
>> subscriptions are included at no additional charge with subscriptions for
>> JBoss EAP, JBoss Data Grid, JBoss Fuse, JBoss A-MQ, JBoss Data
>> Virtualization, JBoss BRMS and JBoss BPM Suite. Subscribers to these
>> products receive full entitlement to all the components within JBoss Core
>> Services Collection.
>>
>> Best regards,
>> Thomas
>>
>>
>> On Wed, Jul 6, 2016 at 12:18 PM, Valerij Timofeev <
>> valerij.timofeev at gmail.com> wrote:
>>
>>> Hi Stian,
>>>
>>> https://access.redhat.com/products/red-hat-single-sign-on
>>>
>>> http://blog.keycloak.org/2016/06/productized-keycloak-now-available-from.html
>>>
>>> We are able to download RH SSO 7.0.0 via our RH EAP account.
>>> But there is no information whether RH SSO is included in the EAP
>>> licence.
>>> We've contacted sales of the RH Partner in Germany, where we purchased
>>> the EAP licence: they said that they will be able to give clear answer
>>> approximately in 1-2 months.
>>>
>>> As already mentioned in this thread we would like to migrate our
>>> production setup from Keycloak 1.9.4 to RH SSO 7.0.x
>>> But I won't get OK for migration from my boss as long as the situation
>>> with the licence is not clear.
>>>
>>> Could you please clarify this point?
>>>
>>> Kind regards
>>> Valerij
>>>
>>>
>>> 2016-07-05 19:22 GMT+02:00 Stian Thorgersen <sthorger at redhat.com>:
>>>
>>>> Thanks Bruno.
>>>>
>>>> I've added an RH-SSO issue and scheduled it to be included in RH-SSO
>>>> 7.0.1.
>>>>
>>>> On 5 July 2016 at 16:59, Bruno Oliveira <bruno at abstractj.org> wrote:
>>>>
>>>>> I just completely tried in a fresh new browser profile and managed to
>>>>> reproduce your issue. It happens with 1.9.x and Facebook accounts.
>>>>>
>>>>> I've create da Jira for this:
>>>>> https://issues.jboss.org/browse/KEYCLOAK-3267
>>>>>
>>>>>
>>>>> On 2016-07-05, Bruno Oliveira wrote:
>>>>> > I've just downloaded and tried with 1.9.8 too, it works. Is this
>>>>> happening with
>>>>> > all users? Have you considered to setup an isolated environment from
>>>>> > scratch?
>>>>> >
>>>>> > On 2016-07-05, Valerij Timofeev wrote:
>>>>> > > Hi Bruno,
>>>>> > >
>>>>> > > thank you for the check.
>>>>> > > We are going to migrate our production setup from Keycloak 1.9.4
>>>>> to Red Hat
>>>>> > > SSO 7.0, which is based on Keycloak 1.9.8.
>>>>> > > Direct migration to 2.0.0.Final would be for us too risky, but
>>>>> still an
>>>>> > > option somewhen later.
>>>>> > >
>>>>> > > @All,
>>>>> > > any ideas for Keycloak 1.9.x? May be there is some setting we miss
>>>>> allowing
>>>>> > > us to use both "peacefully".
>>>>> > >
>>>>> > > Kind regards
>>>>> > > Valerij
>>>>> > >
>>>>> > > 2016-07-05 15:59 GMT+02:00 Bruno Oliveira <bruno at abstractj.org>:
>>>>> > >
>>>>> > > > Hi Valerij,
>>>>> > > >
>>>>> > > > I've tested against 2.0.0.Final right now and I couldn't
>>>>> reproduce your
>>>>> > > > issue.
>>>>> > > >
>>>>> > > > I have brute force enabled by default here and Facebook
>>>>> configured
>>>>> > > > exactly like described at the docs.
>>>>> > > >
>>>>> > > > Not sure how to reproduce your issue :/ Maybe, give 2.0.0.Final
>>>>> a try?
>>>>> > > >
>>>>> > > > On 2016-07-05, Valerij Timofeev wrote:
>>>>> > > > > Hi all,
>>>>> > > > >
>>>>> > > > > it looks like the Brute Force Detection breaks Social login.
>>>>> > > > >
>>>>> > > > > I've:
>>>>> > > > > 1) downloaded keycloak-demo-1.9.8.Final
>>>>> > > > > 2) setup Facebook Identity provider
>>>>> > > > > 3) successfully tested Facebook login
>>>>> > > > > 4) activated Brute Force Detection with default values
>>>>> > > > > 5) tested Facebook login: it fails with the error message:
>>>>> "Account is
>>>>> > > > > disabled, contact admin."
>>>>> > > > >
>>>>> > > > > I wonder whether somebody has ever tested this combination.
>>>>> > > > >
>>>>> > > > >
>>>>> > > > > Kind regards
>>>>> > > > > Valerij Timofeev
>>>>> > > >
>>>>> > > > > _______________________________________________
>>>>> > > > > keycloak-user mailing list
>>>>> > > > > keycloak-user at lists.jboss.org
>>>>> > > > > https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>>> > > >
>>>>> > > >
>>>>> > > > --
>>>>> > > >
>>>>> > > > abstractj
>>>>> > > > PGP: 0x84DC9914
>>>>> > > >
>>>>> >
>>>>> > --
>>>>> >
>>>>> > abstractj
>>>>> > PGP: 0x84DC9914
>>>>>
>>>>> --
>>>>>
>>>>> abstractj
>>>>> PGP: 0x84DC9914
>>>>> _______________________________________________
>>>>> keycloak-user mailing list
>>>>> keycloak-user at lists.jboss.org
>>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>>>
>>>>
>>>>
>>>
>>> _______________________________________________
>>> keycloak-user mailing list
>>> keycloak-user at lists.jboss.org
>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>
>>
>>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160707/18815177/attachment.html 

From psilva at redhat.com  Thu Jul  7 07:32:09 2016
From: psilva at redhat.com (Pedro Igor Silva)
Date: Thu, 7 Jul 2016 07:32:09 -0400 (EDT)
Subject: [keycloak-user] Cannot create Drolls policy.
In-Reply-To: <CAFBJWv6DwzF=C1om-4tm3bUswotsx6Ud+=ahvyVoOxRN4vnBAg@mail.gmail.com>
References: <CAFBJWv76+cb5L3CdB1+Sj96+jCnATgf+Udq9HrAnOic3-HcZvA@mail.gmail.com>
	<844087401.6969673.1467810784671.JavaMail.zimbra@redhat.com>
	<CAFBJWv6DwzF=C1om-4tm3bUswotsx6Ud+=ahvyVoOxRN4vnBAg@mail.gmail.com>
Message-ID: <962811231.7411703.1467891129701.JavaMail.zimbra@redhat.com>

That error is pretty weird. In theory, I should be able to get it here too ...

The only difference that I can see between your environment and mine is the SO. Here, I'm using Linux. Will try to test using a windows box. I've also created https://issues.jboss.org/browse/KEYCLOAK-3279 to track this.

Please, watch that issue for updates.

Thanks.

----- Original Message -----
From: "Charlee Chitsuk" <charlee.ch at gmail.com>
To: keycloak-user at lists.jboss.org
Sent: Thursday, July 7, 2016 12:31:34 AM
Subject: Re: [keycloak-user] Cannot create Drolls policy.

Hi, 

Thank you very much for your guide. I've tried to follow your step, but there is no luck. The stacktrace show me as 

Caused by: java.lang.ClassNotFoundException: org.apache.commons.codec.binary.Base64 from 
[Module "org.drools:main" from local module loader @33e5ccce (finder: local module finder @5a42bbf4 ( 

roots: C:\Java.Application\jboss\keycloak-2.0.0.Final\modules, 
C:\Java.Application\jboss\keycloak-2.0.0.Final\modules\system\layers\keycloak, 
C:\Java.Application\jboss\keycloak-2.0.0.Final\modules\system\layers\base 

))] 

Then I decided to copy the "commons-codec-1.10.jar" from " modules/system/layers/base/ org/apache/commons/codec/main " to "modules" directly. At the moment I can resolve that maven artifact for Drools. I'm not sure if it is a suitable way or not. Could you please help to advise how to put the dependency jars, e.g. the "commons-codec-1.10.jar", to the proper location? 

-- 
Best Regards, 

Charlee Ch 

2016-07-06 20:13 GMT+07:00 Pedro Igor Silva < psilva at redhat.com > : 


Hi, 

Could not reproduce that issue in my environment. Here is what I did: 

- Download standalone server distribution [1] 
- Download examples [2] 
- Extract both server and examples 
- Build examples 
- Run server 
- Import keycloak-examples-2.0.0.Final/authz/photoz/photoz-realm.json 
- Create a Drools Policy just like you did after selecting the "photoz-restful-api" client application. 

Could you send the full stack trace ? Am I'm missing any step in order to reproduce this ? 

Btw, I have also tested using the demo distribution. 

Regards. 
Pedro Igor 

[1] https://downloads.jboss.org/keycloak/2.0.0.Final/keycloak-2.0.0.Final.zip 
[2] https://downloads.jboss.org/keycloak/2.0.0.Final/keycloak-examples-2.0.0.Final.zip 

----- Original Message ----- 
From: "Charlee Chitsuk" < charlee.ch at gmail.com > 
To: keycloak-user at lists.jboss.org 
Sent: Wednesday, July 6, 2016 4:48:35 AM 
Subject: [keycloak-user] Cannot create Drolls policy. 

Hi, 

I'm using the keycloak version 2.0.0.Final with default standalone. I've build and install the maven artifact, the "org.keycloak:photoz-authz-policy:2.0.0.Final" and tried to create the Drools policy. as the following 

mavenArtifactGroupId = org.keycloak 
mavenArtifactId = photoz-authz-policy 
mavenArtifactVersion = 2.0.0.Final" 



When I click the "Resolve" button, the system shows me as "Error! An unexpected server error has occurred" 

The "standalone/log/server.log" also shows as 

[io.undertow.request] (default task-80) UT005023: Exception handling request to 
/auth/admin/realms/photoz/clients/001e0705-8bc6-47de-b408-dd07a5ebba9b/authz/resource-server/policy/drools/resolveModules: 
org.jboss.resteasy.spi.UnhandledException: java.lang.NoClassDefFoundError: 
org/apache/commons/codec/binary/Base64 
at org.jboss.resteasy.core.ExceptionHandler.handleApplicationException(ExceptionHandler.java:76) 
... 
Caused by: java.lang.NoClassDefFoundError: org/apache/commons/codec/binary/Base64 
at org.apache.http.impl.auth.BasicScheme.authenticate(BasicScheme.java:168) 

I can ensure that 

1. The "commons-codec-1.10.jar" is existed at "modules/system/layers/base/org/apache/commons/codec/main" 

2. The "org.keycloak:photoz-authz-policy:2.0.0.Final" is existed at my local repository at 
"some/drive/m2/repo/org/keycloak/photoz-authz-policy/2.0.0.Final/photoz-authz-policy-2.0.0.Final.jar". 

Could you please help to advise further? 

-- 
Best Regards, 

Charlee Ch 

_______________________________________________ 
keycloak-user mailing list 
keycloak-user at lists.jboss.org 
https://lists.jboss.org/mailman/listinfo/keycloak-user 


_______________________________________________
keycloak-user mailing list
keycloak-user at lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user

From bruno at abstractj.org  Thu Jul  7 08:54:57 2016
From: bruno at abstractj.org (Bruno Oliveira)
Date: Thu, 7 Jul 2016 09:54:57 -0300
Subject: [keycloak-user] Why scope permission denial affects the whole
 resource avaiability?
In-Reply-To: <CALKvs9xkO9YD++RevUmrZKzTPbqW748SpFKowbvjhND2foRXag@mail.gmail.com>
References: <CALKvs9w56UhA_voXPW4OuV-ATu6MONtOFdi08yvRj2ZPsGYZjA@mail.gmail.com>
	<CALKvs9xkO9YD++RevUmrZKzTPbqW748SpFKowbvjhND2foRXag@mail.gmail.com>
Message-ID: <20160707125457.GD30105@abstractj.org>

Good morning, I'm not sure if I follow you on this, but if
you look at OIDC spec[1], scope is required. Plus, there's
some explanation here[2].

I hope it helps.

[1] - http://openid.net/specs/openid-connect-core-1_0.html
[2] - https://keycloak.gitbooks.io/server-adminstration-guide/content/topics/roles/client-scope.html

On 2016-07-04, Artem Voskoboynick wrote:
> Looks I've clarified the problem:
> A resource with scopes won't be permitted if there are no permitted scopes.
>
> This is a strange behavior - if there are no permitted scopes, the resource
> should still be available, it just doesn't have any additional actions
> (scopes) permitted.
> In support, if you take a resource without scopes, the resource is
> available (given all resource permissions are permitted). But following the
> current logic Keycloak handles scopes, the resource shouldn't be available
> then, since there are no available scopes.
>
> Now, the only solution is to create a dummy scope and always assign it to
> resources, so that they don't get blocked when no other scopes are
> available.
>
> I think, this behavior should be changed.
> What do you think?

> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user


--

abstractj
PGP: 0x84DC9914

From guus.der.kinderen at gmail.com  Thu Jul  7 09:28:35 2016
From: guus.der.kinderen at gmail.com (Guus der Kinderen)
Date: Thu, 7 Jul 2016 15:28:35 +0200
Subject: [keycloak-user] Realm ID value oddity
Message-ID: <CAMJaV9nxPsLRtSPLuy0OrB4MF=9qRHx0zkXHcgPM_+ZCz83HNw@mail.gmail.com>

Hi there,

I'm looking at a server with a couple of realms in it (version 1.9.x). When
comparing the realm identifiers, I noticed that some realms have UUIDs,
while others have 'human readable' values for an ID.

As the ID is string-based, it probably does not matter much, but the
difference puzzles me. Is this a known ... isssue/characteristic?

Regards,

  Guus
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160707/85d76b4c/attachment-0001.html 

From bburke at redhat.com  Thu Jul  7 09:35:05 2016
From: bburke at redhat.com (Bill Burke)
Date: Thu, 7 Jul 2016 09:35:05 -0400
Subject: [keycloak-user] Realm ID value oddity
In-Reply-To: <CAMJaV9nxPsLRtSPLuy0OrB4MF=9qRHx0zkXHcgPM_+ZCz83HNw@mail.gmail.com>
References: <CAMJaV9nxPsLRtSPLuy0OrB4MF=9qRHx0zkXHcgPM_+ZCz83HNw@mail.gmail.com>
Message-ID: <37a9fe9f-7753-af19-c6ff-83a4b0785c06@redhat.com>

master realm?


On 7/7/16 9:28 AM, Guus der Kinderen wrote:
> Hi there,
>
> I'm looking at a server with a couple of realms in it (version 1.9.x). 
> When comparing the realm identifiers, I noticed that some realms have 
> UUIDs, while others have 'human readable' values for an ID.
>
> As the ID is string-based, it probably does not matter much, but the 
> difference puzzles me. Is this a known ... isssue/characteristic?
>
> Regards,
>
>   Guus
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160707/78fa3c2f/attachment.html 

From harrytpc at gmail.com  Thu Jul  7 09:46:54 2016
From: harrytpc at gmail.com (Harry Trinta)
Date: Thu, 7 Jul 2016 10:46:54 -0300
Subject: [keycloak-user] API Token param
Message-ID: <CA+waeaWBYEBUQ49Y2KUy+wqQ7tFzmcdgGNw8KskM8PnE8vYY7w@mail.gmail.com>

Hi,

When authenticate through the API token ("*/openid-connect/token"), is
possible to send a parameter (key/value) and this parameter be added to
access_token?

Regards,

Harry
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160707/213ca550/attachment.html 

From filipelautert at gmail.com  Thu Jul  7 10:53:38 2016
From: filipelautert at gmail.com (Filipe Lautert)
Date: Thu, 07 Jul 2016 14:53:38 +0000
Subject: [keycloak-user] Keycloak behind Apache with SSL - read certificate
	from body
Message-ID: <CAGDdvgSJWaO7AoY4W4X0q-CXirxLL5BxB4-mEtov-0RdfAECCQ@mail.gmail.com>

Hello

short story: is there a way to get the request body sent from the client
inside an Authenticator (my class implements Authenticator , unsing method
@Override authenticate(context)) ? I'm trying with
context.getHttpRequest().getInputStream()
but it is empty.

Full story:
I'm trying to build a Keycloak authenticator that reads a client
certificate and uses it to validate the user, using as a base the
SecretQuestionAuthenticator example . The client certificate is a hard
token that is read by Firefox. To handle the certificate read part I'm usng
Apache mod ssl, with the below relevant configuration:

SSLEngine on

SSLProxyEngine on

                <LocationMatch "/auth">

                        ProxyPass ajp://localhost:8010/auth

                        ProxyPassReverse ajp://localhost:8010/auth

                </LocationMatch>

SSLOptions +StdEnvVars +ExportCertData

... etc


Looking at a tcpdump/wireshark on port 8010, I can see that the client
certificate is sent on the request body to Keycloak.


So far fine, Apache validates the certificate, extracts it and send to
Keycloak. The problem is that I'm unable to read the request body inside my
authenticator class as context.getHttpRequest().getInputStream() is empty,
and as the body is the raw certificate the method
context.getHttpRequest().getFormParameters()
method won't return me anything.


public class SecretQuestionAuthenticator implements Authenticator {

@Override

public void authenticate(AuthenticationFlowContext context) {

System.out.println(context.getHttpRequest().getInputStream().available());
// prints 0 System.out.println(getStringFromInputStream(context.getHttpRequest().getInputStream()));
//empty :(


Any ideas of how I can get it to work?


Thanks


filipe
-- 
filipe lautert
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160707/1a61d574/attachment-0001.html 

From bburke at redhat.com  Thu Jul  7 16:25:22 2016
From: bburke at redhat.com (Bill Burke)
Date: Thu, 7 Jul 2016 16:25:22 -0400
Subject: [keycloak-user] Keycloak behind Apache with SSL - read
 certificate from body
In-Reply-To: <CAGDdvgSJWaO7AoY4W4X0q-CXirxLL5BxB4-mEtov-0RdfAECCQ@mail.gmail.com>
References: <CAGDdvgSJWaO7AoY4W4X0q-CXirxLL5BxB4-mEtov-0RdfAECCQ@mail.gmail.com>
Message-ID: <208acd55-5133-acb0-5243-2e43a70d85a7@redhat.com>

Don't you have to get the cert chain from a servlet request attribute?  
This might work.


|HttpServletRequest httpServletRequest = 
ResteasyProviderFactory.getContextData(HttpServletRequest.class); 
X509Certificate[]certs 
=(X509Certificate[])httpServletRequest.getAttribute("javax.servlet.request.X509Certificate"); 
|



On 7/7/16 10:53 AM, Filipe Lautert wrote:
> Hello
>
> short story: is there a way to get the request body sent from the 
> client inside an Authenticator (my class implements Authenticator , 
> unsing method @Override authenticate(context)) ? I'm trying with 
> context.getHttpRequest().getInputStream() but it is empty.
>
> Full story:
> I'm trying to build a Keycloak authenticator that reads a client 
> certificate and uses it to validate the user, using as a base the 
> SecretQuestionAuthenticator example . The client certificate is a hard 
> token that is read by Firefox. To handle the certificate read part I'm 
> usng Apache mod ssl, with the below relevant configuration:
>
> SSLEngineon
>
> SSLProxyEngineon
>
>               <LocationMatch"/auth">
>
> ProxyPassajp://localhost:8010/auth
>
> ProxyPassReverseajp://localhost:8010/auth
>
>               </LocationMatch>
>
> SSLOptions+StdEnvVars+ExportCertData
>
> ... etc
>
>
> Looking at a tcpdump/wireshark on port 8010, I can see that the client 
> certificate is sent on the request body to Keycloak.
>
>
> So far fine, Apache validates the certificate, extracts it and send to 
> Keycloak. The problem is that I'm unable to read the request body 
> inside my authenticator class as 
> context.getHttpRequest().getInputStream() is empty, and as the body is 
> the raw certificate the method 
> context.getHttpRequest().getFormParameters() method won't return me 
> anything.
>
>
> public class SecretQuestionAuthenticator implements Authenticator {
>
> @Override
>
> public void authenticate(AuthenticationFlowContext context) {
>
> System.out.println(context.getHttpRequest().getInputStream().available()); 
> // prints 
> 0System.out.println(getStringFromInputStream(context.getHttpRequest().getInputStream())); 
> //empty :(
>
>
> Any ideas of how I can get it to work?
>
>
> Thanks
>
>
> filipe
>
> -- 
> filipe lautert
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160707/bd27be94/attachment-0001.html 

From bruno at abstractj.org  Thu Jul  7 16:27:28 2016
From: bruno at abstractj.org (Bruno Oliveira)
Date: Thu, 7 Jul 2016 17:27:28 -0300
Subject: [keycloak-user] API Token param
In-Reply-To: <CA+waeaWBYEBUQ49Y2KUy+wqQ7tFzmcdgGNw8KskM8PnE8vYY7w@mail.gmail.com>
References: <CA+waeaWBYEBUQ49Y2KUy+wqQ7tFzmcdgGNw8KskM8PnE8vYY7w@mail.gmail.com>
Message-ID: <20160707202728.GA20655@abstractj.org>

I don't think that's possible. What exactly would you like to do?

On 2016-07-07, Harry Trinta wrote:
> Hi,
>
> When authenticate through the API token ("*/openid-connect/token"), is
> possible to send a parameter (key/value) and this parameter be added to
> access_token?
>
> Regards,
>
> Harry

> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user


--

abstractj
PGP: 0x84DC9914

From bruno at abstractj.org  Thu Jul  7 17:48:44 2016
From: bruno at abstractj.org (Bruno Oliveira)
Date: Thu, 7 Jul 2016 18:48:44 -0300
Subject: [keycloak-user] How to setup a maven project generating jar
 containing authentication providers in a debug mode in eclipse
In-Reply-To: <CAJ0vL+J260qBGLrFtzjCnb3OW7KDkhQUkoWNpL89Pc76nyucAg@mail.gmail.com>
References: <CAJ0vL++h+oyLKLUn6sge6F63NR=SdE+Xv7mFYHoGCGk1=U1QgA@mail.gmail.com>
	<CAK-7U1iUCKjsppVvg-67pA+YgRZWPTih-g+0p8hGAW=XnNPD_w@mail.gmail.com>
	<CAJ0vL+JFoaa3qy5k4-UVOZb5xDFBXhTp8bV6xznJpUa88fTUNA@mail.gmail.com>
	<CAJoY9JvPcLizBQ5DX=466QDu+D4WKKAP99F9AcYes9piVPRdkw@mail.gmail.com>
	<CAJ0vL+JWGWoJ=ewobTUGhJsngF3OfWxdH0G3wLMtchq46rDCAw@mail.gmail.com>
	<CAJ0vL+J260qBGLrFtzjCnb3OW7KDkhQUkoWNpL89Pc76nyucAg@mail.gmail.com>
Message-ID: <20160707214844.GB20655@abstractj.org>

Hi Rashmi, moving to keycloak-user mailing list, because it's more appropriate for this
kind of discussion. Also, I believe that would make sense to change the
subject, in this way people can easily search for this subject.

Unless I'm mistaken "--debug" parameter is for the application server
script. I didn't have enough time to think about the best solution, but
here's what worked here: https://gist.github.com/abstractj/67d07610de7ae1ec1d5d4c28dc19c75e

Instructions:

1. Get the two files into the gist and put under a new folder
2. Run docker build -t keycloak-debug .
3. docker run -e KEYCLOAK_USER=user -e KEYCLOAK_PASSWORD=password -it -p 8787:8787 -p 8080:8080 keycloak-debug

I hope it helps.

On 2016-07-06, Rashmi Singh wrote:
> Does anyone have a clue on this issue I am having?
>
> On Sat, Jul 2, 2016 at 7:13 PM, Rashmi Singh <singhrasster at gmail.com> wrote:
>
> > Thanks for your reply Francis. I still have one problem:
> >
> > When I run this:
> > $ docker run --name keycloak1 -p 8080:8080 -p 8787:8787 jboss/keycloak
> >
> > I can access the keycloak app console on http://192.168.99.100:8080/auth/
> > from my browser
> >
> > But when I run it in debug mode as:
> > $ docker run --name keycloak1 -p 8080:8080 -p 8787:8787 jboss/keycloak
> > --debug
> >
> > I cannot access the keycloak console. What is wrong here, any idea?
> >
> > On Fri, Jul 1, 2016 at 12:48 AM, Francis Pouatcha <
> > francis.pouatcha at adorsys.com> wrote:
> >
> >> Rashmi,
> >>
> >> follow these instructions to have keycloack debug accessible from eclipse:
> >>
> >> 1- Simple web application
> >> User a simple HelloServlet to try out the debugging process before
> >> applying you experience to wildfly.
> >>
> >> 1- Wildfly and eclipse
> >> Like Thomas mentioned, Make sure you active the debug property while
> >> starting wildfly. This is independent of keycloak, as keycloak is just
> >> another web application running on wildfly. So make sure you have a simple
> >> webapp running in wildfly standalone so you can get used to the debugging
> >> process.
> >>
> >> 2- Wildfly in a docker container
> >> Take your simple web application and wildfly into a docker container and
> >> try following:
> >> a) Make sure you start wildfly in the container in debug mode. Not matter
> >> how you manage the docker containers in your development environment, you
> >> will have to expose their ports so you can reach the container from and
> >> outside the docker host. "Exposing the port means mapping the defined
> >> wildfly ports to some other ports on the docker host. If you are using
> >> docker-composer you have to try something like:   ports:\    - "8080:8080"\
> >>    - "8787:8787". In this case see the docker-compose reference for details.
> >>
> >> 3- Accessing the docker container
> >> Once you wildfly docker container is startet in debug mode, make sure you
> >> can access you HelloServlet  from a web browser on the same machine on
> >> which you have your eclipse installed. If this works, use the same hostname
> >> or ip to replace "localhost" in you eclipse debugging config. Generally
> >> this will default to: 192.168.99.100:8787.
> >>
> >> You did it right, you will be able to stop on the breakpoint inside your
> >> HelloServlet.
> >>
> >> 4- Keycloak
> >> Repeat the same procedure with your custom authenticator. Do not forget
> >> to download the keycloak sources and include them in your the source path
> >> so you can navigate and set break points.
> >>
> >>
> >> Best regards
> >> Mit freundlichen Gr??en
> >> Cordialement
> >>
> >> Francis Pouatcha
> >> Founder and Technical Lead Group Adorsys
> >>
> >> LinkedIn: http://www.linkedin.com/pub/francis-pouatcha/8/35a/542
> >> adorsys GmbH & Co. KG, Germany:
> >> http://www.youtube.com/watch?v=rVRkFGUNexo&authuser=0
> >> Adorsys S.A., Cameroon: "African Software Competence Center"
> >> Open https://github.com/adorsys
> >>
> >> Cell USA: +1 770 329 7026
> >> Cell Germany: +49 172 18 16 074
> >> Cell Cameroon: +237 51 74 71 99
> >>
> >>
> >> On Fri, Jul 1, 2016 at 2:39 AM, Rashmi Singh <singhrasster at gmail.com>
> >> wrote:
> >>
> >>> Thanks Thomas for your reply. I have a few questions on your response. I
> >>> am still very new to docker, so please bear with me.
> >>> when you say I can set env variables in docker container, would this be
> >>> sufficient?
> >>>
> >>> First connect to the docker container as:
> >>>
> >>> docker exec -i -t keycloak bash
> >>> Then, once I am in the container, I run the following to set env
> >>> variables?
> >>>
> >>> set DEBUG_MODE=true
> >>> set DEBUG_PORT=8787
> >>> exit
> >>> Then, restart the container as:
> >>> docker restart keycloak    (keycloak is the name of my container)
> >>> Also, how can I make sure that the env variable got correctly set in the
> >>> docker container? From inside the container, if I run the command "env",
> >>> should it list these new env variables if they are added successfully?
> >>>
> >>> Then, when you say "......default on port 8787 which you need to expose
> >>> on your docker container or use the container interface...", what exactly
> >>> do you mean? Do you mean some sort of port forwarding? Could you tell me w
> >>> tohat exactly I need to do with my existing container named as "keycloak"
> >>>
> >>> Then, on eclipse, where you mentioned the settings for the Debug
> >>> configurations, what should be the hostname there? would it be localhost?
> >>> or the default machine IP of docker which is 192.168.99.100? Or it should
> >>> be something else?
> >>>
> >>>
> >>>
> >>> On Thu, Jun 30, 2016 at 6:29 PM, Thomas Darimont <
> >>> thomas.darimont at googlemail.com> wrote:
> >>>
> >>>> Hello,
> >>>>
> >>>> you could add -debug flag to the standalone.sh command-line or define
> >>>> the following env variables in your docker container:
> >>>> set DEBUG_MODE=true
> >>>> set DEBUG_PORT=8787
> >>>>
> >>>> this will start keycloak with remote debugging enabled by default on
> >>>> port 8787 which you need to expose on your docker container or use the
> >>>> container interface...
> >>>>
> >>>> you can then connect to the keycloak instance inside the docker
> >>>> container via the remote debugger from your IDE.
> >>>> For eclipse just go to "Debug configurations..." -> Remote Java
> >>>> Application -> select your project with the custom authenticator -> adjust
> >>>> hostname and port and click "debug".
> >>>>
> >>>> Cheers,
> >>>> Thomas
> >>>>
> >>>> 2016-07-01 0:26 GMT+02:00 Rashmi Singh <singhrasster at gmail.com>:
> >>>>
> >>>>> We have a Maven project setup on Eclipse that uses some keycloak
> >>>>> features and we generate a jar that contains our AuthenticationProvider
> >>>>> classes etc.
> >>>>> We use docker for the deployment. We basically run a jboss/keycloak
> >>>>> image there
> >>>>> We have a shell script that has a bunch of commands to copy our
> >>>>> project jars from local to the keycloak image on docker container like:
> >>>>>
> >>>>> docker cp /customauthenticator-1.0.0-SNAPSHOT.jar
> >>>>> keycloak:/home/modules/xxx.yyy.zz.keycloak.customizations
> >>>>> ....
> >>>>> docker restart keycloak
> >>>>>
> >>>>> Running this shell script deploys everything on keycloak on docker.
> >>>>> And so far we are just putting logs throughout our code to debug
> >>>>> issues.
> >>>>> We want to be able to setup a debugging environment on our eclipse. I
> >>>>> am not sure how to achieve this when we use keycloak. Because, here we
> >>>>> basically build our modules or authenticator jars etc and copy them to
> >>>>> keycloak directories. So, it's not a standalone project war file that we
> >>>>> are directly deploying to app server as such. So, then how do we put our
> >>>>> maven project (creating jars etc) in a debug mode in eclipse? Is it
> >>>>> possible? How?
> >>>>>
> >>>>> _______________________________________________
> >>>>> keycloak-dev mailing list
> >>>>> keycloak-dev at lists.jboss.org
> >>>>> https://lists.jboss.org/mailman/listinfo/keycloak-dev
> >>>>>
> >>>>
> >>>>
> >>>
> >>> _______________________________________________
> >>> keycloak-dev mailing list
> >>> keycloak-dev at lists.jboss.org
> >>> https://lists.jboss.org/mailman/listinfo/keycloak-dev
> >>>
> >>
> >>
> >

> _______________________________________________
> keycloak-dev mailing list
> keycloak-dev at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-dev


--

abstractj
PGP: 0x84DC9914

From leo.nunes at gjccorp.com.br  Thu Jul  7 19:05:57 2016
From: leo.nunes at gjccorp.com.br (LEONARDO NUNES)
Date: Thu, 7 Jul 2016 23:05:57 +0000
Subject: [keycloak-user] Servlet Filter Adapter not working with
	Tomcat/Memcached
Message-ID: <D3A466A4.2C47F%leo.nunes@ojc.com.br>

Hi everyone,

An application is deployed using Servlet Filter Adapter at 2 Tomcats in which are saving sessions to 1 Memcached. There's a Nginx load balancer with sticky session in front of both Tomcats.

After log in to the application if one Tomcat goes down or is removed from the load balancer we get the exception below. The problem occur using Servlet Filter Adapter, it works with Tomcat Adapter but we can't use it for some of our applications.

java.lang.NullPointerException
org.keycloak.KeycloakSecurityContext.getRealm(KeycloakSecurityContext.java:73)
org.keycloak.adapters.RefreshableKeycloakSecurityContext.refreshExpiredToken(RefreshableKeycloakSecurityContext.java:103)
org.keycloak.adapters.servlet.OIDCFilterSessionStore.checkCurrentToken(OIDCFilterSessionStore.java:87)
org.keycloak.adapters.servlet.KeycloakOIDCFilter.doFilter(KeycloakOIDCFilter.java:145)


1. Access a restricted page of the application
2. Nginx will direct to Tomcat1 (because of sticky session next requests will go to Tomcat1)
3. You will be redirected to Keycloak Login page
4. After login, Keycloak redirects back to the restricted page
(Note: this session is already saved to memcached)
5. At Nginx disable Tomcat1 server
6. At the browser refresh the application page
7. Now the request will go to Tomcat2 server
8. The session is retrieved from memcached
9. An exception is thrown because token is null inside of KeycloakSecurityContext.getRealm()
(Note: sometimes at this step the restricted page is displayed, but if I refresh the page the exception is thrown)


I've opened the issue ticket below:
https://issues.jboss.org/browse/KEYCLOAK-3288


--
Leonardo Nunes
________________________________
Esta mensagem pode conter informa??o confidencial e/ou privilegiada. Se voc? n?o for o destinat?rio ou a pessoa autorizada a receber esta mensagem, n?o poder? usar, copiar ou divulgar as informa??es nela contidas ou tomar qualquer a??o baseada nessas informa??es. Se voc? recebeu esta mensagem por engano, por favor avise imediatamente o remetente, respondendo o e-mail e em seguida apague-o. Agradecemos sua coopera??o.

This message may contain confidential and/or privileged information. If you are not the addressee or authorized to receive this for the addressee, you must not use, copy, disclose or take any action based on this message or any information herein. If you have received this message in error, please advise the sender immediately by reply e-mail and delete this message. Thank you for your cooperation
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160707/68f46565/attachment.html 

From bburke at redhat.com  Thu Jul  7 23:19:40 2016
From: bburke at redhat.com (Bill Burke)
Date: Thu, 7 Jul 2016 23:19:40 -0400
Subject: [keycloak-user] Servlet Filter Adapter not working with
 Tomcat/Memcached
In-Reply-To: <D3A466A4.2C47F%leo.nunes@ojc.com.br>
References: <D3A466A4.2C47F%leo.nunes@ojc.com.br>
Message-ID: <88547020-f2d0-a17d-d576-847cf55931f7@redhat.com>

I''m looking at the code and there is serialization code to re-create 
the token object from a string in KeycloakSecurityContext.

private void readObject(ObjectInputStream in)throws IOException, ClassNotFoundException {
     in.defaultReadObject();

     token = parseToken(tokenString, AccessToken.class);
     idToken = parseToken(idTokenString, IDToken.class);
}




On 7/7/16 7:05 PM, LEONARDO NUNES wrote:
> Hi everyone,
>
> An application is deployed using Servlet Filter Adapter at 2 Tomcats 
> in which are saving sessions to 1 Memcached. There's a Nginx load 
> balancer with sticky session in front of both Tomcats.
>
> After log in to the application if one Tomcat goes down or is removed 
> from the load balancer we get the exception below. The problem occur 
> using Servlet Filter Adapter, it works with Tomcat Adapter but we 
> can't use it for some of our applications.
>
> java.lang.NullPointerException
> org.keycloak.KeycloakSecurityContext.getRealm(KeycloakSecurityContext.java:73)
> org.keycloak.adapters.RefreshableKeycloakSecurityContext.refreshExpiredToken(RefreshableKeycloakSecurityContext.java:103)
> org.keycloak.adapters.servlet.OIDCFilterSessionStore.checkCurrentToken(OIDCFilterSessionStore.java:87)
> org.keycloak.adapters.servlet.KeycloakOIDCFilter.doFilter(KeycloakOIDCFilter.java:145)
>
>
> 1. Access a restricted page of the application
> 2. Nginx will direct to Tomcat1 (because of sticky session next 
> requests will go to Tomcat1)
> 3. You will be redirected to Keycloak Login page
> 4. After login, Keycloak redirects back to the restricted page
> (Note: this session is already saved to memcached)
> 5. At Nginx disable Tomcat1 server
> 6. At the browser refresh the application page
> 7. Now the request will go to Tomcat2 server
> 8. The session is retrieved from memcached
> 9. An exception is thrown because token is null inside of 
> KeycloakSecurityContext.getRealm()
> (Note: sometimes at this step the restricted page is displayed, but if 
> I refresh the page the exception is thrown)
>
>
> I've opened the issue ticket below:
> https://issues.jboss.org/browse/KEYCLOAK-3288
>
>
> -- 
> Leonardo Nunes
> ------------------------------------------------------------------------
> /Esta mensagem pode conter informa??o confidencial e/ou privilegiada. 
> Se voc? n?o for o destinat?rio ou a pessoa autorizada a receber esta 
> mensagem, n?o poder? usar, copiar ou divulgar as informa??es nela 
> contidas ou tomar qualquer a??o baseada nessas informa??es. Se voc? 
> recebeu esta mensagem por engano, por favor avise imediatamente o 
> remetente, respondendo o e-mail e em seguida apague-o. Agradecemos sua 
> coopera??o.
>
> This message may contain confidential and/or privileged information. 
> If you are not the addressee or authorized to receive this for the 
> addressee, you must not use, copy, disclose or take any action based 
> on this message or any information herein. If you have received this 
> message in error, please advise the sender immediately by reply e-mail 
> and delete this message. Thank you for your cooperation/
> ////
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160707/b7190f18/attachment-0001.html 

From eturella at redhat.com  Fri Jul  8 00:36:28 2016
From: eturella at redhat.com (Eduardo Turella)
Date: Fri, 8 Jul 2016 01:36:28 -0300
Subject: [keycloak-user] Interoperability and SelfService
Message-ID: <CA+Q-H+vpdKAUuVNQ1D17Y9gvtCeiPoi6TdULTaZh3kVqLzf1MA@mail.gmail.com>

Hi,

I am new to keycloak and starting to study it since it has become Red Hat's
new Single Sign On solution.

I've been through a demonstration and saw some nice features like
two-factor authentication and social media login, and other basic features
like Realm configuration and so on. Some (very basic) questions occurred to
me, though, as I describe below:

1. There are applications in which users authenticate through ADFS (via
SAML 2.0), and other situations where the application has its own database
with its users (external public). How does Keycloak work to allow single
sign on between these two different types of authentication?

2. Keycloak offers an interface where the application user himself changes
the values of some of his own attributes (name, telephone, etc.). Can it be
extended and show other metadata? How can I customize and embed this
functionality within my application?

3. Is it possible to enable single sign on between multiple applications
using different types protocols? e.g.: an user accessed a Java application
and acquired an OAuth Token; then he accessed a .NET application based in
SAML 2.0. Will the SSO work in this case? How?

Thank you for your help.

Regards,
-- 
Eduardo Turella
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160708/a6a02f4e/attachment.html 

From valerij.timofeev at gmail.com  Fri Jul  8 04:40:47 2016
From: valerij.timofeev at gmail.com (Valerij Timofeev)
Date: Fri, 8 Jul 2016 10:40:47 +0200
Subject: [keycloak-user] KEYCLOAK-3202 Creating users causes memory leak
Message-ID: <CAOy2obEVCKZhK6tLLhs8RQRs4ScUCgKfWTPjhn0N9Nmy2+yQpA@mail.gmail.com>

Hi Stian,

You are the assignee in KEYCLOAK-3202
<https://issues.jboss.org/browse/KEYCLOAK-3202>, so I addressed this email
to you directly.

I guess that this issue could be the cause of trouble in our production
environment.

There are 4 EAP-6 nodes with Keycloak adapters and 2 Keycloak 1.9.4
standalone servers running in 2 clusters respectively.

We experience logout failures approximately after one and a half days of
operation.
Restarting EAP 6 nodes temporary resolves the logout problem.

Durable load tests in out test environment showed that login and logout of
existing users don't result in above behaviour.
We added to the durable load test additional scenario creating new users
and were able to reproduce logout failure: users are getting empty page and
not the login screen as expected. Page reload navigates back into the
protected web application .

Logout is accomplished in a Java web applictaion by calling OIDC logout
endpoint:





*FacesContext                .getCurrentInstance()
.getExternalContext()
.redirect(keycloakDeployment.getLogoutUrl().queryParam("redirect_uri",
redirectURL).toTemplate());*

Logout is initiated via h:commandLink, so I suppose that the OIDC logout
endpoint is called via the GET method. Should we use the POST method
instead?

Has servlet logout any advantages?



*((HttpServletRequest)
FacesContext.getCurrentInstance().getExternalContext().getRequest()).logout();*
I'd appreciate quick response*, *because restarting production EAP cluster
every day is not a pleasant option ;-)

Thank you in advance

Kind regards
Valerij Timofeev
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160708/9de49d98/attachment.html 

From h.p.przybysz at gmail.com  Fri Jul  8 09:36:06 2016
From: h.p.przybysz at gmail.com (Hubert Przybysz)
Date: Fri, 8 Jul 2016 15:36:06 +0200
Subject: [keycloak-user] Support for CORS Access-Control-Expose-Headers in
	2.0.0.Final
Message-ID: <CAJMEJTW7aZZeHRDinB66PDTfMaZ3aHLs8VNrx=xTNPJ+qqCORg@mail.gmail.com>

Hi,

Is configuration of CORS Access-Control-Expose-Headers supported in
2.0.0.Final adapters?

Best regards / Hubert.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160708/25edbea1/attachment.html 

From eduard.matuszak at atos.net  Fri Jul  8 09:59:54 2016
From: eduard.matuszak at atos.net (Matuszak, Eduard)
Date: Fri, 8 Jul 2016 13:59:54 +0000
Subject: [keycloak-user] User federation provider taking care of ID provider
	links
Message-ID: <61D077C6283D454FAFD06F6AC4AB74D723E00FF1@DEFTHW99EZ1MSX.ww931.my-it-solutions.net>

Hello

I have implemented a (JPA-based) user federation provider that works pretty fine so far. We now want to be able to load the link information to a federated id provider (like google) from the external datasource into the Keycloak's DB by means of the user federation provider, when the user is initially created in the Keycloak DB via his first login (or via user-synchronization). So far I could see, the user federation SPI works with a UserModel class which does not care about those attributes. Do you see any chance to set such attributes in a userfederation-implementation?

One issue is, that keycloak's user entries are deleted when the userfederation provider fails to connect to the federated resource (not found how to to deactivate this behaviour so far). The user entry is recreated after the next login succeeded (OK and fine), but the link to the identity provider is lost (not fine). The other issue is, that we want to administer userattributes completey in the federated datasource to reduce complexity of our datamanagement.


Best regards, Eduard Matuszak


Dr. Eduard Matuszak

Worldline, an atos company
T  +49 (211)399 398 63
M +49 (163)166 23 67
F +49(211) 399 22 430
eduard.matuszak at atos.net<mailto:eduard.matuszak at atos.net>
Max-Stromeyer-Stra?e 116
78467 Konstanz
Germany
de.worldline.com<http://worldline.com/de/1/Home.html>
worldline.jobs.de<http://worldline.jobs.de>
facebook.com/WorldlineKarriere<http://www.facebook.com/WorldlineKarriere>



Worldline GmbH
Gesch?ftsf?hrer: Wolf Kunisch
Aufsichtsratsvorsitzender: Christophe Duquenne
Sitz der Gesellschaft: Frankfurt/Main
Handelsregister: Frankfurt/Main HRB 40 417

* * * * * * * * L E G A L D I S C L A I M E R * * * * * * * *
This e-mail and the documents attached are confidential and intended solely for the addressee; it may also be privileged. If you receive this e-mail by error, please notify the sender immediately and destroy it. As its integrity cannot be secured on the internet, the Atos group liability cannot be triggered for the message content. Although the sender endeavors to maintain a computer virus-free network, the sender does not warrant that this transmission is virus-free and shall not be liable for any damages resulting from any virus transmitted.
* * * * * * * * L E G A L D I S C L A I M E R * * * * * * * *




-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160708/449c30e3/attachment-0001.html 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: Picture (Device Independent Bitmap) 1.jpg
Type: image/jpeg
Size: 1227 bytes
Desc: Picture (Device Independent Bitmap) 1.jpg
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20160708/449c30e3/attachment-0002.jpg 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: Picture (Device Independent Bitmap) 2.jpg
Type: image/jpeg
Size: 2883 bytes
Desc: Picture (Device Independent Bitmap) 2.jpg
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20160708/449c30e3/attachment-0003.jpg 

From filipelautert at gmail.com  Fri Jul  8 10:11:05 2016
From: filipelautert at gmail.com (Filipe Lautert)
Date: Fri, 08 Jul 2016 14:11:05 +0000
Subject: [keycloak-user] Keycloak behind Apache with SSL - read
 certificate from body
In-Reply-To: <208acd55-5133-acb0-5243-2e43a70d85a7@redhat.com>
References: <CAGDdvgSJWaO7AoY4W4X0q-CXirxLL5BxB4-mEtov-0RdfAECCQ@mail.gmail.com>
	<208acd55-5133-acb0-5243-2e43a70d85a7@redhat.com>
Message-ID: <CAGDdvgRhg41FCKuZHnYiYpHDk4BhtZcGJxNnUNpWpB+p0pNHfQ@mail.gmail.com>

Hi

thanks Bill, it worked - I wasn't aware of class ResteasyProviderFactory .

Cheers

filipe

On Thu, Jul 7, 2016 at 5:25 PM Bill Burke <bburke at redhat.com> wrote:

> Don't you have to get the cert chain from a servlet request attribute?
> This might work.
>
>
>     HttpServletRequest httpServletRequest = ResteasyProviderFactory.getContextData(HttpServletRequest.class);
>     X509Certificate[] certs = (X509Certificate[]) httpServletRequest.getAttribute("javax.servlet.request.X509Certificate");
>
>
>
>
> On 7/7/16 10:53 AM, Filipe Lautert wrote:
>
> Hello
>
> short story: is there a way to get the request body sent from the client
> inside an Authenticator (my class implements Authenticator , unsing
> method @Override authenticate(context)) ? I'm trying with context.getHttpRequest().getInputStream()
> but it is empty.
>
> Full story:
> I'm trying to build a Keycloak authenticator that reads a client
> certificate and uses it to validate the user, using as a base the
> SecretQuestionAuthenticator example . The client certificate is a hard
> token that is read by Firefox. To handle the certificate read part I'm usng
> Apache mod ssl, with the below relevant configuration:
>
> SSLEngine on
>
> SSLProxyEngine on
>
>                 <LocationMatch "/auth">
>
>                         ProxyPass ajp://localhost:8010/auth
>
>                         ProxyPassReverse ajp://localhost:8010/auth
>
>                 </LocationMatch>
>
> SSLOptions +StdEnvVars +ExportCertData
>
> ... etc
>
>
> Looking at a tcpdump/wireshark on port 8010, I can see that the client
> certificate is sent on the request body to Keycloak.
>
>
> So far fine, Apache validates the certificate, extracts it and send to
> Keycloak. The problem is that I'm unable to read the request body inside my
> authenticator class as context.getHttpRequest().getInputStream() is
> empty, and as the body is the raw certificate the method context.getHttpRequest().getFormParameters()
> method won't return me anything.
>
>
> public class SecretQuestionAuthenticator implements Authenticator {
>
> @Override
>
> public void authenticate(AuthenticationFlowContext context) {
>
> System.out.println(context.getHttpRequest().getInputStream().available());
> // prints 0 System.out.println(getStringFromInputStream(context.getHttpRequest().getInputStream()));
> //empty :(
>
>
> Any ideas of how I can get it to work?
>
>
> Thanks
>
>
> filipe
> --
> filipe lautert
>
>
> _______________________________________________
> keycloak-user mailing listkeycloak-user at lists.jboss.orghttps://lists.jboss.org/mailman/listinfo/keycloak-user
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

-- 
filipe lautert
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160708/9b82b2a7/attachment.html 

From mposolda at redhat.com  Fri Jul  8 10:43:56 2016
From: mposolda at redhat.com (Marek Posolda)
Date: Fri, 8 Jul 2016 16:43:56 +0200
Subject: [keycloak-user] User federation provider taking care of ID
 provider links
In-Reply-To: <61D077C6283D454FAFD06F6AC4AB74D723E00FF1@DEFTHW99EZ1MSX.ww931.my-it-solutions.net>
References: <61D077C6283D454FAFD06F6AC4AB74D723E00FF1@DEFTHW99EZ1MSX.ww931.my-it-solutions.net>
Message-ID: <577FBC2C.4000105@redhat.com>

On 08/07/16 15:59, Matuszak, Eduard wrote:
> Hello
> I have implemented a (JPA-based) user federation provider that works 
> pretty fine so far. We now want to be able to load the link 
> information to a federated id provider (like google) from the external 
> datasource into the Keycloak?s DB by means of the user federation 
> provider, when the user is initially created in the Keycloak DB via 
> his first login (or via user-synchronization). So far I could see, the 
> user federation SPI works with a UserModel class which does not care 
> about those attributes. Do you see any chance to set such attributes 
> in a userfederation-implementation?
> One issue is, that keycloak?s user entries are deleted when the 
> userfederation provider fails to connect to the federated resource 
> (not found how to to deactivate this behaviour so far). The user entry 
> is recreated after the next login succeeded (OK and fine), but the 
> link to the identity provider is lost (not fine). The other issue is, 
> that we want to administer userattributes completey in the federated 
> datasource to reduce complexity of our datamanagement.
It depends how you implement methods "isValid"  and "validateAndProxy" 
of your UserFederation provider. If you fail to connect, you can 
possibly just return the proxy of "local" UserModel, which was  passed 
as an argument to methods. But note that then all writes to this 
UserModel won't be updated to your storage, but just to Keycloak DB.


Btv. There is UserFederation SPI refactoring in progressand there will 
be updates to this SPI in next Keycloak versions (2.1 and laters)

Marek
> Best regards, Eduard Matuszak
> *Dr. Eduard Matuszak*
> Worldline, an atos company
> T  +49 (211)399 398 63
> M +49 (163)166 23 67
> F +49(211) 399 22 430
> _eduard.matuszak at atos.net_ <mailto:eduard.matuszak at atos.net>
> Max-Stromeyer-Stra?e 116
> 78467 Konstanz
> Germany
> _de.worldline.com_ <http://worldline.com/de/1/Home.html>
> _worldline.jobs.de_ <http://worldline.jobs.de>
> _facebook.com/WorldlineKarriere_ 
> <http://www.facebook.com/WorldlineKarriere>
> Worldline GmbH
> Gesch?ftsf?hrer: Wolf Kunisch
> Aufsichtsratsvorsitzender: Christophe Duquenne
> Sitz der Gesellschaft: Frankfurt/Main
> Handelsregister: Frankfurt/Main HRB 40 417
>
> * * * * * * * * L E G A L D I S C L A I M E R * * * * * * * *
> This e-mail and the documents attached are confidential and intended 
> solely for the addressee; it may also be privileged. If you receive 
> this e-mail by error, please notify the sender immediately and destroy 
> it. As its integrity cannot be secured on the internet, the Atos group 
> liability cannot be triggered for the message content. Although the 
> sender endeavors to maintain a computer virus-free network, the sender 
> does not warrant that this transmission is virus-free and shall not be 
> liable for any damages resulting from any virus transmitted.
> * * * * * * * * L E G A L D I S C L A I M E R * * * * * * * *
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160708/e4b6bdcf/attachment-0001.html 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: image/jpeg
Size: 1227 bytes
Desc: not available
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20160708/e4b6bdcf/attachment-0002.jpe 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: image/jpeg
Size: 2883 bytes
Desc: not available
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20160708/e4b6bdcf/attachment-0003.jpe 

From bruno at abstractj.org  Sat Jul  9 01:38:36 2016
From: bruno at abstractj.org (Bruno Oliveira)
Date: Sat, 9 Jul 2016 02:38:36 -0300
Subject: [keycloak-user] Support for CORS Access-Control-Expose-Headers
 in 2.0.0.Final
In-Reply-To: <CAJMEJTW7aZZeHRDinB66PDTfMaZ3aHLs8VNrx=xTNPJ+qqCORg@mail.gmail.com>
References: <CAJMEJTW7aZZeHRDinB66PDTfMaZ3aHLs8VNrx=xTNPJ+qqCORg@mail.gmail.com>
Message-ID: <20160709053836.GA23953@abstractj.org>

As far as I can tell, yes.

See:
https://keycloak.gitbooks.io/server-adminstration-guide/content/topics/clients/client-oidc.html
https://github.com/keycloak/keycloak/blob/5c98b8c6ae7052b2d906156d8fc212ccd9dfd57d/services/src/main/java/org/keycloak/services/resources/Cors.java#L143

On 2016-07-08, Hubert Przybysz wrote:
> Hi,
>
> Is configuration of CORS Access-Control-Expose-Headers supported in
> 2.0.0.Final adapters?
>
> Best regards / Hubert.

> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user


--

abstractj
PGP: 0x84DC9914

From aikeaguinea at xsmail.com  Sat Jul  9 13:48:02 2016
From: aikeaguinea at xsmail.com (Aikeaguinea)
Date: Sat, 09 Jul 2016 13:48:02 -0400
Subject: [keycloak-user] Keycloak behind Apache with SSL - read
 certificate from body
In-Reply-To: <CAGDdvgSJWaO7AoY4W4X0q-CXirxLL5BxB4-mEtov-0RdfAECCQ@mail.gmail.com>
References: <CAGDdvgSJWaO7AoY4W4X0q-CXirxLL5BxB4-mEtov-0RdfAECCQ@mail.gmail.com>
Message-ID: <1468086482.3922915.661524881.121E5DDF@webmail.messagingengine.com>

If you don't have requirements that your certificate authenticator be
proprietary, might I suggest that you open-source it? I think this kind
of authentication may not be an uncommon use case, particularly with the
Internet of Things beginning to take off.
 
 
On Thu, Jul 7, 2016, at 10:53 AM, Filipe Lautert wrote:
> Hello
>
> short story: is there a way to get the request body sent from the
> client inside an Authenticator (my class implements Authenticator ,
> unsing method @Override authenticate(context)) ? I'm trying with
> context.getHttpRequest().getInputStream() but it is empty.
>
> Full story:
> I'm trying to build a Keycloak authenticator that reads a client
> certificate and uses it to validate the user, using as a base the
> SecretQuestionAuthenticator example . The client certificate is a hard
> token that is read by Firefox. To handle the certificate read part I'm
> usng Apache mod ssl, with the below relevant configuration:
>
> SSLEngine on
> SSLProxyEngine on
>                 <LocationMatch "/auth">
>                         ProxyPass ajp://localhost:8010/auth
>                         ProxyPassReverse ajp://localhost:8010/auth
>                 </LocationMatch>
> SSLOptions +StdEnvVars +ExportCertData
> ... etc
>
> Looking at a tcpdump/wireshark on port 8010, I can see that the client
> certificate is sent on the request body to Keycloak.
>
> So far fine, Apache validates the certificate, extracts it and send to
> Keycloak. The problem is that I'm unable to read the request body
> inside my authenticator class as
> context.getHttpRequest().getInputStream() is empty, and as the body is
> the raw certificate the method
> context.getHttpRequest().getFormParameters() method won't return me
> anything.
>
> public class SecretQuestionAuthenticator implements Authenticator {
> @Override
> public void authenticate(AuthenticationFlowContext context) {
> System.out.println(context.getHttpRequest().getInputStream().availabl-
> e()); // prints 0 System.out.println(getStringFromInputStream(context-
> .getHttpRequest().getInputStream())); //empty :(
>
>
>
> Any ideas of how I can get it to work?
>
> Thanks
>
> filipe
> --
> filipe lautert
> _________________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
 
--
  Aikeaguinea
  aikeaguinea at xsmail.com
 
?

-- 
http://www.fastmail.com - Does exactly what it says on the tin

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160709/a9859f3d/attachment.html 

From hr.stoyanov at peruncs.com  Sat Jul  9 13:56:57 2016
From: hr.stoyanov at peruncs.com (Hristo Stoyanov)
Date: Sat, 9 Jul 2016 17:56:57 +0000
Subject: [keycloak-user] Login and credit card
In-Reply-To: <CAHiHDeShXqC643jOxSn_zHzsMdw19CxPDU2fEcqR-NMvnKxWzQ@mail.gmail.com>
References: <CAHiHDeSFLr=u_=fOKRF6vE8NgR_mOwW15qYVGe90GG5pEcjMZg@mail.gmail.com>
	<CAHiHDeRBFOxk8zNTBW1htNCfgNYYDVY30AFyH+cHz_k4SQ80QA@mail.gmail.com>
	<CAHiHDeTuFtTDCztSMzqduQLsBt7mikJmicKZ4z41usAM8TydZw@mail.gmail.com>
	<CAHiHDeRjx9jSE7q62H=ES2XjyaENOhi1ZPG0dt2J2zxZ6Os2Og@mail.gmail.com>
	<CAHiHDeShXqC643jOxSn_zHzsMdw19CxPDU2fEcqR-NMvnKxWzQ@mail.gmail.com>
Message-ID: <CAHiHDeRZv8McyZW0g0qDsR1UeqrN-oW2v8x68fnqgs2giOE-BQ@mail.gmail.com>

Many applications would require the user to provide his/her credit card
upon sign up on a single step/screen. This does not work well with the
out_of_box KC screen. How do you solve this? Custom login screen?

/Hristo Stoyanov
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160709/541e0052/attachment-0001.html 

From fabricio.milone at shinetech.com  Sun Jul 10 18:23:24 2016
From: fabricio.milone at shinetech.com (Fabricio Milone)
Date: Mon, 11 Jul 2016 08:23:24 +1000
Subject: [keycloak-user] Login and credit card
In-Reply-To: <CAHiHDeRZv8McyZW0g0qDsR1UeqrN-oW2v8x68fnqgs2giOE-BQ@mail.gmail.com>
References: <CAHiHDeSFLr=u_=fOKRF6vE8NgR_mOwW15qYVGe90GG5pEcjMZg@mail.gmail.com>
	<CAHiHDeRBFOxk8zNTBW1htNCfgNYYDVY30AFyH+cHz_k4SQ80QA@mail.gmail.com>
	<CAHiHDeTuFtTDCztSMzqduQLsBt7mikJmicKZ4z41usAM8TydZw@mail.gmail.com>
	<CAHiHDeRjx9jSE7q62H=ES2XjyaENOhi1ZPG0dt2J2zxZ6Os2Og@mail.gmail.com>
	<CAHiHDeShXqC643jOxSn_zHzsMdw19CxPDU2fEcqR-NMvnKxWzQ@mail.gmail.com>
	<CAHiHDeRZv8McyZW0g0qDsR1UeqrN-oW2v8x68fnqgs2giOE-BQ@mail.gmail.com>
Message-ID: <CAOjtoUO8EPAkozZtDkC+HrQMQB7c5d_Kwpa+za-=dQ6=mWVsgA@mail.gmail.com>

Correct me if I am wrong but my best guess is that you can extend the
default login theme with some app specific template. I have added some
extra required fields when a registration process starts and all I had to
do was extend the keycloak theme, creating a new register.ftl file with my
own template. The other option is a new implementation of the
login-update-profile.ftl and make the Review Profile screen required
(always on under your Authentication flow).

It depens on your requirements really.

Regards,
Fab


On 10 July 2016 at 03:56, Hristo Stoyanov <hr.stoyanov at peruncs.com> wrote:

> Many applications would require the user to provide his/her credit card
> upon sign up on a single step/screen. This does not work well with the
> out_of_box KC screen. How do you solve this? Custom login screen?
>
> /Hristo Stoyanov
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>



-- 
*Fabricio Milone*
Developer

*Shine Consulting *

30/600 Bourke Street

Melbourne VIC 3000

T: 03 8488 9939

M: 04 3200 4006


www.shinetech.com  *a* passion for excellence
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160711/bd897d59/attachment.html 

From hr.stoyanov at peruncs.com  Sun Jul 10 18:29:30 2016
From: hr.stoyanov at peruncs.com (Hristo Stoyanov)
Date: Sun, 10 Jul 2016 22:29:30 +0000
Subject: [keycloak-user] Login and credit card
In-Reply-To: <CAOjtoUO8EPAkozZtDkC+HrQMQB7c5d_Kwpa+za-=dQ6=mWVsgA@mail.gmail.com>
References: <CAHiHDeSFLr=u_=fOKRF6vE8NgR_mOwW15qYVGe90GG5pEcjMZg@mail.gmail.com>
	<CAHiHDeRBFOxk8zNTBW1htNCfgNYYDVY30AFyH+cHz_k4SQ80QA@mail.gmail.com>
	<CAHiHDeTuFtTDCztSMzqduQLsBt7mikJmicKZ4z41usAM8TydZw@mail.gmail.com>
	<CAHiHDeRjx9jSE7q62H=ES2XjyaENOhi1ZPG0dt2J2zxZ6Os2Og@mail.gmail.com>
	<CAHiHDeShXqC643jOxSn_zHzsMdw19CxPDU2fEcqR-NMvnKxWzQ@mail.gmail.com>
	<CAHiHDeRZv8McyZW0g0qDsR1UeqrN-oW2v8x68fnqgs2giOE-BQ@mail.gmail.com>
	<CAOjtoUO8EPAkozZtDkC+HrQMQB7c5d_Kwpa+za-=dQ6=mWVsgA@mail.gmail.com>
Message-ID: <CAHiHDeTQ1VaZPMB6npo1SuNL07d_8NWHckDppC2BCF3a0nLm3g@mail.gmail.com>

I am coming to the conclusion that I have to develop sign up page, as I
don't want to deal with KC patternfly/angular stuff.

/Hristo Stoyanov
On Jul 10, 2016 3:24 PM, "Fabricio Milone" <fabricio.milone at shinetech.com>
wrote:

> Correct me if I am wrong but my best guess is that you can extend the
> default login theme with some app specific template. I have added some
> extra required fields when a registration process starts and all I had to
> do was extend the keycloak theme, creating a new register.ftl file with my
> own template. The other option is a new implementation of the
> login-update-profile.ftl and make the Review Profile screen required
> (always on under your Authentication flow).
>
> It depens on your requirements really.
>
> Regards,
> Fab
>
>
> On 10 July 2016 at 03:56, Hristo Stoyanov <hr.stoyanov at peruncs.com> wrote:
>
>> Many applications would require the user to provide his/her credit card
>> upon sign up on a single step/screen. This does not work well with the
>> out_of_box KC screen. How do you solve this? Custom login screen?
>>
>> /Hristo Stoyanov
>>
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>
>
>
>
> --
> *Fabricio Milone*
> Developer
>
> *Shine Consulting *
>
> 30/600 Bourke Street
>
> Melbourne VIC 3000
>
> T: 03 8488 9939
>
> M: 04 3200 4006
>
>
> www.shinetech.com  *a* passion for excellence
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160710/32ac4b8c/attachment.html 

From fabricio.milone at shinetech.com  Sun Jul 10 19:31:55 2016
From: fabricio.milone at shinetech.com (Fabricio Milone)
Date: Mon, 11 Jul 2016 09:31:55 +1000
Subject: [keycloak-user] Logout 100k users produces an Exception
Message-ID: <CAOjtoUOoh4zKcrm4Z8k_dpExUEaeSpc32NhB8KQnjUYQVPW3kg@mail.gmail.com>

Hi all,

I have this issue with my current configuration on Keycloak 2.0.0 where
after creating more than 100k sessions (or much less than that, but I don't
know the exact number), when I try to log out all of them from the admin
console I got an UI error after some seconds and the exception at the end
of my email. The process does not finish as expected and the sessions are
still there.

I have 12 nodes running in the network with all my users going through a
federator and everything is working as expected so far in terms of
functionality.

Is there any server side configuration I can tune to avoid this?

Thanks in advance!

Regads,
Fab

2016-07-11 08:15:34,334 ERROR [org.keycloak.services] (Timer-2)
>> KC-SERVICES0089: Failed to run scheduled task ClearExpiredUserSessions:
>> org.infinispan.util.concurrent.TimeoutException: Replication timeout for
>> identityapp06l3
>
> at
>> org.infinispan.remoting.transport.jgroups.JGroupsTransport.checkRsp(JGroupsTransport.java:765)
>
> at
>> org.infinispan.remoting.transport.jgroups.JGroupsTransport.lambda$invokeRemotelyAsync$72(JGroupsTransport.java:599)
>
> at
>> org.infinispan.remoting.transport.jgroups.JGroupsTransport$$Lambda$106/1829642022.apply(Unknown
>> Source)
>
> at java.util.concurrent.CompletableFuture$ThenApply.run(Unknown Source)
>
> at java.util.concurrent.CompletableFuture.postComplete(Unknown Source)
>
> at java.util.concurrent.CompletableFuture.complete(Unknown Source)
>
> at
>> org.infinispan.remoting.transport.jgroups.SingleResponseFuture.call(SingleResponseFuture.java:46)
>
> at
>> org.infinispan.remoting.transport.jgroups.SingleResponseFuture.call(SingleResponseFuture.java:17)
>
> at java.util.concurrent.FutureTask.run(Unknown Source)
>
> at
>> java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$201(Unknown
>> Source)
>
> at
>> java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(Unknown
>> Source)
>
> at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source)
>
> at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)
>
> at java.lang.Thread.run(Unknown Source)
>
>
>> 2016-07-11 08:28:52,374 WARN
>>  [org.infinispan.interceptors.locking.NonTransactionalLockingInterceptor]
>> (remote-thread--p7-t1116) ISPN000135: Could not lock key
>> 43bcf8ef-c40b-48de-9f20-a118843cfc30 in order to invalidate from L1 at node
>> identityapp01l3, skipping....
>
> 2016-07-11 08:30:34,385 ERROR [org.keycloak.services] (Timer-2)
>> KC-SERVICES0089: Failed to run scheduled task ClearExpiredUserSessions:
>> org.infinispan.util.concurrent.TimeoutException: Replication timeout for
>> identityapp06l3
>
> at
>> org.infinispan.remoting.transport.jgroups.JGroupsTransport.checkRsp(JGroupsTransport.java:765)
>
> at
>> org.infinispan.remoting.transport.jgroups.JGroupsTransport.lambda$invokeRemotelyAsync$72(JGroupsTransport.java:599)
>
> at
>> org.infinispan.remoting.transport.jgroups.JGroupsTransport$$Lambda$106/1829642022.apply(Unknown
>> Source)
>
> at java.util.concurrent.CompletableFuture$ThenApply.run(Unknown Source)
>
> at java.util.concurrent.CompletableFuture.postComplete(Unknown Source)
>
> at java.util.concurrent.CompletableFuture.complete(Unknown Source)
>
> at
>> org.infinispan.remoting.transport.jgroups.SingleResponseFuture.call(SingleResponseFuture.java:46)
>
> at
>> org.infinispan.remoting.transport.jgroups.SingleResponseFuture.call(SingleResponseFuture.java:17)
>
> at java.util.concurrent.FutureTask.run(Unknown Source)
>
> at
>> java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$201(Unknown
>> Source)
>
> at
>> java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(Unknown
>> Source)
>
> at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source)
>
> at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)
>
> at java.lang.Thread.run(Unknown Source)
>
>
>> 2016-07-11 08:35:41,792 ERROR [io.undertow.request] (default task-60)
>> UT005023: Exception handling request to
>> /auth/admin/realms/electricsheep/logout-all:
>> org.jboss.resteasy.spi.UnhandledException:
>> org.infinispan.util.concurrent.TimeoutException: Replication timeout for
>> identityapp06l3
>
> at
>> org.jboss.resteasy.core.ExceptionHandler.handleApplicationException(ExceptionHandler.java:76)
>
> at
>> org.jboss.resteasy.core.ExceptionHandler.handleException(ExceptionHandler.java:212)
>
> at
>> org.jboss.resteasy.core.SynchronousDispatcher.writeException(SynchronousDispatcher.java:168)
>
> at
>> org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:411)
>
> at
>> org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:202)
>
> at
>> org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.service(ServletContainerDispatcher.java:221)
>
> at
>> org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:56)
>
> at
>> org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:51)
>
> at javax.servlet.http.HttpServlet.service(HttpServlet.java:790)
>
> at
>> io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:85)
>
> at
>> io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:129)
>
> at
>> org.keycloak.services.filters.KeycloakSessionServletFilter.doFilter(KeycloakSessionServletFilter.java:107)
>
> at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:60)
>
> at
>> io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
>
> at
>> io.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.java:84)
>
> at
>> io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:62)
>
> at
>> io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36)
>
> at
>> org.wildfly.extension.undertow.security.SecurityContextAssociationHandler.handleRequest(SecurityContextAssociationHandler.java:78)
>
> at
>> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
>
> at
>> io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:131)
>
> at
>> io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:57)
>
> at
>> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
>
> at
>> io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:46)
>
> at
>> io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64)
>
> at
>> io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:60)
>
> at
>> io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:77)
>
> at
>> io.undertow.security.handlers.NotificationReceiverHandler.handleRequest(NotificationReceiverHandler.java:50)
>
> at
>> io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43)
>
> at
>> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
>
> at
>> org.wildfly.extension.undertow.security.jacc.JACCContextIdHandler.handleRequest(JACCContextIdHandler.java:61)
>
> at
>> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
>
> at
>> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
>
> at
>> io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:284)
>
> at
>> io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:263)
>
> at
>> io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:81)
>
> at
>> io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:174)
>
> at io.undertow.server.Connectors.executeRootHandler(Connectors.java:202)
>
> at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:793)
>
> at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source)
>
> at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)
>
> at java.lang.Thread.run(Unknown Source)
>
> Caused by: org.infinispan.util.concurrent.TimeoutException: Replication
>> timeout for identityapp06l3
>
> at
>> org.infinispan.remoting.transport.jgroups.JGroupsTransport.checkRsp(JGroupsTransport.java:765)
>
> at
>> org.infinispan.remoting.transport.jgroups.JGroupsTransport.lambda$invokeRemotelyAsync$72(JGroupsTransport.java:599)
>
> at
>> org.infinispan.remoting.transport.jgroups.JGroupsTransport$$Lambda$106/1829642022.apply(Unknown
>> Source)
>
> at java.util.concurrent.CompletableFuture$ThenApply.run(Unknown Source)
>
> at java.util.concurrent.CompletableFuture.postComplete(Unknown Source)
>
> at java.util.concurrent.CompletableFuture.complete(Unknown Source)
>
> at
>> org.infinispan.remoting.transport.jgroups.SingleResponseFuture.call(SingleResponseFuture.java:46)
>
> at
>> org.infinispan.remoting.transport.jgroups.SingleResponseFuture.call(SingleResponseFuture.java:17)
>
> at java.util.concurrent.FutureTask.run(Unknown Source)
>
> at
>> java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$201(Unknown
>> Source)
>
> at
>> java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(Unknown
>> Source)
>
> ... 3 more
>
>
-- 
*Fabricio Milone*
Developer

*Shine Consulting *

30/600 Bourke Street

Melbourne VIC 3000

T: 03 8488 9939

M: 04 3200 4006


www.shinetech.com  *a* passion for excellence
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160711/a8ac56dd/attachment-0001.html 

From akaya at expedia.com  Sun Jul 10 20:59:28 2016
From: akaya at expedia.com (Sarp Kaya)
Date: Mon, 11 Jul 2016 00:59:28 +0000
Subject: [keycloak-user] JDBC Connection is closed early for Infinispan
Message-ID: <D3A92C8F.B0B5%akaya@expedia.com>

Hello,

For the caching if we are using infinispan with JDBC_PING then JDBC connection is closed before infinispan stops its caching related stuff. This causes an exception to be thrown and therefore it does not really shut infinispan gracefully.

Logs:
2016-07-11 00:53:48,330 INFO  [org.jboss.as.server] (Thread-2) WFLYSRV0220: Server shutdown has been requested.
2016-07-11 00:53:48,385 INFO  [org.jboss.as.connector.subsystems.datasources] (MSC service thread 1-2) WFLYJCA0010: Unbound data source [java:/MySQLDS]
2016-07-11 00:53:48,394 INFO  [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service thread 1-2) ISPN000080: Disconnecting JGroups channel web
2016-07-11 00:53:48,396 INFO  [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service thread 1-1) ISPN000080: Disconnecting JGroups channel server
2016-07-11 00:53:48,395 INFO  [org.wildfly.extension.undertow] (ServerService Thread Pool -- 60) WFLYUT0022: Unregistered web context: /auth
2016-07-11 00:53:48,397 INFO  [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service thread 1-2) ISPN000082: Stopping the RpcDispatcher for channel web
2016-07-11 00:53:48,398 INFO  [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service thread 1-1) ISPN000082: Stopping the RpcDispatcher for channel server
2016-07-11 00:53:48,403 INFO  [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service thread 1-1) ISPN000080: Disconnecting JGroups channel hibernate
2016-07-11 00:53:48,408 INFO  [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service thread 1-1) ISPN000082: Stopping the RpcDispatcher for channel hibernate
2016-07-11 00:53:48,407 INFO  [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service thread 1-2) ISPN000080: Disconnecting JGroups channel ejb
2016-07-11 00:53:48,411 INFO  [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service thread 1-2) ISPN000082: Stopping the RpcDispatcher for channel ejb
2016-07-11 00:53:48,414 INFO  [org.wildfly.extension.undertow] (MSC service thread 1-2) WFLYUT0008: Undertow HTTPS listener https suspending
2016-07-11 00:53:48,416 WARN  [org.jboss.jca.core.connectionmanager.pool.strategy.OnePool] (ServerService Thread Pool -- 59) IJ000615: Destroying active connection in pool: MySQLDS (org.jboss.jca.adapters.jdbc.local.LocalManagedConnection at 57e067d0)
2016-07-11 00:53:48,423 INFO  [org.wildfly.extension.undertow] (MSC service thread 1-2) WFLYUT0007: Undertow HTTPS listener https stopped, was bound to 0.0.0.0:8443
2016-07-11 00:53:48,429 INFO  [org.jboss.as.connector.deployers.jdbc] (MSC service thread 1-1) WFLYJCA0019: Stopped Driver service with driver-name = mysql
2016-07-11 00:53:48,434 INFO  [org.wildfly.extension.undertow] (MSC service thread 1-1) WFLYUT0019: Host default-host stopping
2016-07-11 00:53:48,448 INFO  [org.jboss.as.connector.subsystems.datasources] (MSC service thread 1-1) WFLYJCA0010: Unbound data source [java:jboss/datasources/ExampleDS]
2016-07-11 00:53:48,467 INFO  [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 59) WFLYCLINF0003: Stopped sessions cache from keycloak container
2016-07-11 00:53:48,472 INFO  [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 60) WFLYCLINF0003: Stopped realms cache from keycloak container
2016-07-11 00:53:48,475 INFO  [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 60) WFLYCLINF0003: Stopped loginFailures cache from keycloak container
2016-07-11 00:53:48,477 INFO  [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 59) WFLYCLINF0003: Stopped offlineSessions cache from keycloak container
2016-07-11 00:53:48,487 INFO  [org.jboss.as.connector.deployers.jdbc] (MSC service thread 1-1) WFLYJCA0019: Stopped Driver service with driver-name = h2
2016-07-11 00:53:48,489 INFO  [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 63) WFLYCLINF0003: Stopped users cache from keycloak container
2016-07-11 00:53:48,492 INFO  [org.wildfly.extension.undertow] (MSC service thread 1-2) WFLYUT0008: Undertow AJP listener ajp suspending
2016-07-11 00:53:48,496 INFO  [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 62) WFLYCLINF0003: Stopped realmVersions cache from keycloak container
2016-07-11 00:53:48,497 INFO  [org.wildfly.extension.undertow] (MSC service thread 1-2) WFLYUT0007: Undertow AJP listener ajp stopped, was bound to 0.0.0.0:8009
2016-07-11 00:53:48,500 INFO  [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 64) WFLYCLINF0003: Stopped work cache from keycloak container
2016-07-11 00:53:48,499 INFO  [org.jboss.modcluster] (ServerService Thread Pool -- 65) MODCLUSTER000002: Initiating mod_cluster shutdown
2016-07-11 00:53:48,506 INFO  [org.jboss.as.server.deployment] (MSC service thread 1-2) WFLYSRV0028: Stopped deployment keycloak-server.war (runtime-name: keycloak-server.war) in 138ms
2016-07-11 00:53:48,499 INFO  [org.wildfly.extension.undertow] (MSC service thread 1-1) WFLYUT0008: Undertow HTTP listener default suspending
2016-07-11 00:53:48,508 INFO  [org.wildfly.extension.undertow] (MSC service thread 1-1) WFLYUT0007: Undertow HTTP listener default stopped, was bound to 0.0.0.0:8080
2016-07-11 00:53:48,516 INFO  [org.jboss.as.clustering.infinispan] (MSC service thread 1-2) WFLYCLINF0003: Stopped authorization cache from keycloak container
2016-07-11 00:53:48,517 INFO  [org.wildfly.extension.undertow] (MSC service thread 1-1) WFLYUT0004: Undertow 1.3.15.Final stopping
2016-07-11 00:53:48,542 INFO  [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service thread 1-2) ISPN000080: Disconnecting JGroups channel keycloak
2016-07-11 00:53:48,543 INFO  [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service thread 1-2) ISPN000082: Stopping the RpcDispatcher for channel keycloak
2016-07-11 00:53:48,553 ERROR [org.jgroups.protocols.JDBC_PING] (MSC service thread 1-1) Could not open connection to database: java.sql.SQLException: javax.resource.ResourceException: IJ000470: You are trying to use a connection factory that has been shut down: java:/MySQLDS
        at org.jboss.jca.adapters.jdbc.WrapperDataSource.getConnection(WrapperDataSource.java:146)
        at org.jboss.as.connector.subsystems.datasources.WildFlyDataSource.getConnection(WildFlyDataSource.java:66)
        at org.jgroups.protocols.JDBC_PING.getConnection(JDBC_PING.java:348)
        at org.jgroups.protocols.JDBC_PING.delete(JDBC_PING.java:379)
        at org.jgroups.protocols.JDBC_PING.deleteSelf(JDBC_PING.java:395)
        at org.jgroups.protocols.JDBC_PING.stop(JDBC_PING.java:144)
        at org.jgroups.stack.ProtocolStack.stopStack(ProtocolStack.java:1015)
        at org.jgroups.JChannel.stopStack(JChannel.java:1002)
        at org.jgroups.JChannel.disconnect(JChannel.java:373)
        at org.wildfly.clustering.jgroups.spi.service.ChannelConnectorBuilder.stop(ChannelConnectorBuilder.java:103)
        at org.jboss.msc.service.ServiceControllerImpl$StopTask.stopService(ServiceControllerImpl.java:2056)
        at org.jboss.msc.service.ServiceControllerImpl$StopTask.run(ServiceControllerImpl.java:2017)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
        at java.lang.Thread.run(Thread.java:745)
Caused by: javax.resource.ResourceException: IJ000470: You are trying to use a connection factory that has been shut down: java:/MySQLDS
        at org.jboss.jca.core.connectionmanager.AbstractConnectionManager.allocateConnection(AbstractConnectionManager.java:735)
        at org.jboss.jca.adapters.jdbc.WrapperDataSource.getConnection(WrapperDataSource.java:138)
        ... 14 more

2016-07-11 00:53:48,559 ERROR [org.jgroups.protocols.JDBC_PING] (MSC service thread 1-1) Failed to delete PingData in database
2016-07-11 00:53:51,576 INFO  [org.jboss.as] (MSC service thread 1-1) WFLYSRV0050: Keycloak 2.0.0.Final (WildFly Core 2.0.10.Final) stopped in 3208ms


Kind Regards,
Sarp Kaya
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160711/e28634fe/attachment.html 

From fabricio.milone at shinetech.com  Mon Jul 11 00:41:16 2016
From: fabricio.milone at shinetech.com (Fabricio Milone)
Date: Mon, 11 Jul 2016 14:41:16 +1000
Subject: [keycloak-user] Admin user from LDAP server
Message-ID: <CAOjtoUNGJUTt=6E0gbpXq+nwnS3gBu0xHk7OB9EnTM_jcctZ8w@mail.gmail.com>

Hi,

We would like to be able to create the admin user using LDAP, so the
credentials are not stored in Keycloak's database at all.

I think there is no way to achieve this at the moment, would you think this
is possible?

I'd like to create a feature request if you don't mind.

Regards
-- 
*Fabricio Milone*
Developer

*Shine Consulting *

30/600 Bourke Street

Melbourne VIC 3000

T: 03 8488 9939

M: 04 3200 4006


www.shinetech.com  *a* passion for excellence
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160711/6d1df645/attachment.html 

From sthorger at redhat.com  Mon Jul 11 01:37:38 2016
From: sthorger at redhat.com (Stian Thorgersen)
Date: Mon, 11 Jul 2016 07:37:38 +0200
Subject: [keycloak-user] KEYCLOAK-3202 Creating users causes memory leak
In-Reply-To: <CAOy2obEVCKZhK6tLLhs8RQRs4ScUCgKfWTPjhn0N9Nmy2+yQpA@mail.gmail.com>
References: <CAOy2obEVCKZhK6tLLhs8RQRs4ScUCgKfWTPjhn0N9Nmy2+yQpA@mail.gmail.com>
Message-ID: <CAJgngAdQQ01OfgcHHw9Ati2-SDYU6WZbq0M1zN=hQBXWg-4qJQ@mail.gmail.com>

Hi,

You can relatively easily try though by adding an eviction policy to the
realmVersions cache. I found that with roughly a million users there would
be around 500Mb of memory consumed, which will run you into issues with the
default settings if you have that many users login over a space of a day
and a half.

Empty page could be due to timeout. Is there any errors in the logs? What
is the status code returned with the empty page?

On 8 July 2016 at 10:40, Valerij Timofeev <valerij.timofeev at gmail.com>
wrote:

> Hi Stian,
>
> You are the assignee in KEYCLOAK-3202
> <https://issues.jboss.org/browse/KEYCLOAK-3202>, so I addressed this
> email to you directly.
>
> I guess that this issue could be the cause of trouble in our production
> environment.
>
> There are 4 EAP-6 nodes with Keycloak adapters and 2 Keycloak 1.9.4
> standalone servers running in 2 clusters respectively.
>
> We experience logout failures approximately after one and a half days of
> operation.
> Restarting EAP 6 nodes temporary resolves the logout problem.
>
> Durable load tests in out test environment showed that login and logout of
> existing users don't result in above behaviour.
> We added to the durable load test additional scenario creating new users
> and were able to reproduce logout failure: users are getting empty page and
> not the login screen as expected. Page reload navigates back into the
> protected web application .
>
> Logout is accomplished in a Java web applictaion by calling OIDC logout
> endpoint:
>
>
>
>
>
> *FacesContext                .getCurrentInstance()
> .getExternalContext()
> .redirect(keycloakDeployment.getLogoutUrl().queryParam("redirect_uri",
> redirectURL).toTemplate());*
>
> Logout is initiated via h:commandLink, so I suppose that the OIDC logout
> endpoint is called via the GET method. Should we use the POST method
> instead?
>
> Has servlet logout any advantages?
>
>
>
> *((HttpServletRequest)
> FacesContext.getCurrentInstance().getExternalContext().getRequest()).logout();*
> I'd appreciate quick response*, *because restarting production EAP
> cluster every day is not a pleasant option ;-)
>
> Thank you in advance
>
> Kind regards
> Valerij Timofeev
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160711/aa3e0b45/attachment-0001.html 

From mposolda at redhat.com  Mon Jul 11 02:45:28 2016
From: mposolda at redhat.com (Marek Posolda)
Date: Mon, 11 Jul 2016 08:45:28 +0200
Subject: [keycloak-user] Logout 100k users produces an Exception
In-Reply-To: <CAOjtoUOoh4zKcrm4Z8k_dpExUEaeSpc32NhB8KQnjUYQVPW3kg@mail.gmail.com>
References: <CAOjtoUOoh4zKcrm4Z8k_dpExUEaeSpc32NhB8KQnjUYQVPW3kg@mail.gmail.com>
Message-ID: <57834088.70806@redhat.com>

It seems that bulk removal of userSessions is not very effective. It 
loads all the sessions locally from the remote nodes and then remove 
them one by one 
https://github.com/keycloak/keycloak/blob/master/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/InfinispanUserSessionProvider.java#L286-290 
. Hopefully infinispan has a way that you will trigger task for "visit" 
sessions, which should be removed. Then you will directly remove the 
sessions on the node, where they live, in single step.

Maybe there are more such bulk operations, which can be improved in 
similar way. Could you please create JIRA for it?

Thanks,
Marek

On 11/07/16 01:31, Fabricio Milone wrote:
> Hi all,
>
> I have this issue with my current configuration on Keycloak 2.0.0 
> where after creating more than 100k sessions (or much less than that, 
> but I don't know the exact number), when I try to log out all of them 
> from the admin console I got an UI error after some seconds and the 
> exception at the end of my email. The process does not finish as 
> expected and the sessions are still there.
>
> I have 12 nodes running in the network with all my users going through 
> a federator and everything is working as expected so far in terms of 
> functionality.
>
> Is there any server side configuration I can tune to avoid this?
>
> Thanks in advance!
>
> Regads,
> Fab
>
>         2016-07-11 08:15:34,334 ERROR [org.keycloak.services]
>         (Timer-2) KC-SERVICES0089: Failed to run scheduled task
>         ClearExpiredUserSessions:
>         org.infinispan.util.concurrent.TimeoutException: Replication
>         timeout for identityapp06l3
>
>         at
>         org.infinispan.remoting.transport.jgroups.JGroupsTransport.checkRsp(JGroupsTransport.java:765)
>
>         at
>         org.infinispan.remoting.transport.jgroups.JGroupsTransport.lambda$invokeRemotelyAsync$72(JGroupsTransport.java:599)
>
>         at
>         org.infinispan.remoting.transport.jgroups.JGroupsTransport$$Lambda$106/1829642022.apply(Unknown
>         Source)
>
>         at
>         java.util.concurrent.CompletableFuture$ThenApply.run(Unknown
>         Source)
>
>         at java.util.concurrent.CompletableFuture.postComplete(Unknown
>         Source)
>
>         at java.util.concurrent.CompletableFuture.complete(Unknown Source)
>
>         at
>         org.infinispan.remoting.transport.jgroups.SingleResponseFuture.call(SingleResponseFuture.java:46)
>
>         at
>         org.infinispan.remoting.transport.jgroups.SingleResponseFuture.call(SingleResponseFuture.java:17)
>
>         at java.util.concurrent.FutureTask.run(Unknown Source)
>
>         at
>         java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$201(Unknown
>         Source)
>
>         at
>         java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(Unknown
>         Source)
>
>         at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown
>         Source)
>
>         at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown
>         Source)
>
>         at java.lang.Thread.run(Unknown Source)
>
>
>         2016-07-11 08:28:52,374 WARN
>          [org.infinispan.interceptors.locking.NonTransactionalLockingInterceptor]
>         (remote-thread--p7-t1116) ISPN000135: Could not lock key
>         43bcf8ef-c40b-48de-9f20-a118843cfc30 in order to invalidate
>         from L1 at node identityapp01l3, skipping....
>
>         2016-07-11 08:30:34,385 ERROR [org.keycloak.services]
>         (Timer-2) KC-SERVICES0089: Failed to run scheduled task
>         ClearExpiredUserSessions:
>         org.infinispan.util.concurrent.TimeoutException: Replication
>         timeout for identityapp06l3
>
>         at
>         org.infinispan.remoting.transport.jgroups.JGroupsTransport.checkRsp(JGroupsTransport.java:765)
>
>         at
>         org.infinispan.remoting.transport.jgroups.JGroupsTransport.lambda$invokeRemotelyAsync$72(JGroupsTransport.java:599)
>
>         at
>         org.infinispan.remoting.transport.jgroups.JGroupsTransport$$Lambda$106/1829642022.apply(Unknown
>         Source)
>
>         at
>         java.util.concurrent.CompletableFuture$ThenApply.run(Unknown
>         Source)
>
>         at java.util.concurrent.CompletableFuture.postComplete(Unknown
>         Source)
>
>         at java.util.concurrent.CompletableFuture.complete(Unknown Source)
>
>         at
>         org.infinispan.remoting.transport.jgroups.SingleResponseFuture.call(SingleResponseFuture.java:46)
>
>         at
>         org.infinispan.remoting.transport.jgroups.SingleResponseFuture.call(SingleResponseFuture.java:17)
>
>         at java.util.concurrent.FutureTask.run(Unknown Source)
>
>         at
>         java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$201(Unknown
>         Source)
>
>         at
>         java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(Unknown
>         Source)
>
>         at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown
>         Source)
>
>         at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown
>         Source)
>
>         at java.lang.Thread.run(Unknown Source)
>
>
>         2016-07-11 08:35:41,792 ERROR [io.undertow.request] (default
>         task-60) UT005023: Exception handling request to
>         /auth/admin/realms/electricsheep/logout-all:
>         org.jboss.resteasy.spi.UnhandledException:
>         org.infinispan.util.concurrent.TimeoutException: Replication
>         timeout for identityapp06l3
>
>         at
>         org.jboss.resteasy.core.ExceptionHandler.handleApplicationException(ExceptionHandler.java:76)
>
>         at
>         org.jboss.resteasy.core.ExceptionHandler.handleException(ExceptionHandler.java:212)
>
>         at
>         org.jboss.resteasy.core.SynchronousDispatcher.writeException(SynchronousDispatcher.java:168)
>
>         at
>         org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:411)
>
>         at
>         org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:202)
>
>         at
>         org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.service(ServletContainerDispatcher.java:221)
>
>         at
>         org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:56)
>
>         at
>         org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:51)
>
>         at javax.servlet.http.HttpServlet.service(HttpServlet.java:790)
>
>         at
>         io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:85)
>
>         at
>         io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:129)
>
>         at
>         org.keycloak.services.filters.KeycloakSessionServletFilter.doFilter(KeycloakSessionServletFilter.java:107)
>
>         at
>         io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:60)
>
>         at
>         io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
>
>         at
>         io.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.java:84)
>
>         at
>         io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:62)
>
>         at
>         io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36)
>
>         at
>         org.wildfly.extension.undertow.security.SecurityContextAssociationHandler.handleRequest(SecurityContextAssociationHandler.java:78)
>
>         at
>         io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
>
>         at
>         io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:131)
>
>         at
>         io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:57)
>
>         at
>         io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
>
>         at
>         io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:46)
>
>         at
>         io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64)
>
>         at
>         io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:60)
>
>         at
>         io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:77)
>
>         at
>         io.undertow.security.handlers.NotificationReceiverHandler.handleRequest(NotificationReceiverHandler.java:50)
>
>         at
>         io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43)
>
>         at
>         io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
>
>         at
>         org.wildfly.extension.undertow.security.jacc.JACCContextIdHandler.handleRequest(JACCContextIdHandler.java:61)
>
>         at
>         io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
>
>         at
>         io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
>
>         at
>         io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:284)
>
>         at
>         io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:263)
>
>         at
>         io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:81)
>
>         at
>         io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:174)
>
>         at
>         io.undertow.server.Connectors.executeRootHandler(Connectors.java:202)
>
>         at
>         io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:793)
>
>         at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown
>         Source)
>
>         at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown
>         Source)
>
>         at java.lang.Thread.run(Unknown Source)
>
>         Caused by: org.infinispan.util.concurrent.TimeoutException:
>         Replication timeout for identityapp06l3
>
>         at
>         org.infinispan.remoting.transport.jgroups.JGroupsTransport.checkRsp(JGroupsTransport.java:765)
>
>         at
>         org.infinispan.remoting.transport.jgroups.JGroupsTransport.lambda$invokeRemotelyAsync$72(JGroupsTransport.java:599)
>
>         at
>         org.infinispan.remoting.transport.jgroups.JGroupsTransport$$Lambda$106/1829642022.apply(Unknown
>         Source)
>
>         at
>         java.util.concurrent.CompletableFuture$ThenApply.run(Unknown
>         Source)
>
>         at java.util.concurrent.CompletableFuture.postComplete(Unknown
>         Source)
>
>         at java.util.concurrent.CompletableFuture.complete(Unknown Source)
>
>         at
>         org.infinispan.remoting.transport.jgroups.SingleResponseFuture.call(SingleResponseFuture.java:46)
>
>         at
>         org.infinispan.remoting.transport.jgroups.SingleResponseFuture.call(SingleResponseFuture.java:17)
>
>         at java.util.concurrent.FutureTask.run(Unknown Source)
>
>         at
>         java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$201(Unknown
>         Source)
>
>         at
>         java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(Unknown
>         Source)
>
>         ... 3 more
>
>
> -- 
> *Fabricio Milone*
> Developer
> *
> *
> *
> Shine Consulting *
>
> 30/600 Bourke Street
>
> Melbourne VIC 3000
>
> T: 03 8488 9939
>
> M: 04 3200 4006
>
>
> www.shinetech.com <http://www.shinetech.com/>/*a*/ passion for excellence
>
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160711/b7857a25/attachment-0001.html 

From mposolda at redhat.com  Mon Jul 11 02:54:02 2016
From: mposolda at redhat.com (Marek Posolda)
Date: Mon, 11 Jul 2016 08:54:02 +0200
Subject: [keycloak-user] JDBC Connection is closed early for Infinispan
In-Reply-To: <D3A92C8F.B0B5%akaya@expedia.com>
References: <D3A92C8F.B0B5%akaya@expedia.com>
Message-ID: <5783428A.60703@redhat.com>

Not sure if this is Wildfly issue or Keycloak issue. Maybe it can be 
handled somehow in our subsystem, so you will be able to declare that 
infinispan CacheManager (or JGroups Channel) is dependent on datasource 
"java:/MySQLDS" , which should then ensure that infinispan/jgroups will 
be shoutdown first and then the MySQLDS datasource afterwards.

Maybe we can handle our subsystem should be more "flexible" and support 
somehow to easily declare dependencies on additional components (maybe 
it supports it already, I don't know...)

Maybe you can create JIRA and investigate this deeper. I suggest you 
investigate by yourself as we probably won't have time to look at it. 
The JGroups channel with JDBC_PING is probably not very big priority for 
us...

Marek

On 11/07/16 02:59, Sarp Kaya wrote:
> Hello,
>
> For the caching if we are using infinispan with JDBC_PING then JDBC 
> connection is closed before infinispan stops its caching related 
> stuff. This causes an exception to be thrown and therefore it does not 
> really shut infinispan gracefully.
>
> Logs:
> 2016-07-11 00:53:48,330 INFO  [org.jboss.as.server] (Thread-2) 
> WFLYSRV0220: Server shutdown has been requested.
> 2016-07-11 00:53:48,385 INFO 
>  [org.jboss.as.connector.subsystems.datasources] (MSC service thread 
> 1-2) WFLYJCA0010: Unbound data source [java:/MySQLDS]
> 2016-07-11 00:53:48,394 INFO 
>  [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC 
> service thread 1-2) ISPN000080: Disconnecting JGroups channel web
> 2016-07-11 00:53:48,396 INFO 
>  [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC 
> service thread 1-1) ISPN000080: Disconnecting JGroups channel server
> 2016-07-11 00:53:48,395 INFO  [org.wildfly.extension.undertow] 
> (ServerService Thread Pool -- 60) WFLYUT0022: Unregistered web 
> context: /auth
> 2016-07-11 00:53:48,397 INFO 
>  [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC 
> service thread 1-2) ISPN000082: Stopping the RpcDispatcher for channel web
> 2016-07-11 00:53:48,398 INFO 
>  [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC 
> service thread 1-1) ISPN000082: Stopping the RpcDispatcher for channel 
> server
> 2016-07-11 00:53:48,403 INFO 
>  [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC 
> service thread 1-1) ISPN000080: Disconnecting JGroups channel hibernate
> 2016-07-11 00:53:48,408 INFO 
>  [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC 
> service thread 1-1) ISPN000082: Stopping the RpcDispatcher for channel 
> hibernate
> 2016-07-11 00:53:48,407 INFO 
>  [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC 
> service thread 1-2) ISPN000080: Disconnecting JGroups channel ejb
> 2016-07-11 00:53:48,411 INFO 
>  [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC 
> service thread 1-2) ISPN000082: Stopping the RpcDispatcher for channel ejb
> 2016-07-11 00:53:48,414 INFO  [org.wildfly.extension.undertow] (MSC 
> service thread 1-2) WFLYUT0008: Undertow HTTPS listener https suspending
> 2016-07-11 00:53:48,416 WARN 
>  [org.jboss.jca.core.connectionmanager.pool.strategy.OnePool] 
> (ServerService Thread Pool -- 59) IJ000615: Destroying active 
> connection in pool: MySQLDS 
> (org.jboss.jca.adapters.jdbc.local.LocalManagedConnection at 57e067d0)
> 2016-07-11 00:53:48,423 INFO  [org.wildfly.extension.undertow] (MSC 
> service thread 1-2) WFLYUT0007: Undertow HTTPS listener https stopped, 
> was bound to 0.0.0.0:8443
> 2016-07-11 00:53:48,429 INFO  [org.jboss.as.connector.deployers.jdbc] 
> (MSC service thread 1-1) WFLYJCA0019: Stopped Driver service with 
> driver-name = mysql
> 2016-07-11 00:53:48,434 INFO  [org.wildfly.extension.undertow] (MSC 
> service thread 1-1) WFLYUT0019: Host default-host stopping
> 2016-07-11 00:53:48,448 INFO 
>  [org.jboss.as.connector.subsystems.datasources] (MSC service thread 
> 1-1) WFLYJCA0010: Unbound data source [java:jboss/datasources/ExampleDS]
> 2016-07-11 00:53:48,467 INFO  [org.jboss.as.clustering.infinispan] 
> (ServerService Thread Pool -- 59) WFLYCLINF0003: Stopped sessions 
> cache from keycloak container
> 2016-07-11 00:53:48,472 INFO  [org.jboss.as.clustering.infinispan] 
> (ServerService Thread Pool -- 60) WFLYCLINF0003: Stopped realms cache 
> from keycloak container
> 2016-07-11 00:53:48,475 INFO  [org.jboss.as.clustering.infinispan] 
> (ServerService Thread Pool -- 60) WFLYCLINF0003: Stopped loginFailures 
> cache from keycloak container
> 2016-07-11 00:53:48,477 INFO  [org.jboss.as.clustering.infinispan] 
> (ServerService Thread Pool -- 59) WFLYCLINF0003: Stopped 
> offlineSessions cache from keycloak container
> 2016-07-11 00:53:48,487 INFO  [org.jboss.as.connector.deployers.jdbc] 
> (MSC service thread 1-1) WFLYJCA0019: Stopped Driver service with 
> driver-name = h2
> 2016-07-11 00:53:48,489 INFO  [org.jboss.as.clustering.infinispan] 
> (ServerService Thread Pool -- 63) WFLYCLINF0003: Stopped users cache 
> from keycloak container
> 2016-07-11 00:53:48,492 INFO  [org.wildfly.extension.undertow] (MSC 
> service thread 1-2) WFLYUT0008: Undertow AJP listener ajp suspending
> 2016-07-11 00:53:48,496 INFO  [org.jboss.as.clustering.infinispan] 
> (ServerService Thread Pool -- 62) WFLYCLINF0003: Stopped realmVersions 
> cache from keycloak container
> 2016-07-11 00:53:48,497 INFO  [org.wildfly.extension.undertow] (MSC 
> service thread 1-2) WFLYUT0007: Undertow AJP listener ajp stopped, was 
> bound to 0.0.0.0:8009
> 2016-07-11 00:53:48,500 INFO  [org.jboss.as.clustering.infinispan] 
> (ServerService Thread Pool -- 64) WFLYCLINF0003: Stopped work cache 
> from keycloak container
> 2016-07-11 00:53:48,499 INFO  [org.jboss.modcluster] (ServerService 
> Thread Pool -- 65) MODCLUSTER000002: Initiating mod_cluster shutdown
> 2016-07-11 00:53:48,506 INFO  [org.jboss.as.server.deployment] (MSC 
> service thread 1-2) WFLYSRV0028: Stopped deployment 
> keycloak-server.war (runtime-name: keycloak-server.war) in 138ms
> 2016-07-11 00:53:48,499 INFO  [org.wildfly.extension.undertow] (MSC 
> service thread 1-1) WFLYUT0008: Undertow HTTP listener default suspending
> 2016-07-11 00:53:48,508 INFO  [org.wildfly.extension.undertow] (MSC 
> service thread 1-1) WFLYUT0007: Undertow HTTP listener default 
> stopped, was bound to 0.0.0.0:8080
> 2016-07-11 00:53:48,516 INFO  [org.jboss.as.clustering.infinispan] 
> (MSC service thread 1-2) WFLYCLINF0003: Stopped authorization cache 
> from keycloak container
> 2016-07-11 00:53:48,517 INFO  [org.wildfly.extension.undertow] (MSC 
> service thread 1-1) WFLYUT0004: Undertow 1.3.15.Final stopping
> 2016-07-11 00:53:48,542 INFO 
>  [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC 
> service thread 1-2) ISPN000080: Disconnecting JGroups channel keycloak
> 2016-07-11 00:53:48,543 INFO 
>  [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC 
> service thread 1-2) ISPN000082: Stopping the RpcDispatcher for channel 
> keycloak
> 2016-07-11 00:53:48,553 ERROR [org.jgroups.protocols.JDBC_PING] (MSC 
> service thread 1-1) Could not open connection to database: 
> java.sql.SQLException: javax.resource.ResourceException: IJ000470: You 
> are trying to use a connection factory that has been shut down: 
> java:/MySQLDS
>         at 
> org.jboss.jca.adapters.jdbc.WrapperDataSource.getConnection(WrapperDataSource.java:146)
>         at 
> org.jboss.as.connector.subsystems.datasources.WildFlyDataSource.getConnection(WildFlyDataSource.java:66)
>         at 
> org.jgroups.protocols.JDBC_PING.getConnection(JDBC_PING.java:348)
>         at org.jgroups.protocols.JDBC_PING.delete(JDBC_PING.java:379)
>         at org.jgroups.protocols.JDBC_PING.deleteSelf(JDBC_PING.java:395)
>         at org.jgroups.protocols.JDBC_PING.stop(JDBC_PING.java:144)
>         at 
> org.jgroups.stack.ProtocolStack.stopStack(ProtocolStack.java:1015)
>         at org.jgroups.JChannel.stopStack(JChannel.java:1002)
>         at org.jgroups.JChannel.disconnect(JChannel.java:373)
>         at 
> org.wildfly.clustering.jgroups.spi.service.ChannelConnectorBuilder.stop(ChannelConnectorBuilder.java:103)
>         at 
> org.jboss.msc.service.ServiceControllerImpl$StopTask.stopService(ServiceControllerImpl.java:2056)
>         at 
> org.jboss.msc.service.ServiceControllerImpl$StopTask.run(ServiceControllerImpl.java:2017)
>         at 
> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
>         at 
> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
>         at java.lang.Thread.run(Thread.java:745)
> Caused by: javax.resource.ResourceException: IJ000470: You are trying 
> to use a connection factory that has been shut down: java:/MySQLDS
>         at 
> org.jboss.jca.core.connectionmanager.AbstractConnectionManager.allocateConnection(AbstractConnectionManager.java:735)
>         at 
> org.jboss.jca.adapters.jdbc.WrapperDataSource.getConnection(WrapperDataSource.java:138)
>         ... 14 more
>
> 2016-07-11 00:53:48,559 ERROR [org.jgroups.protocols.JDBC_PING] (MSC 
> service thread 1-1) Failed to delete PingData in database
> 2016-07-11 00:53:51,576 INFO  [org.jboss.as] (MSC service thread 1-1) 
> WFLYSRV0050: Keycloak 2.0.0.Final (WildFly Core 2.0.10.Final) stopped 
> in 3208ms
>
>
> Kind Regards,
> Sarp Kaya
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160711/be98b71a/attachment.html 

From mposolda at redhat.com  Mon Jul 11 02:59:00 2016
From: mposolda at redhat.com (Marek Posolda)
Date: Mon, 11 Jul 2016 08:59:00 +0200
Subject: [keycloak-user] Admin user from LDAP server
In-Reply-To: <CAOjtoUNGJUTt=6E0gbpXq+nwnS3gBu0xHk7OB9EnTM_jcctZ8w@mail.gmail.com>
References: <CAOjtoUNGJUTt=6E0gbpXq+nwnS3gBu0xHk7OB9EnTM_jcctZ8w@mail.gmail.com>
Message-ID: <578343B4.7000302@redhat.com>

What you can do is:
- Create the user "temp-admin" and bootstrap Keycloak with him
- Login to admin console as "temp-admin" and create LDAP federation 
provider in master realm with syncRegistrations=true
- Create new user "real-admin" and set the password for him. This one 
will be stored in LDAP now
- Logout as "temp-admin" and login to admin console as "real-admin"
- Delete "temp-admin" .

The user "real-admin" is now stored in LDAP with his credentials and 
there is no admin user with credentials in Keycloak DB.

Is it sufficient for your use-case?

Marek

On 11/07/16 06:41, Fabricio Milone wrote:
>
> Hi,
>
> We would like to be able to create the admin user using LDAP, so the 
> credentials are not stored in Keycloak's database at all.
>
> I think there is no way to achieve this at the moment, would you think 
> this is possible?
>
> I'd like to create a feature request if you don't mind.
>
> Regards
> -- 
> *Fabricio Milone*
> Developer
> *
> *
> *
> Shine Consulting *
>
> 30/600 Bourke Street
>
> Melbourne VIC 3000
>
> T: 03 8488 9939
>
> M: 04 3200 4006
>
>
> www.shinetech.com <http://www.shinetech.com/>/*a*/ passion for excellence
>
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160711/e7fc5c29/attachment-0001.html 

From akaya at expedia.com  Mon Jul 11 03:11:15 2016
From: akaya at expedia.com (Sarp Kaya)
Date: Mon, 11 Jul 2016 07:11:15 +0000
Subject: [keycloak-user] JDBC Connection is closed early for Infinispan
In-Reply-To: <5783428A.60703@redhat.com>
References: <D3A92C8F.B0B5%akaya@expedia.com> <5783428A.60703@redhat.com>
Message-ID: <D3A9833E.B111%akaya@expedia.com>

Hi Marek,

The configuration for JDBC_PING is already like this:


<protocol type="JDBC_PING">
    <property name="datasource_jndi_name">java:/MySQLDS</property>
    <property name="clear_table_on_view_change">true</property>
</protocol>

Do you mean something else or is this enough to ?declare dependency? on MySQLDS?

Kind Regards,
Sarp Kaya

From: Marek Posolda <mposolda at redhat.com<mailto:mposolda at redhat.com>>
Date: Monday, July 11, 2016 at 4:54 PM
To: Abdullah Sarp Kaya <akaya at expedia.com<mailto:akaya at expedia.com>>, "keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>" <keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>>
Subject: Re: [keycloak-user] JDBC Connection is closed early for Infinispan

Not sure if this is Wildfly issue or Keycloak issue. Maybe it can be handled somehow in our subsystem, so you will be able to declare that infinispan CacheManager (or JGroups Channel) is dependent on datasource "java:/MySQLDS" , which should then ensure that infinispan/jgroups will be shoutdown first and then the MySQLDS datasource afterwards.

Maybe we can handle our subsystem should be more "flexible" and support somehow to easily declare dependencies on additional components (maybe it supports it already, I don't know...)

Maybe you can create JIRA and investigate this deeper. I suggest you investigate by yourself as we probably won't have time to look at it. The JGroups channel with JDBC_PING is probably not very big priority for us...

Marek

On 11/07/16 02:59, Sarp Kaya wrote:
Hello,

For the caching if we are using infinispan with JDBC_PING then JDBC connection is closed before infinispan stops its caching related stuff. This causes an exception to be thrown and therefore it does not really shut infinispan gracefully.

Logs:
2016-07-11 00:53:48,330 INFO  [org.jboss.as.server] (Thread-2) WFLYSRV0220: Server shutdown has been requested.
2016-07-11 00:53:48,385 INFO  [org.jboss.as.connector.subsystems.datasources] (MSC service thread 1-2) WFLYJCA0010: Unbound data source [java:/MySQLDS]
2016-07-11 00:53:48,394 INFO  [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service thread 1-2) ISPN000080: Disconnecting JGroups channel web
2016-07-11 00:53:48,396 INFO  [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service thread 1-1) ISPN000080: Disconnecting JGroups channel server
2016-07-11 00:53:48,395 INFO  [org.wildfly.extension.undertow] (ServerService Thread Pool -- 60) WFLYUT0022: Unregistered web context: /auth
2016-07-11 00:53:48,397 INFO  [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service thread 1-2) ISPN000082: Stopping the RpcDispatcher for channel web
2016-07-11 00:53:48,398 INFO  [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service thread 1-1) ISPN000082: Stopping the RpcDispatcher for channel server
2016-07-11 00:53:48,403 INFO  [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service thread 1-1) ISPN000080: Disconnecting JGroups channel hibernate
2016-07-11 00:53:48,408 INFO  [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service thread 1-1) ISPN000082: Stopping the RpcDispatcher for channel hibernate
2016-07-11 00:53:48,407 INFO  [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service thread 1-2) ISPN000080: Disconnecting JGroups channel ejb
2016-07-11 00:53:48,411 INFO  [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service thread 1-2) ISPN000082: Stopping the RpcDispatcher for channel ejb
2016-07-11 00:53:48,414 INFO  [org.wildfly.extension.undertow] (MSC service thread 1-2) WFLYUT0008: Undertow HTTPS listener https suspending
2016-07-11 00:53:48,416 WARN  [org.jboss.jca.core.connectionmanager.pool.strategy.OnePool] (ServerService Thread Pool -- 59) IJ000615: Destroying active connection in pool: MySQLDS (org.jboss.jca.adapters.jdbc.local.LocalManagedConnection at 57e067d0)
2016-07-11 00:53:48,423 INFO  [org.wildfly.extension.undertow] (MSC service thread 1-2) WFLYUT0007: Undertow HTTPS listener https stopped, was bound to 0.0.0.0:8443
2016-07-11 00:53:48,429 INFO  [org.jboss.as.connector.deployers.jdbc] (MSC service thread 1-1) WFLYJCA0019: Stopped Driver service with driver-name = mysql
2016-07-11 00:53:48,434 INFO  [org.wildfly.extension.undertow] (MSC service thread 1-1) WFLYUT0019: Host default-host stopping
2016-07-11 00:53:48,448 INFO  [org.jboss.as.connector.subsystems.datasources] (MSC service thread 1-1) WFLYJCA0010: Unbound data source [java:jboss/datasources/ExampleDS]
2016-07-11 00:53:48,467 INFO  [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 59) WFLYCLINF0003: Stopped sessions cache from keycloak container
2016-07-11 00:53:48,472 INFO  [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 60) WFLYCLINF0003: Stopped realms cache from keycloak container
2016-07-11 00:53:48,475 INFO  [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 60) WFLYCLINF0003: Stopped loginFailures cache from keycloak container
2016-07-11 00:53:48,477 INFO  [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 59) WFLYCLINF0003: Stopped offlineSessions cache from keycloak container
2016-07-11 00:53:48,487 INFO  [org.jboss.as.connector.deployers.jdbc] (MSC service thread 1-1) WFLYJCA0019: Stopped Driver service with driver-name = h2
2016-07-11 00:53:48,489 INFO  [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 63) WFLYCLINF0003: Stopped users cache from keycloak container
2016-07-11 00:53:48,492 INFO  [org.wildfly.extension.undertow] (MSC service thread 1-2) WFLYUT0008: Undertow AJP listener ajp suspending
2016-07-11 00:53:48,496 INFO  [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 62) WFLYCLINF0003: Stopped realmVersions cache from keycloak container
2016-07-11 00:53:48,497 INFO  [org.wildfly.extension.undertow] (MSC service thread 1-2) WFLYUT0007: Undertow AJP listener ajp stopped, was bound to 0.0.0.0:8009
2016-07-11 00:53:48,500 INFO  [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 64) WFLYCLINF0003: Stopped work cache from keycloak container
2016-07-11 00:53:48,499 INFO  [org.jboss.modcluster] (ServerService Thread Pool -- 65) MODCLUSTER000002: Initiating mod_cluster shutdown
2016-07-11 00:53:48,506 INFO  [org.jboss.as.server.deployment] (MSC service thread 1-2) WFLYSRV0028: Stopped deployment keycloak-server.war (runtime-name: keycloak-server.war) in 138ms
2016-07-11 00:53:48,499 INFO  [org.wildfly.extension.undertow] (MSC service thread 1-1) WFLYUT0008: Undertow HTTP listener default suspending
2016-07-11 00:53:48,508 INFO  [org.wildfly.extension.undertow] (MSC service thread 1-1) WFLYUT0007: Undertow HTTP listener default stopped, was bound to 0.0.0.0:8080
2016-07-11 00:53:48,516 INFO  [org.jboss.as.clustering.infinispan] (MSC service thread 1-2) WFLYCLINF0003: Stopped authorization cache from keycloak container
2016-07-11 00:53:48,517 INFO  [org.wildfly.extension.undertow] (MSC service thread 1-1) WFLYUT0004: Undertow 1.3.15.Final stopping
2016-07-11 00:53:48,542 INFO  [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service thread 1-2) ISPN000080: Disconnecting JGroups channel keycloak
2016-07-11 00:53:48,543 INFO  [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service thread 1-2) ISPN000082: Stopping the RpcDispatcher for channel keycloak
2016-07-11 00:53:48,553 ERROR [org.jgroups.protocols.JDBC_PING] (MSC service thread 1-1) Could not open connection to database: java.sql.SQLException: javax.resource.ResourceException: IJ000470: You are trying to use a connection factory that has been shut down: java:/MySQLDS
        at org.jboss.jca.adapters.jdbc.WrapperDataSource.getConnection(WrapperDataSource.java:146)
        at org.jboss.as.connector.subsystems.datasources.WildFlyDataSource.getConnection(WildFlyDataSource.java:66)
        at org.jgroups.protocols.JDBC_PING.getConnection(JDBC_PING.java:348)
        at org.jgroups.protocols.JDBC_PING.delete(JDBC_PING.java:379)
        at org.jgroups.protocols.JDBC_PING.deleteSelf(JDBC_PING.java:395)
        at org.jgroups.protocols.JDBC_PING.stop(JDBC_PING.java:144)
        at org.jgroups.stack.ProtocolStack.stopStack(ProtocolStack.java:1015)
        at org.jgroups.JChannel.stopStack(JChannel.java:1002)
        at org.jgroups.JChannel.disconnect(JChannel.java:373)
        at org.wildfly.clustering.jgroups.spi.service.ChannelConnectorBuilder.stop(ChannelConnectorBuilder.java:103)
        at org.jboss.msc.service.ServiceControllerImpl$StopTask.stopService(ServiceControllerImpl.java:2056)
        at org.jboss.msc.service.ServiceControllerImpl$StopTask.run(ServiceControllerImpl.java:2017)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
        at java.lang.Thread.run(Thread.java:745)
Caused by: javax.resource.ResourceException: IJ000470: You are trying to use a connection factory that has been shut down: java:/MySQLDS
        at org.jboss.jca.core.connectionmanager.AbstractConnectionManager.allocateConnection(AbstractConnectionManager.java:735)
        at org.jboss.jca.adapters.jdbc.WrapperDataSource.getConnection(WrapperDataSource.java:138)
        ... 14 more

2016-07-11 00:53:48,559 ERROR [org.jgroups.protocols.JDBC_PING] (MSC service thread 1-1) Failed to delete PingData in database
2016-07-11 00:53:51,576 INFO  [org.jboss.as] (MSC service thread 1-1) WFLYSRV0050: Keycloak 2.0.0.Final (WildFly Core 2.0.10.Final) stopped in 3208ms


Kind Regards,
Sarp Kaya



_______________________________________________
keycloak-user mailing list
keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>https://lists.jboss.org/mailman/listinfo/keycloak-user

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160711/07e034fb/attachment.html 

From mposolda at redhat.com  Mon Jul 11 03:40:18 2016
From: mposolda at redhat.com (Marek Posolda)
Date: Mon, 11 Jul 2016 09:40:18 +0200
Subject: [keycloak-user] JDBC Connection is closed early for Infinispan
In-Reply-To: <D3A9833E.B111%akaya@expedia.com>
References: <D3A92C8F.B0B5%akaya@expedia.com> <5783428A.60703@redhat.com>
	<D3A9833E.B111%akaya@expedia.com>
Message-ID: <57834D62.1020300@redhat.com>


Hmm... then maybe it's the Wildfly issue in Jgroups subsystem.

The startup lifecycle usually works in a way, that if componentA is 
dependent on componentB, then startup should first ensure that 
componentB is started and then componentA is started afterwards. The 
shutdown works in an opposite way, hence componentA must be first 
shutdown and then componentB afterwards.

I suppose that JGroups subsystem should be clever enough that if it sees 
the property "datasource_jndi_name", it should internally declare itself 
to be dependent on "java:/MySQLDS" datasource. This should ensure that 
during shutdown is JGroups channel shutdown first and then the 
datasource is shutdown afterwards.

Could you ask on Wildfly forums for this?

Marek


On 11/07/16 09:11, Sarp Kaya wrote:
> Hi Marek,
>
> The configuration for JDBC_PING is already like this:
>
> <protocol type="JDBC_PING"> <property name="datasource_jndi_name">java:/MySQLDS</property> <property name="clear_table_on_view_change">true</property> </protocol>
>
> Do you mean something else or is this enough to ?declare dependency? 
> on MySQLDS?
>
> Kind Regards,
> Sarp Kaya
>
> From: Marek Posolda <mposolda at redhat.com <mailto:mposolda at redhat.com>>
> Date: Monday, July 11, 2016 at 4:54 PM
> To: Abdullah Sarp Kaya <akaya at expedia.com <mailto:akaya at expedia.com>>, 
> "keycloak-user at lists.jboss.org <mailto:keycloak-user at lists.jboss.org>" 
> <keycloak-user at lists.jboss.org <mailto:keycloak-user at lists.jboss.org>>
> Subject: Re: [keycloak-user] JDBC Connection is closed early for 
> Infinispan
>
> Not sure if this is Wildfly issue or Keycloak issue. Maybe it can be 
> handled somehow in our subsystem, so you will be able to declare that 
> infinispan CacheManager (or JGroups Channel) is dependent on 
> datasource "java:/MySQLDS" , which should then ensure that 
> infinispan/jgroups will be shoutdown first and then the MySQLDS 
> datasource afterwards.
>
> Maybe we can handle our subsystem should be more "flexible" and 
> support somehow to easily declare dependencies on additional 
> components (maybe it supports it already, I don't know...)
>
> Maybe you can create JIRA and investigate this deeper. I suggest you 
> investigate by yourself as we probably won't have time to look at it. 
> The JGroups channel with JDBC_PING is probably not very big priority 
> for us...
>
> Marek
>
> On 11/07/16 02:59, Sarp Kaya wrote:
>> Hello,
>>
>> For the caching if we are using infinispan with JDBC_PING then JDBC 
>> connection is closed before infinispan stops its caching related 
>> stuff. This causes an exception to be thrown and therefore it does 
>> not really shut infinispan gracefully.
>>
>> Logs:
>> 2016-07-11 00:53:48,330 INFO  [org.jboss.as.server] (Thread-2) 
>> WFLYSRV0220: Server shutdown has been requested.
>> 2016-07-11 00:53:48,385 INFO 
>>  [org.jboss.as.connector.subsystems.datasources] (MSC service thread 
>> 1-2) WFLYJCA0010: Unbound data source [java:/MySQLDS]
>> 2016-07-11 00:53:48,394 INFO 
>>  [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC 
>> service thread 1-2) ISPN000080: Disconnecting JGroups channel web
>> 2016-07-11 00:53:48,396 INFO 
>>  [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC 
>> service thread 1-1) ISPN000080: Disconnecting JGroups channel server
>> 2016-07-11 00:53:48,395 INFO  [org.wildfly.extension.undertow] 
>> (ServerService Thread Pool -- 60) WFLYUT0022: Unregistered web 
>> context: /auth
>> 2016-07-11 00:53:48,397 INFO 
>>  [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC 
>> service thread 1-2) ISPN000082: Stopping the RpcDispatcher for 
>> channel web
>> 2016-07-11 00:53:48,398 INFO 
>>  [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC 
>> service thread 1-1) ISPN000082: Stopping the RpcDispatcher for 
>> channel server
>> 2016-07-11 00:53:48,403 INFO 
>>  [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC 
>> service thread 1-1) ISPN000080: Disconnecting JGroups channel hibernate
>> 2016-07-11 00:53:48,408 INFO 
>>  [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC 
>> service thread 1-1) ISPN000082: Stopping the RpcDispatcher for 
>> channel hibernate
>> 2016-07-11 00:53:48,407 INFO 
>>  [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC 
>> service thread 1-2) ISPN000080: Disconnecting JGroups channel ejb
>> 2016-07-11 00:53:48,411 INFO 
>>  [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC 
>> service thread 1-2) ISPN000082: Stopping the RpcDispatcher for 
>> channel ejb
>> 2016-07-11 00:53:48,414 INFO  [org.wildfly.extension.undertow] (MSC 
>> service thread 1-2) WFLYUT0008: Undertow HTTPS listener https suspending
>> 2016-07-11 00:53:48,416 WARN 
>>  [org.jboss.jca.core.connectionmanager.pool.strategy.OnePool] 
>> (ServerService Thread Pool -- 59) IJ000615: Destroying active 
>> connection in pool: MySQLDS 
>> (org.jboss.jca.adapters.jdbc.local.LocalManagedConnection at 57e067d0)
>> 2016-07-11 00:53:48,423 INFO  [org.wildfly.extension.undertow] (MSC 
>> service thread 1-2) WFLYUT0007: Undertow HTTPS listener https 
>> stopped, was bound to 0.0.0.0:8443
>> 2016-07-11 00:53:48,429 INFO  [org.jboss.as.connector.deployers.jdbc] 
>> (MSC service thread 1-1) WFLYJCA0019: Stopped Driver service with 
>> driver-name = mysql
>> 2016-07-11 00:53:48,434 INFO  [org.wildfly.extension.undertow] (MSC 
>> service thread 1-1) WFLYUT0019: Host default-host stopping
>> 2016-07-11 00:53:48,448 INFO 
>>  [org.jboss.as.connector.subsystems.datasources] (MSC service thread 
>> 1-1) WFLYJCA0010: Unbound data source [java:jboss/datasources/ExampleDS]
>> 2016-07-11 00:53:48,467 INFO  [org.jboss.as.clustering.infinispan] 
>> (ServerService Thread Pool -- 59) WFLYCLINF0003: Stopped sessions 
>> cache from keycloak container
>> 2016-07-11 00:53:48,472 INFO  [org.jboss.as.clustering.infinispan] 
>> (ServerService Thread Pool -- 60) WFLYCLINF0003: Stopped realms cache 
>> from keycloak container
>> 2016-07-11 00:53:48,475 INFO  [org.jboss.as.clustering.infinispan] 
>> (ServerService Thread Pool -- 60) WFLYCLINF0003: Stopped 
>> loginFailures cache from keycloak container
>> 2016-07-11 00:53:48,477 INFO  [org.jboss.as.clustering.infinispan] 
>> (ServerService Thread Pool -- 59) WFLYCLINF0003: Stopped 
>> offlineSessions cache from keycloak container
>> 2016-07-11 00:53:48,487 INFO  [org.jboss.as.connector.deployers.jdbc] 
>> (MSC service thread 1-1) WFLYJCA0019: Stopped Driver service with 
>> driver-name = h2
>> 2016-07-11 00:53:48,489 INFO  [org.jboss.as.clustering.infinispan] 
>> (ServerService Thread Pool -- 63) WFLYCLINF0003: Stopped users cache 
>> from keycloak container
>> 2016-07-11 00:53:48,492 INFO  [org.wildfly.extension.undertow] (MSC 
>> service thread 1-2) WFLYUT0008: Undertow AJP listener ajp suspending
>> 2016-07-11 00:53:48,496 INFO  [org.jboss.as.clustering.infinispan] 
>> (ServerService Thread Pool -- 62) WFLYCLINF0003: Stopped 
>> realmVersions cache from keycloak container
>> 2016-07-11 00:53:48,497 INFO  [org.wildfly.extension.undertow] (MSC 
>> service thread 1-2) WFLYUT0007: Undertow AJP listener ajp stopped, 
>> was bound to 0.0.0.0:8009
>> 2016-07-11 00:53:48,500 INFO  [org.jboss.as.clustering.infinispan] 
>> (ServerService Thread Pool -- 64) WFLYCLINF0003: Stopped work cache 
>> from keycloak container
>> 2016-07-11 00:53:48,499 INFO  [org.jboss.modcluster] (ServerService 
>> Thread Pool -- 65) MODCLUSTER000002: Initiating mod_cluster shutdown
>> 2016-07-11 00:53:48,506 INFO  [org.jboss.as.server.deployment] (MSC 
>> service thread 1-2) WFLYSRV0028: Stopped deployment 
>> keycloak-server.war (runtime-name: keycloak-server.war) in 138ms
>> 2016-07-11 00:53:48,499 INFO  [org.wildfly.extension.undertow] (MSC 
>> service thread 1-1) WFLYUT0008: Undertow HTTP listener default suspending
>> 2016-07-11 00:53:48,508 INFO  [org.wildfly.extension.undertow] (MSC 
>> service thread 1-1) WFLYUT0007: Undertow HTTP listener default 
>> stopped, was bound to 0.0.0.0:8080
>> 2016-07-11 00:53:48,516 INFO  [org.jboss.as.clustering.infinispan] 
>> (MSC service thread 1-2) WFLYCLINF0003: Stopped authorization cache 
>> from keycloak container
>> 2016-07-11 00:53:48,517 INFO  [org.wildfly.extension.undertow] (MSC 
>> service thread 1-1) WFLYUT0004: Undertow 1.3.15.Final stopping
>> 2016-07-11 00:53:48,542 INFO 
>>  [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC 
>> service thread 1-2) ISPN000080: Disconnecting JGroups channel keycloak
>> 2016-07-11 00:53:48,543 INFO 
>>  [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC 
>> service thread 1-2) ISPN000082: Stopping the RpcDispatcher for 
>> channel keycloak
>> 2016-07-11 00:53:48,553 ERROR [org.jgroups.protocols.JDBC_PING] (MSC 
>> service thread 1-1) Could not open connection to database: 
>> java.sql.SQLException: javax.resource.ResourceException: IJ000470: 
>> You are trying to use a connection factory that has been shut down: 
>> java:/MySQLDS
>>         at 
>> org.jboss.jca.adapters.jdbc.WrapperDataSource.getConnection(WrapperDataSource.java:146)
>>         at 
>> org.jboss.as.connector.subsystems.datasources.WildFlyDataSource.getConnection(WildFlyDataSource.java:66)
>>         at 
>> org.jgroups.protocols.JDBC_PING.getConnection(JDBC_PING.java:348)
>>         at org.jgroups.protocols.JDBC_PING.delete(JDBC_PING.java:379)
>>         at org.jgroups.protocols.JDBC_PING.deleteSelf(JDBC_PING.java:395)
>>         at org.jgroups.protocols.JDBC_PING.stop(JDBC_PING.java:144)
>>         at 
>> org.jgroups.stack.ProtocolStack.stopStack(ProtocolStack.java:1015)
>>         at org.jgroups.JChannel.stopStack(JChannel.java:1002)
>>         at org.jgroups.JChannel.disconnect(JChannel.java:373)
>>         at 
>> org.wildfly.clustering.jgroups.spi.service.ChannelConnectorBuilder.stop(ChannelConnectorBuilder.java:103)
>>         at 
>> org.jboss.msc.service.ServiceControllerImpl$StopTask.stopService(ServiceControllerImpl.java:2056)
>>         at 
>> org.jboss.msc.service.ServiceControllerImpl$StopTask.run(ServiceControllerImpl.java:2017)
>>         at 
>> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
>>         at 
>> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
>>         at java.lang.Thread.run(Thread.java:745)
>> Caused by: javax.resource.ResourceException: IJ000470: You are trying 
>> to use a connection factory that has been shut down: java:/MySQLDS
>>         at 
>> org.jboss.jca.core.connectionmanager.AbstractConnectionManager.allocateConnection(AbstractConnectionManager.java:735)
>>         at 
>> org.jboss.jca.adapters.jdbc.WrapperDataSource.getConnection(WrapperDataSource.java:138)
>>         ... 14 more
>>
>> 2016-07-11 00:53:48,559 ERROR [org.jgroups.protocols.JDBC_PING] (MSC 
>> service thread 1-1) Failed to delete PingData in database
>> 2016-07-11 00:53:51,576 INFO  [org.jboss.as] (MSC service thread 1-1) 
>> WFLYSRV0050: Keycloak 2.0.0.Final (WildFly Core 2.0.10.Final) stopped 
>> in 3208ms
>>
>>
>> Kind Regards,
>> Sarp Kaya
>>
>>
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.orghttps://lists.jboss.org/mailman/listinfo/keycloak-user
>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160711/54446f4f/attachment-0001.html 

From valerij.timofeev at gmail.com  Mon Jul 11 05:08:20 2016
From: valerij.timofeev at gmail.com (Valerij Timofeev)
Date: Mon, 11 Jul 2016 11:08:20 +0200
Subject: [keycloak-user] KEYCLOAK-3202 Creating users causes memory leak
In-Reply-To: <CAJgngAdQQ01OfgcHHw9Ati2-SDYU6WZbq0M1zN=hQBXWg-4qJQ@mail.gmail.com>
References: <CAOy2obEVCKZhK6tLLhs8RQRs4ScUCgKfWTPjhn0N9Nmy2+yQpA@mail.gmail.com>
	<CAJgngAdQQ01OfgcHHw9Ati2-SDYU6WZbq0M1zN=hQBXWg-4qJQ@mail.gmail.com>
Message-ID: <CAOy2obE_nBrnSA1DeCsnZenRAOgM+pJ8VR_xU12kuUK51OxAVg@mail.gmail.com>

Thank you for the prompt response Stian.

> adding an eviction policy to the realmVersions cache.

This was my impression after reading the ticket too, but I was not sure,
because according pull request looks a little bit more complicated.
We will give a try to this Keycloak setting in the production environment
tomorrow.
We are going to enable Infinispan statistics additionally to get more
information.

> Is there any errors in the logs?

We could identify only errors duiring the service logout until now:

Stack Trace:

org.keycloak.adapters.ServerRequest.error(ServerRequest.java:228)

org.keycloak.adapters.ServerRequest.invokeLogout(ServerRequest.java:82)

com.nhp.ts.b2b.services.auth.KcAdminServiceBean.serviceAccountLogout(KcAdminServiceBean.java:330)

com.nhp.ts.b2b.services.auth.KcAdminServiceBean.executeAPIpostMethod(KcAdminServiceBean.java:545)

sun.reflect.GeneratedMethodAccessor10512.invoke(Unknown Source)

...

> What is the status code returned with the empty page?

Our web application unfortunately does not log status code and error
message. Exception message is null in case of service account logout. We
will roll out a fix for this with the next web application release on
Thursday this week.

Additionally we are going to switch from the OIDC logout endpint method to
the ServletRequest.logout() method because it seems to be a more consistent
way for a web application which is already protected by Keycloak EAP 6
adapters, isn't it?

Additional details about the experienced behaviour: the empty page is our
web application internal page. In Google Chrome webbrowser I see for
example that the initiator of the last POST request to this internal page
was www.googletagmanager.com/gtm.js?id=... Could be this a problem?
If I refresh this empty page, I'm back in the web application (still logged
in).
But if I call OCID logout endpoint
(/realms/${realm}/protocol/openid-connect/logout) in the same browser
myself  and then refresh the empty page, then I'm redirected to the KC
login screen.

Any ideas?

Apart from that I hope that we will get more information after the release
on Thursday.


2016-07-11 7:37 GMT+02:00 Stian Thorgersen <sthorger at redhat.com>:

> Hi,
>
> You can relatively easily try though by adding an eviction policy to the
> realmVersions cache. I found that with roughly a million users there would
> be around 500Mb of memory consumed, which will run you into issues with the
> default settings if you have that many users login over a space of a day
> and a half.
>
> Empty page could be due to timeout. Is there any errors in the logs? What
> is the status code returned with the empty page?
>
> On 8 July 2016 at 10:40, Valerij Timofeev <valerij.timofeev at gmail.com>
> wrote:
>
>> Hi Stian,
>>
>> You are the assignee in KEYCLOAK-3202
>> <https://issues.jboss.org/browse/KEYCLOAK-3202>, so I addressed this
>> email to you directly.
>>
>> I guess that this issue could be the cause of trouble in our production
>> environment.
>>
>> There are 4 EAP-6 nodes with Keycloak adapters and 2 Keycloak 1.9.4
>> standalone servers running in 2 clusters respectively.
>>
>> We experience logout failures approximately after one and a half days of
>> operation.
>> Restarting EAP 6 nodes temporary resolves the logout problem.
>>
>> Durable load tests in out test environment showed that login and logout
>> of existing users don't result in above behaviour.
>> We added to the durable load test additional scenario creating new users
>> and were able to reproduce logout failure: users are getting empty page and
>> not the login screen as expected. Page reload navigates back into the
>> protected web application .
>>
>> Logout is accomplished in a Java web applictaion by calling OIDC logout
>> endpoint:
>>
>>
>>
>>
>>
>> *FacesContext                .getCurrentInstance()
>> .getExternalContext()
>> .redirect(keycloakDeployment.getLogoutUrl().queryParam("redirect_uri",
>> redirectURL).toTemplate());*
>>
>> Logout is initiated via h:commandLink, so I suppose that the OIDC logout
>> endpoint is called via the GET method. Should we use the POST method
>> instead?
>>
>> Has servlet logout any advantages?
>>
>>
>>
>> *((HttpServletRequest)
>> FacesContext.getCurrentInstance().getExternalContext().getRequest()).logout();*
>> I'd appreciate quick response*, *because restarting production EAP
>> cluster every day is not a pleasant option ;-)
>>
>> Thank you in advance
>>
>> Kind regards
>> Valerij Timofeev
>>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160711/066bef48/attachment.html 

From sthorger at redhat.com  Mon Jul 11 06:08:39 2016
From: sthorger at redhat.com (Stian Thorgersen)
Date: Mon, 11 Jul 2016 12:08:39 +0200
Subject: [keycloak-user] KEYCLOAK-3202 Creating users causes memory leak
In-Reply-To: <CAOy2obE_nBrnSA1DeCsnZenRAOgM+pJ8VR_xU12kuUK51OxAVg@mail.gmail.com>
References: <CAOy2obEVCKZhK6tLLhs8RQRs4ScUCgKfWTPjhn0N9Nmy2+yQpA@mail.gmail.com>
	<CAJgngAdQQ01OfgcHHw9Ati2-SDYU6WZbq0M1zN=hQBXWg-4qJQ@mail.gmail.com>
	<CAOy2obE_nBrnSA1DeCsnZenRAOgM+pJ8VR_xU12kuUK51OxAVg@mail.gmail.com>
Message-ID: <CAJgngAc11BoOFi17SjV9iripau9DDNMF3HktrLNrhqFDqDvoTg@mail.gmail.com>

On 11 July 2016 at 11:08, Valerij Timofeev <valerij.timofeev at gmail.com>
wrote:

> Thank you for the prompt response Stian.
>
> > adding an eviction policy to the realmVersions cache.
>
> This was my impression after reading the ticket too, but I was not sure,
> because according pull request looks a little bit more complicated.
> We will give a try to this Keycloak setting in the production environment
> tomorrow.
> We are going to enable Infinispan statistics additionally to get more
> information.
>

There's a bit more to it as we're now adding the caches internally +
managing the size of them. This to hide it from users as they shouldn't
really be configurable.


>
> > Is there any errors in the logs?
>
> We could identify only errors duiring the service logout until now:
>
> Stack Trace:
>
> org.keycloak.adapters.ServerRequest.error(ServerRequest.java:228)
>
> org.keycloak.adapters.ServerRequest.invokeLogout(ServerRequest.java:82)
>
> com.nhp.ts.b2b.services.auth.KcAdminServiceBean.serviceAccountLogout(KcAdminServiceBean.java:330)
>
> com.nhp.ts.b2b.services.auth.KcAdminServiceBean.executeAPIpostMethod(KcAdminServiceBean.java:545)
>
> sun.reflect.GeneratedMethodAccessor10512.invoke(Unknown Source)
>
> ...
>
> > What is the status code returned with the empty page?
>
> Our web application unfortunately does not log status code and error
> message. Exception message is null in case of service account logout. We
> will roll out a fix for this with the next web application release on
> Thursday this week.
>
> Additionally we are going to switch from the OIDC logout endpint method to
> the ServletRequest.logout() method because it seems to be a more consistent
> way for a web application which is already protected by Keycloak EAP 6
> adapters, isn't it?
>

Are you redirecting the user to the logout endpoint or just calling it?

ServletRequest.logout()  redirects to the logout endpoint which will
invalidate the SSO session, then it redirects back to the application and
the http session is removed. It's certainly simpler to use this directly as
it takes care of everything.


>
> Additional details about the experienced behaviour: the empty page is our
> web application internal page. In Google Chrome webbrowser I see for
> example that the initiator of the last POST request to this internal page
> was www.googletagmanager.com/gtm.js?id=... Could be this a problem?
> If I refresh this empty page, I'm back in the web application (still
> logged in).
> But if I call OCID logout endpoint
> (/realms/${realm}/protocol/openid-connect/logout) in the same browser
> myself  and then refresh the empty page, then I'm redirected to the KC
> login screen.
>
> Any ideas?
>

It could also be that the session is no longer valid when you are invoking
the logout. Sessions expires on the Keycloak server and are removed when
they are expired so could be that the session you are trying to logout no
longer exist on the server and that causes the bad behavior. You can try to
emulate that in the test environment by changing the max life for a session
in the admin console.


>
> Apart from that I hope that we will get more information after the release
> on Thursday.
>
>
> 2016-07-11 7:37 GMT+02:00 Stian Thorgersen <sthorger at redhat.com>:
>
>> Hi,
>>
>> You can relatively easily try though by adding an eviction policy to the
>> realmVersions cache. I found that with roughly a million users there would
>> be around 500Mb of memory consumed, which will run you into issues with the
>> default settings if you have that many users login over a space of a day
>> and a half.
>>
>> Empty page could be due to timeout. Is there any errors in the logs? What
>> is the status code returned with the empty page?
>>
>> On 8 July 2016 at 10:40, Valerij Timofeev <valerij.timofeev at gmail.com>
>> wrote:
>>
>>> Hi Stian,
>>>
>>> You are the assignee in KEYCLOAK-3202
>>> <https://issues.jboss.org/browse/KEYCLOAK-3202>, so I addressed this
>>> email to you directly.
>>>
>>> I guess that this issue could be the cause of trouble in our production
>>> environment.
>>>
>>> There are 4 EAP-6 nodes with Keycloak adapters and 2 Keycloak 1.9.4
>>> standalone servers running in 2 clusters respectively.
>>>
>>> We experience logout failures approximately after one and a half days of
>>> operation.
>>> Restarting EAP 6 nodes temporary resolves the logout problem.
>>>
>>> Durable load tests in out test environment showed that login and logout
>>> of existing users don't result in above behaviour.
>>> We added to the durable load test additional scenario creating new users
>>> and were able to reproduce logout failure: users are getting empty page and
>>> not the login screen as expected. Page reload navigates back into the
>>> protected web application .
>>>
>>> Logout is accomplished in a Java web applictaion by calling OIDC logout
>>> endpoint:
>>>
>>>
>>>
>>>
>>>
>>> *FacesContext                .getCurrentInstance()
>>> .getExternalContext()
>>> .redirect(keycloakDeployment.getLogoutUrl().queryParam("redirect_uri",
>>> redirectURL).toTemplate());*
>>>
>>> Logout is initiated via h:commandLink, so I suppose that the OIDC logout
>>> endpoint is called via the GET method. Should we use the POST method
>>> instead?
>>>
>>> Has servlet logout any advantages?
>>>
>>>
>>>
>>> *((HttpServletRequest)
>>> FacesContext.getCurrentInstance().getExternalContext().getRequest()).logout();*
>>> I'd appreciate quick response*, *because restarting production EAP
>>> cluster every day is not a pleasant option ;-)
>>>
>>> Thank you in advance
>>>
>>> Kind regards
>>> Valerij Timofeev
>>>
>>
>>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160711/f3f97d89/attachment-0001.html 

From h.p.przybysz at gmail.com  Mon Jul 11 07:22:38 2016
From: h.p.przybysz at gmail.com (Hubert Przybysz)
Date: Mon, 11 Jul 2016 13:22:38 +0200
Subject: [keycloak-user] Support for CORS Access-Control-Expose-Headers
	in 2.0.0.Final
In-Reply-To: <20160709053836.GA23953@abstractj.org>
References: <CAJMEJTW7aZZeHRDinB66PDTfMaZ3aHLs8VNrx=xTNPJ+qqCORg@mail.gmail.com>
	<20160709053836.GA23953@abstractj.org>
Message-ID: <CAJMEJTU0OzN_2axzBypNeL268iyZBk4ca6i6nTdyLkv8t+nhQg@mail.gmail.com>

Thanks for the info.

I've tried configuring cors-exposed-headers in a JBOSS EAP 6 adapter like
this:

keycloak.json:
{
...

  "enable-cors" : true,

  "cors-allowed-methods" : "POST,PUT,DELETE,GET",

  "cors-allowed-headers" :
"Accept,Content-Type,If-Match,If-None-Match,Origin",

  "cors-exposed-headers" : "ETag,Location",

...

}


But the adapter does not recognise this config and fails to start:

10:57:15,923 ERROR [org.apache.catalina.core] (ServerService Thread Pool --
69) JBWEB001097: Error starting context /data: java.lang.RuntimeException:
com.fasterxml.jackson.databind.exc.UnrecognizedPropertyException:
Unrecognized field "cors-exposed-headers" (class
org.keycloak.representations.adapters.config.AdapterConfig), not marked as
ignorable (32 known properties: "ssl-required", "cors-allowed-headers",
"register-node-period", "turn-off-change-session-id-on-login",
"truststore", "always-refresh-token", "client-key-password",
"policy-enforcer", "token-store", "resource", "realm", "proxy-url",
"disable-trust-manager", "bearer-only", "truststore-password",
"use-resource-role-mappings", "connection-pool-size", "client-keystore",
"register-node-at-startup", "client-keystore-password", "auth-server-url",
"cors-allowed-methods", "public-client", "expose-token",
"token-minimum-time-to-live", "enable-basic-auth", "cors-max-age",
"enable-cors", "allow-any-hostname", "realm-public-key", "credentials",
"principal-attribute"])

 at [Source: java.io.ByteArrayInputStream at 67593e31; line: 14, column: 29]
(through reference chain:
org.keycloak.representations.adapters.config.AdapterConfig["cors-exposed-headers"])

at
org.keycloak.adapters.KeycloakDeploymentBuilder.loadAdapterConfig(KeycloakDeploymentBuilder.java:137)
[keycloak-adapter-core-2.0.0.Final.jar:2.0.0.Final]

at
org.keycloak.adapters.KeycloakDeploymentBuilder.build(KeycloakDeploymentBuilder.java:126)
[keycloak-adapter-core-2.0.0.Final.jar:2.0.0.Final]

at
org.keycloak.adapters.tomcat.AbstractKeycloakAuthenticatorValve.keycloakInit(AbstractKeycloakAuthenticatorValve.java:133)
[keycloak-tomcat-core-adapter-2.0.0.Final.jar:2.0.0.Final]

at
org.keycloak.adapters.tomcat.AbstractKeycloakAuthenticatorValve.lifecycleEvent(AbstractKeycloakAuthenticatorValve.java:75)
[keycloak-tomcat-core-adapter-2.0.0.Final.jar:2.0.0.Final]

at
org.apache.catalina.util.LifecycleSupport.fireLifecycleEvent(LifecycleSupport.java:115)
[jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]

at
org.apache.catalina.core.StandardContext.start(StandardContext.java:3775)
[jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]

at
org.jboss.as.web.deployment.WebDeploymentService.doStart(WebDeploymentService.java:163)
[jboss-as-web-7.5.0.Final-redhat-21.jar:7.5.0.Final-redhat-21]

at
org.jboss.as.web.deployment.WebDeploymentService.access$000(WebDeploymentService.java:61)
[jboss-as-web-7.5.0.Final-redhat-21.jar:7.5.0.Final-redhat-21]

at
org.jboss.as.web.deployment.WebDeploymentService$1.run(WebDeploymentService.java:96)
[jboss-as-web-7.5.0.Final-redhat-21.jar:7.5.0.Final-redhat-21]

at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:471)
[rt.jar:1.7.0_80]

at java.util.concurrent.FutureTask.run(FutureTask.java:262)
[rt.jar:1.7.0_80]

at
java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)
[rt.jar:1.7.0_80]

at
java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)
[rt.jar:1.7.0_80]

at java.lang.Thread.run(Thread.java:745) [rt.jar:1.7.0_80]

at org.jboss.threads.JBossThread.run(JBossThread.java:122)

Caused by:
com.fasterxml.jackson.databind.exc.UnrecognizedPropertyException:
Unrecognized field "cors-exposed-headers" (class
org.keycloak.representations.adapters.config.AdapterConfig), not marked as
ignorable (32 known properties: "ssl-required", "cors-allowed-headers",
"register-node-period", "turn-off-change-session-id-on-login",
"truststore", "always-refresh-token", "client-key-password",
"policy-enforcer", "token-store", "resource", "realm", "proxy-url",
"disable-trust-manager", "bearer-only", "truststore-password",
"use-resource-role-mappings", "connection-pool-size", "client-keystore",
"register-node-at-startup", "client-keystore-password", "auth-server-url",
"cors-allowed-methods", "public-client", "expose-token",
"token-minimum-time-to-live", "enable-basic-auth", "cors-max-age",
"enable-cors", "allow-any-hostname", "realm-public-key", "credentials",
"principal-attribute"])

 at [Source: java.io.ByteArrayInputStream at 67593e31; line: 14, column: 29]
(through reference chain:
org.keycloak.representations.adapters.config.AdapterConfig["cors-exposed-headers"])

at
com.fasterxml.jackson.databind.exc.UnrecognizedPropertyException.from(UnrecognizedPropertyException.java:51)

at
com.fasterxml.jackson.databind.DeserializationContext.reportUnknownProperty(DeserializationContext.java:817)

at
com.fasterxml.jackson.databind.deser.std.StdDeserializer.handleUnknownProperty(StdDeserializer.java:958)

at
com.fasterxml.jackson.databind.deser.BeanDeserializerBase.handleUnknownProperty(BeanDeserializerBase.java:1324)

at
com.fasterxml.jackson.databind.deser.BeanDeserializerBase.handleUnknownVanilla(BeanDeserializerBase.java:1302)

at
com.fasterxml.jackson.databind.deser.BeanDeserializer.vanillaDeserialize(BeanDeserializer.java:249)

at
com.fasterxml.jackson.databind.deser.BeanDeserializer.deserialize(BeanDeserializer.java:136)

at
com.fasterxml.jackson.databind.ObjectMapper._readMapAndClose(ObjectMapper.java:3564)

at
com.fasterxml.jackson.databind.ObjectMapper.readValue(ObjectMapper.java:2650)

at
org.keycloak.adapters.KeycloakDeploymentBuilder.loadAdapterConfig(KeycloakDeploymentBuilder.java:135)
[keycloak-adapter-core-2.0.0.Final.jar:2.0.0.Final]

... 14 more


10:57:15,973 ERROR [org.apache.catalina.core] (ServerService Thread Pool --
69) JBWEB001103: Error detected during context /data start, will stop it

10:57:15,985 ERROR [org.jboss.msc.service.fail] (ServerService Thread Pool
-- 69) MSC000001: Failed to start service
jboss.web.deployment.default-host./data:
org.jboss.msc.service.StartException in service
jboss.web.deployment.default-host./data:
org.jboss.msc.service.StartException in anonymous service: JBAS018040:
Failed to start context

at
org.jboss.as.web.deployment.WebDeploymentService$1.run(WebDeploymentService.java:99)

at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:471)
[rt.jar:1.7.0_80]

at java.util.concurrent.FutureTask.run(FutureTask.java:262)
[rt.jar:1.7.0_80]

at
java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)
[rt.jar:1.7.0_80]

at
java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)
[rt.jar:1.7.0_80]

at java.lang.Thread.run(Thread.java:745) [rt.jar:1.7.0_80]

at org.jboss.threads.JBossThread.run(JBossThread.java:122)

Caused by: org.jboss.msc.service.StartException in anonymous service:
JBAS018040: Failed to start context

at
org.jboss.as.web.deployment.WebDeploymentService.doStart(WebDeploymentService.java:168)

at
org.jboss.as.web.deployment.WebDeploymentService.access$000(WebDeploymentService.java:61)

at
org.jboss.as.web.deployment.WebDeploymentService$1.run(WebDeploymentService.java:96)

... 6 more


10:57:16,019 ERROR [org.jboss.as.controller.management-operation]
(Controller Boot Thread) JBAS014612: Operation ("deploy") failed - address:
([("deployment" => "webims-jcom-data-1.3.1-SNAPSHOT-secure-keycloak.war")])
- failure description: {"JBAS014671: Failed services" =>
{"jboss.web.deployment.default-host./data" =>
"org.jboss.msc.service.StartException in service
jboss.web.deployment.default-host./data:
org.jboss.msc.service.StartException in anonymous service: JBAS018040:
Failed to start context

    Caused by: org.jboss.msc.service.StartException in anonymous service:
JBAS018040: Failed to start context"}}






On Sat, Jul 9, 2016 at 7:38 AM, Bruno Oliveira <bruno at abstractj.org> wrote:

> As far as I can tell, yes.
>
> See:
>
> https://keycloak.gitbooks.io/server-adminstration-guide/content/topics/clients/client-oidc.html
>
> https://github.com/keycloak/keycloak/blob/5c98b8c6ae7052b2d906156d8fc212ccd9dfd57d/services/src/main/java/org/keycloak/services/resources/Cors.java#L143
>
> On 2016-07-08, Hubert Przybysz wrote:
> > Hi,
> >
> > Is configuration of CORS Access-Control-Expose-Headers supported in
> > 2.0.0.Final adapters?
> >
> > Best regards / Hubert.
>
> > _______________________________________________
> > keycloak-user mailing list
> > keycloak-user at lists.jboss.org
> > https://lists.jboss.org/mailman/listinfo/keycloak-user
>
>
> --
>
> abstractj
> PGP: 0x84DC9914
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160711/ef4a2525/attachment.html 

From tpearson at bkool.com  Mon Jul 11 11:24:59 2016
From: tpearson at bkool.com (Tom Pearson)
Date: Mon, 11 Jul 2016 17:24:59 +0200
Subject: [keycloak-user] Social login Issue
Message-ID: <CALHbiGLy-H9hC21ge8D8dT4WOgd1eStkw6cnvB6i0-D-bwaD3w@mail.gmail.com>

Hi,

I'm currently part of a team implementing a single sign on solution using
Open ID Connect and Keycloak.

We have a number of services which all interact with a central Json Rest
API. The API is secured according to the second Open ID Connect use case as
described in the Keycloak docs
<https://keycloak.gitbooks.io/securing-client-applications-guide/content/v/2.0/topics/overview/supported-protocols.html>.
That
is to say, all API clients must obtain a digitally signed access token from
Keycloak and then pass it over on every request (in our case, within the
Authorization header).

One of the services is a native mobile application. This application
already has social login/registration implemented and the team would prefer
not to redirect to Keycloak as per the standard authorization code flow.
Instead, they would like to obtain a Keycloak access token using the
previously obtained social login credentials.

This seems to pose a problem as the direct grant flow doesn't support
social login. Is there any way to achieve this?

Kind Regards,
Tom Pearson
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160711/063d43c9/attachment-0001.html 

From bruno at abstractj.org  Mon Jul 11 12:13:10 2016
From: bruno at abstractj.org (Bruno Oliveira)
Date: Mon, 11 Jul 2016 13:13:10 -0300
Subject: [keycloak-user] Support for CORS Access-Control-Expose-Headers
 in 2.0.0.Final
In-Reply-To: <CAJMEJTU0OzN_2axzBypNeL268iyZBk4ca6i6nTdyLkv8t+nhQg@mail.gmail.com>
References: <CAJMEJTW7aZZeHRDinB66PDTfMaZ3aHLs8VNrx=xTNPJ+qqCORg@mail.gmail.com>
	<20160709053836.GA23953@abstractj.org>
	<CAJMEJTU0OzN_2axzBypNeL268iyZBk4ca6i6nTdyLkv8t+nhQg@mail.gmail.com>
Message-ID: <20160711161310.GA7375@abstractj.org>

You are right Hubert it's not supported at keycloak.json file, I just overlooked the code.
Sorry about that.

On 2016-07-11, Hubert Przybysz wrote:
> Thanks for the info.
>
> I've tried configuring cors-exposed-headers in a JBOSS EAP 6 adapter like
> this:
>
> keycloak.json:
> {
> ...
>
>   "enable-cors" : true,
>
>   "cors-allowed-methods" : "POST,PUT,DELETE,GET",
>
>   "cors-allowed-headers" :
> "Accept,Content-Type,If-Match,If-None-Match,Origin",
>
>   "cors-exposed-headers" : "ETag,Location",
>
> ...
>
> }
>
>
> But the adapter does not recognise this config and fails to start:
>
> 10:57:15,923 ERROR [org.apache.catalina.core] (ServerService Thread Pool --
> 69) JBWEB001097: Error starting context /data: java.lang.RuntimeException:
> com.fasterxml.jackson.databind.exc.UnrecognizedPropertyException:
> Unrecognized field "cors-exposed-headers" (class
> org.keycloak.representations.adapters.config.AdapterConfig), not marked as
> ignorable (32 known properties: "ssl-required", "cors-allowed-headers",
> "register-node-period", "turn-off-change-session-id-on-login",
> "truststore", "always-refresh-token", "client-key-password",
> "policy-enforcer", "token-store", "resource", "realm", "proxy-url",
> "disable-trust-manager", "bearer-only", "truststore-password",
> "use-resource-role-mappings", "connection-pool-size", "client-keystore",
> "register-node-at-startup", "client-keystore-password", "auth-server-url",
> "cors-allowed-methods", "public-client", "expose-token",
> "token-minimum-time-to-live", "enable-basic-auth", "cors-max-age",
> "enable-cors", "allow-any-hostname", "realm-public-key", "credentials",
> "principal-attribute"])
>
>  at [Source: java.io.ByteArrayInputStream at 67593e31; line: 14, column: 29]
> (through reference chain:
> org.keycloak.representations.adapters.config.AdapterConfig["cors-exposed-headers"])
>
> at
> org.keycloak.adapters.KeycloakDeploymentBuilder.loadAdapterConfig(KeycloakDeploymentBuilder.java:137)
> [keycloak-adapter-core-2.0.0.Final.jar:2.0.0.Final]
>
> at
> org.keycloak.adapters.KeycloakDeploymentBuilder.build(KeycloakDeploymentBuilder.java:126)
> [keycloak-adapter-core-2.0.0.Final.jar:2.0.0.Final]
>
> at
> org.keycloak.adapters.tomcat.AbstractKeycloakAuthenticatorValve.keycloakInit(AbstractKeycloakAuthenticatorValve.java:133)
> [keycloak-tomcat-core-adapter-2.0.0.Final.jar:2.0.0.Final]
>
> at
> org.keycloak.adapters.tomcat.AbstractKeycloakAuthenticatorValve.lifecycleEvent(AbstractKeycloakAuthenticatorValve.java:75)
> [keycloak-tomcat-core-adapter-2.0.0.Final.jar:2.0.0.Final]
>
> at
> org.apache.catalina.util.LifecycleSupport.fireLifecycleEvent(LifecycleSupport.java:115)
> [jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]
>
> at
> org.apache.catalina.core.StandardContext.start(StandardContext.java:3775)
> [jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]
>
> at
> org.jboss.as.web.deployment.WebDeploymentService.doStart(WebDeploymentService.java:163)
> [jboss-as-web-7.5.0.Final-redhat-21.jar:7.5.0.Final-redhat-21]
>
> at
> org.jboss.as.web.deployment.WebDeploymentService.access$000(WebDeploymentService.java:61)
> [jboss-as-web-7.5.0.Final-redhat-21.jar:7.5.0.Final-redhat-21]
>
> at
> org.jboss.as.web.deployment.WebDeploymentService$1.run(WebDeploymentService.java:96)
> [jboss-as-web-7.5.0.Final-redhat-21.jar:7.5.0.Final-redhat-21]
>
> at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:471)
> [rt.jar:1.7.0_80]
>
> at java.util.concurrent.FutureTask.run(FutureTask.java:262)
> [rt.jar:1.7.0_80]
>
> at
> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)
> [rt.jar:1.7.0_80]
>
> at
> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)
> [rt.jar:1.7.0_80]
>
> at java.lang.Thread.run(Thread.java:745) [rt.jar:1.7.0_80]
>
> at org.jboss.threads.JBossThread.run(JBossThread.java:122)
>
> Caused by:
> com.fasterxml.jackson.databind.exc.UnrecognizedPropertyException:
> Unrecognized field "cors-exposed-headers" (class
> org.keycloak.representations.adapters.config.AdapterConfig), not marked as
> ignorable (32 known properties: "ssl-required", "cors-allowed-headers",
> "register-node-period", "turn-off-change-session-id-on-login",
> "truststore", "always-refresh-token", "client-key-password",
> "policy-enforcer", "token-store", "resource", "realm", "proxy-url",
> "disable-trust-manager", "bearer-only", "truststore-password",
> "use-resource-role-mappings", "connection-pool-size", "client-keystore",
> "register-node-at-startup", "client-keystore-password", "auth-server-url",
> "cors-allowed-methods", "public-client", "expose-token",
> "token-minimum-time-to-live", "enable-basic-auth", "cors-max-age",
> "enable-cors", "allow-any-hostname", "realm-public-key", "credentials",
> "principal-attribute"])
>
>  at [Source: java.io.ByteArrayInputStream at 67593e31; line: 14, column: 29]
> (through reference chain:
> org.keycloak.representations.adapters.config.AdapterConfig["cors-exposed-headers"])
>
> at
> com.fasterxml.jackson.databind.exc.UnrecognizedPropertyException.from(UnrecognizedPropertyException.java:51)
>
> at
> com.fasterxml.jackson.databind.DeserializationContext.reportUnknownProperty(DeserializationContext.java:817)
>
> at
> com.fasterxml.jackson.databind.deser.std.StdDeserializer.handleUnknownProperty(StdDeserializer.java:958)
>
> at
> com.fasterxml.jackson.databind.deser.BeanDeserializerBase.handleUnknownProperty(BeanDeserializerBase.java:1324)
>
> at
> com.fasterxml.jackson.databind.deser.BeanDeserializerBase.handleUnknownVanilla(BeanDeserializerBase.java:1302)
>
> at
> com.fasterxml.jackson.databind.deser.BeanDeserializer.vanillaDeserialize(BeanDeserializer.java:249)
>
> at
> com.fasterxml.jackson.databind.deser.BeanDeserializer.deserialize(BeanDeserializer.java:136)
>
> at
> com.fasterxml.jackson.databind.ObjectMapper._readMapAndClose(ObjectMapper.java:3564)
>
> at
> com.fasterxml.jackson.databind.ObjectMapper.readValue(ObjectMapper.java:2650)
>
> at
> org.keycloak.adapters.KeycloakDeploymentBuilder.loadAdapterConfig(KeycloakDeploymentBuilder.java:135)
> [keycloak-adapter-core-2.0.0.Final.jar:2.0.0.Final]
>
> ... 14 more
>
>
> 10:57:15,973 ERROR [org.apache.catalina.core] (ServerService Thread Pool --
> 69) JBWEB001103: Error detected during context /data start, will stop it
>
> 10:57:15,985 ERROR [org.jboss.msc.service.fail] (ServerService Thread Pool
> -- 69) MSC000001: Failed to start service
> jboss.web.deployment.default-host./data:
> org.jboss.msc.service.StartException in service
> jboss.web.deployment.default-host./data:
> org.jboss.msc.service.StartException in anonymous service: JBAS018040:
> Failed to start context
>
> at
> org.jboss.as.web.deployment.WebDeploymentService$1.run(WebDeploymentService.java:99)
>
> at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:471)
> [rt.jar:1.7.0_80]
>
> at java.util.concurrent.FutureTask.run(FutureTask.java:262)
> [rt.jar:1.7.0_80]
>
> at
> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)
> [rt.jar:1.7.0_80]
>
> at
> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)
> [rt.jar:1.7.0_80]
>
> at java.lang.Thread.run(Thread.java:745) [rt.jar:1.7.0_80]
>
> at org.jboss.threads.JBossThread.run(JBossThread.java:122)
>
> Caused by: org.jboss.msc.service.StartException in anonymous service:
> JBAS018040: Failed to start context
>
> at
> org.jboss.as.web.deployment.WebDeploymentService.doStart(WebDeploymentService.java:168)
>
> at
> org.jboss.as.web.deployment.WebDeploymentService.access$000(WebDeploymentService.java:61)
>
> at
> org.jboss.as.web.deployment.WebDeploymentService$1.run(WebDeploymentService.java:96)
>
> ... 6 more
>
>
> 10:57:16,019 ERROR [org.jboss.as.controller.management-operation]
> (Controller Boot Thread) JBAS014612: Operation ("deploy") failed - address:
> ([("deployment" => "webims-jcom-data-1.3.1-SNAPSHOT-secure-keycloak.war")])
> - failure description: {"JBAS014671: Failed services" =>
> {"jboss.web.deployment.default-host./data" =>
> "org.jboss.msc.service.StartException in service
> jboss.web.deployment.default-host./data:
> org.jboss.msc.service.StartException in anonymous service: JBAS018040:
> Failed to start context
>
>     Caused by: org.jboss.msc.service.StartException in anonymous service:
> JBAS018040: Failed to start context"}}
>
>
>
>
>
>
> On Sat, Jul 9, 2016 at 7:38 AM, Bruno Oliveira <bruno at abstractj.org> wrote:
>
> > As far as I can tell, yes.
> >
> > See:
> >
> > https://keycloak.gitbooks.io/server-adminstration-guide/content/topics/clients/client-oidc.html
> >
> > https://github.com/keycloak/keycloak/blob/5c98b8c6ae7052b2d906156d8fc212ccd9dfd57d/services/src/main/java/org/keycloak/services/resources/Cors.java#L143
> >
> > On 2016-07-08, Hubert Przybysz wrote:
> > > Hi,
> > >
> > > Is configuration of CORS Access-Control-Expose-Headers supported in
> > > 2.0.0.Final adapters?
> > >
> > > Best regards / Hubert.
> >
> > > _______________________________________________
> > > keycloak-user mailing list
> > > keycloak-user at lists.jboss.org
> > > https://lists.jboss.org/mailman/listinfo/keycloak-user
> >
> >
> > --
> >
> > abstractj
> > PGP: 0x84DC9914
> >

--

abstractj
PGP: 0x84DC9914

From h.p.przybysz at gmail.com  Mon Jul 11 12:36:26 2016
From: h.p.przybysz at gmail.com (Hubert Przybysz)
Date: Mon, 11 Jul 2016 18:36:26 +0200
Subject: [keycloak-user] Support for CORS Access-Control-Expose-Headers
	in 2.0.0.Final
In-Reply-To: <20160711161310.GA7375@abstractj.org>
References: <CAJMEJTW7aZZeHRDinB66PDTfMaZ3aHLs8VNrx=xTNPJ+qqCORg@mail.gmail.com>
	<20160709053836.GA23953@abstractj.org>
	<CAJMEJTU0OzN_2axzBypNeL268iyZBk4ca6i6nTdyLkv8t+nhQg@mail.gmail.com>
	<20160711161310.GA7375@abstractj.org>
Message-ID: <CAJMEJTUKHG8oNp5ni8ZECfezeideXntDpdEbgVkXYKcTMaBY4g@mail.gmail.com>

Does anyone know when it will be possible to configure the adapters with
CORS expose headers?

I don't find any jira for it.

Br / Hubert.

On Mon, Jul 11, 2016 at 6:13 PM, Bruno Oliveira <bruno at abstractj.org> wrote:

> You are right Hubert it's not supported at keycloak.json file, I just
> overlooked the code.
> Sorry about that.
>
> On 2016-07-11, Hubert Przybysz wrote:
> > Thanks for the info.
> >
> > I've tried configuring cors-exposed-headers in a JBOSS EAP 6 adapter like
> > this:
> >
> > keycloak.json:
> > {
> > ...
> >
> >   "enable-cors" : true,
> >
> >   "cors-allowed-methods" : "POST,PUT,DELETE,GET",
> >
> >   "cors-allowed-headers" :
> > "Accept,Content-Type,If-Match,If-None-Match,Origin",
> >
> >   "cors-exposed-headers" : "ETag,Location",
> >
> > ...
> >
> > }
> >
> >
> > But the adapter does not recognise this config and fails to start:
> >
> > 10:57:15,923 ERROR [org.apache.catalina.core] (ServerService Thread Pool
> --
> > 69) JBWEB001097: Error starting context /data:
> java.lang.RuntimeException:
> > com.fasterxml.jackson.databind.exc.UnrecognizedPropertyException:
> > Unrecognized field "cors-exposed-headers" (class
> > org.keycloak.representations.adapters.config.AdapterConfig), not marked
> as
> > ignorable (32 known properties: "ssl-required", "cors-allowed-headers",
> > "register-node-period", "turn-off-change-session-id-on-login",
> > "truststore", "always-refresh-token", "client-key-password",
> > "policy-enforcer", "token-store", "resource", "realm", "proxy-url",
> > "disable-trust-manager", "bearer-only", "truststore-password",
> > "use-resource-role-mappings", "connection-pool-size", "client-keystore",
> > "register-node-at-startup", "client-keystore-password",
> "auth-server-url",
> > "cors-allowed-methods", "public-client", "expose-token",
> > "token-minimum-time-to-live", "enable-basic-auth", "cors-max-age",
> > "enable-cors", "allow-any-hostname", "realm-public-key", "credentials",
> > "principal-attribute"])
> >
> >  at [Source: java.io.ByteArrayInputStream at 67593e31; line: 14, column:
> 29]
> > (through reference chain:
> >
> org.keycloak.representations.adapters.config.AdapterConfig["cors-exposed-headers"])
> >
> > at
> >
> org.keycloak.adapters.KeycloakDeploymentBuilder.loadAdapterConfig(KeycloakDeploymentBuilder.java:137)
> > [keycloak-adapter-core-2.0.0.Final.jar:2.0.0.Final]
> >
> > at
> >
> org.keycloak.adapters.KeycloakDeploymentBuilder.build(KeycloakDeploymentBuilder.java:126)
> > [keycloak-adapter-core-2.0.0.Final.jar:2.0.0.Final]
> >
> > at
> >
> org.keycloak.adapters.tomcat.AbstractKeycloakAuthenticatorValve.keycloakInit(AbstractKeycloakAuthenticatorValve.java:133)
> > [keycloak-tomcat-core-adapter-2.0.0.Final.jar:2.0.0.Final]
> >
> > at
> >
> org.keycloak.adapters.tomcat.AbstractKeycloakAuthenticatorValve.lifecycleEvent(AbstractKeycloakAuthenticatorValve.java:75)
> > [keycloak-tomcat-core-adapter-2.0.0.Final.jar:2.0.0.Final]
> >
> > at
> >
> org.apache.catalina.util.LifecycleSupport.fireLifecycleEvent(LifecycleSupport.java:115)
> > [jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]
> >
> > at
> > org.apache.catalina.core.StandardContext.start(StandardContext.java:3775)
> > [jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]
> >
> > at
> >
> org.jboss.as.web.deployment.WebDeploymentService.doStart(WebDeploymentService.java:163)
> > [jboss-as-web-7.5.0.Final-redhat-21.jar:7.5.0.Final-redhat-21]
> >
> > at
> >
> org.jboss.as.web.deployment.WebDeploymentService.access$000(WebDeploymentService.java:61)
> > [jboss-as-web-7.5.0.Final-redhat-21.jar:7.5.0.Final-redhat-21]
> >
> > at
> >
> org.jboss.as.web.deployment.WebDeploymentService$1.run(WebDeploymentService.java:96)
> > [jboss-as-web-7.5.0.Final-redhat-21.jar:7.5.0.Final-redhat-21]
> >
> > at
> java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:471)
> > [rt.jar:1.7.0_80]
> >
> > at java.util.concurrent.FutureTask.run(FutureTask.java:262)
> > [rt.jar:1.7.0_80]
> >
> > at
> >
> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)
> > [rt.jar:1.7.0_80]
> >
> > at
> >
> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)
> > [rt.jar:1.7.0_80]
> >
> > at java.lang.Thread.run(Thread.java:745) [rt.jar:1.7.0_80]
> >
> > at org.jboss.threads.JBossThread.run(JBossThread.java:122)
> >
> > Caused by:
> > com.fasterxml.jackson.databind.exc.UnrecognizedPropertyException:
> > Unrecognized field "cors-exposed-headers" (class
> > org.keycloak.representations.adapters.config.AdapterConfig), not marked
> as
> > ignorable (32 known properties: "ssl-required", "cors-allowed-headers",
> > "register-node-period", "turn-off-change-session-id-on-login",
> > "truststore", "always-refresh-token", "client-key-password",
> > "policy-enforcer", "token-store", "resource", "realm", "proxy-url",
> > "disable-trust-manager", "bearer-only", "truststore-password",
> > "use-resource-role-mappings", "connection-pool-size", "client-keystore",
> > "register-node-at-startup", "client-keystore-password",
> "auth-server-url",
> > "cors-allowed-methods", "public-client", "expose-token",
> > "token-minimum-time-to-live", "enable-basic-auth", "cors-max-age",
> > "enable-cors", "allow-any-hostname", "realm-public-key", "credentials",
> > "principal-attribute"])
> >
> >  at [Source: java.io.ByteArrayInputStream at 67593e31; line: 14, column:
> 29]
> > (through reference chain:
> >
> org.keycloak.representations.adapters.config.AdapterConfig["cors-exposed-headers"])
> >
> > at
> >
> com.fasterxml.jackson.databind.exc.UnrecognizedPropertyException.from(UnrecognizedPropertyException.java:51)
> >
> > at
> >
> com.fasterxml.jackson.databind.DeserializationContext.reportUnknownProperty(DeserializationContext.java:817)
> >
> > at
> >
> com.fasterxml.jackson.databind.deser.std.StdDeserializer.handleUnknownProperty(StdDeserializer.java:958)
> >
> > at
> >
> com.fasterxml.jackson.databind.deser.BeanDeserializerBase.handleUnknownProperty(BeanDeserializerBase.java:1324)
> >
> > at
> >
> com.fasterxml.jackson.databind.deser.BeanDeserializerBase.handleUnknownVanilla(BeanDeserializerBase.java:1302)
> >
> > at
> >
> com.fasterxml.jackson.databind.deser.BeanDeserializer.vanillaDeserialize(BeanDeserializer.java:249)
> >
> > at
> >
> com.fasterxml.jackson.databind.deser.BeanDeserializer.deserialize(BeanDeserializer.java:136)
> >
> > at
> >
> com.fasterxml.jackson.databind.ObjectMapper._readMapAndClose(ObjectMapper.java:3564)
> >
> > at
> >
> com.fasterxml.jackson.databind.ObjectMapper.readValue(ObjectMapper.java:2650)
> >
> > at
> >
> org.keycloak.adapters.KeycloakDeploymentBuilder.loadAdapterConfig(KeycloakDeploymentBuilder.java:135)
> > [keycloak-adapter-core-2.0.0.Final.jar:2.0.0.Final]
> >
> > ... 14 more
> >
> >
> > 10:57:15,973 ERROR [org.apache.catalina.core] (ServerService Thread Pool
> --
> > 69) JBWEB001103: Error detected during context /data start, will stop it
> >
> > 10:57:15,985 ERROR [org.jboss.msc.service.fail] (ServerService Thread
> Pool
> > -- 69) MSC000001: Failed to start service
> > jboss.web.deployment.default-host./data:
> > org.jboss.msc.service.StartException in service
> > jboss.web.deployment.default-host./data:
> > org.jboss.msc.service.StartException in anonymous service: JBAS018040:
> > Failed to start context
> >
> > at
> >
> org.jboss.as.web.deployment.WebDeploymentService$1.run(WebDeploymentService.java:99)
> >
> > at
> java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:471)
> > [rt.jar:1.7.0_80]
> >
> > at java.util.concurrent.FutureTask.run(FutureTask.java:262)
> > [rt.jar:1.7.0_80]
> >
> > at
> >
> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)
> > [rt.jar:1.7.0_80]
> >
> > at
> >
> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)
> > [rt.jar:1.7.0_80]
> >
> > at java.lang.Thread.run(Thread.java:745) [rt.jar:1.7.0_80]
> >
> > at org.jboss.threads.JBossThread.run(JBossThread.java:122)
> >
> > Caused by: org.jboss.msc.service.StartException in anonymous service:
> > JBAS018040: Failed to start context
> >
> > at
> >
> org.jboss.as.web.deployment.WebDeploymentService.doStart(WebDeploymentService.java:168)
> >
> > at
> >
> org.jboss.as.web.deployment.WebDeploymentService.access$000(WebDeploymentService.java:61)
> >
> > at
> >
> org.jboss.as.web.deployment.WebDeploymentService$1.run(WebDeploymentService.java:96)
> >
> > ... 6 more
> >
> >
> > 10:57:16,019 ERROR [org.jboss.as.controller.management-operation]
> > (Controller Boot Thread) JBAS014612: Operation ("deploy") failed -
> address:
> > ([("deployment" =>
> "webims-jcom-data-1.3.1-SNAPSHOT-secure-keycloak.war")])
> > - failure description: {"JBAS014671: Failed services" =>
> > {"jboss.web.deployment.default-host./data" =>
> > "org.jboss.msc.service.StartException in service
> > jboss.web.deployment.default-host./data:
> > org.jboss.msc.service.StartException in anonymous service: JBAS018040:
> > Failed to start context
> >
> >     Caused by: org.jboss.msc.service.StartException in anonymous service:
> > JBAS018040: Failed to start context"}}
> >
> >
> >
> >
> >
> >
> > On Sat, Jul 9, 2016 at 7:38 AM, Bruno Oliveira <bruno at abstractj.org>
> wrote:
> >
> > > As far as I can tell, yes.
> > >
> > > See:
> > >
> > >
> https://keycloak.gitbooks.io/server-adminstration-guide/content/topics/clients/client-oidc.html
> > >
> > >
> https://github.com/keycloak/keycloak/blob/5c98b8c6ae7052b2d906156d8fc212ccd9dfd57d/services/src/main/java/org/keycloak/services/resources/Cors.java#L143
> > >
> > > On 2016-07-08, Hubert Przybysz wrote:
> > > > Hi,
> > > >
> > > > Is configuration of CORS Access-Control-Expose-Headers supported in
> > > > 2.0.0.Final adapters?
> > > >
> > > > Best regards / Hubert.
> > >
> > > > _______________________________________________
> > > > keycloak-user mailing list
> > > > keycloak-user at lists.jboss.org
> > > > https://lists.jboss.org/mailman/listinfo/keycloak-user
> > >
> > >
> > > --
> > >
> > > abstractj
> > > PGP: 0x84DC9914
> > >
>
> --
>
> abstractj
> PGP: 0x84DC9914
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160711/59e48253/attachment-0001.html 

From harrytpc at gmail.com  Mon Jul 11 12:45:06 2016
From: harrytpc at gmail.com (Harry Trinta)
Date: Mon, 11 Jul 2016 13:45:06 -0300
Subject: [keycloak-user] API Token param
In-Reply-To: <20160707202728.GA20655@abstractj.org>
References: <CA+waeaWBYEBUQ49Y2KUy+wqQ7tFzmcdgGNw8KskM8PnE8vYY7w@mail.gmail.com>
	<20160707202728.GA20655@abstractj.org>
Message-ID: <CA+waeaVs=mcEg2EJG93eZ0mqLX3-0LeScBvDN_2FfapknNF7pA@mail.gmail.com>

I would like to save some notes about the app and/or the user in the token.
For example, if the token is from a session that is being impersonated.

2016-07-07 17:27 GMT-03:00 Bruno Oliveira <bruno at abstractj.org>:

> I don't think that's possible. What exactly would you like to do?
>
> On 2016-07-07, Harry Trinta wrote:
> > Hi,
> >
> > When authenticate through the API token ("*/openid-connect/token"), is
> > possible to send a parameter (key/value) and this parameter be added to
> > access_token?
> >
> > Regards,
> >
> > Harry
>
> > _______________________________________________
> > keycloak-user mailing list
> > keycloak-user at lists.jboss.org
> > https://lists.jboss.org/mailman/listinfo/keycloak-user
>
>
> --
>
> abstractj
> PGP: 0x84DC9914
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160711/aa87d09e/attachment.html 

From bruno at abstractj.org  Mon Jul 11 13:29:43 2016
From: bruno at abstractj.org (Bruno Oliveira)
Date: Mon, 11 Jul 2016 17:29:43 +0000
Subject: [keycloak-user] Support for CORS Access-Control-Expose-Headers
	in 2.0.0.Final
In-Reply-To: <CAJMEJTUKHG8oNp5ni8ZECfezeideXntDpdEbgVkXYKcTMaBY4g@mail.gmail.com>
References: <CAJMEJTW7aZZeHRDinB66PDTfMaZ3aHLs8VNrx=xTNPJ+qqCORg@mail.gmail.com>
	<20160709053836.GA23953@abstractj.org>
	<CAJMEJTU0OzN_2axzBypNeL268iyZBk4ca6i6nTdyLkv8t+nhQg@mail.gmail.com>
	<20160711161310.GA7375@abstractj.org>
	<CAJMEJTUKHG8oNp5ni8ZECfezeideXntDpdEbgVkXYKcTMaBY4g@mail.gmail.com>
Message-ID: <CAM5SUC44a5CFm5fh0Ac5k=26nkHMz6vgYh4TDvZiq1Fd=+wWTQ@mail.gmail.com>

Please, go ahead and create one. I couldn't find any Jira related to this.

On Mon, Jul 11, 2016 at 1:36 PM Hubert Przybysz <h.p.przybysz at gmail.com>
wrote:

> Does anyone know when it will be possible to configure the adapters with
> CORS expose headers?
>
> I don't find any jira for it.
>
> Br / Hubert.
>
> On Mon, Jul 11, 2016 at 6:13 PM, Bruno Oliveira <bruno at abstractj.org>
> wrote:
>
>> You are right Hubert it's not supported at keycloak.json file, I just
>> overlooked the code.
>> Sorry about that.
>>
>> On 2016-07-11, Hubert Przybysz wrote:
>> > Thanks for the info.
>> >
>> > I've tried configuring cors-exposed-headers in a JBOSS EAP 6 adapter
>> like
>> > this:
>> >
>> > keycloak.json:
>> > {
>> > ...
>> >
>> >   "enable-cors" : true,
>> >
>> >   "cors-allowed-methods" : "POST,PUT,DELETE,GET",
>> >
>> >   "cors-allowed-headers" :
>> > "Accept,Content-Type,If-Match,If-None-Match,Origin",
>> >
>> >   "cors-exposed-headers" : "ETag,Location",
>> >
>> > ...
>> >
>> > }
>> >
>> >
>> > But the adapter does not recognise this config and fails to start:
>> >
>> > 10:57:15,923 ERROR [org.apache.catalina.core] (ServerService Thread
>> Pool --
>> > 69) JBWEB001097: Error starting context /data:
>> java.lang.RuntimeException:
>> > com.fasterxml.jackson.databind.exc.UnrecognizedPropertyException:
>> > Unrecognized field "cors-exposed-headers" (class
>> > org.keycloak.representations.adapters.config.AdapterConfig), not marked
>> as
>> > ignorable (32 known properties: "ssl-required", "cors-allowed-headers",
>> > "register-node-period", "turn-off-change-session-id-on-login",
>> > "truststore", "always-refresh-token", "client-key-password",
>> > "policy-enforcer", "token-store", "resource", "realm", "proxy-url",
>> > "disable-trust-manager", "bearer-only", "truststore-password",
>> > "use-resource-role-mappings", "connection-pool-size", "client-keystore",
>> > "register-node-at-startup", "client-keystore-password",
>> "auth-server-url",
>> > "cors-allowed-methods", "public-client", "expose-token",
>> > "token-minimum-time-to-live", "enable-basic-auth", "cors-max-age",
>> > "enable-cors", "allow-any-hostname", "realm-public-key", "credentials",
>> > "principal-attribute"])
>> >
>> >  at [Source: java.io.ByteArrayInputStream at 67593e31; line: 14, column:
>> 29]
>> > (through reference chain:
>> >
>> org.keycloak.representations.adapters.config.AdapterConfig["cors-exposed-headers"])
>> >
>> > at
>> >
>> org.keycloak.adapters.KeycloakDeploymentBuilder.loadAdapterConfig(KeycloakDeploymentBuilder.java:137)
>> > [keycloak-adapter-core-2.0.0.Final.jar:2.0.0.Final]
>> >
>> > at
>> >
>> org.keycloak.adapters.KeycloakDeploymentBuilder.build(KeycloakDeploymentBuilder.java:126)
>> > [keycloak-adapter-core-2.0.0.Final.jar:2.0.0.Final]
>> >
>> > at
>> >
>> org.keycloak.adapters.tomcat.AbstractKeycloakAuthenticatorValve.keycloakInit(AbstractKeycloakAuthenticatorValve.java:133)
>> > [keycloak-tomcat-core-adapter-2.0.0.Final.jar:2.0.0.Final]
>> >
>> > at
>> >
>> org.keycloak.adapters.tomcat.AbstractKeycloakAuthenticatorValve.lifecycleEvent(AbstractKeycloakAuthenticatorValve.java:75)
>> > [keycloak-tomcat-core-adapter-2.0.0.Final.jar:2.0.0.Final]
>> >
>> > at
>> >
>> org.apache.catalina.util.LifecycleSupport.fireLifecycleEvent(LifecycleSupport.java:115)
>> > [jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]
>> >
>> > at
>> >
>> org.apache.catalina.core.StandardContext.start(StandardContext.java:3775)
>> > [jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]
>> >
>> > at
>> >
>> org.jboss.as.web.deployment.WebDeploymentService.doStart(WebDeploymentService.java:163)
>> > [jboss-as-web-7.5.0.Final-redhat-21.jar:7.5.0.Final-redhat-21]
>> >
>> > at
>> >
>> org.jboss.as.web.deployment.WebDeploymentService.access$000(WebDeploymentService.java:61)
>> > [jboss-as-web-7.5.0.Final-redhat-21.jar:7.5.0.Final-redhat-21]
>> >
>> > at
>> >
>> org.jboss.as.web.deployment.WebDeploymentService$1.run(WebDeploymentService.java:96)
>> > [jboss-as-web-7.5.0.Final-redhat-21.jar:7.5.0.Final-redhat-21]
>> >
>> > at
>> java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:471)
>> > [rt.jar:1.7.0_80]
>> >
>> > at java.util.concurrent.FutureTask.run(FutureTask.java:262)
>> > [rt.jar:1.7.0_80]
>> >
>> > at
>> >
>> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)
>> > [rt.jar:1.7.0_80]
>> >
>> > at
>> >
>> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)
>> > [rt.jar:1.7.0_80]
>> >
>> > at java.lang.Thread.run(Thread.java:745) [rt.jar:1.7.0_80]
>> >
>> > at org.jboss.threads.JBossThread.run(JBossThread.java:122)
>> >
>> > Caused by:
>> > com.fasterxml.jackson.databind.exc.UnrecognizedPropertyException:
>> > Unrecognized field "cors-exposed-headers" (class
>> > org.keycloak.representations.adapters.config.AdapterConfig), not marked
>> as
>> > ignorable (32 known properties: "ssl-required", "cors-allowed-headers",
>> > "register-node-period", "turn-off-change-session-id-on-login",
>> > "truststore", "always-refresh-token", "client-key-password",
>> > "policy-enforcer", "token-store", "resource", "realm", "proxy-url",
>> > "disable-trust-manager", "bearer-only", "truststore-password",
>> > "use-resource-role-mappings", "connection-pool-size", "client-keystore",
>> > "register-node-at-startup", "client-keystore-password",
>> "auth-server-url",
>> > "cors-allowed-methods", "public-client", "expose-token",
>> > "token-minimum-time-to-live", "enable-basic-auth", "cors-max-age",
>> > "enable-cors", "allow-any-hostname", "realm-public-key", "credentials",
>> > "principal-attribute"])
>> >
>> >  at [Source: java.io.ByteArrayInputStream at 67593e31; line: 14, column:
>> 29]
>> > (through reference chain:
>> >
>> org.keycloak.representations.adapters.config.AdapterConfig["cors-exposed-headers"])
>> >
>> > at
>> >
>> com.fasterxml.jackson.databind.exc.UnrecognizedPropertyException.from(UnrecognizedPropertyException.java:51)
>> >
>> > at
>> >
>> com.fasterxml.jackson.databind.DeserializationContext.reportUnknownProperty(DeserializationContext.java:817)
>> >
>> > at
>> >
>> com.fasterxml.jackson.databind.deser.std.StdDeserializer.handleUnknownProperty(StdDeserializer.java:958)
>> >
>> > at
>> >
>> com.fasterxml.jackson.databind.deser.BeanDeserializerBase.handleUnknownProperty(BeanDeserializerBase.java:1324)
>> >
>> > at
>> >
>> com.fasterxml.jackson.databind.deser.BeanDeserializerBase.handleUnknownVanilla(BeanDeserializerBase.java:1302)
>> >
>> > at
>> >
>> com.fasterxml.jackson.databind.deser.BeanDeserializer.vanillaDeserialize(BeanDeserializer.java:249)
>> >
>> > at
>> >
>> com.fasterxml.jackson.databind.deser.BeanDeserializer.deserialize(BeanDeserializer.java:136)
>> >
>> > at
>> >
>> com.fasterxml.jackson.databind.ObjectMapper._readMapAndClose(ObjectMapper.java:3564)
>> >
>> > at
>> >
>> com.fasterxml.jackson.databind.ObjectMapper.readValue(ObjectMapper.java:2650)
>> >
>> > at
>> >
>> org.keycloak.adapters.KeycloakDeploymentBuilder.loadAdapterConfig(KeycloakDeploymentBuilder.java:135)
>> > [keycloak-adapter-core-2.0.0.Final.jar:2.0.0.Final]
>> >
>> > ... 14 more
>> >
>> >
>> > 10:57:15,973 ERROR [org.apache.catalina.core] (ServerService Thread
>> Pool --
>> > 69) JBWEB001103: Error detected during context /data start, will stop it
>> >
>> > 10:57:15,985 ERROR [org.jboss.msc.service.fail] (ServerService Thread
>> Pool
>> > -- 69) MSC000001: Failed to start service
>> > jboss.web.deployment.default-host./data:
>> > org.jboss.msc.service.StartException in service
>> > jboss.web.deployment.default-host./data:
>> > org.jboss.msc.service.StartException in anonymous service: JBAS018040:
>> > Failed to start context
>> >
>> > at
>> >
>> org.jboss.as.web.deployment.WebDeploymentService$1.run(WebDeploymentService.java:99)
>> >
>> > at
>> java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:471)
>> > [rt.jar:1.7.0_80]
>> >
>> > at java.util.concurrent.FutureTask.run(FutureTask.java:262)
>> > [rt.jar:1.7.0_80]
>> >
>> > at
>> >
>> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)
>> > [rt.jar:1.7.0_80]
>> >
>> > at
>> >
>> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)
>> > [rt.jar:1.7.0_80]
>> >
>> > at java.lang.Thread.run(Thread.java:745) [rt.jar:1.7.0_80]
>> >
>> > at org.jboss.threads.JBossThread.run(JBossThread.java:122)
>> >
>> > Caused by: org.jboss.msc.service.StartException in anonymous service:
>> > JBAS018040: Failed to start context
>> >
>> > at
>> >
>> org.jboss.as.web.deployment.WebDeploymentService.doStart(WebDeploymentService.java:168)
>> >
>> > at
>> >
>> org.jboss.as.web.deployment.WebDeploymentService.access$000(WebDeploymentService.java:61)
>> >
>> > at
>> >
>> org.jboss.as.web.deployment.WebDeploymentService$1.run(WebDeploymentService.java:96)
>> >
>> > ... 6 more
>> >
>> >
>> > 10:57:16,019 ERROR [org.jboss.as.controller.management-operation]
>> > (Controller Boot Thread) JBAS014612: Operation ("deploy") failed -
>> address:
>> > ([("deployment" =>
>> "webims-jcom-data-1.3.1-SNAPSHOT-secure-keycloak.war")])
>> > - failure description: {"JBAS014671: Failed services" =>
>> > {"jboss.web.deployment.default-host./data" =>
>> > "org.jboss.msc.service.StartException in service
>> > jboss.web.deployment.default-host./data:
>> > org.jboss.msc.service.StartException in anonymous service: JBAS018040:
>> > Failed to start context
>> >
>> >     Caused by: org.jboss.msc.service.StartException in anonymous
>> service:
>> > JBAS018040: Failed to start context"}}
>> >
>> >
>> >
>> >
>> >
>> >
>> > On Sat, Jul 9, 2016 at 7:38 AM, Bruno Oliveira <bruno at abstractj.org>
>> wrote:
>> >
>> > > As far as I can tell, yes.
>> > >
>> > > See:
>> > >
>> > >
>> https://keycloak.gitbooks.io/server-adminstration-guide/content/topics/clients/client-oidc.html
>> > >
>> > >
>> https://github.com/keycloak/keycloak/blob/5c98b8c6ae7052b2d906156d8fc212ccd9dfd57d/services/src/main/java/org/keycloak/services/resources/Cors.java#L143
>> > >
>> > > On 2016-07-08, Hubert Przybysz wrote:
>> > > > Hi,
>> > > >
>> > > > Is configuration of CORS Access-Control-Expose-Headers supported in
>> > > > 2.0.0.Final adapters?
>> > > >
>> > > > Best regards / Hubert.
>> > >
>> > > > _______________________________________________
>> > > > keycloak-user mailing list
>> > > > keycloak-user at lists.jboss.org
>> > > > https://lists.jboss.org/mailman/listinfo/keycloak-user
>> > >
>> > >
>> > > --
>> > >
>> > > abstractj
>> > > PGP: 0x84DC9914
>> > >
>>
>> --
>>
>> abstractj
>> PGP: 0x84DC9914
>>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160711/1a5ff1d6/attachment-0001.html 

From h.p.przybysz at gmail.com  Mon Jul 11 14:25:50 2016
From: h.p.przybysz at gmail.com (Hubert Przybysz)
Date: Mon, 11 Jul 2016 20:25:50 +0200
Subject: [keycloak-user] Support for CORS Access-Control-Expose-Headers
	in 2.0.0.Final
In-Reply-To: <CAM5SUC44a5CFm5fh0Ac5k=26nkHMz6vgYh4TDvZiq1Fd=+wWTQ@mail.gmail.com>
References: <CAJMEJTW7aZZeHRDinB66PDTfMaZ3aHLs8VNrx=xTNPJ+qqCORg@mail.gmail.com>
	<20160709053836.GA23953@abstractj.org>
	<CAJMEJTU0OzN_2axzBypNeL268iyZBk4ca6i6nTdyLkv8t+nhQg@mail.gmail.com>
	<20160711161310.GA7375@abstractj.org>
	<CAJMEJTUKHG8oNp5ni8ZECfezeideXntDpdEbgVkXYKcTMaBY4g@mail.gmail.com>
	<CAM5SUC44a5CFm5fh0Ac5k=26nkHMz6vgYh4TDvZiq1Fd=+wWTQ@mail.gmail.com>
Message-ID: <CAJMEJTXCO=LWoFM3KPTi7hqBKJE4YBjGTZGx52r8Zcxz5SY3-w@mail.gmail.com>

I have created KEYCLOAK-3297 <https://issues.jboss.org/browse/KEYCLOAK-3297>
 .

On Mon, Jul 11, 2016 at 7:29 PM, Bruno Oliveira <bruno at abstractj.org> wrote:

> Please, go ahead and create one. I couldn't find any Jira related to this.
>
> On Mon, Jul 11, 2016 at 1:36 PM Hubert Przybysz <h.p.przybysz at gmail.com>
> wrote:
>
>> Does anyone know when it will be possible to configure the adapters with
>> CORS expose headers?
>>
>> I don't find any jira for it.
>>
>> Br / Hubert.
>>
>> On Mon, Jul 11, 2016 at 6:13 PM, Bruno Oliveira <bruno at abstractj.org>
>> wrote:
>>
>>> You are right Hubert it's not supported at keycloak.json file, I just
>>> overlooked the code.
>>> Sorry about that.
>>>
>>> On 2016-07-11, Hubert Przybysz wrote:
>>> > Thanks for the info.
>>> >
>>> > I've tried configuring cors-exposed-headers in a JBOSS EAP 6 adapter
>>> like
>>> > this:
>>> >
>>> > keycloak.json:
>>> > {
>>> > ...
>>> >
>>> >   "enable-cors" : true,
>>> >
>>> >   "cors-allowed-methods" : "POST,PUT,DELETE,GET",
>>> >
>>> >   "cors-allowed-headers" :
>>> > "Accept,Content-Type,If-Match,If-None-Match,Origin",
>>> >
>>> >   "cors-exposed-headers" : "ETag,Location",
>>> >
>>> > ...
>>> >
>>> > }
>>> >
>>> >
>>> > But the adapter does not recognise this config and fails to start:
>>> >
>>> > 10:57:15,923 ERROR [org.apache.catalina.core] (ServerService Thread
>>> Pool --
>>> > 69) JBWEB001097: Error starting context /data:
>>> java.lang.RuntimeException:
>>> > com.fasterxml.jackson.databind.exc.UnrecognizedPropertyException:
>>> > Unrecognized field "cors-exposed-headers" (class
>>> > org.keycloak.representations.adapters.config.AdapterConfig), not
>>> marked as
>>> > ignorable (32 known properties: "ssl-required", "cors-allowed-headers",
>>> > "register-node-period", "turn-off-change-session-id-on-login",
>>> > "truststore", "always-refresh-token", "client-key-password",
>>> > "policy-enforcer", "token-store", "resource", "realm", "proxy-url",
>>> > "disable-trust-manager", "bearer-only", "truststore-password",
>>> > "use-resource-role-mappings", "connection-pool-size",
>>> "client-keystore",
>>> > "register-node-at-startup", "client-keystore-password",
>>> "auth-server-url",
>>> > "cors-allowed-methods", "public-client", "expose-token",
>>> > "token-minimum-time-to-live", "enable-basic-auth", "cors-max-age",
>>> > "enable-cors", "allow-any-hostname", "realm-public-key", "credentials",
>>> > "principal-attribute"])
>>> >
>>> >  at [Source: java.io.ByteArrayInputStream at 67593e31; line: 14, column:
>>> 29]
>>> > (through reference chain:
>>> >
>>> org.keycloak.representations.adapters.config.AdapterConfig["cors-exposed-headers"])
>>> >
>>> > at
>>> >
>>> org.keycloak.adapters.KeycloakDeploymentBuilder.loadAdapterConfig(KeycloakDeploymentBuilder.java:137)
>>> > [keycloak-adapter-core-2.0.0.Final.jar:2.0.0.Final]
>>> >
>>> > at
>>> >
>>> org.keycloak.adapters.KeycloakDeploymentBuilder.build(KeycloakDeploymentBuilder.java:126)
>>> > [keycloak-adapter-core-2.0.0.Final.jar:2.0.0.Final]
>>> >
>>> > at
>>> >
>>> org.keycloak.adapters.tomcat.AbstractKeycloakAuthenticatorValve.keycloakInit(AbstractKeycloakAuthenticatorValve.java:133)
>>> > [keycloak-tomcat-core-adapter-2.0.0.Final.jar:2.0.0.Final]
>>> >
>>> > at
>>> >
>>> org.keycloak.adapters.tomcat.AbstractKeycloakAuthenticatorValve.lifecycleEvent(AbstractKeycloakAuthenticatorValve.java:75)
>>> > [keycloak-tomcat-core-adapter-2.0.0.Final.jar:2.0.0.Final]
>>> >
>>> > at
>>> >
>>> org.apache.catalina.util.LifecycleSupport.fireLifecycleEvent(LifecycleSupport.java:115)
>>> > [jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]
>>> >
>>> > at
>>> >
>>> org.apache.catalina.core.StandardContext.start(StandardContext.java:3775)
>>> > [jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]
>>> >
>>> > at
>>> >
>>> org.jboss.as.web.deployment.WebDeploymentService.doStart(WebDeploymentService.java:163)
>>> > [jboss-as-web-7.5.0.Final-redhat-21.jar:7.5.0.Final-redhat-21]
>>> >
>>> > at
>>> >
>>> org.jboss.as.web.deployment.WebDeploymentService.access$000(WebDeploymentService.java:61)
>>> > [jboss-as-web-7.5.0.Final-redhat-21.jar:7.5.0.Final-redhat-21]
>>> >
>>> > at
>>> >
>>> org.jboss.as.web.deployment.WebDeploymentService$1.run(WebDeploymentService.java:96)
>>> > [jboss-as-web-7.5.0.Final-redhat-21.jar:7.5.0.Final-redhat-21]
>>> >
>>> > at
>>> java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:471)
>>> > [rt.jar:1.7.0_80]
>>> >
>>> > at java.util.concurrent.FutureTask.run(FutureTask.java:262)
>>> > [rt.jar:1.7.0_80]
>>> >
>>> > at
>>> >
>>> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)
>>> > [rt.jar:1.7.0_80]
>>> >
>>> > at
>>> >
>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)
>>> > [rt.jar:1.7.0_80]
>>> >
>>> > at java.lang.Thread.run(Thread.java:745) [rt.jar:1.7.0_80]
>>> >
>>> > at org.jboss.threads.JBossThread.run(JBossThread.java:122)
>>> >
>>> > Caused by:
>>> > com.fasterxml.jackson.databind.exc.UnrecognizedPropertyException:
>>> > Unrecognized field "cors-exposed-headers" (class
>>> > org.keycloak.representations.adapters.config.AdapterConfig), not
>>> marked as
>>> > ignorable (32 known properties: "ssl-required", "cors-allowed-headers",
>>> > "register-node-period", "turn-off-change-session-id-on-login",
>>> > "truststore", "always-refresh-token", "client-key-password",
>>> > "policy-enforcer", "token-store", "resource", "realm", "proxy-url",
>>> > "disable-trust-manager", "bearer-only", "truststore-password",
>>> > "use-resource-role-mappings", "connection-pool-size",
>>> "client-keystore",
>>> > "register-node-at-startup", "client-keystore-password",
>>> "auth-server-url",
>>> > "cors-allowed-methods", "public-client", "expose-token",
>>> > "token-minimum-time-to-live", "enable-basic-auth", "cors-max-age",
>>> > "enable-cors", "allow-any-hostname", "realm-public-key", "credentials",
>>> > "principal-attribute"])
>>> >
>>> >  at [Source: java.io.ByteArrayInputStream at 67593e31; line: 14, column:
>>> 29]
>>> > (through reference chain:
>>> >
>>> org.keycloak.representations.adapters.config.AdapterConfig["cors-exposed-headers"])
>>> >
>>> > at
>>> >
>>> com.fasterxml.jackson.databind.exc.UnrecognizedPropertyException.from(UnrecognizedPropertyException.java:51)
>>> >
>>> > at
>>> >
>>> com.fasterxml.jackson.databind.DeserializationContext.reportUnknownProperty(DeserializationContext.java:817)
>>> >
>>> > at
>>> >
>>> com.fasterxml.jackson.databind.deser.std.StdDeserializer.handleUnknownProperty(StdDeserializer.java:958)
>>> >
>>> > at
>>> >
>>> com.fasterxml.jackson.databind.deser.BeanDeserializerBase.handleUnknownProperty(BeanDeserializerBase.java:1324)
>>> >
>>> > at
>>> >
>>> com.fasterxml.jackson.databind.deser.BeanDeserializerBase.handleUnknownVanilla(BeanDeserializerBase.java:1302)
>>> >
>>> > at
>>> >
>>> com.fasterxml.jackson.databind.deser.BeanDeserializer.vanillaDeserialize(BeanDeserializer.java:249)
>>> >
>>> > at
>>> >
>>> com.fasterxml.jackson.databind.deser.BeanDeserializer.deserialize(BeanDeserializer.java:136)
>>> >
>>> > at
>>> >
>>> com.fasterxml.jackson.databind.ObjectMapper._readMapAndClose(ObjectMapper.java:3564)
>>> >
>>> > at
>>> >
>>> com.fasterxml.jackson.databind.ObjectMapper.readValue(ObjectMapper.java:2650)
>>> >
>>> > at
>>> >
>>> org.keycloak.adapters.KeycloakDeploymentBuilder.loadAdapterConfig(KeycloakDeploymentBuilder.java:135)
>>> > [keycloak-adapter-core-2.0.0.Final.jar:2.0.0.Final]
>>> >
>>> > ... 14 more
>>> >
>>> >
>>> > 10:57:15,973 ERROR [org.apache.catalina.core] (ServerService Thread
>>> Pool --
>>> > 69) JBWEB001103: Error detected during context /data start, will stop
>>> it
>>> >
>>> > 10:57:15,985 ERROR [org.jboss.msc.service.fail] (ServerService Thread
>>> Pool
>>> > -- 69) MSC000001: Failed to start service
>>> > jboss.web.deployment.default-host./data:
>>> > org.jboss.msc.service.StartException in service
>>> > jboss.web.deployment.default-host./data:
>>> > org.jboss.msc.service.StartException in anonymous service: JBAS018040:
>>> > Failed to start context
>>> >
>>> > at
>>> >
>>> org.jboss.as.web.deployment.WebDeploymentService$1.run(WebDeploymentService.java:99)
>>> >
>>> > at
>>> java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:471)
>>> > [rt.jar:1.7.0_80]
>>> >
>>> > at java.util.concurrent.FutureTask.run(FutureTask.java:262)
>>> > [rt.jar:1.7.0_80]
>>> >
>>> > at
>>> >
>>> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)
>>> > [rt.jar:1.7.0_80]
>>> >
>>> > at
>>> >
>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)
>>> > [rt.jar:1.7.0_80]
>>> >
>>> > at java.lang.Thread.run(Thread.java:745) [rt.jar:1.7.0_80]
>>> >
>>> > at org.jboss.threads.JBossThread.run(JBossThread.java:122)
>>> >
>>> > Caused by: org.jboss.msc.service.StartException in anonymous service:
>>> > JBAS018040: Failed to start context
>>> >
>>> > at
>>> >
>>> org.jboss.as.web.deployment.WebDeploymentService.doStart(WebDeploymentService.java:168)
>>> >
>>> > at
>>> >
>>> org.jboss.as.web.deployment.WebDeploymentService.access$000(WebDeploymentService.java:61)
>>> >
>>> > at
>>> >
>>> org.jboss.as.web.deployment.WebDeploymentService$1.run(WebDeploymentService.java:96)
>>> >
>>> > ... 6 more
>>> >
>>> >
>>> > 10:57:16,019 ERROR [org.jboss.as.controller.management-operation]
>>> > (Controller Boot Thread) JBAS014612: Operation ("deploy") failed -
>>> address:
>>> > ([("deployment" =>
>>> "webims-jcom-data-1.3.1-SNAPSHOT-secure-keycloak.war")])
>>> > - failure description: {"JBAS014671: Failed services" =>
>>> > {"jboss.web.deployment.default-host./data" =>
>>> > "org.jboss.msc.service.StartException in service
>>> > jboss.web.deployment.default-host./data:
>>> > org.jboss.msc.service.StartException in anonymous service: JBAS018040:
>>> > Failed to start context
>>> >
>>> >     Caused by: org.jboss.msc.service.StartException in anonymous
>>> service:
>>> > JBAS018040: Failed to start context"}}
>>> >
>>> >
>>> >
>>> >
>>> >
>>> >
>>> > On Sat, Jul 9, 2016 at 7:38 AM, Bruno Oliveira <bruno at abstractj.org>
>>> wrote:
>>> >
>>> > > As far as I can tell, yes.
>>> > >
>>> > > See:
>>> > >
>>> > >
>>> https://keycloak.gitbooks.io/server-adminstration-guide/content/topics/clients/client-oidc.html
>>> > >
>>> > >
>>> https://github.com/keycloak/keycloak/blob/5c98b8c6ae7052b2d906156d8fc212ccd9dfd57d/services/src/main/java/org/keycloak/services/resources/Cors.java#L143
>>> > >
>>> > > On 2016-07-08, Hubert Przybysz wrote:
>>> > > > Hi,
>>> > > >
>>> > > > Is configuration of CORS Access-Control-Expose-Headers supported in
>>> > > > 2.0.0.Final adapters?
>>> > > >
>>> > > > Best regards / Hubert.
>>> > >
>>> > > > _______________________________________________
>>> > > > keycloak-user mailing list
>>> > > > keycloak-user at lists.jboss.org
>>> > > > https://lists.jboss.org/mailman/listinfo/keycloak-user
>>> > >
>>> > >
>>> > > --
>>> > >
>>> > > abstractj
>>> > > PGP: 0x84DC9914
>>> > >
>>>
>>> --
>>>
>>> abstractj
>>> PGP: 0x84DC9914
>>>
>>
>>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160711/c818ce3b/attachment.html 

From mposolda at redhat.com  Mon Jul 11 15:52:05 2016
From: mposolda at redhat.com (Marek Posolda)
Date: Mon, 11 Jul 2016 21:52:05 +0200
Subject: [keycloak-user] API Token param
In-Reply-To: <CA+waeaVs=mcEg2EJG93eZ0mqLX3-0LeScBvDN_2FfapknNF7pA@mail.gmail.com>
References: <CA+waeaWBYEBUQ49Y2KUy+wqQ7tFzmcdgGNw8KskM8PnE8vYY7w@mail.gmail.com>
	<20160707202728.GA20655@abstractj.org>
	<CA+waeaVs=mcEg2EJG93eZ0mqLX3-0LeScBvDN_2FfapknNF7pA@mail.gmail.com>
Message-ID: <5783F8E5.6050100@redhat.com>

You can set some additional parameters to Authentication Request (the 
initial request from your app to the Keycloak) and every additional 
parameter will be then saved to the clientSession note like 
"client_request_param_foo" in case that name of your parameter is "foo" 
. Then you can create ProtocolMapper implementation, which will read the 
clientSession note and put the info as claim to the token. You can take 
a look at

org.keycloak.protocol.oidc.mappers.UserSessionNoteMapper for inspiration - the only difference is, that you will need to call clientSession.getNote instead of userSession.getNote.

Marek


On 11/07/16 18:45, Harry Trinta wrote:
> I would like to save some notes about the app and/or the user in the 
> token. For example, if the token is from a session that is being 
> impersonated.
>
> 2016-07-07 17:27 GMT-03:00 Bruno Oliveira <bruno at abstractj.org 
> <mailto:bruno at abstractj.org>>:
>
>     I don't think that's possible. What exactly would you like to do?
>
>     On 2016-07-07, Harry Trinta wrote:
>     > Hi,
>     >
>     > When authenticate through the API token
>     ("*/openid-connect/token"), is
>     > possible to send a parameter (key/value) and this parameter be
>     added to
>     > access_token?
>     >
>     > Regards,
>     >
>     > Harry
>
>     > _______________________________________________
>     > keycloak-user mailing list
>     > keycloak-user at lists.jboss.org <mailto:keycloak-user at lists.jboss.org>
>     > https://lists.jboss.org/mailman/listinfo/keycloak-user
>
>
>     --
>
>     abstractj
>     PGP: 0x84DC9914
>
>
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160711/d494d9fc/attachment-0001.html 

From mposolda at redhat.com  Mon Jul 11 15:55:32 2016
From: mposolda at redhat.com (Marek Posolda)
Date: Mon, 11 Jul 2016 21:55:32 +0200
Subject: [keycloak-user] Social login Issue
In-Reply-To: <CALHbiGLy-H9hC21ge8D8dT4WOgd1eStkw6cnvB6i0-D-bwaD3w@mail.gmail.com>
References: <CALHbiGLy-H9hC21ge8D8dT4WOgd1eStkw6cnvB6i0-D-bwaD3w@mail.gmail.com>
Message-ID: <5783F9B4.9050805@redhat.com>

AFAIK this is not yet possible. However you can create your own 
implementation of Authenticator and setup the Direct Grant flow with 
your custom authenticator implementation, which will be able to 
authenticate with social token. Maybe it's something, which we should 
better support OOTB...

Marek

On 11/07/16 17:24, Tom Pearson wrote:
> Hi,
>
> I'm currently part of a team implementing a single sign on solution 
> using Open ID Connect and Keycloak.
>
> We have a number of services which all interact with a central Json 
> Rest API. The API is secured according to the second Open ID Connect 
> use case as described in the Keycloak docs 
> <https://keycloak.gitbooks.io/securing-client-applications-guide/content/v/2.0/topics/overview/supported-protocols.html>. That 
> is to say, all API clients must obtain a digitally signed access token 
> from Keycloak and then pass it over on every request (in our case, 
> within the Authorization header).
>
> One of the services is a native mobile application. This application 
> already has social login/registration implemented and the team would 
> prefer not to redirect to Keycloak as per the standard authorization 
> code flow. Instead, they would like to obtain a Keycloak access token 
> using the previously obtained social login credentials.
>
> This seems to pose a problem as the direct grant flow doesn't support 
> social login. Is there any way to achieve this?
>
> Kind Regards,
> Tom Pearson
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160711/76bacd23/attachment.html 

From fabricio.milone at shinetech.com  Mon Jul 11 18:21:54 2016
From: fabricio.milone at shinetech.com (Fabricio Milone)
Date: Tue, 12 Jul 2016 08:21:54 +1000
Subject: [keycloak-user] Logout 100k users produces an Exception
In-Reply-To: <57834088.70806@redhat.com>
References: <CAOjtoUOoh4zKcrm4Z8k_dpExUEaeSpc32NhB8KQnjUYQVPW3kg@mail.gmail.com>
	<57834088.70806@redhat.com>
Message-ID: <CAOjtoUON6T4n5BhBcUcJHPp4Xfd-gD-tkOYt_=KodAXczA7X5g@mail.gmail.com>

Thanks Marek,

I was looking into that method yesterday as well, with a huge amount of
sessions the Sessions screen performs very slowly as well, so I will create
a Jira ticket to track this.

Regards,
Fab

On 11 July 2016 at 16:45, Marek Posolda <mposolda at redhat.com> wrote:

> It seems that bulk removal of userSessions is not very effective. It loads
> all the sessions locally from the remote nodes and then remove them one by
> one
> https://github.com/keycloak/keycloak/blob/master/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/InfinispanUserSessionProvider.java#L286-290
> . Hopefully infinispan has a way that you will trigger task for "visit"
> sessions, which should be removed. Then you will directly remove the
> sessions on the node, where they live, in single step.
>
> Maybe there are more such bulk operations, which can be improved in
> similar way. Could you please create JIRA for it?
>
> Thanks,
> Marek
>
>
> On 11/07/16 01:31, Fabricio Milone wrote:
>
> Hi all,
>
> I have this issue with my current configuration on Keycloak 2.0.0 where
> after creating more than 100k sessions (or much less than that, but I don't
> know the exact number), when I try to log out all of them from the admin
> console I got an UI error after some seconds and the exception at the end
> of my email. The process does not finish as expected and the sessions are
> still there.
>
> I have 12 nodes running in the network with all my users going through a
> federator and everything is working as expected so far in terms of
> functionality.
>
> Is there any server side configuration I can tune to avoid this?
>
> Thanks in advance!
>
> Regads,
> Fab
>
> 2016-07-11 08:15:34,334 ERROR [org.keycloak.services] (Timer-2)
>>> KC-SERVICES0089: Failed to run scheduled task ClearExpiredUserSessions:
>>> org.infinispan.util.concurrent.TimeoutException: Replication timeout for
>>> identityapp06l3
>>
>> at
>>> org.infinispan.remoting.transport.jgroups.JGroupsTransport.checkRsp(JGroupsTransport.java:765)
>>
>> at
>>> org.infinispan.remoting.transport.jgroups.JGroupsTransport.lambda$invokeRemotelyAsync$72(JGroupsTransport.java:599)
>>
>> at
>>> org.infinispan.remoting.transport.jgroups.JGroupsTransport$$Lambda$106/1829642022.apply(Unknown
>>> Source)
>>
>> at java.util.concurrent.CompletableFuture$ThenApply.run(Unknown Source)
>>
>> at java.util.concurrent.CompletableFuture.postComplete(Unknown Source)
>>
>> at java.util.concurrent.CompletableFuture.complete(Unknown Source)
>>
>> at
>>> org.infinispan.remoting.transport.jgroups.SingleResponseFuture.call(SingleResponseFuture.java:46)
>>
>> at
>>> org.infinispan.remoting.transport.jgroups.SingleResponseFuture.call(SingleResponseFuture.java:17)
>>
>> at java.util.concurrent.FutureTask.run(Unknown Source)
>>
>> at
>>> java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$201(Unknown
>>> Source)
>>
>> at
>>> java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(Unknown
>>> Source)
>>
>> at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source)
>>
>> at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)
>>
>> at java.lang.Thread.run(Unknown Source)
>>
>>
>>> 2016-07-11 08:28:52,374 WARN
>>>  [org.infinispan.interceptors.locking.NonTransactionalLockingInterceptor]
>>> (remote-thread--p7-t1116) ISPN000135: Could not lock key
>>> 43bcf8ef-c40b-48de-9f20-a118843cfc30 in order to invalidate from L1 at node
>>> identityapp01l3, skipping....
>>
>> 2016-07-11 08:30:34,385 ERROR [org.keycloak.services] (Timer-2)
>>> KC-SERVICES0089: Failed to run scheduled task ClearExpiredUserSessions:
>>> org.infinispan.util.concurrent.TimeoutException: Replication timeout for
>>> identityapp06l3
>>
>> at
>>> org.infinispan.remoting.transport.jgroups.JGroupsTransport.checkRsp(JGroupsTransport.java:765)
>>
>> at
>>> org.infinispan.remoting.transport.jgroups.JGroupsTransport.lambda$invokeRemotelyAsync$72(JGroupsTransport.java:599)
>>
>> at
>>> org.infinispan.remoting.transport.jgroups.JGroupsTransport$$Lambda$106/1829642022.apply(Unknown
>>> Source)
>>
>> at java.util.concurrent.CompletableFuture$ThenApply.run(Unknown Source)
>>
>> at java.util.concurrent.CompletableFuture.postComplete(Unknown Source)
>>
>> at java.util.concurrent.CompletableFuture.complete(Unknown Source)
>>
>> at
>>> org.infinispan.remoting.transport.jgroups.SingleResponseFuture.call(SingleResponseFuture.java:46)
>>
>> at
>>> org.infinispan.remoting.transport.jgroups.SingleResponseFuture.call(SingleResponseFuture.java:17)
>>
>> at java.util.concurrent.FutureTask.run(Unknown Source)
>>
>> at
>>> java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$201(Unknown
>>> Source)
>>
>> at
>>> java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(Unknown
>>> Source)
>>
>> at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source)
>>
>> at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)
>>
>> at java.lang.Thread.run(Unknown Source)
>>
>>
>>> 2016-07-11 08:35:41,792 ERROR [io.undertow.request] (default task-60)
>>> UT005023: Exception handling request to
>>> /auth/admin/realms/electricsheep/logout-all:
>>> org.jboss.resteasy.spi.UnhandledException:
>>> org.infinispan.util.concurrent.TimeoutException: Replication timeout for
>>> identityapp06l3
>>
>> at
>>> org.jboss.resteasy.core.ExceptionHandler.handleApplicationException(ExceptionHandler.java:76)
>>
>> at
>>> org.jboss.resteasy.core.ExceptionHandler.handleException(ExceptionHandler.java:212)
>>
>> at
>>> org.jboss.resteasy.core.SynchronousDispatcher.writeException(SynchronousDispatcher.java:168)
>>
>> at
>>> org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:411)
>>
>> at
>>> org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:202)
>>
>> at
>>> org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.service(ServletContainerDispatcher.java:221)
>>
>> at
>>> org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:56)
>>
>> at
>>> org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:51)
>>
>> at javax.servlet.http.HttpServlet.service(HttpServlet.java:790)
>>
>> at
>>> io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:85)
>>
>> at
>>> io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:129)
>>
>> at
>>> org.keycloak.services.filters.KeycloakSessionServletFilter.doFilter(KeycloakSessionServletFilter.java:107)
>>
>> at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:60)
>>
>> at
>>> io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
>>
>> at
>>> io.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.java:84)
>>
>> at
>>> io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:62)
>>
>> at
>>> io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36)
>>
>> at
>>> org.wildfly.extension.undertow.security.SecurityContextAssociationHandler.handleRequest(SecurityContextAssociationHandler.java:78)
>>
>> at
>>> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
>>
>> at
>>> io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:131)
>>
>> at
>>> io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:57)
>>
>> at
>>> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
>>
>> at
>>> io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:46)
>>
>> at
>>> io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64)
>>
>> at
>>> io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:60)
>>
>> at
>>> io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:77)
>>
>> at
>>> io.undertow.security.handlers.NotificationReceiverHandler.handleRequest(NotificationReceiverHandler.java:50)
>>
>> at
>>> io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43)
>>
>> at
>>> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
>>
>> at
>>> org.wildfly.extension.undertow.security.jacc.JACCContextIdHandler.handleRequest(JACCContextIdHandler.java:61)
>>
>> at
>>> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
>>
>> at
>>> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
>>
>> at
>>> io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:284)
>>
>> at
>>> io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:263)
>>
>> at
>>> io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:81)
>>
>> at
>>> io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:174)
>>
>> at io.undertow.server.Connectors.executeRootHandler(Connectors.java:202)
>>
>> at
>>> io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:793)
>>
>> at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source)
>>
>> at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)
>>
>> at java.lang.Thread.run(Unknown Source)
>>
>> Caused by: org.infinispan.util.concurrent.TimeoutException: Replication
>>> timeout for identityapp06l3
>>
>> at
>>> org.infinispan.remoting.transport.jgroups.JGroupsTransport.checkRsp(JGroupsTransport.java:765)
>>
>> at
>>> org.infinispan.remoting.transport.jgroups.JGroupsTransport.lambda$invokeRemotelyAsync$72(JGroupsTransport.java:599)
>>
>> at
>>> org.infinispan.remoting.transport.jgroups.JGroupsTransport$$Lambda$106/1829642022.apply(Unknown
>>> Source)
>>
>> at java.util.concurrent.CompletableFuture$ThenApply.run(Unknown Source)
>>
>> at java.util.concurrent.CompletableFuture.postComplete(Unknown Source)
>>
>> at java.util.concurrent.CompletableFuture.complete(Unknown Source)
>>
>> at
>>> org.infinispan.remoting.transport.jgroups.SingleResponseFuture.call(SingleResponseFuture.java:46)
>>
>> at
>>> org.infinispan.remoting.transport.jgroups.SingleResponseFuture.call(SingleResponseFuture.java:17)
>>
>> at java.util.concurrent.FutureTask.run(Unknown Source)
>>
>> at
>>> java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$201(Unknown
>>> Source)
>>
>> at
>>> java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(Unknown
>>> Source)
>>
>> ... 3 more
>>
>>
> --
> *Fabricio Milone*
> Developer
>
> * Shine Consulting *
>
> 30/600 Bourke Street
>
> Melbourne VIC 3000
>
> T: 03 8488 9939
>
> M: 04 3200 4006
>
>
> www.shinetech.com  *a* passion for excellence
>
>
> _______________________________________________
> keycloak-user mailing listkeycloak-user at lists.jboss.orghttps://lists.jboss.org/mailman/listinfo/keycloak-user
>
>
>


-- 
*Fabricio Milone*
Developer

*Shine Consulting *

30/600 Bourke Street

Melbourne VIC 3000

T: 03 8488 9939

M: 04 3200 4006


www.shinetech.com  *a* passion for excellence
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160712/b094c785/attachment-0001.html 

From sthorger at redhat.com  Tue Jul 12 01:17:30 2016
From: sthorger at redhat.com (Stian Thorgersen)
Date: Tue, 12 Jul 2016 07:17:30 +0200
Subject: [keycloak-user] Support for CORS Access-Control-Expose-Headers
	in 2.0.0.Final
In-Reply-To: <CAJMEJTXCO=LWoFM3KPTi7hqBKJE4YBjGTZGx52r8Zcxz5SY3-w@mail.gmail.com>
References: <CAJMEJTW7aZZeHRDinB66PDTfMaZ3aHLs8VNrx=xTNPJ+qqCORg@mail.gmail.com>
	<20160709053836.GA23953@abstractj.org>
	<CAJMEJTU0OzN_2axzBypNeL268iyZBk4ca6i6nTdyLkv8t+nhQg@mail.gmail.com>
	<20160711161310.GA7375@abstractj.org>
	<CAJMEJTUKHG8oNp5ni8ZECfezeideXntDpdEbgVkXYKcTMaBY4g@mail.gmail.com>
	<CAM5SUC44a5CFm5fh0Ac5k=26nkHMz6vgYh4TDvZiq1Fd=+wWTQ@mail.gmail.com>
	<CAJMEJTXCO=LWoFM3KPTi7hqBKJE4YBjGTZGx52r8Zcxz5SY3-w@mail.gmail.com>
Message-ID: <CAJgngAfL2jGJSeyL1_zxj+3jp6u_W8QDEiPxhuU1u6ac8F9xQg@mail.gmail.com>

I changed that issue to a feature request, since we've never supported it
it's not a bug.

On 11 July 2016 at 20:25, Hubert Przybysz <h.p.przybysz at gmail.com> wrote:

> I have created KEYCLOAK-3297
> <https://issues.jboss.org/browse/KEYCLOAK-3297> .
>
> On Mon, Jul 11, 2016 at 7:29 PM, Bruno Oliveira <bruno at abstractj.org>
> wrote:
>
>> Please, go ahead and create one. I couldn't find any Jira related to this.
>>
>> On Mon, Jul 11, 2016 at 1:36 PM Hubert Przybysz <h.p.przybysz at gmail.com>
>> wrote:
>>
>>> Does anyone know when it will be possible to configure the adapters with
>>> CORS expose headers?
>>>
>>> I don't find any jira for it.
>>>
>>> Br / Hubert.
>>>
>>> On Mon, Jul 11, 2016 at 6:13 PM, Bruno Oliveira <bruno at abstractj.org>
>>> wrote:
>>>
>>>> You are right Hubert it's not supported at keycloak.json file, I just
>>>> overlooked the code.
>>>> Sorry about that.
>>>>
>>>> On 2016-07-11, Hubert Przybysz wrote:
>>>> > Thanks for the info.
>>>> >
>>>> > I've tried configuring cors-exposed-headers in a JBOSS EAP 6 adapter
>>>> like
>>>> > this:
>>>> >
>>>> > keycloak.json:
>>>> > {
>>>> > ...
>>>> >
>>>> >   "enable-cors" : true,
>>>> >
>>>> >   "cors-allowed-methods" : "POST,PUT,DELETE,GET",
>>>> >
>>>> >   "cors-allowed-headers" :
>>>> > "Accept,Content-Type,If-Match,If-None-Match,Origin",
>>>> >
>>>> >   "cors-exposed-headers" : "ETag,Location",
>>>> >
>>>> > ...
>>>> >
>>>> > }
>>>> >
>>>> >
>>>> > But the adapter does not recognise this config and fails to start:
>>>> >
>>>> > 10:57:15,923 ERROR [org.apache.catalina.core] (ServerService Thread
>>>> Pool --
>>>> > 69) JBWEB001097: Error starting context /data:
>>>> java.lang.RuntimeException:
>>>> > com.fasterxml.jackson.databind.exc.UnrecognizedPropertyException:
>>>> > Unrecognized field "cors-exposed-headers" (class
>>>> > org.keycloak.representations.adapters.config.AdapterConfig), not
>>>> marked as
>>>> > ignorable (32 known properties: "ssl-required",
>>>> "cors-allowed-headers",
>>>> > "register-node-period", "turn-off-change-session-id-on-login",
>>>> > "truststore", "always-refresh-token", "client-key-password",
>>>> > "policy-enforcer", "token-store", "resource", "realm", "proxy-url",
>>>> > "disable-trust-manager", "bearer-only", "truststore-password",
>>>> > "use-resource-role-mappings", "connection-pool-size",
>>>> "client-keystore",
>>>> > "register-node-at-startup", "client-keystore-password",
>>>> "auth-server-url",
>>>> > "cors-allowed-methods", "public-client", "expose-token",
>>>> > "token-minimum-time-to-live", "enable-basic-auth", "cors-max-age",
>>>> > "enable-cors", "allow-any-hostname", "realm-public-key",
>>>> "credentials",
>>>> > "principal-attribute"])
>>>> >
>>>> >  at [Source: java.io.ByteArrayInputStream at 67593e31; line: 14,
>>>> column: 29]
>>>> > (through reference chain:
>>>> >
>>>> org.keycloak.representations.adapters.config.AdapterConfig["cors-exposed-headers"])
>>>> >
>>>> > at
>>>> >
>>>> org.keycloak.adapters.KeycloakDeploymentBuilder.loadAdapterConfig(KeycloakDeploymentBuilder.java:137)
>>>> > [keycloak-adapter-core-2.0.0.Final.jar:2.0.0.Final]
>>>> >
>>>> > at
>>>> >
>>>> org.keycloak.adapters.KeycloakDeploymentBuilder.build(KeycloakDeploymentBuilder.java:126)
>>>> > [keycloak-adapter-core-2.0.0.Final.jar:2.0.0.Final]
>>>> >
>>>> > at
>>>> >
>>>> org.keycloak.adapters.tomcat.AbstractKeycloakAuthenticatorValve.keycloakInit(AbstractKeycloakAuthenticatorValve.java:133)
>>>> > [keycloak-tomcat-core-adapter-2.0.0.Final.jar:2.0.0.Final]
>>>> >
>>>> > at
>>>> >
>>>> org.keycloak.adapters.tomcat.AbstractKeycloakAuthenticatorValve.lifecycleEvent(AbstractKeycloakAuthenticatorValve.java:75)
>>>> > [keycloak-tomcat-core-adapter-2.0.0.Final.jar:2.0.0.Final]
>>>> >
>>>> > at
>>>> >
>>>> org.apache.catalina.util.LifecycleSupport.fireLifecycleEvent(LifecycleSupport.java:115)
>>>> > [jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]
>>>> >
>>>> > at
>>>> >
>>>> org.apache.catalina.core.StandardContext.start(StandardContext.java:3775)
>>>> > [jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]
>>>> >
>>>> > at
>>>> >
>>>> org.jboss.as.web.deployment.WebDeploymentService.doStart(WebDeploymentService.java:163)
>>>> > [jboss-as-web-7.5.0.Final-redhat-21.jar:7.5.0.Final-redhat-21]
>>>> >
>>>> > at
>>>> >
>>>> org.jboss.as.web.deployment.WebDeploymentService.access$000(WebDeploymentService.java:61)
>>>> > [jboss-as-web-7.5.0.Final-redhat-21.jar:7.5.0.Final-redhat-21]
>>>> >
>>>> > at
>>>> >
>>>> org.jboss.as.web.deployment.WebDeploymentService$1.run(WebDeploymentService.java:96)
>>>> > [jboss-as-web-7.5.0.Final-redhat-21.jar:7.5.0.Final-redhat-21]
>>>> >
>>>> > at
>>>> java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:471)
>>>> > [rt.jar:1.7.0_80]
>>>> >
>>>> > at java.util.concurrent.FutureTask.run(FutureTask.java:262)
>>>> > [rt.jar:1.7.0_80]
>>>> >
>>>> > at
>>>> >
>>>> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)
>>>> > [rt.jar:1.7.0_80]
>>>> >
>>>> > at
>>>> >
>>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)
>>>> > [rt.jar:1.7.0_80]
>>>> >
>>>> > at java.lang.Thread.run(Thread.java:745) [rt.jar:1.7.0_80]
>>>> >
>>>> > at org.jboss.threads.JBossThread.run(JBossThread.java:122)
>>>> >
>>>> > Caused by:
>>>> > com.fasterxml.jackson.databind.exc.UnrecognizedPropertyException:
>>>> > Unrecognized field "cors-exposed-headers" (class
>>>> > org.keycloak.representations.adapters.config.AdapterConfig), not
>>>> marked as
>>>> > ignorable (32 known properties: "ssl-required",
>>>> "cors-allowed-headers",
>>>> > "register-node-period", "turn-off-change-session-id-on-login",
>>>> > "truststore", "always-refresh-token", "client-key-password",
>>>> > "policy-enforcer", "token-store", "resource", "realm", "proxy-url",
>>>> > "disable-trust-manager", "bearer-only", "truststore-password",
>>>> > "use-resource-role-mappings", "connection-pool-size",
>>>> "client-keystore",
>>>> > "register-node-at-startup", "client-keystore-password",
>>>> "auth-server-url",
>>>> > "cors-allowed-methods", "public-client", "expose-token",
>>>> > "token-minimum-time-to-live", "enable-basic-auth", "cors-max-age",
>>>> > "enable-cors", "allow-any-hostname", "realm-public-key",
>>>> "credentials",
>>>> > "principal-attribute"])
>>>> >
>>>> >  at [Source: java.io.ByteArrayInputStream at 67593e31; line: 14,
>>>> column: 29]
>>>> > (through reference chain:
>>>> >
>>>> org.keycloak.representations.adapters.config.AdapterConfig["cors-exposed-headers"])
>>>> >
>>>> > at
>>>> >
>>>> com.fasterxml.jackson.databind.exc.UnrecognizedPropertyException.from(UnrecognizedPropertyException.java:51)
>>>> >
>>>> > at
>>>> >
>>>> com.fasterxml.jackson.databind.DeserializationContext.reportUnknownProperty(DeserializationContext.java:817)
>>>> >
>>>> > at
>>>> >
>>>> com.fasterxml.jackson.databind.deser.std.StdDeserializer.handleUnknownProperty(StdDeserializer.java:958)
>>>> >
>>>> > at
>>>> >
>>>> com.fasterxml.jackson.databind.deser.BeanDeserializerBase.handleUnknownProperty(BeanDeserializerBase.java:1324)
>>>> >
>>>> > at
>>>> >
>>>> com.fasterxml.jackson.databind.deser.BeanDeserializerBase.handleUnknownVanilla(BeanDeserializerBase.java:1302)
>>>> >
>>>> > at
>>>> >
>>>> com.fasterxml.jackson.databind.deser.BeanDeserializer.vanillaDeserialize(BeanDeserializer.java:249)
>>>> >
>>>> > at
>>>> >
>>>> com.fasterxml.jackson.databind.deser.BeanDeserializer.deserialize(BeanDeserializer.java:136)
>>>> >
>>>> > at
>>>> >
>>>> com.fasterxml.jackson.databind.ObjectMapper._readMapAndClose(ObjectMapper.java:3564)
>>>> >
>>>> > at
>>>> >
>>>> com.fasterxml.jackson.databind.ObjectMapper.readValue(ObjectMapper.java:2650)
>>>> >
>>>> > at
>>>> >
>>>> org.keycloak.adapters.KeycloakDeploymentBuilder.loadAdapterConfig(KeycloakDeploymentBuilder.java:135)
>>>> > [keycloak-adapter-core-2.0.0.Final.jar:2.0.0.Final]
>>>> >
>>>> > ... 14 more
>>>> >
>>>> >
>>>> > 10:57:15,973 ERROR [org.apache.catalina.core] (ServerService Thread
>>>> Pool --
>>>> > 69) JBWEB001103: Error detected during context /data start, will stop
>>>> it
>>>> >
>>>> > 10:57:15,985 ERROR [org.jboss.msc.service.fail] (ServerService Thread
>>>> Pool
>>>> > -- 69) MSC000001: Failed to start service
>>>> > jboss.web.deployment.default-host./data:
>>>> > org.jboss.msc.service.StartException in service
>>>> > jboss.web.deployment.default-host./data:
>>>> > org.jboss.msc.service.StartException in anonymous service: JBAS018040:
>>>> > Failed to start context
>>>> >
>>>> > at
>>>> >
>>>> org.jboss.as.web.deployment.WebDeploymentService$1.run(WebDeploymentService.java:99)
>>>> >
>>>> > at
>>>> java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:471)
>>>> > [rt.jar:1.7.0_80]
>>>> >
>>>> > at java.util.concurrent.FutureTask.run(FutureTask.java:262)
>>>> > [rt.jar:1.7.0_80]
>>>> >
>>>> > at
>>>> >
>>>> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)
>>>> > [rt.jar:1.7.0_80]
>>>> >
>>>> > at
>>>> >
>>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)
>>>> > [rt.jar:1.7.0_80]
>>>> >
>>>> > at java.lang.Thread.run(Thread.java:745) [rt.jar:1.7.0_80]
>>>> >
>>>> > at org.jboss.threads.JBossThread.run(JBossThread.java:122)
>>>> >
>>>> > Caused by: org.jboss.msc.service.StartException in anonymous service:
>>>> > JBAS018040: Failed to start context
>>>> >
>>>> > at
>>>> >
>>>> org.jboss.as.web.deployment.WebDeploymentService.doStart(WebDeploymentService.java:168)
>>>> >
>>>> > at
>>>> >
>>>> org.jboss.as.web.deployment.WebDeploymentService.access$000(WebDeploymentService.java:61)
>>>> >
>>>> > at
>>>> >
>>>> org.jboss.as.web.deployment.WebDeploymentService$1.run(WebDeploymentService.java:96)
>>>> >
>>>> > ... 6 more
>>>> >
>>>> >
>>>> > 10:57:16,019 ERROR [org.jboss.as.controller.management-operation]
>>>> > (Controller Boot Thread) JBAS014612: Operation ("deploy") failed -
>>>> address:
>>>> > ([("deployment" =>
>>>> "webims-jcom-data-1.3.1-SNAPSHOT-secure-keycloak.war")])
>>>> > - failure description: {"JBAS014671: Failed services" =>
>>>> > {"jboss.web.deployment.default-host./data" =>
>>>> > "org.jboss.msc.service.StartException in service
>>>> > jboss.web.deployment.default-host./data:
>>>> > org.jboss.msc.service.StartException in anonymous service: JBAS018040:
>>>> > Failed to start context
>>>> >
>>>> >     Caused by: org.jboss.msc.service.StartException in anonymous
>>>> service:
>>>> > JBAS018040: Failed to start context"}}
>>>> >
>>>> >
>>>> >
>>>> >
>>>> >
>>>> >
>>>> > On Sat, Jul 9, 2016 at 7:38 AM, Bruno Oliveira <bruno at abstractj.org>
>>>> wrote:
>>>> >
>>>> > > As far as I can tell, yes.
>>>> > >
>>>> > > See:
>>>> > >
>>>> > >
>>>> https://keycloak.gitbooks.io/server-adminstration-guide/content/topics/clients/client-oidc.html
>>>> > >
>>>> > >
>>>> https://github.com/keycloak/keycloak/blob/5c98b8c6ae7052b2d906156d8fc212ccd9dfd57d/services/src/main/java/org/keycloak/services/resources/Cors.java#L143
>>>> > >
>>>> > > On 2016-07-08, Hubert Przybysz wrote:
>>>> > > > Hi,
>>>> > > >
>>>> > > > Is configuration of CORS Access-Control-Expose-Headers supported
>>>> in
>>>> > > > 2.0.0.Final adapters?
>>>> > > >
>>>> > > > Best regards / Hubert.
>>>> > >
>>>> > > > _______________________________________________
>>>> > > > keycloak-user mailing list
>>>> > > > keycloak-user at lists.jboss.org
>>>> > > > https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>> > >
>>>> > >
>>>> > > --
>>>> > >
>>>> > > abstractj
>>>> > > PGP: 0x84DC9914
>>>> > >
>>>>
>>>> --
>>>>
>>>> abstractj
>>>> PGP: 0x84DC9914
>>>>
>>>
>>>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160712/a86c9e81/attachment.html 

From sthorger at redhat.com  Tue Jul 12 01:23:44 2016
From: sthorger at redhat.com (Stian Thorgersen)
Date: Tue, 12 Jul 2016 07:23:44 +0200
Subject: [keycloak-user] Login and credit card
In-Reply-To: <CAHiHDeTQ1VaZPMB6npo1SuNL07d_8NWHckDppC2BCF3a0nLm3g@mail.gmail.com>
References: <CAHiHDeSFLr=u_=fOKRF6vE8NgR_mOwW15qYVGe90GG5pEcjMZg@mail.gmail.com>
	<CAHiHDeRBFOxk8zNTBW1htNCfgNYYDVY30AFyH+cHz_k4SQ80QA@mail.gmail.com>
	<CAHiHDeTuFtTDCztSMzqduQLsBt7mikJmicKZ4z41usAM8TydZw@mail.gmail.com>
	<CAHiHDeRjx9jSE7q62H=ES2XjyaENOhi1ZPG0dt2J2zxZ6Os2Og@mail.gmail.com>
	<CAHiHDeShXqC643jOxSn_zHzsMdw19CxPDU2fEcqR-NMvnKxWzQ@mail.gmail.com>
	<CAHiHDeRZv8McyZW0g0qDsR1UeqrN-oW2v8x68fnqgs2giOE-BQ@mail.gmail.com>
	<CAOjtoUO8EPAkozZtDkC+HrQMQB7c5d_Kwpa+za-=dQ6=mWVsgA@mail.gmail.com>
	<CAHiHDeTQ1VaZPMB6npo1SuNL07d_8NWHckDppC2BCF3a0nLm3g@mail.gmail.com>
Message-ID: <CAJgngAdk9x5JQWXKhaQAZ8uOfp_24ASavCCEbChhA1zKRXOrPw@mail.gmail.com>

You don't need to deal with Angular stuff. It's basic FreeMarker templates,
see:
https://keycloak.gitbooks.io/server-developer-guide/content/v/2.0/topics/custom-attributes.html

One issue here is that you shouldn't store credit card details unencrypted.
That would be harder to achieve. You could encrypt it by extending the
registration form handler, see
https://keycloak.gitbooks.io/server-developer-guide/content/v/2.0/topics/auth-spi.html.
I'd also be careful about adding this details to the token and would maybe
expose it only through userinfo endpoint and make sure only selected
clients have access to it.

On 11 July 2016 at 00:29, Hristo Stoyanov <hr.stoyanov at peruncs.com> wrote:

> I am coming to the conclusion that I have to develop sign up page, as I
> don't want to deal with KC patternfly/angular stuff.
>
> /Hristo Stoyanov
> On Jul 10, 2016 3:24 PM, "Fabricio Milone" <fabricio.milone at shinetech.com>
> wrote:
>
>> Correct me if I am wrong but my best guess is that you can extend the
>> default login theme with some app specific template. I have added some
>> extra required fields when a registration process starts and all I had to
>> do was extend the keycloak theme, creating a new register.ftl file with my
>> own template. The other option is a new implementation of the
>> login-update-profile.ftl and make the Review Profile screen required
>> (always on under your Authentication flow).
>>
>> It depens on your requirements really.
>>
>> Regards,
>> Fab
>>
>>
>> On 10 July 2016 at 03:56, Hristo Stoyanov <hr.stoyanov at peruncs.com>
>> wrote:
>>
>>> Many applications would require the user to provide his/her credit card
>>> upon sign up on a single step/screen. This does not work well with the
>>> out_of_box KC screen. How do you solve this? Custom login screen?
>>>
>>> /Hristo Stoyanov
>>>
>>> _______________________________________________
>>> keycloak-user mailing list
>>> keycloak-user at lists.jboss.org
>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>
>>
>>
>>
>> --
>> *Fabricio Milone*
>> Developer
>>
>> *Shine Consulting *
>>
>> 30/600 Bourke Street
>>
>> Melbourne VIC 3000
>>
>> T: 03 8488 9939
>>
>> M: 04 3200 4006
>>
>>
>> www.shinetech.com  *a* passion for excellence
>>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160712/25700107/attachment-0001.html 

From bruno at abstractj.org  Tue Jul 12 01:56:01 2016
From: bruno at abstractj.org (Bruno Oliveira)
Date: Tue, 12 Jul 2016 02:56:01 -0300
Subject: [keycloak-user] Login and credit card
In-Reply-To: <CAJgngAdk9x5JQWXKhaQAZ8uOfp_24ASavCCEbChhA1zKRXOrPw@mail.gmail.com>
References: <CAHiHDeSFLr=u_=fOKRF6vE8NgR_mOwW15qYVGe90GG5pEcjMZg@mail.gmail.com>
	<CAHiHDeRBFOxk8zNTBW1htNCfgNYYDVY30AFyH+cHz_k4SQ80QA@mail.gmail.com>
	<CAHiHDeTuFtTDCztSMzqduQLsBt7mikJmicKZ4z41usAM8TydZw@mail.gmail.com>
	<CAHiHDeRjx9jSE7q62H=ES2XjyaENOhi1ZPG0dt2J2zxZ6Os2Og@mail.gmail.com>
	<CAHiHDeShXqC643jOxSn_zHzsMdw19CxPDU2fEcqR-NMvnKxWzQ@mail.gmail.com>
	<CAHiHDeRZv8McyZW0g0qDsR1UeqrN-oW2v8x68fnqgs2giOE-BQ@mail.gmail.com>
	<CAOjtoUO8EPAkozZtDkC+HrQMQB7c5d_Kwpa+za-=dQ6=mWVsgA@mail.gmail.com>
	<CAHiHDeTQ1VaZPMB6npo1SuNL07d_8NWHckDppC2BCF3a0nLm3g@mail.gmail.com>
	<CAJgngAdk9x5JQWXKhaQAZ8uOfp_24ASavCCEbChhA1zKRXOrPw@mail.gmail.com>
Message-ID: <20160712055601.GA7530@abstractj.org>

On 2016-07-12, Stian Thorgersen wrote:
> You don't need to deal with Angular stuff. It's basic FreeMarker templates,
> see:
> https://keycloak.gitbooks.io/server-developer-guide/content/v/2.0/topics/custom-attributes.html
>
> One issue here is that you shouldn't store credit card details unencrypted.
> That would be harder to achieve. You could encrypt it by extending the
> registration form handler, see
> https://keycloak.gitbooks.io/server-developer-guide/content/v/2.0/topics/auth-spi.html.
> I'd also be careful about adding this details to the token and would maybe
> expose it only through userinfo endpoint and make sure only selected
> clients have access to it.

Just in case someone is interested, a nice/short reading[1].

[1] - https://www.pcisecuritystandards.org/pdfs/pci_fs_data_storage.pdf

>
> On 11 July 2016 at 00:29, Hristo Stoyanov <hr.stoyanov at peruncs.com> wrote:
>
> > I am coming to the conclusion that I have to develop sign up page, as I
> > don't want to deal with KC patternfly/angular stuff.
> >
> > /Hristo Stoyanov
> > On Jul 10, 2016 3:24 PM, "Fabricio Milone" <fabricio.milone at shinetech.com>
> > wrote:
> >
> >> Correct me if I am wrong but my best guess is that you can extend the
> >> default login theme with some app specific template. I have added some
> >> extra required fields when a registration process starts and all I had to
> >> do was extend the keycloak theme, creating a new register.ftl file with my
> >> own template. The other option is a new implementation of the
> >> login-update-profile.ftl and make the Review Profile screen required
> >> (always on under your Authentication flow).
> >>
> >> It depens on your requirements really.
> >>
> >> Regards,
> >> Fab
> >>
> >>
> >> On 10 July 2016 at 03:56, Hristo Stoyanov <hr.stoyanov at peruncs.com>
> >> wrote:
> >>
> >>> Many applications would require the user to provide his/her credit card
> >>> upon sign up on a single step/screen. This does not work well with the
> >>> out_of_box KC screen. How do you solve this? Custom login screen?
> >>>
> >>> /Hristo Stoyanov
> >>>
> >>> _______________________________________________
> >>> keycloak-user mailing list
> >>> keycloak-user at lists.jboss.org
> >>> https://lists.jboss.org/mailman/listinfo/keycloak-user
> >>>
> >>
> >>
> >>
> >> --
> >> *Fabricio Milone*
> >> Developer
> >>
> >> *Shine Consulting *
> >>
> >> 30/600 Bourke Street
> >>
> >> Melbourne VIC 3000
> >>
> >> T: 03 8488 9939
> >>
> >> M: 04 3200 4006
> >>
> >>
> >> www.shinetech.com  *a* passion for excellence
> >>
> >
> > _______________________________________________
> > keycloak-user mailing list
> > keycloak-user at lists.jboss.org
> > https://lists.jboss.org/mailman/listinfo/keycloak-user
> >

> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user


--

abstractj
PGP: 0x84DC9914

From h.p.przybysz at gmail.com  Tue Jul 12 02:32:44 2016
From: h.p.przybysz at gmail.com (Hubert Przybysz)
Date: Tue, 12 Jul 2016 08:32:44 +0200
Subject: [keycloak-user] Support for CORS Access-Control-Expose-Headers
	in 2.0.0.Final
In-Reply-To: <CAJgngAfL2jGJSeyL1_zxj+3jp6u_W8QDEiPxhuU1u6ac8F9xQg@mail.gmail.com>
References: <CAJMEJTW7aZZeHRDinB66PDTfMaZ3aHLs8VNrx=xTNPJ+qqCORg@mail.gmail.com>
	<20160709053836.GA23953@abstractj.org>
	<CAJMEJTU0OzN_2axzBypNeL268iyZBk4ca6i6nTdyLkv8t+nhQg@mail.gmail.com>
	<20160711161310.GA7375@abstractj.org>
	<CAJMEJTUKHG8oNp5ni8ZECfezeideXntDpdEbgVkXYKcTMaBY4g@mail.gmail.com>
	<CAM5SUC44a5CFm5fh0Ac5k=26nkHMz6vgYh4TDvZiq1Fd=+wWTQ@mail.gmail.com>
	<CAJMEJTXCO=LWoFM3KPTi7hqBKJE4YBjGTZGx52r8Zcxz5SY3-w@mail.gmail.com>
	<CAJgngAfL2jGJSeyL1_zxj+3jp6u_W8QDEiPxhuU1u6ac8F9xQg@mail.gmail.com>
Message-ID: <CAJMEJTVb_NCu_EE+hG6R6WF5O6t+Mw=3KzQLp=64O=4HP_4JAA@mail.gmail.com>

Ok, thanks. It was a bit unclear to me if it should have been supported.

On Tue, Jul 12, 2016 at 7:17 AM, Stian Thorgersen <sthorger at redhat.com>
wrote:

> I changed that issue to a feature request, since we've never supported it
> it's not a bug.
>
> On 11 July 2016 at 20:25, Hubert Przybysz <h.p.przybysz at gmail.com> wrote:
>
>> I have created KEYCLOAK-3297
>> <https://issues.jboss.org/browse/KEYCLOAK-3297> .
>>
>> On Mon, Jul 11, 2016 at 7:29 PM, Bruno Oliveira <bruno at abstractj.org>
>> wrote:
>>
>>> Please, go ahead and create one. I couldn't find any Jira related to
>>> this.
>>>
>>> On Mon, Jul 11, 2016 at 1:36 PM Hubert Przybysz <h.p.przybysz at gmail.com>
>>> wrote:
>>>
>>>> Does anyone know when it will be possible to configure the adapters
>>>> with CORS expose headers?
>>>>
>>>> I don't find any jira for it.
>>>>
>>>> Br / Hubert.
>>>>
>>>> On Mon, Jul 11, 2016 at 6:13 PM, Bruno Oliveira <bruno at abstractj.org>
>>>> wrote:
>>>>
>>>>> You are right Hubert it's not supported at keycloak.json file, I just
>>>>> overlooked the code.
>>>>> Sorry about that.
>>>>>
>>>>> On 2016-07-11, Hubert Przybysz wrote:
>>>>> > Thanks for the info.
>>>>> >
>>>>> > I've tried configuring cors-exposed-headers in a JBOSS EAP 6 adapter
>>>>> like
>>>>> > this:
>>>>> >
>>>>> > keycloak.json:
>>>>> > {
>>>>> > ...
>>>>> >
>>>>> >   "enable-cors" : true,
>>>>> >
>>>>> >   "cors-allowed-methods" : "POST,PUT,DELETE,GET",
>>>>> >
>>>>> >   "cors-allowed-headers" :
>>>>> > "Accept,Content-Type,If-Match,If-None-Match,Origin",
>>>>> >
>>>>> >   "cors-exposed-headers" : "ETag,Location",
>>>>> >
>>>>> > ...
>>>>> >
>>>>> > }
>>>>> >
>>>>> >
>>>>> > But the adapter does not recognise this config and fails to start:
>>>>> >
>>>>> > 10:57:15,923 ERROR [org.apache.catalina.core] (ServerService Thread
>>>>> Pool --
>>>>> > 69) JBWEB001097: Error starting context /data:
>>>>> java.lang.RuntimeException:
>>>>> > com.fasterxml.jackson.databind.exc.UnrecognizedPropertyException:
>>>>> > Unrecognized field "cors-exposed-headers" (class
>>>>> > org.keycloak.representations.adapters.config.AdapterConfig), not
>>>>> marked as
>>>>> > ignorable (32 known properties: "ssl-required",
>>>>> "cors-allowed-headers",
>>>>> > "register-node-period", "turn-off-change-session-id-on-login",
>>>>> > "truststore", "always-refresh-token", "client-key-password",
>>>>> > "policy-enforcer", "token-store", "resource", "realm", "proxy-url",
>>>>> > "disable-trust-manager", "bearer-only", "truststore-password",
>>>>> > "use-resource-role-mappings", "connection-pool-size",
>>>>> "client-keystore",
>>>>> > "register-node-at-startup", "client-keystore-password",
>>>>> "auth-server-url",
>>>>> > "cors-allowed-methods", "public-client", "expose-token",
>>>>> > "token-minimum-time-to-live", "enable-basic-auth", "cors-max-age",
>>>>> > "enable-cors", "allow-any-hostname", "realm-public-key",
>>>>> "credentials",
>>>>> > "principal-attribute"])
>>>>> >
>>>>> >  at [Source: java.io.ByteArrayInputStream at 67593e31; line: 14,
>>>>> column: 29]
>>>>> > (through reference chain:
>>>>> >
>>>>> org.keycloak.representations.adapters.config.AdapterConfig["cors-exposed-headers"])
>>>>> >
>>>>> > at
>>>>> >
>>>>> org.keycloak.adapters.KeycloakDeploymentBuilder.loadAdapterConfig(KeycloakDeploymentBuilder.java:137)
>>>>> > [keycloak-adapter-core-2.0.0.Final.jar:2.0.0.Final]
>>>>> >
>>>>> > at
>>>>> >
>>>>> org.keycloak.adapters.KeycloakDeploymentBuilder.build(KeycloakDeploymentBuilder.java:126)
>>>>> > [keycloak-adapter-core-2.0.0.Final.jar:2.0.0.Final]
>>>>> >
>>>>> > at
>>>>> >
>>>>> org.keycloak.adapters.tomcat.AbstractKeycloakAuthenticatorValve.keycloakInit(AbstractKeycloakAuthenticatorValve.java:133)
>>>>> > [keycloak-tomcat-core-adapter-2.0.0.Final.jar:2.0.0.Final]
>>>>> >
>>>>> > at
>>>>> >
>>>>> org.keycloak.adapters.tomcat.AbstractKeycloakAuthenticatorValve.lifecycleEvent(AbstractKeycloakAuthenticatorValve.java:75)
>>>>> > [keycloak-tomcat-core-adapter-2.0.0.Final.jar:2.0.0.Final]
>>>>> >
>>>>> > at
>>>>> >
>>>>> org.apache.catalina.util.LifecycleSupport.fireLifecycleEvent(LifecycleSupport.java:115)
>>>>> > [jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]
>>>>> >
>>>>> > at
>>>>> >
>>>>> org.apache.catalina.core.StandardContext.start(StandardContext.java:3775)
>>>>> > [jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]
>>>>> >
>>>>> > at
>>>>> >
>>>>> org.jboss.as.web.deployment.WebDeploymentService.doStart(WebDeploymentService.java:163)
>>>>> > [jboss-as-web-7.5.0.Final-redhat-21.jar:7.5.0.Final-redhat-21]
>>>>> >
>>>>> > at
>>>>> >
>>>>> org.jboss.as.web.deployment.WebDeploymentService.access$000(WebDeploymentService.java:61)
>>>>> > [jboss-as-web-7.5.0.Final-redhat-21.jar:7.5.0.Final-redhat-21]
>>>>> >
>>>>> > at
>>>>> >
>>>>> org.jboss.as.web.deployment.WebDeploymentService$1.run(WebDeploymentService.java:96)
>>>>> > [jboss-as-web-7.5.0.Final-redhat-21.jar:7.5.0.Final-redhat-21]
>>>>> >
>>>>> > at
>>>>> java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:471)
>>>>> > [rt.jar:1.7.0_80]
>>>>> >
>>>>> > at java.util.concurrent.FutureTask.run(FutureTask.java:262)
>>>>> > [rt.jar:1.7.0_80]
>>>>> >
>>>>> > at
>>>>> >
>>>>> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)
>>>>> > [rt.jar:1.7.0_80]
>>>>> >
>>>>> > at
>>>>> >
>>>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)
>>>>> > [rt.jar:1.7.0_80]
>>>>> >
>>>>> > at java.lang.Thread.run(Thread.java:745) [rt.jar:1.7.0_80]
>>>>> >
>>>>> > at org.jboss.threads.JBossThread.run(JBossThread.java:122)
>>>>> >
>>>>> > Caused by:
>>>>> > com.fasterxml.jackson.databind.exc.UnrecognizedPropertyException:
>>>>> > Unrecognized field "cors-exposed-headers" (class
>>>>> > org.keycloak.representations.adapters.config.AdapterConfig), not
>>>>> marked as
>>>>> > ignorable (32 known properties: "ssl-required",
>>>>> "cors-allowed-headers",
>>>>> > "register-node-period", "turn-off-change-session-id-on-login",
>>>>> > "truststore", "always-refresh-token", "client-key-password",
>>>>> > "policy-enforcer", "token-store", "resource", "realm", "proxy-url",
>>>>> > "disable-trust-manager", "bearer-only", "truststore-password",
>>>>> > "use-resource-role-mappings", "connection-pool-size",
>>>>> "client-keystore",
>>>>> > "register-node-at-startup", "client-keystore-password",
>>>>> "auth-server-url",
>>>>> > "cors-allowed-methods", "public-client", "expose-token",
>>>>> > "token-minimum-time-to-live", "enable-basic-auth", "cors-max-age",
>>>>> > "enable-cors", "allow-any-hostname", "realm-public-key",
>>>>> "credentials",
>>>>> > "principal-attribute"])
>>>>> >
>>>>> >  at [Source: java.io.ByteArrayInputStream at 67593e31; line: 14,
>>>>> column: 29]
>>>>> > (through reference chain:
>>>>> >
>>>>> org.keycloak.representations.adapters.config.AdapterConfig["cors-exposed-headers"])
>>>>> >
>>>>> > at
>>>>> >
>>>>> com.fasterxml.jackson.databind.exc.UnrecognizedPropertyException.from(UnrecognizedPropertyException.java:51)
>>>>> >
>>>>> > at
>>>>> >
>>>>> com.fasterxml.jackson.databind.DeserializationContext.reportUnknownProperty(DeserializationContext.java:817)
>>>>> >
>>>>> > at
>>>>> >
>>>>> com.fasterxml.jackson.databind.deser.std.StdDeserializer.handleUnknownProperty(StdDeserializer.java:958)
>>>>> >
>>>>> > at
>>>>> >
>>>>> com.fasterxml.jackson.databind.deser.BeanDeserializerBase.handleUnknownProperty(BeanDeserializerBase.java:1324)
>>>>> >
>>>>> > at
>>>>> >
>>>>> com.fasterxml.jackson.databind.deser.BeanDeserializerBase.handleUnknownVanilla(BeanDeserializerBase.java:1302)
>>>>> >
>>>>> > at
>>>>> >
>>>>> com.fasterxml.jackson.databind.deser.BeanDeserializer.vanillaDeserialize(BeanDeserializer.java:249)
>>>>> >
>>>>> > at
>>>>> >
>>>>> com.fasterxml.jackson.databind.deser.BeanDeserializer.deserialize(BeanDeserializer.java:136)
>>>>> >
>>>>> > at
>>>>> >
>>>>> com.fasterxml.jackson.databind.ObjectMapper._readMapAndClose(ObjectMapper.java:3564)
>>>>> >
>>>>> > at
>>>>> >
>>>>> com.fasterxml.jackson.databind.ObjectMapper.readValue(ObjectMapper.java:2650)
>>>>> >
>>>>> > at
>>>>> >
>>>>> org.keycloak.adapters.KeycloakDeploymentBuilder.loadAdapterConfig(KeycloakDeploymentBuilder.java:135)
>>>>> > [keycloak-adapter-core-2.0.0.Final.jar:2.0.0.Final]
>>>>> >
>>>>> > ... 14 more
>>>>> >
>>>>> >
>>>>> > 10:57:15,973 ERROR [org.apache.catalina.core] (ServerService Thread
>>>>> Pool --
>>>>> > 69) JBWEB001103: Error detected during context /data start, will
>>>>> stop it
>>>>> >
>>>>> > 10:57:15,985 ERROR [org.jboss.msc.service.fail] (ServerService
>>>>> Thread Pool
>>>>> > -- 69) MSC000001: Failed to start service
>>>>> > jboss.web.deployment.default-host./data:
>>>>> > org.jboss.msc.service.StartException in service
>>>>> > jboss.web.deployment.default-host./data:
>>>>> > org.jboss.msc.service.StartException in anonymous service:
>>>>> JBAS018040:
>>>>> > Failed to start context
>>>>> >
>>>>> > at
>>>>> >
>>>>> org.jboss.as.web.deployment.WebDeploymentService$1.run(WebDeploymentService.java:99)
>>>>> >
>>>>> > at
>>>>> java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:471)
>>>>> > [rt.jar:1.7.0_80]
>>>>> >
>>>>> > at java.util.concurrent.FutureTask.run(FutureTask.java:262)
>>>>> > [rt.jar:1.7.0_80]
>>>>> >
>>>>> > at
>>>>> >
>>>>> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)
>>>>> > [rt.jar:1.7.0_80]
>>>>> >
>>>>> > at
>>>>> >
>>>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)
>>>>> > [rt.jar:1.7.0_80]
>>>>> >
>>>>> > at java.lang.Thread.run(Thread.java:745) [rt.jar:1.7.0_80]
>>>>> >
>>>>> > at org.jboss.threads.JBossThread.run(JBossThread.java:122)
>>>>> >
>>>>> > Caused by: org.jboss.msc.service.StartException in anonymous service:
>>>>> > JBAS018040: Failed to start context
>>>>> >
>>>>> > at
>>>>> >
>>>>> org.jboss.as.web.deployment.WebDeploymentService.doStart(WebDeploymentService.java:168)
>>>>> >
>>>>> > at
>>>>> >
>>>>> org.jboss.as.web.deployment.WebDeploymentService.access$000(WebDeploymentService.java:61)
>>>>> >
>>>>> > at
>>>>> >
>>>>> org.jboss.as.web.deployment.WebDeploymentService$1.run(WebDeploymentService.java:96)
>>>>> >
>>>>> > ... 6 more
>>>>> >
>>>>> >
>>>>> > 10:57:16,019 ERROR [org.jboss.as.controller.management-operation]
>>>>> > (Controller Boot Thread) JBAS014612: Operation ("deploy") failed -
>>>>> address:
>>>>> > ([("deployment" =>
>>>>> "webims-jcom-data-1.3.1-SNAPSHOT-secure-keycloak.war")])
>>>>> > - failure description: {"JBAS014671: Failed services" =>
>>>>> > {"jboss.web.deployment.default-host./data" =>
>>>>> > "org.jboss.msc.service.StartException in service
>>>>> > jboss.web.deployment.default-host./data:
>>>>> > org.jboss.msc.service.StartException in anonymous service:
>>>>> JBAS018040:
>>>>> > Failed to start context
>>>>> >
>>>>> >     Caused by: org.jboss.msc.service.StartException in anonymous
>>>>> service:
>>>>> > JBAS018040: Failed to start context"}}
>>>>> >
>>>>> >
>>>>> >
>>>>> >
>>>>> >
>>>>> >
>>>>> > On Sat, Jul 9, 2016 at 7:38 AM, Bruno Oliveira <bruno at abstractj.org>
>>>>> wrote:
>>>>> >
>>>>> > > As far as I can tell, yes.
>>>>> > >
>>>>> > > See:
>>>>> > >
>>>>> > >
>>>>> https://keycloak.gitbooks.io/server-adminstration-guide/content/topics/clients/client-oidc.html
>>>>> > >
>>>>> > >
>>>>> https://github.com/keycloak/keycloak/blob/5c98b8c6ae7052b2d906156d8fc212ccd9dfd57d/services/src/main/java/org/keycloak/services/resources/Cors.java#L143
>>>>> > >
>>>>> > > On 2016-07-08, Hubert Przybysz wrote:
>>>>> > > > Hi,
>>>>> > > >
>>>>> > > > Is configuration of CORS Access-Control-Expose-Headers supported
>>>>> in
>>>>> > > > 2.0.0.Final adapters?
>>>>> > > >
>>>>> > > > Best regards / Hubert.
>>>>> > >
>>>>> > > > _______________________________________________
>>>>> > > > keycloak-user mailing list
>>>>> > > > keycloak-user at lists.jboss.org
>>>>> > > > https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>>> > >
>>>>> > >
>>>>> > > --
>>>>> > >
>>>>> > > abstractj
>>>>> > > PGP: 0x84DC9914
>>>>> > >
>>>>>
>>>>> --
>>>>>
>>>>> abstractj
>>>>> PGP: 0x84DC9914
>>>>>
>>>>
>>>>
>>
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160712/800ad0cf/attachment-0001.html 

From sthorger at redhat.com  Tue Jul 12 03:59:51 2016
From: sthorger at redhat.com (Stian Thorgersen)
Date: Tue, 12 Jul 2016 09:59:51 +0200
Subject: [keycloak-user] User impersonation - JWT
In-Reply-To: <CA+waeaVd35zy5+M-wt6yRT1OMpj7BQ9mGXS1m9xRZwf=AnUA9w@mail.gmail.com>
References: <CA+waeaUYJe2-Lje-DUGK_QPOwdi6_CSBAi+hY+Oi4wTknwsy3w@mail.gmail.com>
	<CAJgngAcf7c0+-mjyw9b+WAsCC1UcNWic75QQR3BnedCjkkQjQA@mail.gmail.com>
	<CA+waeaVd35zy5+M-wt6yRT1OMpj7BQ9mGXS1m9xRZwf=AnUA9w@mail.gmail.com>
Message-ID: <CAJgngAe3N5yXXUMXRhoT9uLcz=gF4JYXsJCd_kieeDdyLqopPg@mail.gmail.com>

The way it works is:

* Admin impersonate user
* SSO for browser is now switched to be authenticated as the user rather
than the admin
* Admin can now login to any application and would automatically be logged
in as the impersonated user

So it's transparent to the applications and they don't need to deal with
impersonation in a special way.

On 5 July 2016 at 14:47, Harry Trinta <harrytpc at gmail.com> wrote:

> Stian, thanks for the reply!
>
> There is no service to retrieve a token passing the cookies as a parameter?
> I was looking at TokenEndpoint.java, but I have not found a way.
>
> Thanks
>
> 2016-07-05 3:33 GMT-03:00 Stian Thorgersen <sthorger at redhat.com>:
>
>> The impersonation feature we have logs the admin in as the impersonated
>> user rather than generate tokens. We decided on this approach as it would
>> be transparent to applications and they wouldn't need to build-in special
>> impersonation. What you want is not possible at the moment, but you can
>> create a JIRA feature request for it. It would have to be a community
>> contribution if you want it added in a timely manner.
>>
>> On 4 July 2016 at 18:52, Harry Trinta <harrytpc at gmail.com> wrote:
>>
>>> Dears,
>>>
>>>
>>>
>>> I need a help with user impersonation on keycloak.
>>>
>>>
>>>
>>> I am authenticating users through the
>>> "/realms/test/protocol/openid-connect/token". As expected, it returns a
>>> token JWT.
>>>
>>> In my app, all requests go through apiman, which validates the JWT.
>>>
>>>
>>>
>>> Now, I need to personification of user. I'm calling the service
>>> "/admin/realms/test/users/USER_ID/impersonation", sending the token in the
>>> header (Authorization = Bearer eyJhbGciOiJSUzI1NiJ9 ...).
>>>
>>> The service /impersonation creates the user session on keycloak, however
>>> doesnt return a JWT, but 3 cookies. *I'd like to get the JWT of
>>> personified user instead of cookie.* It's possible?
>>>
>>>
>>>
>>> Best regards
>>>
>>> Harry Costa
>>>
>>> _______________________________________________
>>> keycloak-user mailing list
>>> keycloak-user at lists.jboss.org
>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>
>>
>>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160712/e6e13989/attachment.html 

From sundaram.arumugam at yahoo.com  Sat Jul  9 00:13:56 2016
From: sundaram.arumugam at yahoo.com (Mohana sundaram Arumugam)
Date: Sat, 9 Jul 2016 04:13:56 +0000 (UTC)
Subject: [keycloak-user] Need Keycloak Clustering Documentation.
References: <13667308.43250.1468037636771.JavaMail.yahoo.ref@mail.yahoo.com>
Message-ID: <13667308.43250.1468037636771.JavaMail.yahoo@mail.yahoo.com>

Hi Folks,

Please help me to do Keycloak clustering with 1.7.0 version(This version agreed to customer, so persisting with 1.7.0) in 2 different machines or VM's. 

Or give some inputs do the same with shared database with EnterpriseDB instead of Keycloak's internal H2 DB.

I am in very crunch situation to deliver, please help me out guys.


Thanks,
Mohan.

From gambol99 at gmail.com  Tue Jul 12 05:17:07 2016
From: gambol99 at gmail.com (gambol)
Date: Tue, 12 Jul 2016 10:17:07 +0100
Subject: [keycloak-user] Proxy TLS settings
Message-ID: <CA+AP+fNqcqYuz0ZU5tFsEVu2z4_Ne+eBbvgEEFSOZQqsxK1JdQ@mail.gmail.com>

Hiya


We've been running v1.9.2 behind a nginx proxy for some time now. Has the
setup for running Keycloak v2.0.0-Final behind a proxy changed? ... We've
kept the amended lines, but Keycloak is returns content in non-https
appearing to ignore the X-Forwarded-Proto

?
<http-listener name="default" socket-binding="http"
proxy-address-forwarding="true" redirect-socket="proxy-https"/>
...

<socket-binding name="ajp" port="${jboss.ajp.port:8009}"/>

<socket-binding name="http" port="${jboss.http.port:8080}"/>

<socket-binding name="https" port="${jboss.https.port:8443}"/>

<socket-binding name="proxy-https" port="443"/> <---

...
------------------------------

But looking at the urls handed back, they are all http://


Doing a tcpdump dump between proxy and keycloak, I can see the X-Forwarded
headers added by the proxy

GET /auth/admin/master/console/ HTTP/1.0
X-Real-IP: 127.0.0.1
X-Forwarded-For: 127.0.0.1
X-Forwarded-Proto: https
Host: 127.0.0.1
Connection: close
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like
Gecko) Chrome/51.0.2704.106 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*
;q=0.8
Accept-Encoding: gzip, deflate, sdch, br
Accept-Language: en-US,en;q=0.8

Rohith
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160712/dbbedd73/attachment.html 

From sthorger at redhat.com  Tue Jul 12 05:53:19 2016
From: sthorger at redhat.com (Stian Thorgersen)
Date: Tue, 12 Jul 2016 11:53:19 +0200
Subject: [keycloak-user] Proxy TLS settings
In-Reply-To: <CA+AP+fNqcqYuz0ZU5tFsEVu2z4_Ne+eBbvgEEFSOZQqsxK1JdQ@mail.gmail.com>
References: <CA+AP+fNqcqYuz0ZU5tFsEVu2z4_Ne+eBbvgEEFSOZQqsxK1JdQ@mail.gmail.com>
Message-ID: <CAJgngAfTN0Y-uYrrpva5suR4PNFxokWDEN1cRw3i1GknfNj26w@mail.gmail.com>

I'm pretty sure there's no changes. Has anything changed in your proxy
setup? Does it still work with 1.9.2, but the exact same config doesn't
work with 2.0.0?

On 12 July 2016 at 11:17, gambol <gambol99 at gmail.com> wrote:

> Hiya
>
>
> We've been running v1.9.2 behind a nginx proxy for some time now. Has the
> setup for running Keycloak v2.0.0-Final behind a proxy changed? ... We've
> kept the amended lines, but Keycloak is returns content in non-https
> appearing to ignore the X-Forwarded-Proto
>
> ?
> <http-listener name="default" socket-binding="http"
> proxy-address-forwarding="true" redirect-socket="proxy-https"/>
> ...
>
> <socket-binding name="ajp" port="${jboss.ajp.port:8009}"/>
>
> <socket-binding name="http" port="${jboss.http.port:8080}"/>
>
> <socket-binding name="https" port="${jboss.https.port:8443}"/>
>
> <socket-binding name="proxy-https" port="443"/> <---
>
> ...
> ------------------------------
>
> But looking at the urls handed back, they are all http://
>
>
> Doing a tcpdump dump between proxy and keycloak, I can see the X-Forwarded
> headers added by the proxy
>
> GET /auth/admin/master/console/ HTTP/1.0
> X-Real-IP: 127.0.0.1
> X-Forwarded-For: 127.0.0.1
> X-Forwarded-Proto: https
> Host: 127.0.0.1
> Connection: close
> Cache-Control: max-age=0
> Upgrade-Insecure-Requests: 1
> User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML,
> like Gecko) Chrome/51.0.2704.106 Safari/537.36
> Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,
> */*;q=0.8
> Accept-Encoding: gzip, deflate, sdch, br
> Accept-Language: en-US,en;q=0.8
>
> Rohith
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160712/b29c7618/attachment.html 

From sthorger at redhat.com  Tue Jul 12 05:56:49 2016
From: sthorger at redhat.com (Stian Thorgersen)
Date: Tue, 12 Jul 2016 11:56:49 +0200
Subject: [keycloak-user] Need Keycloak Clustering Documentation.
In-Reply-To: <13667308.43250.1468037636771.JavaMail.yahoo@mail.yahoo.com>
References: <13667308.43250.1468037636771.JavaMail.yahoo.ref@mail.yahoo.com>
	<13667308.43250.1468037636771.JavaMail.yahoo@mail.yahoo.com>
Message-ID: <CAJgngAdBn2H0sk43Qm-dON+dfCgUCe35FyHkzzqWFAk=M+uOcQ@mail.gmail.com>

1.7 is unsupported and has not received any security fixes for a long time
so I highly recommend against using this in production!

If you want long term support for a specific version I recommend you get
the supported version from Red Hat, see
https://access.redhat.com/products/red-hat-single-sign-on

The alternative is to keep up to date with the latest releases, which is
currently 2.0.0.Final. For documentation on clustering for 2.0.0.Final see
https://keycloak.gitbooks.io/server-installation-and-configuration/content/v/2.0/topics/clustering.html

On 9 July 2016 at 06:13, Mohana sundaram Arumugam <
sundaram.arumugam at yahoo.com> wrote:

> Hi Folks,
>
> Please help me to do Keycloak clustering with 1.7.0 version(This version
> agreed to customer, so persisting with 1.7.0) in 2 different machines or
> VM's.
>
> Or give some inputs do the same with shared database with EnterpriseDB
> instead of Keycloak's internal H2 DB.
>
> I am in very crunch situation to deliver, please help me out guys.
>
>
> Thanks,
> Mohan.
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160712/7e319523/attachment-0001.html 

From psilva at redhat.com  Tue Jul 12 08:40:29 2016
From: psilva at redhat.com (Pedro Igor Silva)
Date: Tue, 12 Jul 2016 08:40:29 -0400 (EDT)
Subject: [keycloak-user] Cannot import the json for photoz
	authorization	example.
In-Reply-To: <CAFBJWv6iZNihsW8ansTzkrUw7Tje7P+sKjFV0ZMR4iYEhyO_wA@mail.gmail.com>
References: <CAFBJWv7rumJ_RsR+NOML5YEicMF=EaxuTOxm_f_hEgDG675nJQ@mail.gmail.com>
	<CAFBJWv6iZNihsW8ansTzkrUw7Tje7P+sKjFV0ZMR4iYEhyO_wA@mail.gmail.com>
Message-ID: <868309394.9801036.1468327229680.JavaMail.zimbra@redhat.com>

Regarding the drools maven artifact version, that is an issue that should be fixed for the next releases. The version was not bumped during the release.

Regarding your last issue, it happens when you try to import the authz config and the drools maven artifact could not be resolved. I got the same error and I was only able to workaround after installing the examples (and fix the version just like you did) and restarting the server.

There is a bug here though. The problem seems to be related with caching, which is not properly handle failures when importing configuration. I've KEYCLOAK-3305 [1] to fix that.

Thanks.

[1] https://issues.jboss.org/browse/KEYCLOAK-3305


----- Original Message -----
From: "Charlee Chitsuk" <charlee.ch at gmail.com>
To: keycloak-user at lists.jboss.org
Sent: Tuesday, July 5, 2016 7:33:32 AM
Subject: Re: [keycloak-user] Cannot import the json for photoz authorization	example.

Hi, 

Regarding to this issue, I've tried to create the "authorization scope" via the admin GUI manually and found strange behavior as the following:- 

1. Create the scope with name as urn:photoz.com:scopes:album:view 
2. Click save 
3. The system should the success, the scope has been created. 
4. Go back to the "authorization scope", there is no any displayed scope. 

Then I've tried to create again as the following:- 

1. Create the scope with name as aaa 
2. Click save 
3. The system should the success, the scope has been created. 
4. Go back to the "authorization scope", the aaa is displayed. 
5. Click the aaa to edit 
6. Change name from aaa to urn:photoz.com:scopes:album:view 
7. The system should the success, the scope has been created. 
8. Go back to the "authorization scope", the urn:photoz.com:scopes:album:view is displayed. 

Anyhow I cannot find how to delete the created scoped as well. 


I'm not sure if I'm doing something wrong or not. Could you please help to advise further? 


-- 
Best Regards, 

Charlee Ch 

2016-07-05 17:12 GMT+07:00 Charlee Chitsuk < charlee.ch at gmail.com > : 




Hi, 

I try to follow the authorization photoz example[1]. I can import the realm[2] to the keycloak properly. 

Anyhow when importing the authorization json[3] there is a misconfiguration about the drools policy as the "mavenArtifactVersion" should be "2.0.0.Final". 

After correcting the version, sadly there is another failure during the importing the authorization json[3] as 

ERROR [io.undertow.request] (default task-100) UT005023: 
Exception handling request to /auth/admin/realms/photoz/clients/001e0705-8bc6-47de-b408-dd07a5ebba9b/authz/resource-server: 
org.jboss.resteasy.spi.UnhandledException: java.lang.IllegalStateException: Not found in database 
at org.jboss.resteasy.core.ExceptionHandler.handleApplicationException(ExceptionHandler.java:76) 
..... 
Caused by: java.lang.IllegalStateException: Not found in database 
at org.keycloak.models.authorization.infinispan.CachedScopeStore$1.getDelegateForUpdate(CachedScopeStore.java:175) 

Could you please help to advise how to fix this issue? Thank you very much for your help in advance. I'm looking forward to hearing from you soon. 


[1] https://github.com/keycloak/keycloak/tree/master/examples/authz/photoz 

[2] https://github.com/keycloak/keycloak/blob/master/examples/authz/photoz/photoz-realm.json 

[3] https://github.com/keycloak/keycloak/blob/master/examples/authz/photoz/photoz-restful-api-authz-service.json 

-- 
Best Regards, 

Charlee Ch 


_______________________________________________
keycloak-user mailing list
keycloak-user at lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user

From igor.zuk at qualitytaskforce.com  Tue Jul 12 08:58:55 2016
From: igor.zuk at qualitytaskforce.com (Igor Zuk)
Date: Tue, 12 Jul 2016 12:58:55 +0000
Subject: [keycloak-user] Keycloak user data encoding
Message-ID: <HE1PR0201MB2217FED5B5E4767A0DBEFEA3F1300@HE1PR0201MB2217.eurprd02.prod.outlook.com>

Hi

I have an encoding problem. By default users' data fields (e.g. first name and last name) are encoded using ISO-8859-1. People from many countries can't properly create accounts as their personal data is silently messed up. How can I fix it?

*         The MySQL DB receives already damaged names. By default all columns are ISO-8859-1-encoded, but manually converting them to UTF-8 doesn't help.

*         Manual account modification from admin console has same effect.

*         Change of default server (Wildfly) encoding to UTF-8 doesn't do anything.

Best regards
Igor ?uk
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160712/380bd286/attachment.html 

From sthorger at redhat.com  Tue Jul 12 09:37:07 2016
From: sthorger at redhat.com (Stian Thorgersen)
Date: Tue, 12 Jul 2016 15:37:07 +0200
Subject: [keycloak-user] Keycloak user data encoding
In-Reply-To: <HE1PR0201MB2217FED5B5E4767A0DBEFEA3F1300@HE1PR0201MB2217.eurprd02.prod.outlook.com>
References: <HE1PR0201MB2217FED5B5E4767A0DBEFEA3F1300@HE1PR0201MB2217.eurprd02.prod.outlook.com>
Message-ID: <CAJgngAfvYbPf5isVnvt4hkg0DiZevNOQJphQC9H1Ybs5EEBb5A@mail.gmail.com>

Why are you saying the default encoding is ISO-8859-1? All forms are
encoded as UTF-8 and all strings passed to the database should be UTF-8
encoded as well.

The only thing that is ISO-8859-1 is the message properties, but those are
converted to UTF-8 when added to HTML pages.

On 12 July 2016 at 14:58, Igor Zuk <igor.zuk at qualitytaskforce.com> wrote:

> Hi
>
>
>
> I have an encoding problem. By default users' data fields (e.g. first name
> and last name) are encoded using ISO-8859-1. People from many countries
> can't properly create accounts as their personal data is silently messed
> up. How can I fix it?
>
> ?         The MySQL DB receives already damaged names. By default all
> columns are ISO-8859-1-encoded, but manually converting them to UTF-8
> doesn't help.
>
> ?         Manual account modification from admin console has same effect.
>
> ?         Change of default server (Wildfly) encoding to UTF-8 doesn't do
> anything.
>
>
>
> Best regards
>
> Igor ?uk
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160712/580ea8d4/attachment.html 

From sthorger at redhat.com  Tue Jul 12 09:42:37 2016
From: sthorger at redhat.com (Stian Thorgersen)
Date: Tue, 12 Jul 2016 15:42:37 +0200
Subject: [keycloak-user] Keycloak user data encoding
In-Reply-To: <CAJgngAfvYbPf5isVnvt4hkg0DiZevNOQJphQC9H1Ybs5EEBb5A@mail.gmail.com>
References: <HE1PR0201MB2217FED5B5E4767A0DBEFEA3F1300@HE1PR0201MB2217.eurprd02.prod.outlook.com>
	<CAJgngAfvYbPf5isVnvt4hkg0DiZevNOQJphQC9H1Ybs5EEBb5A@mail.gmail.com>
Message-ID: <CAJgngAdOyTsY0Yzk81jQpm6+YnJZH7QkGr1fZ6iyfgF2T1cKUA@mail.gmail.com>

By the way this was fixed in 1.6.0.Final, see
https://issues.jboss.org/browse/KEYCLOAK-1830?jql=project%20%3D%20KEYCLOAK%20AND%20text%20~%20%22encoding%22

Are you using an old version?

On 12 July 2016 at 15:37, Stian Thorgersen <sthorger at redhat.com> wrote:

> Why are you saying the default encoding is ISO-8859-1? All forms are
> encoded as UTF-8 and all strings passed to the database should be UTF-8
> encoded as well.
>
> The only thing that is ISO-8859-1 is the message properties, but those are
> converted to UTF-8 when added to HTML pages.
>
> On 12 July 2016 at 14:58, Igor Zuk <igor.zuk at qualitytaskforce.com> wrote:
>
>> Hi
>>
>>
>>
>> I have an encoding problem. By default users' data fields (e.g. first
>> name and last name) are encoded using ISO-8859-1. People from many
>> countries can't properly create accounts as their personal data is silently
>> messed up. How can I fix it?
>>
>> ?         The MySQL DB receives already damaged names. By default all
>> columns are ISO-8859-1-encoded, but manually converting them to UTF-8
>> doesn't help.
>>
>> ?         Manual account modification from admin console has same effect.
>>
>> ?         Change of default server (Wildfly) encoding to UTF-8 doesn't
>> do anything.
>>
>>
>>
>> Best regards
>>
>> Igor ?uk
>>
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160712/65935617/attachment-0001.html 

From sthorger at redhat.com  Tue Jul 12 09:45:20 2016
From: sthorger at redhat.com (Stian Thorgersen)
Date: Tue, 12 Jul 2016 15:45:20 +0200
Subject: [keycloak-user] Import / restore a custom required action
In-Reply-To: <CAMJaV9n2NiNVZxR=X_DhmWQL4o_YR38hZmS5-WcgGFH2C0wayg@mail.gmail.com>
References: <CAMJaV9n2NiNVZxR=X_DhmWQL4o_YR38hZmS5-WcgGFH2C0wayg@mail.gmail.com>
Message-ID: <CAJgngAct5kEhtL=RBh2t3mnzLwKeKTyb62KiKSSzniqxqUeWNg@mail.gmail.com>

Export and import should restore the custom required action and it sounds
like it doesn't, so may be missing from the export/import bits. Can you
create a JIRA please?

On 5 July 2016 at 11:31, Guus der Kinderen <guus.der.kinderen at gmail.com>
wrote:

> Hello,
>
> We have created a custom required action, in the form of a provider. It
> appears to behave as expected (we're using Keycloak 1.9.2)
>
> We are facing a challenge when trying to provision a new/empty server with
> Keycloak. We are trying to install Keycloak, and restore a pre-existing
> user base in it. Using the guidelines from chapter 25 "export and import"
> of the manual, we're able to do most of what we'd like to achieve.
>
> However, we're unable to restore users that have defined a required action
> as provided by our custom code. When we start up Keycloak, and look at the
> realm configuration for authentication, the 'required action'  is missing,
> but can be registered. After we manually do that, everything appears to be
> fine.
>
> Is there a way in which we can have a registered custom required action,
> without the need for manual intervention?
>
> We've tried adding a JSON snippet to the 'requiredActions' array property
> in the realm.json file that's being imported, but that does not appear to
> have any effect.
>
> An alternative would perhaps be registering the action through the REST
> endpoint that appears to be available, but that would require us to start
> Keycloak, before we've provisioned the users, which if possible, would be
> pretty messy (we'd have to wait for Keycloak to have started, invoke the
> REST endpoint, shut the instance down, and restart it with the user import,
> as far as I can tell).
>
> I'm hoping I'm simply missing an obvious option. Any help is much
> appreciated!
>
> Regards,
>
>   Guus
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160712/4377c87b/attachment.html 

From igor.zuk at qualitytaskforce.com  Tue Jul 12 10:13:33 2016
From: igor.zuk at qualitytaskforce.com (Igor Zuk)
Date: Tue, 12 Jul 2016 14:13:33 +0000
Subject: [keycloak-user] Keycloak user data encoding
In-Reply-To: <CAJgngAdOyTsY0Yzk81jQpm6+YnJZH7QkGr1fZ6iyfgF2T1cKUA@mail.gmail.com>
References: <HE1PR0201MB2217FED5B5E4767A0DBEFEA3F1300@HE1PR0201MB2217.eurprd02.prod.outlook.com>
	<CAJgngAfvYbPf5isVnvt4hkg0DiZevNOQJphQC9H1Ybs5EEBb5A@mail.gmail.com>
	<CAJgngAdOyTsY0Yzk81jQpm6+YnJZH7QkGr1fZ6iyfgF2T1cKUA@mail.gmail.com>
Message-ID: <HE1PR0201MB2217A4A6C24888DBD5414D31F1300@HE1PR0201MB2217.eurprd02.prod.outlook.com>

Thank you for a quick response.

I?m using 1.9.2.Final and the problem is a bit different, it?s not limited to registration screen.

I?m saying, that ISO-8859-1 is the default encoding, because all the text columns in USER_ENTITY table had encoding latin1. The table was created completely by Keycloak as the database was empty in the beginning. I manually switched encoding of FIRST_NAME to UTF-8 and modified it so it contained special letters. I started the user editor in Keycloak admin console and this name was displayed correctly. I added a single character to it, saved, and then the name got messed up with question marks instead of all special characters.

From: Stian Thorgersen [mailto:sthorger at redhat.com]
Sent: Tuesday, July 12, 2016 3:43 PM
To: Stian Thorgersen <stian at redhat.com>
Cc: Igor Zuk <igor.zuk at qualitytaskforce.com>; keycloak-user at lists.jboss.org
Subject: Re: [keycloak-user] Keycloak user data encoding

By the way this was fixed in 1.6.0.Final, see https://issues.jboss.org/browse/KEYCLOAK-1830?jql=project%20%3D%20KEYCLOAK%20AND%20text%20~%20%22encoding%22

Are you using an old version?

On 12 July 2016 at 15:37, Stian Thorgersen <sthorger at redhat.com<mailto:sthorger at redhat.com>> wrote:
Why are you saying the default encoding is ISO-8859-1? All forms are encoded as UTF-8 and all strings passed to the database should be UTF-8 encoded as well.

The only thing that is ISO-8859-1 is the message properties, but those are converted to UTF-8 when added to HTML pages.

On 12 July 2016 at 14:58, Igor Zuk <igor.zuk at qualitytaskforce.com<mailto:igor.zuk at qualitytaskforce.com>> wrote:
Hi

I have an encoding problem. By default users' data fields (e.g. first name and last name) are encoded using ISO-8859-1. People from many countries can't properly create accounts as their personal data is silently messed up. How can I fix it?

?         The MySQL DB receives already damaged names. By default all columns are ISO-8859-1-encoded, but manually converting them to UTF-8 doesn't help.

?         Manual account modification from admin console has same effect.

?         Change of default server (Wildfly) encoding to UTF-8 doesn't do anything.

Best regards
Igor ?uk

_______________________________________________
keycloak-user mailing list
keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>
https://lists.jboss.org/mailman/listinfo/keycloak-user


-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160712/895d4492/attachment.html 

From valerij.timofeev at gmail.com  Tue Jul 12 11:16:08 2016
From: valerij.timofeev at gmail.com (Valerij Timofeev)
Date: Tue, 12 Jul 2016 17:16:08 +0200
Subject: [keycloak-user] KEYCLOAK-3202 Creating users causes memory leak
In-Reply-To: <CAJgngAc11BoOFi17SjV9iripau9DDNMF3HktrLNrhqFDqDvoTg@mail.gmail.com>
References: <CAOy2obEVCKZhK6tLLhs8RQRs4ScUCgKfWTPjhn0N9Nmy2+yQpA@mail.gmail.com>
	<CAJgngAdQQ01OfgcHHw9Ati2-SDYU6WZbq0M1zN=hQBXWg-4qJQ@mail.gmail.com>
	<CAOy2obE_nBrnSA1DeCsnZenRAOgM+pJ8VR_xU12kuUK51OxAVg@mail.gmail.com>
	<CAJgngAc11BoOFi17SjV9iripau9DDNMF3HktrLNrhqFDqDvoTg@mail.gmail.com>
Message-ID: <CAOy2obHzUtaPD1tZbZ2Bnr+D-+5qTXMVS-OpGo3wV7CZ9k5-dw@mail.gmail.com>

Hi Stian,

>> adding an eviction policy to the realmVersions cache.
> There's a bit more to it as we're now adding the caches internally +
managing the size of them. This to hide it from users as they shouldn't
really be configurable.

Thank you for the explanation.
We apply the eviction policy in production environment tomorrow morning.
We have changed additionally number of owners to 2 for distributable caches
in our configuration. Would it make sense to set default to this value in
standalone-ha.xml same like for the web or ejb caches in the future
versions of Keycloak?

> Are you redirecting the user to the logout endpoint or just calling it?

Yes, we are redirecting explicit to the logout endpoint. But on Thursday we
will roll out a new version of our web aplication, which will simply call
ServletRequest.logout()
Additionally we will log more information in case of exceptions during
logout.

> It could also be that the session is no longer valid when you are
invoking the logout. Sessions expires on the Keycloak server and are
removed when they are expired so could be that the session you are trying
to logout no longer exist on the server and that causes the bad behavior.
You can try to emulate that in the test environment by changing the max
life for a session in the admin console.

I've simulated such situation in combination with ServletRequest.logout()
call:

Keycloak adapter logs an error:

16:55:53,548 ERROR
[org.keycloak.adapters.RefreshableKeycloakSecurityContext]
(ajp-/0.0.0.0:8009-4)  Refresh token failure status: 400
{"error_description":"Refresh token expired","error":"invalid_grant"}

Keycloak server logs a warning:

2016-07-12 16:55:53,536 WARN  [org.keycloak.events] (default task-11)
type=REFRESH_TOKEN_ERROR, realmId=myTS-DEV, clientId=myts-b2c, userId=null,
ipAddress=10.10.10.20, error=invalid_token, grant_type=refresh_token,
client_auth_method=client-secret

User is redirected as expected to login screen. So I'd say that the
behavior is correct.

As already mentioned we will roll out some changes this week. I will inform
you about the effect of the measures next week.

Thank you for your assistance!


2016-07-11 12:08 GMT+02:00 Stian Thorgersen <sthorger at redhat.com>:

>
>
> On 11 July 2016 at 11:08, Valerij Timofeev <valerij.timofeev at gmail.com>
> wrote:
>
>> Thank you for the prompt response Stian.
>>
>> > adding an eviction policy to the realmVersions cache.
>>
>> This was my impression after reading the ticket too, but I was not sure,
>> because according pull request looks a little bit more complicated.
>> We will give a try to this Keycloak setting in the production environment
>> tomorrow.
>> We are going to enable Infinispan statistics additionally to get more
>> information.
>>
>
> There's a bit more to it as we're now adding the caches internally +
> managing the size of them. This to hide it from users as they shouldn't
> really be configurable.
>
>
>>
>> > Is there any errors in the logs?
>>
>> We could identify only errors duiring the service logout until now:
>>
>> Stack Trace:
>>
>> org.keycloak.adapters.ServerRequest.error(ServerRequest.java:228)
>>
>> org.keycloak.adapters.ServerRequest.invokeLogout(ServerRequest.java:82)
>>
>> com.nhp.ts.b2b.services.auth.KcAdminServiceBean.serviceAccountLogout(KcAdminServiceBean.java:330)
>>
>> com.nhp.ts.b2b.services.auth.KcAdminServiceBean.executeAPIpostMethod(KcAdminServiceBean.java:545)
>>
>> sun.reflect.GeneratedMethodAccessor10512.invoke(Unknown Source)
>>
>> ...
>>
>> > What is the status code returned with the empty page?
>>
>> Our web application unfortunately does not log status code and error
>> message. Exception message is null in case of service account logout. We
>> will roll out a fix for this with the next web application release on
>> Thursday this week.
>>
>> Additionally we are going to switch from the OIDC logout endpint method
>> to the ServletRequest.logout() method because it seems to be a more
>> consistent way for a web application which is already protected by Keycloak
>> EAP 6 adapters, isn't it?
>>
>
> Are you redirecting the user to the logout endpoint or just calling it?
>
> ServletRequest.logout()  redirects to the logout endpoint which will
> invalidate the SSO session, then it redirects back to the application and
> the http session is removed. It's certainly simpler to use this directly as
> it takes care of everything.
>
>
>>
>> Additional details about the experienced behaviour: the empty page is our
>> web application internal page. In Google Chrome webbrowser I see for
>> example that the initiator of the last POST request to this internal page
>> was www.googletagmanager.com/gtm.js?id=... Could be this a problem?
>> If I refresh this empty page, I'm back in the web application (still
>> logged in).
>> But if I call OCID logout endpoint
>> (/realms/${realm}/protocol/openid-connect/logout) in the same browser
>> myself  and then refresh the empty page, then I'm redirected to the KC
>> login screen.
>>
>> Any ideas?
>>
>
> It could also be that the session is no longer valid when you are invoking
> the logout. Sessions expires on the Keycloak server and are removed when
> they are expired so could be that the session you are trying to logout no
> longer exist on the server and that causes the bad behavior. You can try to
> emulate that in the test environment by changing the max life for a session
> in the admin console.
>
>
>>
>> Apart from that I hope that we will get more information after the
>> release on Thursday.
>>
>>
>> 2016-07-11 7:37 GMT+02:00 Stian Thorgersen <sthorger at redhat.com>:
>>
>>> Hi,
>>>
>>> You can relatively easily try though by adding an eviction policy to the
>>> realmVersions cache. I found that with roughly a million users there would
>>> be around 500Mb of memory consumed, which will run you into issues with the
>>> default settings if you have that many users login over a space of a day
>>> and a half.
>>>
>>> Empty page could be due to timeout. Is there any errors in the logs?
>>> What is the status code returned with the empty page?
>>>
>>> On 8 July 2016 at 10:40, Valerij Timofeev <valerij.timofeev at gmail.com>
>>> wrote:
>>>
>>>> Hi Stian,
>>>>
>>>> You are the assignee in KEYCLOAK-3202
>>>> <https://issues.jboss.org/browse/KEYCLOAK-3202>, so I addressed this
>>>> email to you directly.
>>>>
>>>> I guess that this issue could be the cause of trouble in our production
>>>> environment.
>>>>
>>>> There are 4 EAP-6 nodes with Keycloak adapters and 2 Keycloak 1.9.4
>>>> standalone servers running in 2 clusters respectively.
>>>>
>>>> We experience logout failures approximately after one and a half days
>>>> of operation.
>>>> Restarting EAP 6 nodes temporary resolves the logout problem.
>>>>
>>>> Durable load tests in out test environment showed that login and logout
>>>> of existing users don't result in above behaviour.
>>>> We added to the durable load test additional scenario creating new
>>>> users and were able to reproduce logout failure: users are getting empty
>>>> page and not the login screen as expected. Page reload navigates back into
>>>> the protected web application .
>>>>
>>>> Logout is accomplished in a Java web applictaion by calling OIDC logout
>>>> endpoint:
>>>>
>>>>
>>>>
>>>>
>>>>
>>>> *FacesContext                .getCurrentInstance()
>>>> .getExternalContext()
>>>> .redirect(keycloakDeployment.getLogoutUrl().queryParam("redirect_uri",
>>>> redirectURL).toTemplate());*
>>>>
>>>> Logout is initiated via h:commandLink, so I suppose that the OIDC
>>>> logout endpoint is called via the GET method. Should we use the POST method
>>>> instead?
>>>>
>>>> Has servlet logout any advantages?
>>>>
>>>>
>>>>
>>>> *((HttpServletRequest)
>>>> FacesContext.getCurrentInstance().getExternalContext().getRequest()).logout();*
>>>> I'd appreciate quick response*, *because restarting production EAP
>>>> cluster every day is not a pleasant option ;-)
>>>>
>>>> Thank you in advance
>>>>
>>>> Kind regards
>>>> Valerij Timofeev
>>>>
>>>
>>>
>>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160712/198eb237/attachment-0001.html 

From rllavallee at hotmail.com  Tue Jul 12 16:08:28 2016
From: rllavallee at hotmail.com (Richard Lavallee)
Date: Tue, 12 Jul 2016 20:08:28 +0000
Subject: [keycloak-user] Connection timed out: logging out of Keycloak
Message-ID: <BLU181-W30C4C63CCF1D527978E02DCB300@phx.gbl>

Has anyone experienced a similar failure stack trace when initiating a Logout from Keycloak, please?

This has something to do with the Admin URL, BUT...filling that in seems to cause a Proxy Error when attempting to logout normally, and doesn't seem to work in the first place. I am unsure on how to proceed forward on this, and I'm hoping someone in the community has worked with the Tomcat Adapter
-Richard

19:36:55,145 WARN  [org.keycloak.services] (default task-30) KC-SERVICES0057: Logout for client 'myApp' failed: org.apache.http.conn.ConnectTimeoutException: Connect to 10.0.3.141:8083 [/10.0.3.141] failed: Connection timed out        at org.apache.http.impl.conn.DefaultHttpClientConnectionOperator.connect(DefaultHttpClientConnectionOperator.java:149)        at org.apache.http.impl.conn.PoolingHttpClientConnectionManager.connect(PoolingHttpClientConnectionManager.java:353)        at org.apache.http.impl.execchain.MainClientExec.establishRoute(MainClientExec.java:380)        at org.apache.http.impl.execchain.MainClientExec.execute(MainClientExec.java:236)        at org.apache.http.impl.execchain.ProtocolExec.execute(ProtocolExec.java:184)        at org.apache.http.impl.execchain.RetryExec.execute(RetryExec.java:88)        at org.apache.http.impl.execchain.RedirectExec.execute(RedirectExec.java:110)        at org.apache.http.impl.client.InternalHttpClient.doExecute(InternalHttpClient.java:184)        at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:82)        at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:107)        at org.keycloak.connections.httpclient.DefaultHttpClientFactory$1.postText(DefaultHttpClientFactory.java:70)        at org.keycloak.services.managers.ResourceAdminManager.sendLogoutRequest(ResourceAdminManager.java:251)        at org.keycloak.services.managers.ResourceAdminManager.logoutClientSessions(ResourceAdminManager.java:195)        at org.keycloak.services.managers.ResourceAdminManager.logoutClientSession(ResourceAdminManager.java:150)        at org.keycloak.protocol.oidc.OIDCLoginProtocol.backchannelLogout(OIDCLoginProtocol.java:209)        at org.keycloak.services.managers.AuthenticationManager.browserLogout(AuthenticationManager.java:208)        at org.keycloak.protocol.oidc.endpoints.LogoutEndpoint.logout(LogoutEndpoint.java:142)        at sun.reflect.GeneratedMethodAccessor584.invoke(Unknown Source)        at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)        at java.lang.reflect.Method.invoke(Method.java:498)        at org.jboss.resteasy.core.MethodInjectorImpl.invoke(MethodInjectorImpl.java:139)        at org.jboss.resteasy.core.ResourceMethodInvoker.invokeOnTarget(ResourceMethodInvoker.java:295)        at org.jboss.resteasy.core.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:249)        at org.jboss.resteasy.core.ResourceLocatorInvoker.invokeOnTargetObject(ResourceLocatorInvoker.java:138)        at org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorInvoker.java:107)        at org.jboss.resteasy.core.ResourceLocatorInvoker.invokeOnTargetObject(ResourceLocatorInvoker.java:133)        at org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorInvoker.java:101)        at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:395)        at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:202)        at org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.service(ServletContainerDispatcher.java:221)        at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:56)        at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:51)        at javax.servlet.http.HttpServlet.service(HttpServlet.java:790)        at io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:85)        at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:129)        at org.keycloak.services.filters.KeycloakSessionServletFilter.doFilter(KeycloakSessionServletFilter.java:88)        at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:60)        at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)        at io.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.java:84)        at io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:62)        at io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36)        at org.wildfly.extension.undertow.security.SecurityContextAssociationHandler.handleRequest(SecurityContextAssociationHandler.java:78)        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)        at io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:131)        at io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:57)        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)        at io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:46)        at io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64)        at io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:60)        at io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:77)        at io.undertow.security.handlers.NotificationReceiverHandler.handleRequest(NotificationReceiverHandler.java:50)        at io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43)        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)        at org.wildfly.extension.undertow.security.jacc.JACCContextIdHandler.handleRequest(JACCContextIdHandler.java:61)        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)        at io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:284)        at io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:263)        at io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:81)        at io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:174)        at io.undertow.server.Connectors.executeRootHandler(Connectors.java:202)        at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:793)        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)        at java.lang.Thread.run(Thread.java:745)Caused by: java.net.ConnectException: Connection timed out        at java.net.PlainSocketImpl.socketConnect(Native Method)        at java.net.AbstractPlainSocketImpl.doConnect(AbstractPlainSocketImpl.java:350)        at java.net.AbstractPlainSocketImpl.connectToAddress(AbstractPlainSocketImpl.java:206)        at java.net.AbstractPlainSocketImpl.connect(AbstractPlainSocketImpl.java:188)        at java.net.SocksSocketImpl.connect(SocksSocketImpl.java:392)        at java.net.Socket.connect(Socket.java:589)        at org.apache.http.conn.socket.PlainConnectionSocketFactory.connectSocket(PlainConnectionSocketFactory.java:74)        at org.apache.http.impl.conn.DefaultHttpClientConnectionOperator.connect(DefaultHttpClientConnectionOperator.java:134)        ... 64 more
 		 	   		  
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160712/c6ed1b77/attachment.html 

From azagniotov at gmail.com  Tue Jul 12 18:40:30 2016
From: azagniotov at gmail.com (Alexander Zagniotov)
Date: Tue, 12 Jul 2016 15:40:30 -0700
Subject: [keycloak-user] Does Keycloak compliant with XACML 2.0 or 3.0
	standard?
Message-ID: <CAHt8Wcv85V1GpL6R=b+jrSmEzT0Qmvjb4XKArFeFhAxhHVPSiA@mail.gmail.com>

Hello All,

As per subject.

I am also interested to know if Keycloak supports new features provided by
XACML 3.0:
Multiple Decision Profile, Policy combination algorithms,  Delegation, etc.

That being said, is aggregated policies feature is Keycloak's answer to
some of the XACML 3.0 new features?


Thanks
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160712/760286a0/attachment.html 

From bruno at abstractj.org  Tue Jul 12 21:57:04 2016
From: bruno at abstractj.org (Bruno Oliveira)
Date: Tue, 12 Jul 2016 22:57:04 -0300
Subject: [keycloak-user] Connection timed out: logging out of Keycloak
In-Reply-To: <BLU181-W30C4C63CCF1D527978E02DCB300@phx.gbl>
References: <BLU181-W30C4C63CCF1D527978E02DCB300@phx.gbl>
Message-ID: <20160713015704.GB27520@abstractj.org>

Do you have the exact steps to reproduce? I never experienced that, but
I can give it a try.

On 2016-07-12, Richard Lavallee wrote:
> Has anyone experienced a similar failure stack trace when initiating a Logout from Keycloak, please?
>
> This has something to do with the Admin URL, BUT...filling that in seems to cause a Proxy Error when attempting to logout normally, and doesn't seem to work in the first place. I am unsure on how to proceed forward on this, and I'm hoping someone in the community has worked with the Tomcat Adapter
> -Richard
>
> 19:36:55,145 WARN  [org.keycloak.services] (default task-30) KC-SERVICES0057: Logout for client 'myApp' failed: org.apache.http.conn.ConnectTimeoutException: Connect to 10.0.3.141:8083 [/10.0.3.141] failed: Connection timed out        at org.apache.http.impl.conn.DefaultHttpClientConnectionOperator.connect(DefaultHttpClientConnectionOperator.java:149)        at org.apache.http.impl.conn.PoolingHttpClientConnectionManager.connect(PoolingHttpClientConnectionManager.java:353)        at org.apache.http.impl.execchain.MainClientExec.establishRoute(MainClientExec.java:380)        at org.apache.http.impl.execchain.MainClientExec.execute(MainClientExec.java:236)        at org.apache.http.impl.execchain.ProtocolExec.execute(ProtocolExec.java:184)        at org.apache.http.impl.execchain.RetryExec.execute(RetryExec.java:88)        at org.apache.http.impl.execchain.RedirectExec.execute(RedirectExec.java:110)        at org.apache.http.impl.client.InternalHttpClient.doExecute(InternalHttpClient.java:184)        at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:82)        at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:107)        at org.keycloak.connections.httpclient.DefaultHttpClientFactory$1.postText(DefaultHttpClientFactory.java:70)        at org.keycloak.services.managers.ResourceAdminManager.sendLogoutRequest(ResourceAdminManager.java:251)        at org.keycloak.services.managers.ResourceAdminManager.logoutClientSessions(ResourceAdminManager.java:195)        at org.keycloak.services.managers.ResourceAdminManager.logoutClientSession(ResourceAdminManager.java:150)        at org.keycloak.protocol.oidc.OIDCLoginProtocol.backchannelLogout(OIDCLoginProtocol.java:209)        at org.keycloak.services.managers.AuthenticationManager.browserLogout(AuthenticationManager.java:208)        at org.keycloak.protocol.oidc.endpoints.LogoutEndpoint.logout(LogoutEndpoint.java:142)        at sun.reflect.GeneratedMethodAccessor584.invoke(Unknown Source)        at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)        at java.lang.reflect.Method.invoke(Method.java:498)        at org.jboss.resteasy.core.MethodInjectorImpl.invoke(MethodInjectorImpl.java:139)        at org.jboss.resteasy.core.ResourceMethodInvoker.invokeOnTarget(ResourceMethodInvoker.java:295)        at org.jboss.resteasy.core.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:249)        at org.jboss.resteasy.core.ResourceLocatorInvoker.invokeOnTargetObject(ResourceLocatorInvoker.java:138)        at org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorInvoker.java:107)        at org.jboss.resteasy.core.ResourceLocatorInvoker.invokeOnTargetObject(ResourceLocatorInvoker.java:133)        at org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorInvoker.java:101)        at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:395)        at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:202)        at org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.service(ServletContainerDispatcher.java:221)        at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:56)        at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:51)        at javax.servlet.http.HttpServlet.service(HttpServlet.java:790)        at io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:85)        at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:129)        at org.keycloak.services.filters.KeycloakSessionServletFilter.doFilter(KeycloakSessionServletFilter.java:88)        at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:60)        at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)        at io.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.java:84)        at io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:62)        at io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36)        at org.wildfly.extension.undertow.security.SecurityContextAssociationHandler.handleRequest(SecurityContextAssociationHandler.java:78)        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)        at io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:131)        at io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:57)        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)        at io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:46)        at io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64)        at io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:60)        at io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:77)        at io.undertow.security.handlers.NotificationReceiverHandler.handleRequest(NotificationReceiverHandler.java:50)        at io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43)        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)        at org.wildfly.extension.undertow.security.jacc.JACCContextIdHandler.handleRequest(JACCContextIdHandler.java:61)        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)        at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)        at io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:284)        at io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:263)        at io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:81)        at io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:174)        at io.undertow.server.Connectors.executeRootHandler(Connectors.java:202)        at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:793)        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)        at java.lang.Thread.run(Thread.java:745)Caused by: java.net.ConnectException: Connection timed out        at java.net.PlainSocketImpl.socketConnect(Native Method)        at java.net.AbstractPlainSocketImpl.doConnect(AbstractPlainSocketImpl.java:350)        at java.net.AbstractPlainSocketImpl.connectToAddress(AbstractPlainSocketImpl.java:206)        at java.net.AbstractPlainSocketImpl.connect(AbstractPlainSocketImpl.java:188)        at java.net.SocksSocketImpl.connect(SocksSocketImpl.java:392)        at java.net.Socket.connect(Socket.java:589)        at org.apache.http.conn.socket.PlainConnectionSocketFactory.connectSocket(PlainConnectionSocketFactory.java:74)        at org.apache.http.impl.conn.DefaultHttpClientConnectionOperator.connect(DefaultHttpClientConnectionOperator.java:134)        ... 64 more
>

> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user


--

abstractj
PGP: 0x84DC9914


From sthorger at redhat.com  Wed Jul 13 01:01:27 2016
From: sthorger at redhat.com (Stian Thorgersen)
Date: Wed, 13 Jul 2016 07:01:27 +0200
Subject: [keycloak-user] KEYCLOAK-3202 Creating users causes memory leak
In-Reply-To: <CAOy2obHzUtaPD1tZbZ2Bnr+D-+5qTXMVS-OpGo3wV7CZ9k5-dw@mail.gmail.com>
References: <CAOy2obEVCKZhK6tLLhs8RQRs4ScUCgKfWTPjhn0N9Nmy2+yQpA@mail.gmail.com>
	<CAJgngAdQQ01OfgcHHw9Ati2-SDYU6WZbq0M1zN=hQBXWg-4qJQ@mail.gmail.com>
	<CAOy2obE_nBrnSA1DeCsnZenRAOgM+pJ8VR_xU12kuUK51OxAVg@mail.gmail.com>
	<CAJgngAc11BoOFi17SjV9iripau9DDNMF3HktrLNrhqFDqDvoTg@mail.gmail.com>
	<CAOy2obHzUtaPD1tZbZ2Bnr+D-+5qTXMVS-OpGo3wV7CZ9k5-dw@mail.gmail.com>
Message-ID: <CAJgngAe0ksJBC1NYpm5Yj_oPVgma7Uarac_50621pyihdFEkng@mail.gmail.com>

On 12 July 2016 at 17:16, Valerij Timofeev <valerij.timofeev at gmail.com>
wrote:

> Hi Stian,
>
> >> adding an eviction policy to the realmVersions cache.
> > There's a bit more to it as we're now adding the caches internally +
> managing the size of them. This to hide it from users as they shouldn't
> really be configurable.
>
> Thank you for the explanation.
> We apply the eviction policy in production environment tomorrow morning.
> We have changed additionally number of owners to 2 for distributable
> caches in our configuration. Would it make sense to set default to this
> value in standalone-ha.xml same like for the web or ejb caches in the
> future versions of Keycloak?
>

We've decided to stick with owners set to 1 by default. It's better for
performance and in most cases sufficient as users can just re-authenticate
if a session is lost.


>
>
> > Are you redirecting the user to the logout endpoint or just calling it?
>
> Yes, we are redirecting explicit to the logout endpoint. But on Thursday
> we will roll out a new version of our web aplication, which will simply
> call ServletRequest.logout()
> Additionally we will log more information in case of exceptions during
> logout.
>
> > It could also be that the session is no longer valid when you are
> invoking the logout. Sessions expires on the Keycloak server and are
> removed when they are expired so could be that the session you are trying
> to logout no longer exist on the server and that causes the bad behavior.
> You can try to emulate that in the test environment by changing the max
> life for a session in the admin console.
>
> I've simulated such situation in combination with ServletRequest.logout()
> call:
>
> Keycloak adapter logs an error:
>
> 16:55:53,548 ERROR
> [org.keycloak.adapters.RefreshableKeycloakSecurityContext]
> (ajp-/0.0.0.0:8009-4)  Refresh token failure status: 400
> {"error_description":"Refresh token expired","error":"invalid_grant"}
>
> Keycloak server logs a warning:
>
> 2016-07-12 16:55:53,536 WARN  [org.keycloak.events] (default task-11)
> type=REFRESH_TOKEN_ERROR, realmId=myTS-DEV, clientId=myts-b2c, userId=null,
> ipAddress=10.10.10.20, error=invalid_token, grant_type=refresh_token,
> client_auth_method=client-secret
>
> User is redirected as expected to login screen. So I'd say that the
> behavior is correct.
>
> As already mentioned we will roll out some changes this week. I will
> inform you about the effect of the measures next week.
>
> Thank you for your assistance!
>
>
> 2016-07-11 12:08 GMT+02:00 Stian Thorgersen <sthorger at redhat.com>:
>
>>
>>
>> On 11 July 2016 at 11:08, Valerij Timofeev <valerij.timofeev at gmail.com>
>> wrote:
>>
>>> Thank you for the prompt response Stian.
>>>
>>> > adding an eviction policy to the realmVersions cache.
>>>
>>> This was my impression after reading the ticket too, but I was not sure,
>>> because according pull request looks a little bit more complicated.
>>> We will give a try to this Keycloak setting in the production
>>> environment tomorrow.
>>> We are going to enable Infinispan statistics additionally to get more
>>> information.
>>>
>>
>> There's a bit more to it as we're now adding the caches internally +
>> managing the size of them. This to hide it from users as they shouldn't
>> really be configurable.
>>
>>
>>>
>>> > Is there any errors in the logs?
>>>
>>> We could identify only errors duiring the service logout until now:
>>>
>>> Stack Trace:
>>>
>>> org.keycloak.adapters.ServerRequest.error(ServerRequest.java:228)
>>>
>>> org.keycloak.adapters.ServerRequest.invokeLogout(ServerRequest.java:82)
>>>
>>> com.nhp.ts.b2b.services.auth.KcAdminServiceBean.serviceAccountLogout(KcAdminServiceBean.java:330)
>>>
>>> com.nhp.ts.b2b.services.auth.KcAdminServiceBean.executeAPIpostMethod(KcAdminServiceBean.java:545)
>>>
>>> sun.reflect.GeneratedMethodAccessor10512.invoke(Unknown Source)
>>>
>>> ...
>>>
>>> > What is the status code returned with the empty page?
>>>
>>> Our web application unfortunately does not log status code and error
>>> message. Exception message is null in case of service account logout. We
>>> will roll out a fix for this with the next web application release on
>>> Thursday this week.
>>>
>>> Additionally we are going to switch from the OIDC logout endpint method
>>> to the ServletRequest.logout() method because it seems to be a more
>>> consistent way for a web application which is already protected by Keycloak
>>> EAP 6 adapters, isn't it?
>>>
>>
>> Are you redirecting the user to the logout endpoint or just calling it?
>>
>> ServletRequest.logout()  redirects to the logout endpoint which will
>> invalidate the SSO session, then it redirects back to the application and
>> the http session is removed. It's certainly simpler to use this directly as
>> it takes care of everything.
>>
>>
>>>
>>> Additional details about the experienced behaviour: the empty page is
>>> our web application internal page. In Google Chrome webbrowser I see for
>>> example that the initiator of the last POST request to this internal page
>>> was www.googletagmanager.com/gtm.js?id=... Could be this a problem?
>>> If I refresh this empty page, I'm back in the web application (still
>>> logged in).
>>> But if I call OCID logout endpoint
>>> (/realms/${realm}/protocol/openid-connect/logout) in the same browser
>>> myself  and then refresh the empty page, then I'm redirected to the KC
>>> login screen.
>>>
>>> Any ideas?
>>>
>>
>> It could also be that the session is no longer valid when you are
>> invoking the logout. Sessions expires on the Keycloak server and are
>> removed when they are expired so could be that the session you are trying
>> to logout no longer exist on the server and that causes the bad behavior.
>> You can try to emulate that in the test environment by changing the max
>> life for a session in the admin console.
>>
>>
>>>
>>> Apart from that I hope that we will get more information after the
>>> release on Thursday.
>>>
>>>
>>> 2016-07-11 7:37 GMT+02:00 Stian Thorgersen <sthorger at redhat.com>:
>>>
>>>> Hi,
>>>>
>>>> You can relatively easily try though by adding an eviction policy to
>>>> the realmVersions cache. I found that with roughly a million users there
>>>> would be around 500Mb of memory consumed, which will run you into issues
>>>> with the default settings if you have that many users login over a space of
>>>> a day and a half.
>>>>
>>>> Empty page could be due to timeout. Is there any errors in the logs?
>>>> What is the status code returned with the empty page?
>>>>
>>>> On 8 July 2016 at 10:40, Valerij Timofeev <valerij.timofeev at gmail.com>
>>>> wrote:
>>>>
>>>>> Hi Stian,
>>>>>
>>>>> You are the assignee in KEYCLOAK-3202
>>>>> <https://issues.jboss.org/browse/KEYCLOAK-3202>, so I addressed this
>>>>> email to you directly.
>>>>>
>>>>> I guess that this issue could be the cause of trouble in our
>>>>> production environment.
>>>>>
>>>>> There are 4 EAP-6 nodes with Keycloak adapters and 2 Keycloak 1.9.4
>>>>> standalone servers running in 2 clusters respectively.
>>>>>
>>>>> We experience logout failures approximately after one and a half days
>>>>> of operation.
>>>>> Restarting EAP 6 nodes temporary resolves the logout problem.
>>>>>
>>>>> Durable load tests in out test environment showed that login and
>>>>> logout of existing users don't result in above behaviour.
>>>>> We added to the durable load test additional scenario creating new
>>>>> users and were able to reproduce logout failure: users are getting empty
>>>>> page and not the login screen as expected. Page reload navigates back into
>>>>> the protected web application .
>>>>>
>>>>> Logout is accomplished in a Java web applictaion by calling OIDC
>>>>> logout endpoint:
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>> *FacesContext                .getCurrentInstance()
>>>>> .getExternalContext()
>>>>> .redirect(keycloakDeployment.getLogoutUrl().queryParam("redirect_uri",
>>>>> redirectURL).toTemplate());*
>>>>>
>>>>> Logout is initiated via h:commandLink, so I suppose that the OIDC
>>>>> logout endpoint is called via the GET method. Should we use the POST method
>>>>> instead?
>>>>>
>>>>> Has servlet logout any advantages?
>>>>>
>>>>>
>>>>>
>>>>> *((HttpServletRequest)
>>>>> FacesContext.getCurrentInstance().getExternalContext().getRequest()).logout();*
>>>>> I'd appreciate quick response*, *because restarting production EAP
>>>>> cluster every day is not a pleasant option ;-)
>>>>>
>>>>> Thank you in advance
>>>>>
>>>>> Kind regards
>>>>> Valerij Timofeev
>>>>>
>>>>
>>>>
>>>
>>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160713/48205e1b/attachment.html 

From battery4cid at gmail.com  Wed Jul 13 07:50:18 2016
From: battery4cid at gmail.com (Bruce Shaw)
Date: Wed, 13 Jul 2016 07:50:18 -0400
Subject: [keycloak-user] Keycloak Docker behind loadbalancer with https fails
Message-ID: <CAFYKa1mHK1-sAd+KRBZaqf6NhR-CX8xGTeeanSvL5iDuFL=M+g@mail.gmail.com>

Hello,

I have a standalone Keycloak docker deployed behind a loadbalancer like so:

https -> (443) loadbalancer -> (80) Server -> (8080) DockerContainer

I'm terminating SSL at the loadbalancer, so hitting
https://accounts.mysite.com/auth/admin... fails because all assets return
as http.  I expected Keycloak to match the protocol of https.

If I hit my loadbalancer directly with http, I can flip the switch inside
the realm to force all requests to require ssl.  Then back over to
https://accounts.mysite.com/auth/admin... says "HTTPS Required"??

My network administration knowledge is limited, so at this point I'm
stuck.  Is there an issue with my standalone.xml configuration?

jboss.bind.address is  "0.0.0.0"

<http-listener name="default" socket-binding="http" redirect-socket="https" />

thanks
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160713/aeb44f41/attachment-0001.html 

From mposolda at redhat.com  Wed Jul 13 12:18:38 2016
From: mposolda at redhat.com (Marek Posolda)
Date: Wed, 13 Jul 2016 18:18:38 +0200
Subject: [keycloak-user] Keycloak Docker behind loadbalancer with https
 fails
In-Reply-To: <CAFYKa1mHK1-sAd+KRBZaqf6NhR-CX8xGTeeanSvL5iDuFL=M+g@mail.gmail.com>
References: <CAFYKa1mHK1-sAd+KRBZaqf6NhR-CX8xGTeeanSvL5iDuFL=M+g@mail.gmail.com>
Message-ID: <578669DE.6040605@redhat.com>

On 13/07/16 13:50, Bruce Shaw wrote:
> Hello,
>
> I have a standalone Keycloak docker deployed behind a loadbalancer 
> like so:
>
> https -> (443) loadbalancer -> (80) Server -> (8080) DockerContainer
>
> I'm terminating SSL at the loadbalancer, so hitting 
> https://accounts.mysite.com/auth/admin... fails because all assets 
> return as http.  I expected Keycloak to match the protocol of https.
>
> If I hit my loadbalancer directly with http, I can flip the switch 
> inside the realm to force all requests to require ssl.  Then back over 
> to https://accounts.mysite.com/auth/admin... says "HTTPS Required"??
>
> My network administration knowledge is limited, so at this point I'm 
> stuck.  Is there an issue with my standalone.xml configuration?
Yes, looks like that. Your loadbalancer must forward the headers like 
"X-Forwarded-Proto" . You can also set it in standalone.xml on Keycloak 
side, so Keycloak see the correct protocol. For some details, see our docs:
https://keycloak.gitbooks.io/server-installation-and-configuration/content/v/2.0/topics/clustering/load-balancer.html
https://keycloak.gitbooks.io/server-installation-and-configuration/content/v/2.0/topics/network/https.html

Marek
>
> jboss.bind.address is  "0.0.0.0"
>
> <http-listener name="default" socket-binding="http" redirect-socket="https" />
>
>
> thanks
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160713/627f30ca/attachment.html 

From aikeaguinea at xsmail.com  Wed Jul 13 15:53:28 2016
From: aikeaguinea at xsmail.com (Aikeaguinea)
Date: Wed, 13 Jul 2016 15:53:28 -0400
Subject: [keycloak-user] One client application, users in many organizations
Message-ID: <1468439608.3327910.665471033.6CFA1A2B@webmail.messagingengine.com>

We have a client web application which accepts requests from users in
many different unrelated organizations. Two approaches I see are 1) to
create a realm per organization, or 2) create a single realm with our
application as client, and assign users to different groups based on
their organization.

If we go with approach 1, I'm not sure how we'd handle the client ID and
secret for our web app. If we had multiple realms in Keycloak, each with
one client for our web application, somehow the web application would
need to know which Keycloak client to use for which user, which sounds
complicated and maybe untenable. On the other hand, clients can't span
realms, can they?

If we go with 2, one complication is administration--e.g., bulk logout.
If all the users are in the same realm, it doesn't appear to me that
there's a way in the admin console to logout all sessions of users
belonging to one group, or to disable all users belonging to a group. Is
that right? 

It also doesn't look straightforward to get from the API all the users
for a given group--you can get the groups a user is in, but I don't see
a call that does the inverse. Is there a way we could do this?

Or is there an entirely different approach I'm not thinking of?

-- 
  Aikeaguinea
  aikeaguinea at xsmail.com

-- 
http://www.fastmail.com - Accessible with your email software
                          or over the web


From sthorger at redhat.com  Thu Jul 14 03:30:47 2016
From: sthorger at redhat.com (Stian Thorgersen)
Date: Thu, 14 Jul 2016 09:30:47 +0200
Subject: [keycloak-user] Does Keycloak compliant with XACML 2.0 or 3.0
	standard?
In-Reply-To: <CAHt8Wcv85V1GpL6R=b+jrSmEzT0Qmvjb4XKArFeFhAxhHVPSiA@mail.gmail.com>
References: <CAHt8Wcv85V1GpL6R=b+jrSmEzT0Qmvjb4XKArFeFhAxhHVPSiA@mail.gmail.com>
Message-ID: <CAJgngAdbrzwXJHk5A7CUWn2sY-MuU06X-M48rnSXrybvLhf0OA@mail.gmail.com>

We're not supporting XACML 2.0 or 3.0. I haven't looked at XACML 3 yet
myself, but it sounds like it is a significant improvement and it would be
worth considering adding a XACML 3 policy.

Aggregated policies are a natural addition to Keycloak and it's not
directly an answer to XACML rather an alternative approach.

Pedro can probably elaborate a bit more on this though.

On 13 July 2016 at 00:40, Alexander Zagniotov <azagniotov at gmail.com> wrote:

> Hello All,
>
> As per subject.
>
> I am also interested to know if Keycloak supports new features provided by
> XACML 3.0:
> Multiple Decision Profile, Policy combination algorithms,  Delegation, etc.
>
> That being said, is aggregated policies feature is Keycloak's answer to
> some of the XACML 3.0 new features?
>
>
> Thanks
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160714/38dd7055/attachment.html 

From sthorger at redhat.com  Thu Jul 14 03:40:54 2016
From: sthorger at redhat.com (Stian Thorgersen)
Date: Thu, 14 Jul 2016 09:40:54 +0200
Subject: [keycloak-user] One client application,
	users in many organizations
In-Reply-To: <1468439608.3327910.665471033.6CFA1A2B@webmail.messagingengine.com>
References: <1468439608.3327910.665471033.6CFA1A2B@webmail.messagingengine.com>
Message-ID: <CAJgngAfbC-O8VgdpEDt0AM7bq=zyZsvxBjBx15Kq0AJzDzDK5A@mail.gmail.com>

On 13 July 2016 at 21:53, Aikeaguinea <aikeaguinea at xsmail.com> wrote:

> We have a client web application which accepts requests from users in
> many different unrelated organizations. Two approaches I see are 1) to
> create a realm per organization, or 2) create a single realm with our
> application as client, and assign users to different groups based on
> their organization.
>
> If we go with approach 1, I'm not sure how we'd handle the client ID and
> secret for our web app. If we had multiple realms in Keycloak, each with
> one client for our web application, somehow the web application would
> need to know which Keycloak client to use for which user, which sounds
> complicated and maybe untenable. On the other hand, clients can't span
> realms, can they?


Guess that depends on how many clients you are talking about. FIY we have a
multi tenancy example that shows how you can have multiple configs for the
same app.


>
> If we go with 2, one complication is administration--e.g., bulk logout.
> If all the users are in the same realm, it doesn't appear to me that
> there's a way in the admin console to logout all sessions of users
> belonging to one group, or to disable all users belonging to a group. Is
> that right?
>

There's no option to do that yet, but we want to add support for bulk
updates to users in the future. See
https://issues.jboss.org/browse/KEYCLOAK-1413


>
> It also doesn't look straightforward to get from the API all the users
> for a given group--you can get the groups a user is in, but I don't see
> a call that does the inverse. Is there a way we could do this?
>

True - we don't support search by group. You can create a JIRA request for
that.


>
> Or is there an entirely different approach I'm not thinking of?
>

Not without a lot of customization. However, we do provide several SPIs
that allow you to customize Keycloak to accommodate your needs.

For example for option 1 you can use admin api to create clients which
would allow you to create the client in all realms.

For option 2 you could add a custom realm resource that allows logout or
disabling all users with a specific group.


>
> --
>   Aikeaguinea
>   aikeaguinea at xsmail.com
>
> --
> http://www.fastmail.com - Accessible with your email software
>                           or over the web
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160714/40929617/attachment.html 

From TBarcia at wfscorp.com  Thu Jul 14 09:27:10 2016
From: TBarcia at wfscorp.com (Thomas Barcia)
Date: Thu, 14 Jul 2016 13:27:10 +0000
Subject: [keycloak-user] Keycloak unable to open JDBC connection
Message-ID: <75d2b5690a9c48018f940e99718e1269@MIA-WEX-P16.wfs.com>

I have Keycloak 1.9.8-Final running against an Oracle database and it appears that when the connections are unused for a period of time (usually overnight) Keycloak is unable to open a JDBC connection to the database.  I spoke with the DBAs and the database is not closing the connections.  According to the DBAs I need to enable connection validation but I'm not a programmer and can't find a good example of how it's done.  Can anyone provide some help with this?  Am I on the right track in resolving the issue?

Thanks.

This is from my standalone-ha.xml:
<datasource jndi-name="java:jboss/datasources/KeycloakDS" pool-name="KeycloakDS" enabled="true" use-java-context="true">
                 <connection-url>jdbc:oracle:thin:@<servername>:<port>:<databasename></connection-url>
                  <driver>oracle</driver>
                 <pool>
                   <min-pool-size>1</min-pool-size>
                   <max-pool-size>5</max-pool-size>
                   <prefill>true</prefill>
                  </pool>
                  <security>
                   <user-name><name></user-name>
                   <password><password></password>
                 </security>

                </datasource>
                <drivers>
                    <driver name="h2" module="com.h2database.h2">
                        <xa-datasource-class>org.h2.jdbcx.JdbcDataSource</xa-datasource-class>
                    </driver>
                    <driver name="oracle" module="com.oracle">
                        <driver-class>oracle.jdbc.driver.OracleDriver</driver-class>
                    </driver>
                </drivers>

And this is the error:
2016-07-14 00:13:09,460 WARN  [org.hibernate.engine.jdbc.spi.SqlExceptionHelper] (Timer-2) SQL Error: 0, SQLState: null
2016-07-14 00:13:09,461 ERROR [org.hibernate.engine.jdbc.spi.SqlExceptionHelper] (Timer-2) javax.resource.ResourceException: IJ000453: Unable to get managed connection for java:jboss/datasources/KeycloakDS
2016-07-14 00:13:09,462 ERROR [org.keycloak.services] (Timer-2) KC-SERVICES0089: Failed to run scheduled task ClearExpiredUserSessions: javax.persistence.PersistenceException: org.hibernate.exception.GenericJDBCException: Unable to acquire JDBC Connection
        at org.hibernate.jpa.spi.AbstractEntityManagerImpl.convert(AbstractEntityManagerImpl.java:1692)
        at org.hibernate.jpa.spi.AbstractEntityManagerImpl.convert(AbstractEntityManagerImpl.java:1602)
        at org.hibernate.jpa.spi.AbstractEntityManagerImpl.throwPersistenceException(AbstractEntityManagerImpl.java:1700)
        at org.hibernate.jpa.internal.TransactionImpl.begin(TransactionImpl.java:48)
        at org.keycloak.connections.jpa.JpaKeycloakTransaction.begin(JpaKeycloakTransaction.java:39)
        at org.keycloak.services.DefaultKeycloakTransactionManager.enlist(DefaultKeycloakTransactionManager.java:41)
        at org.keycloak.connections.jpa.DefaultJpaConnectionProviderFactory.create(DefaultJpaConnectionProviderFactory.java:70)
        at org.keycloak.connections.jpa.DefaultJpaConnectionProviderFactory.create(DefaultJpaConnectionProviderFactory.java:54)
        at org.keycloak.services.DefaultKeycloakSession.getProvider(DefaultKeycloakSession.java:101)
        at org.keycloak.models.jpa.JpaRealmProviderFactory.create(JpaRealmProviderFactory.java:51)
        at org.keycloak.models.jpa.JpaRealmProviderFactory.create(JpaRealmProviderFactory.java:33)
        at org.keycloak.services.DefaultKeycloakSession.getProvider(DefaultKeycloakSession.java:101)
        at org.keycloak.models.cache.infinispan.RealmCacheSession.getDelegate(RealmCacheSession.java:161)
        at org.keycloak.models.cache.infinispan.RealmCacheSession.getRealms(RealmCacheSession.java:424)
        at org.keycloak.services.scheduled.ClearExpiredUserSessions.run(ClearExpiredUserSessions.java:33)
        at org.keycloak.services.scheduled.ClusterAwareScheduledTaskRunner$1.call(ClusterAwareScheduledTaskRunner.java:53)
        at org.keycloak.services.scheduled.ClusterAwareScheduledTaskRunner$1.call(ClusterAwareScheduledTaskRunner.java:49)
        at org.keycloak.cluster.infinispan.InfinispanClusterProvider.executeIfNotExecuted(InfinispanClusterProvider.java:90)
        at org.keycloak.services.scheduled.ClusterAwareScheduledTaskRunner.runTask(ClusterAwareScheduledTaskRunner.java:49)
        at org.keycloak.services.scheduled.ScheduledTaskRunner.run(ScheduledTaskRunner.java:44)
        at org.keycloak.timer.basic.BasicTimerProvider$1.run(BasicTimerProvider.java:51)
        at java.util.TimerThread.mainLoop(Timer.java:555)

Thomas  Barcia
Unix Administrator

World Fuel Services Corporation
9800 NW 41st Street|Miami, FL 33178
office: 305.351.4910|email: tbarcia at wfscorp.com<mailto:tbarcia at wfscorp.com>
[Description: Description: wfs]

*** This communication has been sent from World Fuel Services 
Corporation or its subsidiaries or its affiliates for the intended recipient 
only and may contain proprietary, confidential or privileged information. 
If you are not the intended recipient, any review, disclosure, copying, 
use, or distribution of the information included in this communication 
and any attachments is strictly prohibited. If you have received this 
communication in error, please notify us immediately by replying to this 
communication and delete the communication, including any 
attachments, from your computer. Electronic communications sent to or 
from World Fuel Services Corporation or its subsidiaries or its affiliates 
may be monitored for quality assurance and compliance purposes.***

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160714/9bd01817/attachment-0001.html 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image001.png
Type: image/png
Size: 4236 bytes
Desc: image001.png
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20160714/9bd01817/attachment-0001.png 

From guus.der.kinderen at gmail.com  Thu Jul 14 09:37:13 2016
From: guus.der.kinderen at gmail.com (Guus der Kinderen)
Date: Thu, 14 Jul 2016 15:37:13 +0200
Subject: [keycloak-user] Realm ID value oddity
In-Reply-To: <37a9fe9f-7753-af19-c6ff-83a4b0785c06@redhat.com>
References: <CAMJaV9nxPsLRtSPLuy0OrB4MF=9qRHx0zkXHcgPM_+ZCz83HNw@mail.gmail.com>
	<37a9fe9f-7753-af19-c6ff-83a4b0785c06@redhat.com>
Message-ID: <CAMJaV9nULARL1RXQhr7ykcdMNZsoGOXqZMWKHA9c6RUiHPRbFg@mail.gmail.com>

The master realm id is 'master'. Some of the other realms have UUIDs, some
have 'human readable name' values for the ID.

On 7 July 2016 at 15:35, Bill Burke <bburke at redhat.com> wrote:

> master realm?
>
> On 7/7/16 9:28 AM, Guus der Kinderen wrote:
>
> Hi there,
>
> I'm looking at a server with a couple of realms in it (version 1.9.x).
> When comparing the realm identifiers, I noticed that some realms have
> UUIDs, while others have 'human readable' values for an ID.
>
> As the ID is string-based, it probably does not matter much, but the
> difference puzzles me. Is this a known ... isssue/characteristic?
>
> Regards,
>
>   Guus
>
>
> _______________________________________________
> keycloak-user mailing listkeycloak-user at lists.jboss.orghttps://lists.jboss.org/mailman/listinfo/keycloak-user
>
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160714/3e28b515/attachment.html 

From asouza at redhat.com  Thu Jul 14 09:45:12 2016
From: asouza at redhat.com (Angelo Souza)
Date: Thu, 14 Jul 2016 10:45:12 -0300
Subject: [keycloak-user] :: Keycloak + POSTMAN Chrome Plugin
Message-ID: <CAAV7wknY-Se44qT8QWiNMYj-sZdt6sua6-nHUVmcAucSnhuvcA@mail.gmail.com>

Does anyone configured POSTMAN Chrome plugin to get a access token from
Keycloak server using Oath 2.0 authorization type? I'm get lost with
Callback URL, Auth URL and Access Token URL in the plugin Oath
2.0 properties...

Can anyone give a hand with that?

Tks,


-- 
[image: Red Hat] <http://www.redhat.com.br/>
?ngelo Lu?s Pinto Galv?o de Souza | Delivery Architect
Red Hat Brasil
M: +55 11 99385-0247 <%2B55%2011%2098915-3638>
Av. Brigadeiro Faria Lima 3900, 8? Andar. S?o Paulo, Brasil.
RED HAT | TRIED. TESTED. TRUSTED. Saiba porque em redhat.com
<https://www.redhat.com/pt-br/about/trusted>
<http://www.redhat.com/es/about/trusted>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160714/bcaf3601/attachment.html 

From mike.hills at sematree.com  Thu Jul 14 11:49:18 2016
From: mike.hills at sematree.com (Mike Hills)
Date: Thu, 14 Jul 2016 11:49:18 -0400
Subject: [keycloak-user] :: Keycloak + POSTMAN Chrome Plugin
In-Reply-To: <CAAV7wknY-Se44qT8QWiNMYj-sZdt6sua6-nHUVmcAucSnhuvcA@mail.gmail.com>
References: <CAAV7wknY-Se44qT8QWiNMYj-sZdt6sua6-nHUVmcAucSnhuvcA@mail.gmail.com>
Message-ID: <CAFfNJaVr2DgN10a86B1uXMwiE=N4Wfzo+Awi785U1dkRfAn0Jg@mail.gmail.com>

Does this help?

Regards,
mike

On Thu, Jul 14, 2016 at 9:45 AM, Angelo Souza <asouza at redhat.com> wrote:

> Does anyone configured POSTMAN Chrome plugin to get a access token from
> Keycloak server using Oath 2.0 authorization type? I'm get lost with
> Callback URL, Auth URL and Access Token URL in the plugin Oath
> 2.0 properties...
>
> Can anyone give a hand with that?
>
> Tks,
>
>
> --
> [image: Red Hat] <http://www.redhat.com.br/>
> ?ngelo Lu?s Pinto Galv?o de Souza | Delivery Architect
> Red Hat Brasil
> M: +55 11 99385-0247 <%2B55%2011%2098915-3638>
> Av. Brigadeiro Faria Lima 3900, 8? Andar. S?o Paulo, Brasil.
> RED HAT | TRIED. TESTED. TRUSTED. Saiba porque em redhat.com
> <https://www.redhat.com/pt-br/about/trusted>
> <http://www.redhat.com/es/about/trusted>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>



-- 
Michael J. Hills
Sr. CRM Architect

Mobile: 603.475.5093
Email  : mike.hills at sematree.com
Skype : mhills_sematree
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160714/c5cb800e/attachment.html 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: KEYCloak.postman_collection.json
Type: application/json
Size: 1395 bytes
Desc: not available
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20160714/c5cb800e/attachment.bin 

From aikeaguinea at xsmail.com  Thu Jul 14 12:41:47 2016
From: aikeaguinea at xsmail.com (Aikeaguinea)
Date: Thu, 14 Jul 2016 12:41:47 -0400
Subject: [keycloak-user] One client application,
	users in many organizations
In-Reply-To: <CAJgngAfbC-O8VgdpEDt0AM7bq=zyZsvxBjBx15Kq0AJzDzDK5A@mail.gmail.com>
References: <1468439608.3327910.665471033.6CFA1A2B@webmail.messagingengine.com>
	<CAJgngAfbC-O8VgdpEDt0AM7bq=zyZsvxBjBx15Kq0AJzDzDK5A@mail.gmail.com>
Message-ID: <1468514507.3677345.666379905.4B4928FC@webmail.messagingengine.com>

Thanks very much Stian. It sounds like the best approach for us would be
to have one realm per organization and to share clients across them. One
realm per organization sounds like the use case for realms, and
practically speaking  it not only lets us do bulk operations on all
users within a realm, but it also lets us have different combinations of
clients for different organizations.
 
A few more questions, if I may:
 
Is the example of multi tenancy you mention this one:
https://github.com/keycloak/keycloak/tree/master/examples/multi-tenant ?
 
In that example there are multiple .json files, one for each tenant, and
you mention doing the same thing with the admin API.
The API call for creating a new client is a POST to
/admin/realms/{realm}/clients . Does doing two POST calls with the same
client ID to two different realms create the same client in both realms?
 
Can the same thing be achieved by creating the realms in the admin
console and then creating the client with that ID within the realms?
 
If I create a client with client ID myapp in Realm 1, and then I go into
Realm 2 and create a client with the same ID, will they automatically
share the same client secret?
 
Also, if I'm in the admin console for Realm 1 and I look at the sessions
for client myapp, I imagine I see only the sessions pertaining to users
within the realm. Is that right?
 
Thanks for the help. I'll create a JIRA for search by group because it
would be useful in any event.
 
 
On Thu, Jul 14, 2016, at 03:40 AM, Stian Thorgersen wrote:
>
>
> On 13 July 2016 at 21:53, Aikeaguinea <aikeaguinea at xsmail.com> wrote:
>> We have a client web application which accepts requests from users in
>> many different unrelated organizations. Two approaches I see
>> are 1) to
>> create a realm per organization, or 2) create a single realm with our
>> application as client, and assign users to different groups based on
>> their organization.
>>
>> If we go with approach 1, I'm not sure how we'd handle the
>> client ID and
>> secret for our web app. If we had multiple realms in Keycloak,
>> each with
>> one client for our web application, somehow the web application would
>> need to know which Keycloak client to use for which user,
>> which sounds
>> complicated and maybe untenable. On the other hand, clients
>> can't span
>> realms, can they?
>
> Guess that depends on how many clients you are talking about. FIY we
> have a multi tenancy example that shows how you can have multiple
> configs for the same app.
>
>>
>> If we go with 2, one complication is administration--e.g., bulk
>> logout.
>> If all the users are in the same realm, it doesn't appear to me that
>> there's a way in the admin console to logout all sessions of users
>> belonging to one group, or to disable all users belonging to a
>> group. Is
>> that right?
>
> There's no option to do that yet, but we want to add support for bulk
> updates to users in the future. See
> https://issues.jboss.org/browse/KEYCLOAK-1413
>
>>
>> It also doesn't look straightforward to get from the API all
>> the users
>> for a given group--you can get the groups a user is in, but I
>> don't see
>> a call that does the inverse. Is there a way we could do this?
>
> True - we don't support search by group. You can create a JIRA request
> for that.
>
>>
>> Or is there an entirely different approach I'm not thinking of?
>
> Not without a lot of customization. However, we do provide several
> SPIs that allow you to customize Keycloak to accommodate your needs.
>
> For example for option 1 you can use admin api to create clients which
> would allow you to create the client in all realms.
>
> For option 2 you could add a custom realm resource that allows logout
> or disabling all users with a specific group.
>
>>
>> --
>>  Aikeaguinea aikeaguinea at xsmail.com
>>
>>  --
>> http://www.fastmail.com - Accessible with your email software or over
>> the web
>>
>>  _______________________________________________
>>  keycloak-user mailing list keycloak-user at lists.jboss.org
>>  https://lists.jboss.org/mailman/listinfo/keycloak-user
 
--
  Aikeaguinea
  aikeaguinea at xsmail.com
 
?

-- 
http://www.fastmail.com - A fast, anti-spam email service.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160714/2ff933fa/attachment-0001.html 

From asouza at redhat.com  Thu Jul 14 12:55:50 2016
From: asouza at redhat.com (Angelo Souza)
Date: Thu, 14 Jul 2016 13:55:50 -0300
Subject: [keycloak-user] :: Keycloak + POSTMAN Chrome Plugin
In-Reply-To: <CAFfNJaVr2DgN10a86B1uXMwiE=N4Wfzo+Awi785U1dkRfAn0Jg@mail.gmail.com>
References: <CAAV7wknY-Se44qT8QWiNMYj-sZdt6sua6-nHUVmcAucSnhuvcA@mail.gmail.com>
	<CAFfNJaVr2DgN10a86B1uXMwiE=N4Wfzo+Awi785U1dkRfAn0Jg@mail.gmail.com>
Message-ID: <CAAV7wkkCcQ0EFaxN_ryvpDOHH+7u2O6=NP1Hnc4e1bUn3am2Nw@mail.gmail.com>

That helped, tks!

The conf that work is that one:
Auth URL:
http://localhost:8081/auth/realms/{realm}/protocol/openid-connect/auth?redirect_uri=https://www.getpostman.com/oauth2/callback&response_type=code&client_id={client-id}

Access token URL:
http://localhost:8081/auth/realms/{realm}/protocol/openid-connect/token

On Thu, Jul 14, 2016 at 12:49 PM, Mike Hills <mike.hills at sematree.com>
wrote:

> Does this help?
>
> Regards,
> mike
>
> On Thu, Jul 14, 2016 at 9:45 AM, Angelo Souza <asouza at redhat.com> wrote:
>
>> Does anyone configured POSTMAN Chrome plugin to get a access token from
>> Keycloak server using Oath 2.0 authorization type? I'm get lost with
>> Callback URL, Auth URL and Access Token URL in the plugin Oath
>> 2.0 properties...
>>
>> Can anyone give a hand with that?
>>
>> Tks,
>>
>>
>> --
>> [image: Red Hat] <http://www.redhat.com.br/>
>> ?ngelo Lu?s Pinto Galv?o de Souza | Delivery Architect
>> Red Hat Brasil
>> M: +55 11 99385-0247 <%2B55%2011%2098915-3638>
>> Av. Brigadeiro Faria Lima 3900, 8? Andar. S?o Paulo, Brasil.
>> RED HAT | TRIED. TESTED. TRUSTED. Saiba porque em redhat.com
>> <https://www.redhat.com/pt-br/about/trusted>
>> <http://www.redhat.com/es/about/trusted>
>>
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>
>
>
>
> --
> Michael J. Hills
> Sr. CRM Architect
>
> Mobile: 603.475.5093
> Email  : mike.hills at sematree.com
> Skype : mhills_sematree
>



-- 
[image: Red Hat] <http://www.redhat.com.br/>
?ngelo Lu?s Pinto Galv?o de Souza | Delivery Architect
Red Hat Brasil
M: +55 11 99385-0247 <%2B55%2011%2098915-3638>
Av. Brigadeiro Faria Lima 3900, 8? Andar. S?o Paulo, Brasil.
RED HAT | TRIED. TESTED. TRUSTED. Saiba porque em redhat.com
<https://www.redhat.com/pt-br/about/trusted>
<http://www.redhat.com/es/about/trusted>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160714/cff8054a/attachment.html 

From psilva at redhat.com  Thu Jul 14 14:21:43 2016
From: psilva at redhat.com (Pedro Igor Silva)
Date: Thu, 14 Jul 2016 14:21:43 -0400 (EDT)
Subject: [keycloak-user] Does Keycloak compliant with XACML 2.0 or 3.0
 standard?
In-Reply-To: <CAJgngAdbrzwXJHk5A7CUWn2sY-MuU06X-M48rnSXrybvLhf0OA@mail.gmail.com>
References: <CAHt8Wcv85V1GpL6R=b+jrSmEzT0Qmvjb4XKArFeFhAxhHVPSiA@mail.gmail.com>
	<CAJgngAdbrzwXJHk5A7CUWn2sY-MuU06X-M48rnSXrybvLhf0OA@mail.gmail.com>
Message-ID: <14467320.11376307.1468520503413.JavaMail.zimbra@redhat.com>

Hi Alexander,

    Thanks for asking this. Quick answer is: Not yet. Near term, you can expect support for XACML policies but I'm not sure about the whole protocol itself. Our services are really based on OAuth2, OpenID Connect and UMA [1]. Where the latter plays an important role. 

    Like Stian said, Keycloak Authorization Services is not trying to answer XACML in any way. On the contrary, we have plans to support XACML in the future. Specially XACML policies, where you would be able to import them and have them managed by Keycloak.

    Aggregated policies are just one of the different types of policies we provide. They are not really related with XACML. In fact, they give you a lot of flexibility when writing more complex policies and favor reuse.

    Some of the XACML features that you mentioned can also be achieve with Keycloak. For instance, aggregated policies can help you to combine different policies and manage their results. Delegation and Obligation/Claim Gathering would be possible as soon as we finish our UMA implementation. You can define different decisions strategies for permissions or aggregated policies, which are similar to XACML combining algorithms.

    However, authorization requests and decisions are always associated with a token. Where decisions are made based on the user and the client represented by this token. Differently than XACML, you can not send authorization requests for different subjects (multiple decision profile ?) but you can ask for different resources/scopes.

[1] https://docs.kantarainitiative.org/uma/rec-uma-core.html

Regards.
Pedro Igor     

----- Original Message -----
> From: "Stian Thorgersen" <sthorger at redhat.com>
> To: "Alexander Zagniotov" <azagniotov at gmail.com>, "Pedro Igor Silva" <psilva at redhat.com>
> Cc: "keycloak-user" <keycloak-user at lists.jboss.org>
> Sent: Thursday, July 14, 2016 4:30:47 AM
> Subject: Re: [keycloak-user] Does Keycloak compliant with XACML 2.0 or 3.0 standard?
> 
> We're not supporting XACML 2.0 or 3.0. I haven't looked at XACML 3 yet
> myself, but it sounds like it is a significant improvement and it would be
> worth considering adding a XACML 3 policy.
> 
> Aggregated policies are a natural addition to Keycloak and it's not
> directly an answer to XACML rather an alternative approach.
> 
> Pedro can probably elaborate a bit more on this though.
> 
> On 13 July 2016 at 00:40, Alexander Zagniotov <azagniotov at gmail.com> wrote:
> 
> > Hello All,
> >
> > As per subject.
> >
> > I am also interested to know if Keycloak supports new features provided by
> > XACML 3.0:
> > Multiple Decision Profile, Policy combination algorithms,  Delegation, etc.
> >
> > That being said, is aggregated policies feature is Keycloak's answer to
> > some of the XACML 3.0 new features?
> >
> >
> > Thanks
> >
> > _______________________________________________
> > keycloak-user mailing list
> > keycloak-user at lists.jboss.org
> > https://lists.jboss.org/mailman/listinfo/keycloak-user
> >
> 

From nielsbne at gmail.com  Thu Jul 14 23:48:15 2016
From: nielsbne at gmail.com (Niels Bertram)
Date: Fri, 15 Jul 2016 13:48:15 +1000
Subject: [keycloak-user] Keycloak can't access identity provider behind
	corporate proxy
Message-ID: <CAPLPyg=snUZUeJrywO2YdcBwdpNrfeicDBHDPrernrwdaK3WAg@mail.gmail.com>

Was wondering if someone has seen configuration examples on how to setup
keycloak to communicate outwards via a coprorate proxy. (Not asking about
running keycloak behind a reverse proxy, that part is well documented).


I setup keycloak to federate with Google and everything works up to the
point where google sends back the code token and Keycloak attempts to get
access tokens issued via the back channel. The full stack trace is posted
below but in essence keycloak fails to exchange the code for access tokens
caused by a Connection timed out.

The server which keycloak runs on has access to google's endpoints which I
tested sucessfully using curl and the http_proxy environment variable.

https://accounts.google.com/.well-known/openid-configuration
https://www.googleapis.com/*


I added "-Dhttp.proxyHost=proxy.mydomain.here -Dhttp.proxyPort=8080" to the
JAVA_OPTS startup of the container and I can see these settings expand
properly on startup. Nothing in SimpleHttp suggests these standard Java
params should not work but at the same token corporate proxies have always
been a royal pain in the backside to deal with.

Does anyone have any thoughts or suggestions on what could be amiss in my
configuration?

Many thanks,
Niels


2016-07-15 13:16:51,732 ERROR
[org.keycloak.broker.oidc.AbstractOAuth2IdentityProvider] (default task-23)
Failed to make identity provider oauth callback: java.net.ConnectException:
Connection timed out
        at java.net.PlainSocketImpl.socketConnect(Native Method)
        at
java.net.AbstractPlainSocketImpl.doConnect(AbstractPlainSocketImpl.java:350)
        at
java.net.AbstractPlainSocketImpl.connectToAddress(AbstractPlainSocketImpl.java:206)
        at
java.net.AbstractPlainSocketImpl.connect(AbstractPlainSocketImpl.java:188)
        at java.net.SocksSocketImpl.connect(SocksSocketImpl.java:392)
        at java.net.Socket.connect(Socket.java:589)
        at sun.security.ssl.SSLSocketImpl.connect(SSLSocketImpl.java:668)
        at
sun.security.ssl.BaseSSLSocketImpl.connect(BaseSSLSocketImpl.java:173)
        at sun.net.NetworkClient.doConnect(NetworkClient.java:180)
        at sun.net.www.http.HttpClient.openServer(HttpClient.java:432)
        at sun.net.www.http.HttpClient.openServer(HttpClient.java:527)
        at
sun.net.www.protocol.https.HttpsClient.<init>(HttpsClient.java:264)
        at sun.net.www.protocol.https.HttpsClient.New(HttpsClient.java:367)
        at
sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.getNewHttpClient(AbstractDelegateHttpsURLConnection.java:191)
        at
sun.net.www.protocol.http.HttpURLConnection.plainConnect0(HttpURLConnection.java:1105)
        at
sun.net.www.protocol.http.HttpURLConnection.plainConnect(HttpURLConnection.java:999)
        at
sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java:177)
        at
sun.net.www.protocol.http.HttpURLConnection.getOutputStream0(HttpURLConnection.java:1283)
        at
sun.net.www.protocol.http.HttpURLConnection.getOutputStream(HttpURLConnection.java:1258)
        at
sun.net.www.protocol.https.HttpsURLConnectionImpl.getOutputStream(HttpsURLConnectionImpl.java:250)
        at
org.keycloak.broker.provider.util.SimpleHttp.asString(SimpleHttp.java:141)
        at
org.keycloak.broker.oidc.AbstractOAuth2IdentityProvider$Endpoint.authResponse(AbstractOAuth2IdentityProvider.java:228)
        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at
sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
        at
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
        at java.lang.reflect.Method.invoke(Method.java:498)
        at
org.jboss.resteasy.core.MethodInjectorImpl.invoke(MethodInjectorImpl.java:139)
        at
org.jboss.resteasy.core.ResourceMethodInvoker.invokeOnTarget(ResourceMethodInvoker.java:295)
        at
org.jboss.resteasy.core.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:249)
        at
org.jboss.resteasy.core.ResourceLocatorInvoker.invokeOnTargetObject(ResourceLocatorInvoker.java:138)
        at
org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorInvoker.java:107)
        at
org.jboss.resteasy.core.ResourceLocatorInvoker.invokeOnTargetObject(ResourceLocatorInvoker.java:133)
        at
org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorInvoker.java:101)
        at
org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:395)
        at
org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:202)
        at
org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.service(ServletContainerDispatcher.java:221)
        at
org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:56)
        at
org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:51)
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:790)
        at
io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:85)
        at
io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:129)
        at
org.keycloak.services.filters.KeycloakSessionServletFilter.doFilter(KeycloakSessionServletFilter.java:88)
        at
io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:60)
        at
io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
        at
io.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.java:84)
        at
io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:62)
        at
io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36)
        at
org.wildfly.extension.undertow.security.SecurityContextAssociationHandler.handleRequest(SecurityContextAssociationHandler.java:78)
        at
io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
        at
io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:131)
        at
io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:57)
        at
io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
        at
io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:46)
        at
io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64)
        at
io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:60)
        at
io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:77)
        at
io.undertow.security.handlers.NotificationReceiverHandler.handleRequest(NotificationReceiverHandler.java:50)
        at
io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43)
        at
io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
        at
org.wildfly.extension.undertow.security.jacc.JACCContextIdHandler.handleRequest(JACCContextIdHandler.java:61)
        at
io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
        at
io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
        at
io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:284)
        at
io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:263)
        at
io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:81)
        at
io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:174)
        at
io.undertow.server.Connectors.executeRootHandler(Connectors.java:202)
        at
io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:793)
        at
java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
        at
java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
        at java.lang.Thread.run(Thread.java:745)
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160715/5cd89e5a/attachment-0001.html 

From sthorger at redhat.com  Fri Jul 15 00:47:46 2016
From: sthorger at redhat.com (Stian Thorgersen)
Date: Fri, 15 Jul 2016 06:47:46 +0200
Subject: [keycloak-user] Keycloak user data encoding
In-Reply-To: <HE1PR0201MB2217A4A6C24888DBD5414D31F1300@HE1PR0201MB2217.eurprd02.prod.outlook.com>
References: <HE1PR0201MB2217FED5B5E4767A0DBEFEA3F1300@HE1PR0201MB2217.eurprd02.prod.outlook.com>
	<CAJgngAfvYbPf5isVnvt4hkg0DiZevNOQJphQC9H1Ybs5EEBb5A@mail.gmail.com>
	<CAJgngAdOyTsY0Yzk81jQpm6+YnJZH7QkGr1fZ6iyfgF2T1cKUA@mail.gmail.com>
	<HE1PR0201MB2217A4A6C24888DBD5414D31F1300@HE1PR0201MB2217.eurprd02.prod.outlook.com>
Message-ID: <CAJgngAcGRUhxcVL3QUJnVCG8O===hmKUd4h45F206-q2V3K70A@mail.gmail.com>

It's strange that no one else has reported this. We had several people
report the issue with umlats, but no one else seems to have the issue with
the database encoding. Maybe there's something different with your database
config? Could you try with a default MySQL database installation and see if
you can reproduce the issue? Also, can you give me a sample name that shows
the problems.

I added a test for umlats to registration and account management, see
https://github.com/keycloak/keycloak/pull/3036. Once it's in I'll schedule
a run with CI, which tests with a range of different databases.

On 12 July 2016 at 16:13, Igor Zuk <igor.zuk at qualitytaskforce.com> wrote:

> Thank you for a quick response.
>
>
>
> I?m using 1.9.2.Final and the problem is a bit different, it?s not limited
> to registration screen.
>
>
>
> I?m saying, that ISO-8859-1 is the default encoding, because all the text
> columns in USER_ENTITY table had encoding latin1. The table was created
> completely by Keycloak as the database was empty in the beginning. I
> manually switched encoding of FIRST_NAME to UTF-8 and modified it so it
> contained special letters. I started the user editor in Keycloak admin
> console and this name was displayed correctly. I added a single character
> to it, saved, and then the name got messed up with question marks instead
> of all special characters.
>
>
>
> *From:* Stian Thorgersen [mailto:sthorger at redhat.com]
> *Sent:* Tuesday, July 12, 2016 3:43 PM
> *To:* Stian Thorgersen <stian at redhat.com>
> *Cc:* Igor Zuk <igor.zuk at qualitytaskforce.com>;
> keycloak-user at lists.jboss.org
> *Subject:* Re: [keycloak-user] Keycloak user data encoding
>
>
>
> By the way this was fixed in 1.6.0.Final, see
> https://issues.jboss.org/browse/KEYCLOAK-1830?jql=project%20%3D%20KEYCLOAK%20AND%20text%20~%20%22encoding%22
>
>
>
> Are you using an old version?
>
>
>
> On 12 July 2016 at 15:37, Stian Thorgersen <sthorger at redhat.com> wrote:
>
> Why are you saying the default encoding is ISO-8859-1? All forms are
> encoded as UTF-8 and all strings passed to the database should be UTF-8
> encoded as well.
>
>
>
> The only thing that is ISO-8859-1 is the message properties, but those are
> converted to UTF-8 when added to HTML pages.
>
>
>
> On 12 July 2016 at 14:58, Igor Zuk <igor.zuk at qualitytaskforce.com> wrote:
>
> Hi
>
>
>
> I have an encoding problem. By default users' data fields (e.g. first name
> and last name) are encoded using ISO-8859-1. People from many countries
> can't properly create accounts as their personal data is silently messed
> up. How can I fix it?
>
> ?         The MySQL DB receives already damaged names. By default all
> columns are ISO-8859-1-encoded, but manually converting them to UTF-8
> doesn't help.
>
> ?         Manual account modification from admin console has same effect.
>
> ?         Change of default server (Wildfly) encoding to UTF-8 doesn't do
> anything.
>
>
>
> Best regards
>
> Igor ?uk
>
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
>
>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160715/bdd8123e/attachment.html 

From sthorger at redhat.com  Fri Jul 15 01:12:42 2016
From: sthorger at redhat.com (Stian Thorgersen)
Date: Fri, 15 Jul 2016 07:12:42 +0200
Subject: [keycloak-user] Realm ID value oddity
In-Reply-To: <CAMJaV9nULARL1RXQhr7ykcdMNZsoGOXqZMWKHA9c6RUiHPRbFg@mail.gmail.com>
References: <CAMJaV9nxPsLRtSPLuy0OrB4MF=9qRHx0zkXHcgPM_+ZCz83HNw@mail.gmail.com>
	<37a9fe9f-7753-af19-c6ff-83a4b0785c06@redhat.com>
	<CAMJaV9nULARL1RXQhr7ykcdMNZsoGOXqZMWKHA9c6RUiHPRbFg@mail.gmail.com>
Message-ID: <CAJgngActegr0vWwN_Gxd9m-dooLyTw24=C8GpYJUxJ5GfENHOQ@mail.gmail.com>

The master realm is bootstrapped at first startup and is sets name and id
to 'master'.

When you create a realm through the admin console it will only specify the
realm name, not the id. The server-side will then generate an id.

Realm rest endpoints do allow you to specify an id though, so maybe in your
case someone has created realms using the admin endpoints and specified the
id as well.

On 14 July 2016 at 15:37, Guus der Kinderen <guus.der.kinderen at gmail.com>
wrote:

> The master realm id is 'master'. Some of the other realms have UUIDs, some
> have 'human readable name' values for the ID.
>
> On 7 July 2016 at 15:35, Bill Burke <bburke at redhat.com> wrote:
>
>> master realm?
>>
>> On 7/7/16 9:28 AM, Guus der Kinderen wrote:
>>
>> Hi there,
>>
>> I'm looking at a server with a couple of realms in it (version 1.9.x).
>> When comparing the realm identifiers, I noticed that some realms have
>> UUIDs, while others have 'human readable' values for an ID.
>>
>> As the ID is string-based, it probably does not matter much, but the
>> difference puzzles me. Is this a known ... isssue/characteristic?
>>
>> Regards,
>>
>>   Guus
>>
>>
>> _______________________________________________
>> keycloak-user mailing listkeycloak-user at lists.jboss.orghttps://lists.jboss.org/mailman/listinfo/keycloak-user
>>
>>
>>
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160715/61a7bef3/attachment.html 

From sthorger at redhat.com  Fri Jul 15 01:32:13 2016
From: sthorger at redhat.com (Stian Thorgersen)
Date: Fri, 15 Jul 2016 07:32:13 +0200
Subject: [keycloak-user] One client application,
	users in many organizations
In-Reply-To: <1468514507.3677345.666379905.4B4928FC@webmail.messagingengine.com>
References: <1468439608.3327910.665471033.6CFA1A2B@webmail.messagingengine.com>
	<CAJgngAfbC-O8VgdpEDt0AM7bq=zyZsvxBjBx15Kq0AJzDzDK5A@mail.gmail.com>
	<1468514507.3677345.666379905.4B4928FC@webmail.messagingengine.com>
Message-ID: <CAJgngAeKND9xj=5tGDSBFemam45g-4xTYMCOBHMROs6PO04g8w@mail.gmail.com>

On 14 July 2016 at 18:41, Aikeaguinea <aikeaguinea at xsmail.com> wrote:

> Thanks very much Stian. It sounds like the best approach for us would be
> to have one realm per organization and to share clients across them. One
> realm per organization sounds like the use case for realms, and practically
> speaking it not only lets us do bulk operations on all users within a
> realm, but it also lets us have different combinations of clients for
> different organizations.
>

One realm per organization is not directly the use case for realms. Realms
are for when you want isolated config and users. In your case there are
other things than clients you need to deal with as well. Realm settings,
etc.. It's up to you if you want that isolation per-organization or not.


>
> A few more questions, if I may:
>
> Is the example of multi tenancy you mention this one:
> https://github.com/keycloak/keycloak/tree/master/examples/multi-tenant ?
>

Yes


>
> In that example there are multiple .json files, one for each tenant, and
> you mention doing the same thing with the admin API.
> The API call for creating a new client is a POST to
> /admin/realms/{realm}/clients . Does doing two POST calls with the same
> client ID to two different realms create the same client in both realms?
>

You don't need multiple json files. You can create the configuration
programatically as well based on a single json file by just swapping the
realm name for the organization name for example.

Just remove the public key from the json file (as the adapter will download
it from Keycloak if you don't specify it) and make sure the client-id and
secret are the same.


>
> Can the same thing be achieved by creating the realms in the admin console
> and then creating the client with that ID within the realms?
>

Admin console doesn't directly let you specify secret. If you import the
client from a json file in the admin console then you can specify the
secret.


>
> If I create a client with client ID myapp in Realm 1, and then I go into
> Realm 2 and create a client with the same ID, will they automatically share
> the same client secret?
>

No, there is total isolation between realms.


>
> Also, if I'm in the admin console for Realm 1 and I look at the sessions
> for client myapp, I imagine I see only the sessions pertaining to users
> within the realm. Is that right?
>

Yes


>
> Thanks for the help. I'll create a JIRA for search by group because it
> would be useful in any event.
>
>
> On Thu, Jul 14, 2016, at 03:40 AM, Stian Thorgersen wrote:
>
>
>
> On 13 July 2016 at 21:53, Aikeaguinea <aikeaguinea at xsmail.com> wrote:
>
> We have a client web application which accepts requests from users in
> many different unrelated organizations. Two approaches I see are 1) to
> create a realm per organization, or 2) create a single realm with our
> application as client, and assign users to different groups based on
> their organization.
>
> If we go with approach 1, I'm not sure how we'd handle the client ID and
> secret for our web app. If we had multiple realms in Keycloak, each with
> one client for our web application, somehow the web application would
> need to know which Keycloak client to use for which user, which sounds
> complicated and maybe untenable. On the other hand, clients can't span
> realms, can they?
>
>
> Guess that depends on how many clients you are talking about. FIY we have
> a multi tenancy example that shows how you can have multiple configs for
> the same app.
>
>
>
> If we go with 2, one complication is administration--e.g., bulk logout.
> If all the users are in the same realm, it doesn't appear to me that
> there's a way in the admin console to logout all sessions of users
> belonging to one group, or to disable all users belonging to a group. Is
> that right?
>
>
> There's no option to do that yet, but we want to add support for bulk
> updates to users in the future. See
> https://issues.jboss.org/browse/KEYCLOAK-1413
>
>
>
> It also doesn't look straightforward to get from the API all the users
> for a given group--you can get the groups a user is in, but I don't see
> a call that does the inverse. Is there a way we could do this?
>
>
> True - we don't support search by group. You can create a JIRA request for
> that.
>
>
>
> Or is there an entirely different approach I'm not thinking of?
>
>
> Not without a lot of customization. However, we do provide several SPIs
> that allow you to customize Keycloak to accommodate your needs.
>
> For example for option 1 you can use admin api to create clients which
> would allow you to create the client in all realms.
>
> For option 2 you could add a custom realm resource that allows logout or
> disabling all users with a specific group.
>
>
>
> --
> Aikeaguinea
> aikeaguinea at xsmail.com
>
> --
> http://www.fastmail.com - Accessible with your email software
> or over the web
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
>
> --
>   Aikeaguinea
>   aikeaguinea at xsmail.com
>
>
>
> -- http://www.fastmail.com - A fast, anti-spam email service.
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160715/88b4b3e6/attachment-0001.html 

From sthorger at redhat.com  Fri Jul 15 04:51:39 2016
From: sthorger at redhat.com (Stian Thorgersen)
Date: Fri, 15 Jul 2016 10:51:39 +0200
Subject: [keycloak-user] Keycloak unable to open JDBC connection
In-Reply-To: <75d2b5690a9c48018f940e99718e1269@MIA-WEX-P16.wfs.com>
References: <75d2b5690a9c48018f940e99718e1269@MIA-WEX-P16.wfs.com>
Message-ID: <CAJgngAcfE8WbrJSCdBGQK1cfn3nEE4kZxN6FjZo+aEvjGHpMaQ@mail.gmail.com>

See
http://stackoverflow.com/questions/31455450/auto-recover-connections-in-wildfly-8-2-for-oracle-without-using-validate-on-mat

On 14 July 2016 at 15:27, Thomas Barcia <TBarcia at wfscorp.com> wrote:

> I have Keycloak 1.9.8-Final running against an Oracle database and it
> appears that when the connections are unused for a period of time (usually
> overnight) Keycloak is unable to open a JDBC connection to the database.  I
> spoke with the DBAs and the database is not closing the connections.
> According to the DBAs I need to enable connection validation but I?m not a
> programmer and can?t find a good example of how it?s done.  Can anyone
> provide some help with this?  Am I on the right track in resolving the
> issue?
>
>
>
> Thanks.
>
>
>
> This is from my standalone-ha.xml:
>
> <datasource jndi-name="java:jboss/datasources/KeycloakDS"
> pool-name="KeycloakDS" enabled="true" use-java-context="true">
>
>                  <connection-url>jdbc:oracle:thin:@
> <servername>:<port>:<databasename></connection-url>
>
>                   <driver>oracle</driver>
>
>                  <pool>
>
>                    <min-pool-size>1</min-pool-size>
>
>                    <max-pool-size>5</max-pool-size>
>
>                    <prefill>true</prefill>
>
>                   </pool>
>
>                   <security>
>
>                    <user-name><name></user-name>
>
>                    <password><password></password>
>
>                  </security>
>
>
>
>                 </datasource>
>
>                 <drivers>
>
>                     <driver name="h2" module="com.h2database.h2">
>
>
>                     <xa-datasource-class>org.h2.jdbcx.JdbcDataSource</xa-datasource-class>
>
>                     </driver>
>
>                     <driver name="oracle" module="com.oracle">
>
>
> <driver-class>oracle.jdbc.driver.OracleDriver</driver-class>
>
>                     </driver>
>
>                 </drivers>
>
>
>
> And this is the error:
>
> 2016-07-14 00:13:09,460 WARN
> [org.hibernate.engine.jdbc.spi.SqlExceptionHelper] (Timer-2) SQL Error: 0,
> SQLState: null
>
> 2016-07-14 00:13:09,461 ERROR
> [org.hibernate.engine.jdbc.spi.SqlExceptionHelper] (Timer-2)
> javax.resource.ResourceException: IJ000453: Unable to get managed
> connection for java:jboss/datasources/KeycloakDS
>
> 2016-07-14 00:13:09,462 ERROR [org.keycloak.services] (Timer-2)
> KC-SERVICES0089: Failed to run scheduled task ClearExpiredUserSessions:
> javax.persistence.PersistenceException:
> org.hibernate.exception.GenericJDBCException: Unable to acquire JDBC
> Connection
>
>         at
> org.hibernate.jpa.spi.AbstractEntityManagerImpl.convert(AbstractEntityManagerImpl.java:1692)
>
>         at
> org.hibernate.jpa.spi.AbstractEntityManagerImpl.convert(AbstractEntityManagerImpl.java:1602)
>
>         at
> org.hibernate.jpa.spi.AbstractEntityManagerImpl.throwPersistenceException(AbstractEntityManagerImpl.java:1700)
>
>         at
> org.hibernate.jpa.internal.TransactionImpl.begin(TransactionImpl.java:48)
>
>         at
> org.keycloak.connections.jpa.JpaKeycloakTransaction.begin(JpaKeycloakTransaction.java:39)
>
>         at
> org.keycloak.services.DefaultKeycloakTransactionManager.enlist(DefaultKeycloakTransactionManager.java:41)
>
>         at
> org.keycloak.connections.jpa.DefaultJpaConnectionProviderFactory.create(DefaultJpaConnectionProviderFactory.java:70)
>
>         at
> org.keycloak.connections.jpa.DefaultJpaConnectionProviderFactory.create(DefaultJpaConnectionProviderFactory.java:54)
>
>         at
> org.keycloak.services.DefaultKeycloakSession.getProvider(DefaultKeycloakSession.java:101)
>
>         at
> org.keycloak.models.jpa.JpaRealmProviderFactory.create(JpaRealmProviderFactory.java:51)
>
>         at
> org.keycloak.models.jpa.JpaRealmProviderFactory.create(JpaRealmProviderFactory.java:33)
>
>         at
> org.keycloak.services.DefaultKeycloakSession.getProvider(DefaultKeycloakSession.java:101)
>
>         at
> org.keycloak.models.cache.infinispan.RealmCacheSession.getDelegate(RealmCacheSession.java:161)
>
>         at
> org.keycloak.models.cache.infinispan.RealmCacheSession.getRealms(RealmCacheSession.java:424)
>
>         at
> org.keycloak.services.scheduled.ClearExpiredUserSessions.run(ClearExpiredUserSessions.java:33)
>
>         at
> org.keycloak.services.scheduled.ClusterAwareScheduledTaskRunner$1.call(ClusterAwareScheduledTaskRunner.java:53)
>
>         at
> org.keycloak.services.scheduled.ClusterAwareScheduledTaskRunner$1.call(ClusterAwareScheduledTaskRunner.java:49)
>
>         at
> org.keycloak.cluster.infinispan.InfinispanClusterProvider.executeIfNotExecuted(InfinispanClusterProvider.java:90)
>
>         at
> org.keycloak.services.scheduled.ClusterAwareScheduledTaskRunner.runTask(ClusterAwareScheduledTaskRunner.java:49)
>
>         at
> org.keycloak.services.scheduled.ScheduledTaskRunner.run(ScheduledTaskRunner.java:44)
>
>         at
> org.keycloak.timer.basic.BasicTimerProvider$1.run(BasicTimerProvider.java:51)
>
>         at java.util.TimerThread.mainLoop(Timer.java:555)
>
>
>
> *Thomas  Barcia*
>
> Unix Administrator
>
>
>
> World Fuel Services Corporation
>
> 9800 NW 41st Street|Miami, FL 33178
>
> office: 305.351.4910|email: tbarcia at wfscorp.com
>
> [image: Description: Description: wfs]
>
>
>
> *** This communication has been sent from World Fuel Services
> Corporation or its subsidiaries or its affiliates for the intended
> recipient
> only and may contain proprietary, confidential or privileged information.
> If you are not the intended recipient, any review, disclosure, copying,
> use, or distribution of the information included in this communication
> and any attachments is strictly prohibited. If you have received this
> communication in error, please notify us immediately by replying to this
> communication and delete the communication, including any
> attachments, from your computer. Electronic communications sent to or
> from World Fuel Services Corporation or its subsidiaries or its affiliates
> may be monitored for quality assurance and compliance purposes.***
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160715/eb322b59/attachment.html 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image001.png
Type: image/png
Size: 4236 bytes
Desc: not available
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20160715/eb322b59/attachment.png 

From sthorger at redhat.com  Fri Jul 15 04:53:05 2016
From: sthorger at redhat.com (Stian Thorgersen)
Date: Fri, 15 Jul 2016 10:53:05 +0200
Subject: [keycloak-user] Connection timed out: logging out of Keycloak
In-Reply-To: <BLU181-W30C4C63CCF1D527978E02DCB300@phx.gbl>
References: <BLU181-W30C4C63CCF1D527978E02DCB300@phx.gbl>
Message-ID: <CAJgngAcefObGacNxm6P2GraPO7Ry9a-YMm_V06Empn7LE6J1nQ@mail.gmail.com>

Can the Keycloak server connect to 10.0.3.141:8083 at all?

On 12 July 2016 at 22:08, Richard Lavallee <rllavallee at hotmail.com> wrote:

> Has anyone experienced a similar failure stack trace when initiating a
> Logout from Keycloak, please?
>
>
> This has something to do with the Admin URL, BUT...filling that in seems
> to cause a Proxy Error when attempting to logout normally, and doesn't seem
> to work in the first place. I am unsure on how to proceed forward on this,
> and I'm hoping someone in the community has worked with the Tomcat Adapter
>
> -Richard
>
>
> 19:36:55,145 WARN  [org.keycloak.services] (default task-30)
> KC-SERVICES0057: Logout for client 'myApp' failed:
> org.apache.http.conn.ConnectTimeoutException: Connect to 10.0.3.141:8083
>  [/10.0.3.141] failed: Connection timed out
>         at
> org.apache.http.impl.conn.DefaultHttpClientConnectionOperator.connect(DefaultHttpClientConnectionOperator.java:149)
>         at
> org.apache.http.impl.conn.PoolingHttpClientConnectionManager.connect(PoolingHttpClientConnectionManager.java:353)
>         at
> org.apache.http.impl.execchain.MainClientExec.establishRoute(MainClientExec.java:380)
>         at
> org.apache.http.impl.execchain.MainClientExec.execute(MainClientExec.java:236)
>         at
> org.apache.http.impl.execchain.ProtocolExec.execute(ProtocolExec.java:184)
>         at
> org.apache.http.impl.execchain.RetryExec.execute(RetryExec.java:88)
>         at
> org.apache.http.impl.execchain.RedirectExec.execute(RedirectExec.java:110)
>         at
> org.apache.http.impl.client.InternalHttpClient.doExecute(InternalHttpClient.java:184)
>         at
> org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:82)
>         at
> org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:107)
>         at
> org.keycloak.connections.httpclient.DefaultHttpClientFactory$1.postText(DefaultHttpClientFactory.java:70)
>         at
> org.keycloak.services.managers.ResourceAdminManager.sendLogoutRequest(ResourceAdminManager.java:251)
>         at
> org.keycloak.services.managers.ResourceAdminManager.logoutClientSessions(ResourceAdminManager.java:195)
>         at
> org.keycloak.services.managers.ResourceAdminManager.logoutClientSession(ResourceAdminManager.java:150)
>         at
> org.keycloak.protocol.oidc.OIDCLoginProtocol.backchannelLogout(OIDCLoginProtocol.java:209)
>         at
> org.keycloak.services.managers.AuthenticationManager.browserLogout(AuthenticationManager.java:208)
>         at
> org.keycloak.protocol.oidc.endpoints.LogoutEndpoint.logout(LogoutEndpoint.java:142)
>         at sun.reflect.GeneratedMethodAccessor584.invoke(Unknown Source)
>         at
> sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
>         at java.lang.reflect.Method.invoke(Method.java:498)
>         at
> org.jboss.resteasy.core.MethodInjectorImpl.invoke(MethodInjectorImpl.java:139)
>         at
> org.jboss.resteasy.core.ResourceMethodInvoker.invokeOnTarget(ResourceMethodInvoker.java:295)
>         at
> org.jboss.resteasy.core.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:249)
>         at
> org.jboss.resteasy.core.ResourceLocatorInvoker.invokeOnTargetObject(ResourceLocatorInvoker.java:138)
>         at
> org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorInvoker.java:107)
>         at
> org.jboss.resteasy.core.ResourceLocatorInvoker.invokeOnTargetObject(ResourceLocatorInvoker.java:133)
>         at
> org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorInvoker.java:101)
>         at
> org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:395)
>         at
> org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:202)
>         at
> org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.service(ServletContainerDispatcher.java:221)
>         at
> org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:56)
>         at
> org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:51)
>         at javax.servlet.http.HttpServlet.service(HttpServlet.java:790)
>         at
> io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:85)
>         at
> io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:129)
>         at
> org.keycloak.services.filters.KeycloakSessionServletFilter.doFilter(KeycloakSessionServletFilter.java:88)
>         at
> io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:60)
>         at
> io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
>         at
> io.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.java:84)
>         at
> io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:62)
>         at
> io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36)
>         at
> org.wildfly.extension.undertow.security.SecurityContextAssociationHandler.handleRequest(SecurityContextAssociationHandler.java:78)
>         at
> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
>         at
> io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:131)
>         at
> io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:57)
>         at
> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
>         at
> io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:46)
>         at
> io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64)
>         at
> io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:60)
>         at
> io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:77)
>         at
> io.undertow.security.handlers.NotificationReceiverHandler.handleRequest(NotificationReceiverHandler.java:50)
>         at
> io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43)
>         at
> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
>         at
> org.wildfly.extension.undertow.security.jacc.JACCContextIdHandler.handleRequest(JACCContextIdHandler.java:61)
>         at
> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
>         at
> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
>         at
> io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:284)
>         at
> io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:263)
>         at
> io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:81)
>         at
> io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:174)
>         at
> io.undertow.server.Connectors.executeRootHandler(Connectors.java:202)
>         at
> io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:793)
>         at
> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
>         at
> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
>         at java.lang.Thread.run(Thread.java:745)
> Caused by: java.net.ConnectException: Connection timed out
>         at java.net.PlainSocketImpl.socketConnect(Native Method)
>         at java.net
> .AbstractPlainSocketImpl.doConnect(AbstractPlainSocketImpl.java:350)
>         at java.net
> .AbstractPlainSocketImpl.connectToAddress(AbstractPlainSocketImpl.java:206)
>         at java.net
> .AbstractPlainSocketImpl.connect(AbstractPlainSocketImpl.java:188)
>         at java.net.SocksSocketImpl.connect(SocksSocketImpl.java:392)
>         at java.net.Socket.connect(Socket.java:589)
>         at
> org.apache.http.conn.socket.PlainConnectionSocketFactory.connectSocket(PlainConnectionSocketFactory.java:74)
>         at
> org.apache.http.impl.conn.DefaultHttpClientConnectionOperator.connect(DefaultHttpClientConnectionOperator.java:134)
>         ... 64 more
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160715/3a347833/attachment-0001.html 

From christian.froehlich at agfa.com  Fri Jul 15 03:26:33 2016
From: christian.froehlich at agfa.com (Christian Froehlich)
Date: Fri, 15 Jul 2016 09:26:33 +0200
Subject: [keycloak-user] Keycloak wf8 adapter 2.0.0.Final and authz
Message-ID: <OF957745A2.AC57C410-ONC1257FF1.0027B7CA-C1257FF1.0028E19C@agfa.com>

Hi,

I got a NoClassDefFoundError when I try to use the Authorization provided 
by keycloak. My Application is running on a wildfly 8 including the 
coresponding wf8 adapter. Keycloak itself is runing as a standalone 
server. The module "keycloak-authz-client" is missing in wf8 adapter when 
I compare the adapter of wildfly 9/10 and wildfly 8. Is it a bug or is it 
not possible to use the authorization within a wildfly 8?
Here the stacktrace of my deployment error:
[31m2016-07-15 06:40:50,714 ERROR [org.jboss.msc.service.fail] (MSC 
service thread 1-3) () MSC000001: Failed to start service 
jboss.undertow.deployment.default-server.default-host./orbis-4u: 
org.jboss.msc.service.StartException in service 
jboss.undertow.deployment.default-server.default-host./orbis-4u: Failed to 
start service
        at 
org.jboss.msc.service.ServiceControllerImpl$StartTask.run(ServiceControllerImpl.java:1904) 
[jboss-msc-1.2.2.Final.jar:1.2.2.Final]
        at 
java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) 
[rt.jar:1.8.0_92]
        at 
java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) 
[rt.jar:1.8.0_92]
        at java.lang.Thread.run(Thread.java:745) [rt.jar:1.8.0_92]
 Caused by: java.lang.NoClassDefFoundError: 
org/keycloak/authorization/client/Configuration
        at 
org.keycloak.adapters.authorization.PolicyEnforcer.<init>(PolicyEnforcer.java:56)
        at 
org.keycloak.adapters.KeycloakDeploymentBuilder.internalBuild(KeycloakDeploymentBuilder.java:118)
        at 
org.keycloak.adapters.KeycloakDeploymentBuilder.build(KeycloakDeploymentBuilder.java:127)
        at 
org.keycloak.adapters.undertow.KeycloakServletExtension.handleDeployment(KeycloakServletExtension.java:135)
        at 
io.undertow.servlet.core.DeploymentManagerImpl.handleExtensions(DeploymentManagerImpl.java:244)
        at 
io.undertow.servlet.core.DeploymentManagerImpl.deploy(DeploymentManagerImpl.java:149)
        at 
org.wildfly.extension.undertow.deployment.UndertowDeploymentService.startContext(UndertowDeploymentService.java:87)
        at 
org.wildfly.extension.undertow.deployment.UndertowDeploymentService.start(UndertowDeploymentService.java:72)
        at 
org.jboss.msc.service.ServiceControllerImpl$StartTask.startService(ServiceControllerImpl.java:1948) 
[jboss-msc-1.2.2.Final.jar:1.2.2.Final]
        at 
org.jboss.msc.service.ServiceControllerImpl$StartTask.run(ServiceControllerImpl.java:1881) 
[jboss-msc-1.2.2.Final.jar:1.2.2.Final]
        ... 3 more
 Caused by: java.lang.ClassNotFoundException: 
org.keycloak.authorization.client.Configuration from [Module 
"org.keycloak.keycloak-adapter-core:main" from local module loader 
@3b94d659 (finder: local module finder @24b1d79b (roots: 
/opt/orbis/oas/server/orbis-as-08.04.27.00.0015200-DACHL/modules,/opt/orbis/oas/server/orbis-as-08.04.27.00.0015200-DACHL/modules/system/layers/base,/opt/orbis/oas/server/orbis-as-08.04.27.00.0015200-DACHL/modules/system/add-ons/keycloak))]
        at 
org.jboss.modules.ModuleClassLoader.findClass(ModuleClassLoader.java:213) 
[jboss-modules.jar:1.3.3.Final]
        at 
org.jboss.modules.ConcurrentClassLoader.performLoadClassUnchecked(ConcurrentClassLoader.java:459) 
[jboss-modules.jar:1.3.3.Final]
        at 
org.jboss.modules.ConcurrentClassLoader.performLoadClassChecked(ConcurrentClassLoader.java:408) 
[jboss-modules.jar:1.3.3.Final]
        at 
org.jboss.modules.ConcurrentClassLoader.performLoadClass(ConcurrentClassLoader.java:389) 
[jboss-modules.jar:1.3.3.Final]
        at 
org.jboss.modules.ConcurrentClassLoader.loadClass(ConcurrentClassLoader.java:134) 
[jboss-modules.jar:1.3.3.Final]
        ... 13 more
 
[31m2016-07-15 06:40:50,744 ERROR 
[org.jboss.as.controller.management-operation] (Controller Boot Thread) () 
JBAS014613: Operation ("deploy") failed - address: ([("deployment" => 
"orbis-4u.war")]) - failure description: {"JBAS014671: Failed services" => 
{"jboss.undertow.deployment.default-server.default-host./orbis-4u" => 
"org.jboss.msc.service.StartException in service 
jboss.undertow.deployment.default-server.default-host./orbis-4u: Failed to 
start service
     Caused by: java.lang.NoClassDefFoundError: 
org/keycloak/authorization/client/Configuration
     Caused by: java.lang.ClassNotFoundException: 
org.keycloak.authorization.client.Configuration from [Module 
\"org.keycloak.keycloak-adapter-core:main\" from local module loader 
@3b94d659 (finder: local module finder @24b1d79b (roots: 
/opt/orbis/oas/server/orbis-as-08.04.27.00.0015200-DACHL/modules,/opt/orbis/oas/server/orbis-as-08.04.27.00.0015200-DACHL/modules/system/layers/base,/opt/orbis/oas/server/orbis-as-08.04.27.00.0015200-DACHL/modules/system/add-ons/keycloak))]"}}
 [0m06:40:50,780 INFO 
[org.hibernate.hql.internal.QueryTranslatorFactoryInitiator] 
(ServerService Thread Pool -- 49) HHH000397: Using 
ASTQueryTranslatorFactory
 [0m2016-07-15 06:40:50,856 INFO  [org.jboss.as.server] (ServerService 
Thread Pool -- 33) () JBAS018559: Deployed "orbis-4u.war" (runtime-name : 
"orbis-4u.war")
 [0m2016-07-15 06:40:50,870 INFO  [org.jboss.as.controller] (Controller 
Boot Thread) () JBAS014774: Service status report
 JBAS014777:   Services which failed to start:      service 
jboss.undertow.deployment.default-server.default-host./orbis-4u: 
org.jboss.msc.service.StartException in service 
jboss.undertow.deployment.default-server.default-host./orbis-4u: Failed to 
start service

Regards Christian
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160715/4cc94476/attachment.html 

From valerij.timofeev at gmail.com  Fri Jul 15 06:22:31 2016
From: valerij.timofeev at gmail.com (Valerij Timofeev)
Date: Fri, 15 Jul 2016 12:22:31 +0200
Subject: [keycloak-user] KEYCLOAK-1014 Reset password leads to 400 Bad
	Request - still unresolved?
Message-ID: <CAOy2obGavjXW_LXqOi47x8joZkUEz-oLF2gwe0a1w_TKUkh41A@mail.gmail.com>

Hi,

our customers are experiencing problems in situations where resetting
password is started in one web browser and accomplished in another one.
This scenario occurs if a user surfs with one kind of web browser, but an
email application opens password reset link in another one.

I suppose that the root cause is the same like the documented in
KEYCLOAK-1014 one.

We run Keycloak 1.9.4 standalone servers in our production at the moment,
but already started to roll out RH SSO 7.0 in other stages. So a bug fix
should be scheduled for this version as well.

Kind regards
Valerij Timofeev
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160715/bd569ccb/attachment.html 

From sthorger at redhat.com  Fri Jul 15 07:14:39 2016
From: sthorger at redhat.com (Stian Thorgersen)
Date: Fri, 15 Jul 2016 13:14:39 +0200
Subject: [keycloak-user] KEYCLOAK-1014 Reset password leads to 400 Bad
 Request - still unresolved?
In-Reply-To: <CAOy2obGavjXW_LXqOi47x8joZkUEz-oLF2gwe0a1w_TKUkh41A@mail.gmail.com>
References: <CAOy2obGavjXW_LXqOi47x8joZkUEz-oLF2gwe0a1w_TKUkh41A@mail.gmail.com>
Message-ID: <CAJgngAf7WGsk1kDiW7y+7DkNh2TBXN3aVt3fNKtLNu_uqkkaqA@mail.gmail.com>

Just checked and I'm not able to reproduce this issue.

I clicked on reset password in one browser, copied the link and opened it
in a new incognito session. Worked just fine.

On 15 July 2016 at 12:22, Valerij Timofeev <valerij.timofeev at gmail.com>
wrote:

> Hi,
>
> our customers are experiencing problems in situations where resetting
> password is started in one web browser and accomplished in another one.
> This scenario occurs if a user surfs with one kind of web browser, but an
> email application opens password reset link in another one.
>
> I suppose that the root cause is the same like the documented in
> KEYCLOAK-1014 one.
>
> We run Keycloak 1.9.4 standalone servers in our production at the moment,
> but already started to roll out RH SSO 7.0 in other stages. So a bug fix
> should be scheduled for this version as well.
>
> Kind regards
> Valerij Timofeev
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160715/0b4e542d/attachment.html 

From sthorger at redhat.com  Fri Jul 15 07:15:48 2016
From: sthorger at redhat.com (Stian Thorgersen)
Date: Fri, 15 Jul 2016 13:15:48 +0200
Subject: [keycloak-user] KEYCLOAK-1014 Reset password leads to 400 Bad
 Request - still unresolved?
In-Reply-To: <CAJgngAf7WGsk1kDiW7y+7DkNh2TBXN3aVt3fNKtLNu_uqkkaqA@mail.gmail.com>
References: <CAOy2obGavjXW_LXqOi47x8joZkUEz-oLF2gwe0a1w_TKUkh41A@mail.gmail.com>
	<CAJgngAf7WGsk1kDiW7y+7DkNh2TBXN3aVt3fNKtLNu_uqkkaqA@mail.gmail.com>
Message-ID: <CAJgngAf2OLZoSA5UErLruHsEAVD34gBa1bVTSvRx-OOkiROriQ@mail.gmail.com>

I tested with 2.0.0.Final though. Please check with 1.9.8.Final or RH SSO
7.0. I believe there was some fixes around this at some point in 1.9.x.

On 15 July 2016 at 13:14, Stian Thorgersen <sthorger at redhat.com> wrote:

> Just checked and I'm not able to reproduce this issue.
>
> I clicked on reset password in one browser, copied the link and opened it
> in a new incognito session. Worked just fine.
>
> On 15 July 2016 at 12:22, Valerij Timofeev <valerij.timofeev at gmail.com>
> wrote:
>
>> Hi,
>>
>> our customers are experiencing problems in situations where resetting
>> password is started in one web browser and accomplished in another one.
>> This scenario occurs if a user surfs with one kind of web browser, but an
>> email application opens password reset link in another one.
>>
>> I suppose that the root cause is the same like the documented in
>> KEYCLOAK-1014 one.
>>
>> We run Keycloak 1.9.4 standalone servers in our production at the moment,
>> but already started to roll out RH SSO 7.0 in other stages. So a bug fix
>> should be scheduled for this version as well.
>>
>> Kind regards
>> Valerij Timofeev
>>
>>
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160715/66603363/attachment-0001.html 

From psilva at redhat.com  Fri Jul 15 07:47:26 2016
From: psilva at redhat.com (Pedro Igor Silva)
Date: Fri, 15 Jul 2016 07:47:26 -0400 (EDT)
Subject: [keycloak-user] Keycloak wf8 adapter 2.0.0.Final and authz
In-Reply-To: <OF957745A2.AC57C410-ONC1257FF1.0027B7CA-C1257FF1.0028E19C@agfa.com>
References: <OF957745A2.AC57C410-ONC1257FF1.0027B7CA-C1257FF1.0028E19C@agfa.com>
Message-ID: <1866045405.11690322.1468583246837.JavaMail.zimbra@redhat.com>

Hi Christian,

    WF8 is not enabled with authz services, but WF10 only. I've created a JIRA to track this [1].   

Regards. 

[1] https://issues.jboss.org/browse/KEYCLOAK-3320

----- Original Message -----
From: "Christian Froehlich" <christian.froehlich at agfa.com>
To: keycloak-user at lists.jboss.org
Sent: Friday, July 15, 2016 4:26:33 AM
Subject: [keycloak-user] Keycloak wf8 adapter 2.0.0.Final and authz

Hi, 

I got a NoClassDefFoundError when I try to use the Authorization provided by keycloak. My Application is running on a wildfly 8 including the coresponding wf8 adapter. Keycloak itself is runing as a standalone server. The module "keycloak-authz-client" is missing in wf8 adapter when I compare the adapter of wildfly 9/10 and wildfly 8. Is it a bug or is it not possible to use the authorization within a wildfly 8? 
Here the stacktrace of my deployment error: 
[31m2016-07-15 06:40:50,714 ERROR [org.jboss.msc.service.fail] (MSC service thread 1-3) () MSC000001: Failed to start service jboss.undertow.deployment.default-server.default-host./orbis-4u: org.jboss.msc.service.StartException in service jboss.undertow.deployment.default-server.default-host./orbis-4u: Failed to start service 
at org.jboss.msc.service.ServiceControllerImpl$StartTask.run(ServiceControllerImpl.java:1904) [jboss-msc-1.2.2.Final.jar:1.2.2.Final] 
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) [rt.jar:1.8.0_92] 
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) [rt.jar:1.8.0_92] 
at java.lang.Thread.run(Thread.java:745) [rt.jar:1.8.0_92] 
Caused by: java.lang.NoClassDefFoundError: org/keycloak/authorization/client/Configuration 
at org.keycloak.adapters.authorization.PolicyEnforcer.<init>(PolicyEnforcer.java:56) 
at org.keycloak.adapters.KeycloakDeploymentBuilder.internalBuild(KeycloakDeploymentBuilder.java:118) 
at org.keycloak.adapters.KeycloakDeploymentBuilder.build(KeycloakDeploymentBuilder.java:127) 
at org.keycloak.adapters.undertow.KeycloakServletExtension.handleDeployment(KeycloakServletExtension.java:135) 
at io.undertow.servlet.core.DeploymentManagerImpl.handleExtensions(DeploymentManagerImpl.java:244) 
at io.undertow.servlet.core.DeploymentManagerImpl.deploy(DeploymentManagerImpl.java:149) 
at org.wildfly.extension.undertow.deployment.UndertowDeploymentService.startContext(UndertowDeploymentService.java:87) 
at org.wildfly.extension.undertow.deployment.UndertowDeploymentService.start(UndertowDeploymentService.java:72) 
at org.jboss.msc.service.ServiceControllerImpl$StartTask.startService(ServiceControllerImpl.java:1948) [jboss-msc-1.2.2.Final.jar:1.2.2.Final] 
at org.jboss.msc.service.ServiceControllerImpl$StartTask.run(ServiceControllerImpl.java:1881) [jboss-msc-1.2.2.Final.jar:1.2.2.Final] 
... 3 more 
Caused by: java.lang.ClassNotFoundException: org.keycloak.authorization.client.Configuration from [Module "org.keycloak.keycloak-adapter-core:main" from local module loader @3b94d659 (finder: local module finder @24b1d79b (roots: /opt/orbis/oas/server/orbis-as-08.04.27.00.0015200-DACHL/modules,/opt/orbis/oas/server/orbis-as-08.04.27.00.0015200-DACHL/modules/system/layers/base,/opt/orbis/oas/server/orbis-as-08.04.27.00.0015200-DACHL/modules/system/add-ons/keycloak))] 
at org.jboss.modules.ModuleClassLoader.findClass(ModuleClassLoader.java:213) [jboss-modules.jar:1.3.3.Final] 
at org.jboss.modules.ConcurrentClassLoader.performLoadClassUnchecked(ConcurrentClassLoader.java:459) [jboss-modules.jar:1.3.3.Final] 
at org.jboss.modules.ConcurrentClassLoader.performLoadClassChecked(ConcurrentClassLoader.java:408) [jboss-modules.jar:1.3.3.Final] 
at org.jboss.modules.ConcurrentClassLoader.performLoadClass(ConcurrentClassLoader.java:389) [jboss-modules.jar:1.3.3.Final] 
at org.jboss.modules.ConcurrentClassLoader.loadClass(ConcurrentClassLoader.java:134) [jboss-modules.jar:1.3.3.Final] 
... 13 more 

[31m2016-07-15 06:40:50,744 ERROR [org.jboss.as.controller.management-operation] (Controller Boot Thread) () JBAS014613: Operation ("deploy") failed - address: ([("deployment" => "orbis-4u.war")]) - failure description: {"JBAS014671: Failed services" => {"jboss.undertow.deployment.default-server.default-host./orbis-4u" => "org.jboss.msc.service.StartException in service jboss.undertow.deployment.default-server.default-host./orbis-4u: Failed to start service 
Caused by: java.lang.NoClassDefFoundError: org/keycloak/authorization/client/Configuration 
Caused by: java.lang.ClassNotFoundException: org.keycloak.authorization.client.Configuration from [Module \"org.keycloak.keycloak-adapter-core:main\" from local module loader @3b94d659 (finder: local module finder @24b1d79b (roots: /opt/orbis/oas/server/orbis-as-08.04.27.00.0015200-DACHL/modules,/opt/orbis/oas/server/orbis-as-08.04.27.00.0015200-DACHL/modules/system/layers/base,/opt/orbis/oas/server/orbis-as-08.04.27.00.0015200-DACHL/modules/system/add-ons/keycloak))]"}} 
[0m06:40:50,780 INFO [org.hibernate.hql.internal.QueryTranslatorFactoryInitiator] (ServerService Thread Pool -- 49) HHH000397: Using ASTQueryTranslatorFactory 
[0m2016-07-15 06:40:50,856 INFO [org.jboss.as.server] (ServerService Thread Pool -- 33) () JBAS018559: Deployed "orbis-4u.war" (runtime-name : "orbis-4u.war") 
[0m2016-07-15 06:40:50,870 INFO [org.jboss.as.controller] (Controller Boot Thread) () JBAS014774: Service status report 
JBAS014777: Services which failed to start: service jboss.undertow.deployment.default-server.default-host./orbis-4u: org.jboss.msc.service.StartException in service jboss.undertow.deployment.default-server.default-host./orbis-4u: Failed to start service 

Regards Christian 

_______________________________________________
keycloak-user mailing list
keycloak-user at lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user

From valerij.timofeev at gmail.com  Fri Jul 15 09:17:21 2016
From: valerij.timofeev at gmail.com (Valerij Timofeev)
Date: Fri, 15 Jul 2016 15:17:21 +0200
Subject: [keycloak-user] KEYCLOAK-1014 Reset password leads to 400 Bad
 Request - still unresolved?
In-Reply-To: <CAJgngAf2OLZoSA5UErLruHsEAVD34gBa1bVTSvRx-OOkiROriQ@mail.gmail.com>
References: <CAOy2obGavjXW_LXqOi47x8joZkUEz-oLF2gwe0a1w_TKUkh41A@mail.gmail.com>
	<CAJgngAf7WGsk1kDiW7y+7DkNh2TBXN3aVt3fNKtLNu_uqkkaqA@mail.gmail.com>
	<CAJgngAf2OLZoSA5UErLruHsEAVD34gBa1bVTSvRx-OOkiROriQ@mail.gmail.com>
Message-ID: <CAOy2obFXj8v=EfCPH87xTHzGptnZinH2E1mMXS8Rnu5VA-PLoQ@mail.gmail.com>

I've just quickly tested in RH SSO 7.0: it works!
The only thing we have to do now is to test thoroughly and roll out it in
production :-)

Thank you very much for your quick assistance!

2016-07-15 13:15 GMT+02:00 Stian Thorgersen <sthorger at redhat.com>:

> I tested with 2.0.0.Final though. Please check with 1.9.8.Final or RH SSO
> 7.0. I believe there was some fixes around this at some point in 1.9.x.
>
> On 15 July 2016 at 13:14, Stian Thorgersen <sthorger at redhat.com> wrote:
>
>> Just checked and I'm not able to reproduce this issue.
>>
>> I clicked on reset password in one browser, copied the link and opened it
>> in a new incognito session. Worked just fine.
>>
>> On 15 July 2016 at 12:22, Valerij Timofeev <valerij.timofeev at gmail.com>
>> wrote:
>>
>>> Hi,
>>>
>>> our customers are experiencing problems in situations where resetting
>>> password is started in one web browser and accomplished in another one.
>>> This scenario occurs if a user surfs with one kind of web browser, but
>>> an email application opens password reset link in another one.
>>>
>>> I suppose that the root cause is the same like the documented in
>>> KEYCLOAK-1014 one.
>>>
>>> We run Keycloak 1.9.4 standalone servers in our production at the
>>> moment, but already started to roll out RH SSO 7.0 in other stages. So a
>>> bug fix should be scheduled for this version as well.
>>>
>>> Kind regards
>>> Valerij Timofeev
>>>
>>>
>>> _______________________________________________
>>> keycloak-user mailing list
>>> keycloak-user at lists.jboss.org
>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>
>>
>>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160715/f4786ba1/attachment.html 

From adrianmatei at gmail.com  Fri Jul 15 10:34:07 2016
From: adrianmatei at gmail.com (Adrian Matei)
Date: Fri, 15 Jul 2016 16:34:07 +0200
Subject: [keycloak-user] Two way communication required between Keycloak
 Server and REST API BAckend Server?
Message-ID: <CAG=THF2A4HDUHv8stWmZEEgpt=1-m+G-kRNL296YXBRfgtCPZQ@mail.gmail.com>

Hi everyone,

Does a Keycloak secured REST Api on JBoss EAP 6.1 (access-type bearer only)
need to communicate with the Keycloak Server once the Adapter and
standalone.xml are properly configured?

Currently both servers are on the same DMZ zone, but we'd like to move the
REST Api Server in Intranet zone.

(test - the REST backend seems to be callable as long as the token is
valid, though the Keycloak Server was shutdown, but I ask myself why do I
need to specify the auth-server-url in standalone.xml, or keycloak.json
file)


Thanks
Adrian
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160715/7708fedd/attachment.html 

From valerij.timofeev at gmail.com  Fri Jul 15 11:03:23 2016
From: valerij.timofeev at gmail.com (Valerij Timofeev)
Date: Fri, 15 Jul 2016 17:03:23 +0200
Subject: [keycloak-user] KEYCLOAK-1014 Reset password leads to 400 Bad
 Request - still unresolved?
In-Reply-To: <CAOy2obFXj8v=EfCPH87xTHzGptnZinH2E1mMXS8Rnu5VA-PLoQ@mail.gmail.com>
References: <CAOy2obGavjXW_LXqOi47x8joZkUEz-oLF2gwe0a1w_TKUkh41A@mail.gmail.com>
	<CAJgngAf7WGsk1kDiW7y+7DkNh2TBXN3aVt3fNKtLNu_uqkkaqA@mail.gmail.com>
	<CAJgngAf2OLZoSA5UErLruHsEAVD34gBa1bVTSvRx-OOkiROriQ@mail.gmail.com>
	<CAOy2obFXj8v=EfCPH87xTHzGptnZinH2E1mMXS8Rnu5VA-PLoQ@mail.gmail.com>
Message-ID: <CAOy2obEsEsi2Uea7jyVS+4eqdLw6bTz-FECgwk-hquWLskumNw@mail.gmail.com>

I've figred out exact condition when descibed scenario fails for us:

1) it does not work in combination with our legacy web application (built
on RH/JBoss Seam 2)
2) but it works in Keycloak 1.9.4 properly too if a user logins in into the
Account web application and then starts password reset process

Are there any known general issues with Seam 2 or JSF web applications
protected by Keycloak?

2016-07-15 15:17 GMT+02:00 Valerij Timofeev <valerij.timofeev at gmail.com>:

> I've just quickly tested in RH SSO 7.0: it works!
> The only thing we have to do now is to test thoroughly and roll out it in
> production :-)
>
> Thank you very much for your quick assistance!
>
> 2016-07-15 13:15 GMT+02:00 Stian Thorgersen <sthorger at redhat.com>:
>
>> I tested with 2.0.0.Final though. Please check with 1.9.8.Final or RH SSO
>> 7.0. I believe there was some fixes around this at some point in 1.9.x.
>>
>> On 15 July 2016 at 13:14, Stian Thorgersen <sthorger at redhat.com> wrote:
>>
>>> Just checked and I'm not able to reproduce this issue.
>>>
>>> I clicked on reset password in one browser, copied the link and opened
>>> it in a new incognito session. Worked just fine.
>>>
>>> On 15 July 2016 at 12:22, Valerij Timofeev <valerij.timofeev at gmail.com>
>>> wrote:
>>>
>>>> Hi,
>>>>
>>>> our customers are experiencing problems in situations where resetting
>>>> password is started in one web browser and accomplished in another one.
>>>> This scenario occurs if a user surfs with one kind of web browser, but
>>>> an email application opens password reset link in another one.
>>>>
>>>> I suppose that the root cause is the same like the documented in
>>>> KEYCLOAK-1014 one.
>>>>
>>>> We run Keycloak 1.9.4 standalone servers in our production at the
>>>> moment, but already started to roll out RH SSO 7.0 in other stages. So a
>>>> bug fix should be scheduled for this version as well.
>>>>
>>>> Kind regards
>>>> Valerij Timofeev
>>>>
>>>>
>>>> _______________________________________________
>>>> keycloak-user mailing list
>>>> keycloak-user at lists.jboss.org
>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>>
>>>
>>>
>>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160715/1a13deea/attachment.html 

From pygator at linux.com  Sat Jul 16 09:39:28 2016
From: pygator at linux.com (Ricardo Chu)
Date: Sat, 16 Jul 2016 09:39:28 -0400
Subject: [keycloak-user] Keycloak unable to open JDBC connection
In-Reply-To: <CAN_wU+aeG1h6ndXFBfLCMcLm69sdeyzNf30RdxAAVvEuEAnajA@mail.gmail.com>
References: <75d2b5690a9c48018f940e99718e1269@MIA-WEX-P16.wfs.com>
	<CAJgngAcfE8WbrJSCdBGQK1cfn3nEE4kZxN6FjZo+aEvjGHpMaQ@mail.gmail.com>
	<CAN_wU+aeG1h6ndXFBfLCMcLm69sdeyzNf30RdxAAVvEuEAnajA@mail.gmail.com>
Message-ID: <CAN_wU+bvKif2QesV_x0brH_s+FZE+OxXZXf8oNTyzs_+YVwQtg@mail.gmail.com>

The jboss documentation describes how to setup the validation check for
Oracle with nice examples:
https://access.redhat.com/documentation/en-US/JBoss_Enterprise_Application_Platform/6/html/Administration_and_Configuration_Guide/Example_Oracle_Datasource.html

Another option is to use the Wildfly administrator pages to setup
the datasource.  This option will create a new datasource that includes the
validation check.  This tutorial describes what this looks like:
http://www.itprogrammingtutorials.com/2014/java/jboss/connection-pool-jboss-wildfly/

Rick

On Sat, Jul 16, 2016 at 9:35 AM, Ricardo Chu <rick at chucrew.net> wrote:

> The jboss documentation describes how to setup the validation check for
> Oracle with nice examples:
>
> https://access.redhat.com/documentation/en-US/JBoss_Enterprise_Application_Platform/6/html/Administration_and_Configuration_Guide/Example_Oracle_Datasource.html
>
> Another option is to use the Wildfly administrator pages to setup
> the datasource.  This option will create a new datasource that includes the
> validation check.  This tutorial describes what this looks like:
> http://www.itprogrammingtutorials.com/2014/java/jboss/connection-pool-jboss-wildfly/
>
> Rick
>
> On Fri, Jul 15, 2016 at 4:51 AM, Stian Thorgersen <sthorger at redhat.com>
> wrote:
>
>> See
>> http://stackoverflow.com/questions/31455450/auto-recover-connections-in-wildfly-8-2-for-oracle-without-using-validate-on-mat
>>
>> On 14 July 2016 at 15:27, Thomas Barcia <TBarcia at wfscorp.com> wrote:
>>
>>> I have Keycloak 1.9.8-Final running against an Oracle database and it
>>> appears that when the connections are unused for a period of time (usually
>>> overnight) Keycloak is unable to open a JDBC connection to the database.  I
>>> spoke with the DBAs and the database is not closing the connections.
>>> According to the DBAs I need to enable connection validation but I?m not a
>>> programmer and can?t find a good example of how it?s done.  Can anyone
>>> provide some help with this?  Am I on the right track in resolving the
>>> issue?
>>>
>>>
>>>
>>> Thanks.
>>>
>>>
>>>
>>> This is from my standalone-ha.xml:
>>>
>>> <datasource jndi-name="java:jboss/datasources/KeycloakDS"
>>> pool-name="KeycloakDS" enabled="true" use-java-context="true">
>>>
>>>                  <connection-url>jdbc:oracle:thin:@
>>> <servername>:<port>:<databasename></connection-url>
>>>
>>>                   <driver>oracle</driver>
>>>
>>>                  <pool>
>>>
>>>                    <min-pool-size>1</min-pool-size>
>>>
>>>                    <max-pool-size>5</max-pool-size>
>>>
>>>                    <prefill>true</prefill>
>>>
>>>                   </pool>
>>>
>>>                   <security>
>>>
>>>                    <user-name><name></user-name>
>>>
>>>                    <password><password></password>
>>>
>>>                  </security>
>>>
>>>
>>>
>>>                 </datasource>
>>>
>>>                 <drivers>
>>>
>>>                     <driver name="h2" module="com.h2database.h2">
>>>
>>>
>>>                     <xa-datasource-class>org.h2.jdbcx.JdbcDataSource</xa-datasource-class>
>>>
>>>                     </driver>
>>>
>>>                     <driver name="oracle" module="com.oracle">
>>>
>>>
>>> <driver-class>oracle.jdbc.driver.OracleDriver</driver-class>
>>>
>>>                     </driver>
>>>
>>>                 </drivers>
>>>
>>>
>>>
>>> And this is the error:
>>>
>>> 2016-07-14 00:13:09,460 WARN
>>> [org.hibernate.engine.jdbc.spi.SqlExceptionHelper] (Timer-2) SQL Error: 0,
>>> SQLState: null
>>>
>>> 2016-07-14 00:13:09,461 ERROR
>>> [org.hibernate.engine.jdbc.spi.SqlExceptionHelper] (Timer-2)
>>> javax.resource.ResourceException: IJ000453: Unable to get managed
>>> connection for java:jboss/datasources/KeycloakDS
>>>
>>> 2016-07-14 00:13:09,462 ERROR [org.keycloak.services] (Timer-2)
>>> KC-SERVICES0089: Failed to run scheduled task ClearExpiredUserSessions:
>>> javax.persistence.PersistenceException:
>>> org.hibernate.exception.GenericJDBCException: Unable to acquire JDBC
>>> Connection
>>>
>>>         at
>>> org.hibernate.jpa.spi.AbstractEntityManagerImpl.convert(AbstractEntityManagerImpl.java:1692)
>>>
>>>         at
>>> org.hibernate.jpa.spi.AbstractEntityManagerImpl.convert(AbstractEntityManagerImpl.java:1602)
>>>
>>>         at
>>> org.hibernate.jpa.spi.AbstractEntityManagerImpl.throwPersistenceException(AbstractEntityManagerImpl.java:1700)
>>>
>>>         at
>>> org.hibernate.jpa.internal.TransactionImpl.begin(TransactionImpl.java:48)
>>>
>>>         at
>>> org.keycloak.connections.jpa.JpaKeycloakTransaction.begin(JpaKeycloakTransaction.java:39)
>>>
>>>         at
>>> org.keycloak.services.DefaultKeycloakTransactionManager.enlist(DefaultKeycloakTransactionManager.java:41)
>>>
>>>         at
>>> org.keycloak.connections.jpa.DefaultJpaConnectionProviderFactory.create(DefaultJpaConnectionProviderFactory.java:70)
>>>
>>>         at
>>> org.keycloak.connections.jpa.DefaultJpaConnectionProviderFactory.create(DefaultJpaConnectionProviderFactory.java:54)
>>>
>>>         at
>>> org.keycloak.services.DefaultKeycloakSession.getProvider(DefaultKeycloakSession.java:101)
>>>
>>>         at
>>> org.keycloak.models.jpa.JpaRealmProviderFactory.create(JpaRealmProviderFactory.java:51)
>>>
>>>         at
>>> org.keycloak.models.jpa.JpaRealmProviderFactory.create(JpaRealmProviderFactory.java:33)
>>>
>>>         at
>>> org.keycloak.services.DefaultKeycloakSession.getProvider(DefaultKeycloakSession.java:101)
>>>
>>>         at
>>> org.keycloak.models.cache.infinispan.RealmCacheSession.getDelegate(RealmCacheSession.java:161)
>>>
>>>         at
>>> org.keycloak.models.cache.infinispan.RealmCacheSession.getRealms(RealmCacheSession.java:424)
>>>
>>>         at
>>> org.keycloak.services.scheduled.ClearExpiredUserSessions.run(ClearExpiredUserSessions.java:33)
>>>
>>>         at
>>> org.keycloak.services.scheduled.ClusterAwareScheduledTaskRunner$1.call(ClusterAwareScheduledTaskRunner.java:53)
>>>
>>>         at
>>> org.keycloak.services.scheduled.ClusterAwareScheduledTaskRunner$1.call(ClusterAwareScheduledTaskRunner.java:49)
>>>
>>>         at
>>> org.keycloak.cluster.infinispan.InfinispanClusterProvider.executeIfNotExecuted(InfinispanClusterProvider.java:90)
>>>
>>>         at
>>> org.keycloak.services.scheduled.ClusterAwareScheduledTaskRunner.runTask(ClusterAwareScheduledTaskRunner.java:49)
>>>
>>>         at
>>> org.keycloak.services.scheduled.ScheduledTaskRunner.run(ScheduledTaskRunner.java:44)
>>>
>>>         at
>>> org.keycloak.timer.basic.BasicTimerProvider$1.run(BasicTimerProvider.java:51)
>>>
>>>         at java.util.TimerThread.mainLoop(Timer.java:555)
>>>
>>>
>>>
>>> *Thomas  Barcia*
>>>
>>> Unix Administrator
>>>
>>>
>>>
>>> World Fuel Services Corporation
>>>
>>> 9800 NW 41st Street|Miami, FL 33178
>>>
>>> office: 305.351.4910|email: tbarcia at wfscorp.com
>>>
>>> [image: Description: Description: wfs]
>>>
>>>
>>>
>>> *** This communication has been sent from World Fuel Services
>>> Corporation or its subsidiaries or its affiliates for the intended
>>> recipient
>>> only and may contain proprietary, confidential or privileged
>>> information.
>>> If you are not the intended recipient, any review, disclosure, copying,
>>> use, or distribution of the information included in this communication
>>> and any attachments is strictly prohibited. If you have received this
>>> communication in error, please notify us immediately by replying to this
>>> communication and delete the communication, including any
>>> attachments, from your computer. Electronic communications sent to or
>>> from World Fuel Services Corporation or its subsidiaries or its
>>> affiliates
>>> may be monitored for quality assurance and compliance purposes.***
>>>
>>>
>>> _______________________________________________
>>> keycloak-user mailing list
>>> keycloak-user at lists.jboss.org
>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>
>>
>>
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160716/05aee0db/attachment-0001.html 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image001.png
Type: image/png
Size: 4236 bytes
Desc: not available
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20160716/05aee0db/attachment-0001.png 

From bruno at abstractj.org  Mon Jul 18 09:45:26 2016
From: bruno at abstractj.org (Bruno Oliveira)
Date: Mon, 18 Jul 2016 10:45:26 -0300
Subject: [keycloak-user] KEYCLOAK-1014 Reset password leads to 400 Bad
 Request - still unresolved?
In-Reply-To: <CAOy2obEsEsi2Uea7jyVS+4eqdLw6bTz-FECgwk-hquWLskumNw@mail.gmail.com>
References: <CAOy2obGavjXW_LXqOi47x8joZkUEz-oLF2gwe0a1w_TKUkh41A@mail.gmail.com>
	<CAJgngAf7WGsk1kDiW7y+7DkNh2TBXN3aVt3fNKtLNu_uqkkaqA@mail.gmail.com>
	<CAJgngAf2OLZoSA5UErLruHsEAVD34gBa1bVTSvRx-OOkiROriQ@mail.gmail.com>
	<CAOy2obFXj8v=EfCPH87xTHzGptnZinH2E1mMXS8Rnu5VA-PLoQ@mail.gmail.com>
	<CAOy2obEsEsi2Uea7jyVS+4eqdLw6bTz-FECgwk-hquWLskumNw@mail.gmail.com>
Message-ID: <20160718134526.GA8661@abstractj.org>

I never heard about such issue. Do you get any errors at the logs?

On 2016-07-15, Valerij Timofeev wrote:
> I've figred out exact condition when descibed scenario fails for us:
>
> 1) it does not work in combination with our legacy web application (built
> on RH/JBoss Seam 2)
> 2) but it works in Keycloak 1.9.4 properly too if a user logins in into the
> Account web application and then starts password reset process
>
> Are there any known general issues with Seam 2 or JSF web applications
> protected by Keycloak?
>
> 2016-07-15 15:17 GMT+02:00 Valerij Timofeev <valerij.timofeev at gmail.com>:
>
> > I've just quickly tested in RH SSO 7.0: it works!
> > The only thing we have to do now is to test thoroughly and roll out it in
> > production :-)
> >
> > Thank you very much for your quick assistance!
> >
> > 2016-07-15 13:15 GMT+02:00 Stian Thorgersen <sthorger at redhat.com>:
> >
> >> I tested with 2.0.0.Final though. Please check with 1.9.8.Final or RH SSO
> >> 7.0. I believe there was some fixes around this at some point in 1.9.x.
> >>
> >> On 15 July 2016 at 13:14, Stian Thorgersen <sthorger at redhat.com> wrote:
> >>
> >>> Just checked and I'm not able to reproduce this issue.
> >>>
> >>> I clicked on reset password in one browser, copied the link and opened
> >>> it in a new incognito session. Worked just fine.
> >>>
> >>> On 15 July 2016 at 12:22, Valerij Timofeev <valerij.timofeev at gmail.com>
> >>> wrote:
> >>>
> >>>> Hi,
> >>>>
> >>>> our customers are experiencing problems in situations where resetting
> >>>> password is started in one web browser and accomplished in another one.
> >>>> This scenario occurs if a user surfs with one kind of web browser, but
> >>>> an email application opens password reset link in another one.
> >>>>
> >>>> I suppose that the root cause is the same like the documented in
> >>>> KEYCLOAK-1014 one.
> >>>>
> >>>> We run Keycloak 1.9.4 standalone servers in our production at the
> >>>> moment, but already started to roll out RH SSO 7.0 in other stages. So a
> >>>> bug fix should be scheduled for this version as well.
> >>>>
> >>>> Kind regards
> >>>> Valerij Timofeev
> >>>>
> >>>>
> >>>> _______________________________________________
> >>>> keycloak-user mailing list
> >>>> keycloak-user at lists.jboss.org
> >>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
> >>>>
> >>>
> >>>
> >>
> >

> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user


--

abstractj
PGP: 0x84DC9914

From valerij.timofeev at gmail.com  Mon Jul 18 09:55:29 2016
From: valerij.timofeev at gmail.com (Valerij Timofeev)
Date: Mon, 18 Jul 2016 15:55:29 +0200
Subject: [keycloak-user] KEYCLOAK-1014 Reset password leads to 400 Bad
 Request - still unresolved?
In-Reply-To: <CAOy2obEsEsi2Uea7jyVS+4eqdLw6bTz-FECgwk-hquWLskumNw@mail.gmail.com>
References: <CAOy2obGavjXW_LXqOi47x8joZkUEz-oLF2gwe0a1w_TKUkh41A@mail.gmail.com>
	<CAJgngAf7WGsk1kDiW7y+7DkNh2TBXN3aVt3fNKtLNu_uqkkaqA@mail.gmail.com>
	<CAJgngAf2OLZoSA5UErLruHsEAVD34gBa1bVTSvRx-OOkiROriQ@mail.gmail.com>
	<CAOy2obFXj8v=EfCPH87xTHzGptnZinH2E1mMXS8Rnu5VA-PLoQ@mail.gmail.com>
	<CAOy2obEsEsi2Uea7jyVS+4eqdLw6bTz-FECgwk-hquWLskumNw@mail.gmail.com>
Message-ID: <CAOy2obGhbKmsWNFd2mmW9vp=VcuLLTV1Jnc5BOrpub3qptvYMg@mail.gmail.com>

Hi,

I was able to reproduce the problem in RH SSO 7.0 (rh-sso theme) in my
development environment with a pure CDI web application running on another
application server (EAP 6) in another web domain.

Error on the page: JBWEB000065: HTTP Status 400
Warning in server.log: 14:04:42,979 WARN
[org.keycloak.adapters.OAuthRequestAuthenticator] (ajp-/0.0.0.0:8009-5)  No
state cookie

Navigating to a protected resource (after the error occurs) loads expected
web application page: this means that the user is already logged in.

The test web applicationhas been generated in Eclipse using maven
*jboss-javaee6-webapp-ear-blank--archetaype
7.1.3 Final* archetype.

Have anybody tested KEYCLOAK-1014 issue in similar setup?

1) protected web application is running on another application server than
Keyclok and another web domain (Apache, mod_jk)
2) RH SSO 7 is configured in root context (no /auth context)

Should we continue this dicussion here or should I submit a RH support case
instead?

Kind regards
Valerij Timofeev

2016-07-15 17:03 GMT+02:00 Valerij Timofeev <valerij.timofeev at gmail.com>:

> I've figred out exact condition when descibed scenario fails for us:
>
> 1) it does not work in combination with our legacy web application (built
> on RH/JBoss Seam 2)
> 2) but it works in Keycloak 1.9.4 properly too if a user logins in into
> the Account web application and then starts password reset process
>
> Are there any known general issues with Seam 2 or JSF web applications
> protected by Keycloak?
>
> 2016-07-15 15:17 GMT+02:00 Valerij Timofeev <valerij.timofeev at gmail.com>:
>
>> I've just quickly tested in RH SSO 7.0: it works!
>> The only thing we have to do now is to test thoroughly and roll out it in
>> production :-)
>>
>> Thank you very much for your quick assistance!
>>
>> 2016-07-15 13:15 GMT+02:00 Stian Thorgersen <sthorger at redhat.com>:
>>
>>> I tested with 2.0.0.Final though. Please check with 1.9.8.Final or RH
>>> SSO 7.0. I believe there was some fixes around this at some point in 1.9.x.
>>>
>>> On 15 July 2016 at 13:14, Stian Thorgersen <sthorger at redhat.com> wrote:
>>>
>>>> Just checked and I'm not able to reproduce this issue.
>>>>
>>>> I clicked on reset password in one browser, copied the link and opened
>>>> it in a new incognito session. Worked just fine.
>>>>
>>>> On 15 July 2016 at 12:22, Valerij Timofeev <valerij.timofeev at gmail.com>
>>>> wrote:
>>>>
>>>>> Hi,
>>>>>
>>>>> our customers are experiencing problems in situations where resetting
>>>>> password is started in one web browser and accomplished in another one.
>>>>> This scenario occurs if a user surfs with one kind of web browser, but
>>>>> an email application opens password reset link in another one.
>>>>>
>>>>> I suppose that the root cause is the same like the documented in
>>>>> KEYCLOAK-1014 one.
>>>>>
>>>>> We run Keycloak 1.9.4 standalone servers in our production at the
>>>>> moment, but already started to roll out RH SSO 7.0 in other stages. So a
>>>>> bug fix should be scheduled for this version as well.
>>>>>
>>>>> Kind regards
>>>>> Valerij Timofeev
>>>>>
>>>>>
>>>>> _______________________________________________
>>>>> keycloak-user mailing list
>>>>> keycloak-user at lists.jboss.org
>>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>>>
>>>>
>>>>
>>>
>>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160718/deead421/attachment.html 

From sthorger at redhat.com  Tue Jul 19 02:45:33 2016
From: sthorger at redhat.com (Stian Thorgersen)
Date: Tue, 19 Jul 2016 08:45:33 +0200
Subject: [keycloak-user] Two way communication required between Keycloak
 Server and REST API BAckend Server?
In-Reply-To: <CAG=THF2A4HDUHv8stWmZEEgpt=1-m+G-kRNL296YXBRfgtCPZQ@mail.gmail.com>
References: <CAG=THF2A4HDUHv8stWmZEEgpt=1-m+G-kRNL296YXBRfgtCPZQ@mail.gmail.com>
Message-ID: <CAJgngAdhNkFGvt2MbrDk_m1h4-ZpM6yRwxm_2mXr_RW0h6WnHA@mail.gmail.com>

The REST service doesn't need to communicate directly with Keycloak. The
auth-server-url is required by a bearer only token mainly to verify the
issuer in the token (it's the full url of the realm, not just the realm
name).

On 15 July 2016 at 16:34, Adrian Matei <adrianmatei at gmail.com> wrote:

> Hi everyone,
>
> Does a Keycloak secured REST Api on JBoss EAP 6.1 (access-type bearer
> only) need to communicate with the Keycloak Server once the Adapter and
> standalone.xml are properly configured?
>
> Currently both servers are on the same DMZ zone, but we'd like to move the
> REST Api Server in Intranet zone.
>
> (test - the REST backend seems to be callable as long as the token is
> valid, though the Keycloak Server was shutdown, but I ask myself why do I
> need to specify the auth-server-url in standalone.xml, or keycloak.json
> file)
>
>
> Thanks
> Adrian
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160719/b76622bc/attachment.html 

From sthorger at redhat.com  Tue Jul 19 03:10:14 2016
From: sthorger at redhat.com (Stian Thorgersen)
Date: Tue, 19 Jul 2016 09:10:14 +0200
Subject: [keycloak-user] KEYCLOAK-1014 Reset password leads to 400 Bad
 Request - still unresolved?
In-Reply-To: <CAOy2obGhbKmsWNFd2mmW9vp=VcuLLTV1Jnc5BOrpub3qptvYMg@mail.gmail.com>
References: <CAOy2obGavjXW_LXqOi47x8joZkUEz-oLF2gwe0a1w_TKUkh41A@mail.gmail.com>
	<CAJgngAf7WGsk1kDiW7y+7DkNh2TBXN3aVt3fNKtLNu_uqkkaqA@mail.gmail.com>
	<CAJgngAf2OLZoSA5UErLruHsEAVD34gBa1bVTSvRx-OOkiROriQ@mail.gmail.com>
	<CAOy2obFXj8v=EfCPH87xTHzGptnZinH2E1mMXS8Rnu5VA-PLoQ@mail.gmail.com>
	<CAOy2obEsEsi2Uea7jyVS+4eqdLw6bTz-FECgwk-hquWLskumNw@mail.gmail.com>
	<CAOy2obGhbKmsWNFd2mmW9vp=VcuLLTV1Jnc5BOrpub3qptvYMg@mail.gmail.com>
Message-ID: <CAJgngAf2v3tN5aJaKeBBFxiyngFVo24apZ_XDfg6LVEbO_7CUg@mail.gmail.com>

Confirmed the issue. See https://issues.jboss.org/browse/KEYCLOAK-3331.

We'll make sure this is included in RH SSO 7.0.1.

On 18 July 2016 at 15:55, Valerij Timofeev <valerij.timofeev at gmail.com>
wrote:

> Hi,
>
> I was able to reproduce the problem in RH SSO 7.0 (rh-sso theme) in my
> development environment with a pure CDI web application running on another
> application server (EAP 6) in another web domain.
>
> Error on the page: JBWEB000065: HTTP Status 400
> Warning in server.log: 14:04:42,979 WARN
> [org.keycloak.adapters.OAuthRequestAuthenticator] (ajp-/0.0.0.0:8009-5)
> No state cookie
>
> Navigating to a protected resource (after the error occurs) loads expected
> web application page: this means that the user is already logged in.
>
> The test web applicationhas been generated in Eclipse using maven *jboss-javaee6-webapp-ear-blank--archetaype
> 7.1.3 Final* archetype.
>
> Have anybody tested KEYCLOAK-1014 issue in similar setup?
>
> 1) protected web application is running on another application server than
> Keyclok and another web domain (Apache, mod_jk)
> 2) RH SSO 7 is configured in root context (no /auth context)
>
> Should we continue this dicussion here or should I submit a RH support
> case instead?
>
> Kind regards
> Valerij Timofeev
>
> 2016-07-15 17:03 GMT+02:00 Valerij Timofeev <valerij.timofeev at gmail.com>:
>
>> I've figred out exact condition when descibed scenario fails for us:
>>
>> 1) it does not work in combination with our legacy web application (built
>> on RH/JBoss Seam 2)
>> 2) but it works in Keycloak 1.9.4 properly too if a user logins in into
>> the Account web application and then starts password reset process
>>
>> Are there any known general issues with Seam 2 or JSF web applications
>> protected by Keycloak?
>>
>> 2016-07-15 15:17 GMT+02:00 Valerij Timofeev <valerij.timofeev at gmail.com>:
>>
>>> I've just quickly tested in RH SSO 7.0: it works!
>>> The only thing we have to do now is to test thoroughly and roll out it
>>> in production :-)
>>>
>>> Thank you very much for your quick assistance!
>>>
>>> 2016-07-15 13:15 GMT+02:00 Stian Thorgersen <sthorger at redhat.com>:
>>>
>>>> I tested with 2.0.0.Final though. Please check with 1.9.8.Final or RH
>>>> SSO 7.0. I believe there was some fixes around this at some point in 1.9.x.
>>>>
>>>> On 15 July 2016 at 13:14, Stian Thorgersen <sthorger at redhat.com> wrote:
>>>>
>>>>> Just checked and I'm not able to reproduce this issue.
>>>>>
>>>>> I clicked on reset password in one browser, copied the link and opened
>>>>> it in a new incognito session. Worked just fine.
>>>>>
>>>>> On 15 July 2016 at 12:22, Valerij Timofeev <valerij.timofeev at gmail.com
>>>>> > wrote:
>>>>>
>>>>>> Hi,
>>>>>>
>>>>>> our customers are experiencing problems in situations where resetting
>>>>>> password is started in one web browser and accomplished in another one.
>>>>>> This scenario occurs if a user surfs with one kind of web browser,
>>>>>> but an email application opens password reset link in another one.
>>>>>>
>>>>>> I suppose that the root cause is the same like the documented in
>>>>>> KEYCLOAK-1014 one.
>>>>>>
>>>>>> We run Keycloak 1.9.4 standalone servers in our production at the
>>>>>> moment, but already started to roll out RH SSO 7.0 in other stages. So a
>>>>>> bug fix should be scheduled for this version as well.
>>>>>>
>>>>>> Kind regards
>>>>>> Valerij Timofeev
>>>>>>
>>>>>>
>>>>>> _______________________________________________
>>>>>> keycloak-user mailing list
>>>>>> keycloak-user at lists.jboss.org
>>>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>>>>
>>>>>
>>>>>
>>>>
>>>
>>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160719/8c788cc8/attachment-0001.html 

From adrianmatei at gmail.com  Tue Jul 19 04:20:58 2016
From: adrianmatei at gmail.com (Adrian Matei)
Date: Tue, 19 Jul 2016 10:20:58 +0200
Subject: [keycloak-user] Two way communication required between Keycloak
 Server and REST API BAckend Server?
In-Reply-To: <CAJgngAdhNkFGvt2MbrDk_m1h4-ZpM6yRwxm_2mXr_RW0h6WnHA@mail.gmail.com>
References: <CAG=THF2A4HDUHv8stWmZEEgpt=1-m+G-kRNL296YXBRfgtCPZQ@mail.gmail.com>
	<CAJgngAdhNkFGvt2MbrDk_m1h4-ZpM6yRwxm_2mXr_RW0h6WnHA@mail.gmail.com>
Message-ID: <CAG=THF1g4FEio6ssqdPuwb58OnF_9YOt+okE7K=yQGZ1KykiXw@mail.gmail.com>

Hi Stian,

Thank you for the confirmation.

Kind regards,
Adrian


On Tue, Jul 19, 2016 at 8:45 AM, Stian Thorgersen <sthorger at redhat.com>
wrote:

> The REST service doesn't need to communicate directly with Keycloak. The
> auth-server-url is required by a bearer only token mainly to verify the
> issuer in the token (it's the full url of the realm, not just the realm
> name).
>
> On 15 July 2016 at 16:34, Adrian Matei <adrianmatei at gmail.com> wrote:
>
>> Hi everyone,
>>
>> Does a Keycloak secured REST Api on JBoss EAP 6.1 (access-type bearer
>> only) need to communicate with the Keycloak Server once the Adapter and
>> standalone.xml are properly configured?
>>
>> Currently both servers are on the same DMZ zone, but we'd like to move
>> the REST Api Server in Intranet zone.
>>
>> (test - the REST backend seems to be callable as long as the token is
>> valid, though the Keycloak Server was shutdown, but I ask myself why do I
>> need to specify the auth-server-url in standalone.xml, or keycloak.json
>> file)
>>
>>
>> Thanks
>> Adrian
>>
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160719/1e4c7a4d/attachment.html 

From Priya.Manavalan at jhuapl.edu  Tue Jul 19 10:22:00 2016
From: Priya.Manavalan at jhuapl.edu (Manavalan, Priya J.)
Date: Tue, 19 Jul 2016 14:22:00 +0000
Subject: [keycloak-user] Group names are not unique
Message-ID: <D3B3AFC6.E0E4%Priya.Manavalan@jhuapl.edu>


Group names don't seem to be unique . Based on the admin API in the link below this call should update if the group exists and create otherwise. This does not seem to be the behavior.  It creates a new group with a different id. Is there a way to enforce unique group names?

create or add a top level realm groupSet or create child.<http://www.keycloak.org/docs/rest-api/index.html#_create_or_add_a_top_level_realm_groupset_or_create_child>



-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160719/84491afa/attachment.html 

From valerij.timofeev at gmail.com  Tue Jul 19 11:24:32 2016
From: valerij.timofeev at gmail.com (Valerij Timofeev)
Date: Tue, 19 Jul 2016 17:24:32 +0200
Subject: [keycloak-user] KEYCLOAK-1014 Reset password leads to 400 Bad
 Request - still unresolved?
In-Reply-To: <CAJgngAf2v3tN5aJaKeBBFxiyngFVo24apZ_XDfg6LVEbO_7CUg@mail.gmail.com>
References: <CAOy2obGavjXW_LXqOi47x8joZkUEz-oLF2gwe0a1w_TKUkh41A@mail.gmail.com>
	<CAJgngAf7WGsk1kDiW7y+7DkNh2TBXN3aVt3fNKtLNu_uqkkaqA@mail.gmail.com>
	<CAJgngAf2OLZoSA5UErLruHsEAVD34gBa1bVTSvRx-OOkiROriQ@mail.gmail.com>
	<CAOy2obFXj8v=EfCPH87xTHzGptnZinH2E1mMXS8Rnu5VA-PLoQ@mail.gmail.com>
	<CAOy2obEsEsi2Uea7jyVS+4eqdLw6bTz-FECgwk-hquWLskumNw@mail.gmail.com>
	<CAOy2obGhbKmsWNFd2mmW9vp=VcuLLTV1Jnc5BOrpub3qptvYMg@mail.gmail.com>
	<CAJgngAf2v3tN5aJaKeBBFxiyngFVo24apZ_XDfg6LVEbO_7CUg@mail.gmail.com>
Message-ID: <CAOy2obE7dFeNceRg7VNkZ2n-WjnXoFNdsKmyAJwSjtpfBS+Vig@mail.gmail.com>

Thanks Stian!

2016-07-19 9:10 GMT+02:00 Stian Thorgersen <sthorger at redhat.com>:

> Confirmed the issue. See https://issues.jboss.org/browse/KEYCLOAK-3331.
>
> We'll make sure this is included in RH SSO 7.0.1.
>
> On 18 July 2016 at 15:55, Valerij Timofeev <valerij.timofeev at gmail.com>
> wrote:
>
>> Hi,
>>
>> I was able to reproduce the problem in RH SSO 7.0 (rh-sso theme) in my
>> development environment with a pure CDI web application running on another
>> application server (EAP 6) in another web domain.
>>
>> Error on the page: JBWEB000065: HTTP Status 400
>> Warning in server.log: 14:04:42,979 WARN
>> [org.keycloak.adapters.OAuthRequestAuthenticator] (ajp-/0.0.0.0:8009-5)
>> No state cookie
>>
>> Navigating to a protected resource (after the error occurs) loads
>> expected web application page: this means that the user is already logged
>> in.
>>
>> The test web applicationhas been generated in Eclipse using maven *jboss-javaee6-webapp-ear-blank--archetaype
>> 7.1.3 Final* archetype.
>>
>> Have anybody tested KEYCLOAK-1014 issue in similar setup?
>>
>> 1) protected web application is running on another application server
>> than Keyclok and another web domain (Apache, mod_jk)
>> 2) RH SSO 7 is configured in root context (no /auth context)
>>
>> Should we continue this dicussion here or should I submit a RH support
>> case instead?
>>
>> Kind regards
>> Valerij Timofeev
>>
>> 2016-07-15 17:03 GMT+02:00 Valerij Timofeev <valerij.timofeev at gmail.com>:
>>
>>> I've figred out exact condition when descibed scenario fails for us:
>>>
>>> 1) it does not work in combination with our legacy web application
>>> (built on RH/JBoss Seam 2)
>>> 2) but it works in Keycloak 1.9.4 properly too if a user logins in into
>>> the Account web application and then starts password reset process
>>>
>>> Are there any known general issues with Seam 2 or JSF web applications
>>> protected by Keycloak?
>>>
>>> 2016-07-15 15:17 GMT+02:00 Valerij Timofeev <valerij.timofeev at gmail.com>
>>> :
>>>
>>>> I've just quickly tested in RH SSO 7.0: it works!
>>>> The only thing we have to do now is to test thoroughly and roll out it
>>>> in production :-)
>>>>
>>>> Thank you very much for your quick assistance!
>>>>
>>>> 2016-07-15 13:15 GMT+02:00 Stian Thorgersen <sthorger at redhat.com>:
>>>>
>>>>> I tested with 2.0.0.Final though. Please check with 1.9.8.Final or RH
>>>>> SSO 7.0. I believe there was some fixes around this at some point in 1.9.x.
>>>>>
>>>>> On 15 July 2016 at 13:14, Stian Thorgersen <sthorger at redhat.com>
>>>>> wrote:
>>>>>
>>>>>> Just checked and I'm not able to reproduce this issue.
>>>>>>
>>>>>> I clicked on reset password in one browser, copied the link and
>>>>>> opened it in a new incognito session. Worked just fine.
>>>>>>
>>>>>> On 15 July 2016 at 12:22, Valerij Timofeev <
>>>>>> valerij.timofeev at gmail.com> wrote:
>>>>>>
>>>>>>> Hi,
>>>>>>>
>>>>>>> our customers are experiencing problems in situations where
>>>>>>> resetting password is started in one web browser and accomplished in
>>>>>>> another one.
>>>>>>> This scenario occurs if a user surfs with one kind of web browser,
>>>>>>> but an email application opens password reset link in another one.
>>>>>>>
>>>>>>> I suppose that the root cause is the same like the documented in
>>>>>>> KEYCLOAK-1014 one.
>>>>>>>
>>>>>>> We run Keycloak 1.9.4 standalone servers in our production at the
>>>>>>> moment, but already started to roll out RH SSO 7.0 in other stages. So a
>>>>>>> bug fix should be scheduled for this version as well.
>>>>>>>
>>>>>>> Kind regards
>>>>>>> Valerij Timofeev
>>>>>>>
>>>>>>>
>>>>>>> _______________________________________________
>>>>>>> keycloak-user mailing list
>>>>>>> keycloak-user at lists.jboss.org
>>>>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>>>>>
>>>>>>
>>>>>>
>>>>>
>>>>
>>>
>>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160719/3687588a/attachment.html 

From valerij.timofeev at gmail.com  Tue Jul 19 12:07:41 2016
From: valerij.timofeev at gmail.com (Valerij Timofeev)
Date: Tue, 19 Jul 2016 18:07:41 +0200
Subject: [keycloak-user] KEYCLOAK-3202 Creating users causes memory leak
In-Reply-To: <CAJgngAe0ksJBC1NYpm5Yj_oPVgma7Uarac_50621pyihdFEkng@mail.gmail.com>
References: <CAOy2obEVCKZhK6tLLhs8RQRs4ScUCgKfWTPjhn0N9Nmy2+yQpA@mail.gmail.com>
	<CAJgngAdQQ01OfgcHHw9Ati2-SDYU6WZbq0M1zN=hQBXWg-4qJQ@mail.gmail.com>
	<CAOy2obE_nBrnSA1DeCsnZenRAOgM+pJ8VR_xU12kuUK51OxAVg@mail.gmail.com>
	<CAJgngAc11BoOFi17SjV9iripau9DDNMF3HktrLNrhqFDqDvoTg@mail.gmail.com>
	<CAOy2obHzUtaPD1tZbZ2Bnr+D-+5qTXMVS-OpGo3wV7CZ9k5-dw@mail.gmail.com>
	<CAJgngAe0ksJBC1NYpm5Yj_oPVgma7Uarac_50621pyihdFEkng@mail.gmail.com>
Message-ID: <CAOy2obFCqCavVx1tn=B8gGcR1++uFaTL4Ks5sb8GWQHVRDAgRA@mail.gmail.com>

It looks like our SSO logout problem has been resolved: there are no errors
since our last release day on the 14th of July.
We had to restart the servers at least every 2 days.

Here recap of the rolled out measures:
- logout method changed to *((HttpServletRequest)
FacesContext.getCurrentInstance().getExternalContext().getRequest()).logout();*
- added eviction policy to the realmVersions cache
We don't know which of them was the actual solution for our problem, but
the current number of entries equals 10000 (=eviction policy) on both nodes




2016-07-13 7:01 GMT+02:00 Stian Thorgersen <sthorger at redhat.com>:

>
>
> On 12 July 2016 at 17:16, Valerij Timofeev <valerij.timofeev at gmail.com>
> wrote:
>
>> Hi Stian,
>>
>> >> adding an eviction policy to the realmVersions cache.
>> > There's a bit more to it as we're now adding the caches internally +
>> managing the size of them. This to hide it from users as they shouldn't
>> really be configurable.
>>
>> Thank you for the explanation.
>> We apply the eviction policy in production environment tomorrow morning.
>> We have changed additionally number of owners to 2 for distributable
>> caches in our configuration. Would it make sense to set default to this
>> value in standalone-ha.xml same like for the web or ejb caches in the
>> future versions of Keycloak?
>>
>
> We've decided to stick with owners set to 1 by default. It's better for
> performance and in most cases sufficient as users can just re-authenticate
> if a session is lost.
>
>
>>
>>
>> > Are you redirecting the user to the logout endpoint or just calling it?
>>
>> Yes, we are redirecting explicit to the logout endpoint. But on Thursday
>> we will roll out a new version of our web aplication, which will simply
>> call ServletRequest.logout()
>> Additionally we will log more information in case of exceptions during
>> logout.
>>
>> > It could also be that the session is no longer valid when you are
>> invoking the logout. Sessions expires on the Keycloak server and are
>> removed when they are expired so could be that the session you are trying
>> to logout no longer exist on the server and that causes the bad behavior.
>> You can try to emulate that in the test environment by changing the max
>> life for a session in the admin console.
>>
>> I've simulated such situation in combination with ServletRequest.logout()
>> call:
>>
>> Keycloak adapter logs an error:
>>
>> 16:55:53,548 ERROR
>> [org.keycloak.adapters.RefreshableKeycloakSecurityContext]
>> (ajp-/0.0.0.0:8009-4)  Refresh token failure status: 400
>> {"error_description":"Refresh token expired","error":"invalid_grant"}
>>
>> Keycloak server logs a warning:
>>
>> 2016-07-12 16:55:53,536 WARN  [org.keycloak.events] (default task-11)
>> type=REFRESH_TOKEN_ERROR, realmId=myTS-DEV, clientId=myts-b2c, userId=null,
>> ipAddress=10.10.10.20, error=invalid_token, grant_type=refresh_token,
>> client_auth_method=client-secret
>>
>> User is redirected as expected to login screen. So I'd say that the
>> behavior is correct.
>>
>> As already mentioned we will roll out some changes this week. I will
>> inform you about the effect of the measures next week.
>>
>> Thank you for your assistance!
>>
>>
>> 2016-07-11 12:08 GMT+02:00 Stian Thorgersen <sthorger at redhat.com>:
>>
>>>
>>>
>>> On 11 July 2016 at 11:08, Valerij Timofeev <valerij.timofeev at gmail.com>
>>> wrote:
>>>
>>>> Thank you for the prompt response Stian.
>>>>
>>>> > adding an eviction policy to the realmVersions cache.
>>>>
>>>> This was my impression after reading the ticket too, but I was not
>>>> sure, because according pull request looks a little bit more complicated.
>>>> We will give a try to this Keycloak setting in the production
>>>> environment tomorrow.
>>>> We are going to enable Infinispan statistics additionally to get more
>>>> information.
>>>>
>>>
>>> There's a bit more to it as we're now adding the caches internally +
>>> managing the size of them. This to hide it from users as they shouldn't
>>> really be configurable.
>>>
>>>
>>>>
>>>> > Is there any errors in the logs?
>>>>
>>>> We could identify only errors duiring the service logout until now:
>>>>
>>>> Stack Trace:
>>>>
>>>> org.keycloak.adapters.ServerRequest.error(ServerRequest.java:228)
>>>>
>>>> org.keycloak.adapters.ServerRequest.invokeLogout(ServerRequest.java:82)
>>>>
>>>> com.nhp.ts.b2b.services.auth.KcAdminServiceBean.serviceAccountLogout(KcAdminServiceBean.java:330)
>>>>
>>>> com.nhp.ts.b2b.services.auth.KcAdminServiceBean.executeAPIpostMethod(KcAdminServiceBean.java:545)
>>>>
>>>> sun.reflect.GeneratedMethodAccessor10512.invoke(Unknown Source)
>>>>
>>>> ...
>>>>
>>>> > What is the status code returned with the empty page?
>>>>
>>>> Our web application unfortunately does not log status code and error
>>>> message. Exception message is null in case of service account logout. We
>>>> will roll out a fix for this with the next web application release on
>>>> Thursday this week.
>>>>
>>>> Additionally we are going to switch from the OIDC logout endpint method
>>>> to the ServletRequest.logout() method because it seems to be a more
>>>> consistent way for a web application which is already protected by Keycloak
>>>> EAP 6 adapters, isn't it?
>>>>
>>>
>>> Are you redirecting the user to the logout endpoint or just calling it?
>>>
>>> ServletRequest.logout()  redirects to the logout endpoint which will
>>> invalidate the SSO session, then it redirects back to the application and
>>> the http session is removed. It's certainly simpler to use this directly as
>>> it takes care of everything.
>>>
>>>
>>>>
>>>> Additional details about the experienced behaviour: the empty page is
>>>> our web application internal page. In Google Chrome webbrowser I see for
>>>> example that the initiator of the last POST request to this internal page
>>>> was www.googletagmanager.com/gtm.js?id=... Could be this a problem?
>>>> If I refresh this empty page, I'm back in the web application (still
>>>> logged in).
>>>> But if I call OCID logout endpoint
>>>> (/realms/${realm}/protocol/openid-connect/logout) in the same browser
>>>> myself  and then refresh the empty page, then I'm redirected to the KC
>>>> login screen.
>>>>
>>>> Any ideas?
>>>>
>>>
>>> It could also be that the session is no longer valid when you are
>>> invoking the logout. Sessions expires on the Keycloak server and are
>>> removed when they are expired so could be that the session you are trying
>>> to logout no longer exist on the server and that causes the bad behavior.
>>> You can try to emulate that in the test environment by changing the max
>>> life for a session in the admin console.
>>>
>>>
>>>>
>>>> Apart from that I hope that we will get more information after the
>>>> release on Thursday.
>>>>
>>>>
>>>> 2016-07-11 7:37 GMT+02:00 Stian Thorgersen <sthorger at redhat.com>:
>>>>
>>>>> Hi,
>>>>>
>>>>> You can relatively easily try though by adding an eviction policy to
>>>>> the realmVersions cache. I found that with roughly a million users there
>>>>> would be around 500Mb of memory consumed, which will run you into issues
>>>>> with the default settings if you have that many users login over a space of
>>>>> a day and a half.
>>>>>
>>>>> Empty page could be due to timeout. Is there any errors in the logs?
>>>>> What is the status code returned with the empty page?
>>>>>
>>>>> On 8 July 2016 at 10:40, Valerij Timofeev <valerij.timofeev at gmail.com>
>>>>> wrote:
>>>>>
>>>>>> Hi Stian,
>>>>>>
>>>>>> You are the assignee in KEYCLOAK-3202
>>>>>> <https://issues.jboss.org/browse/KEYCLOAK-3202>, so I addressed this
>>>>>> email to you directly.
>>>>>>
>>>>>> I guess that this issue could be the cause of trouble in our
>>>>>> production environment.
>>>>>>
>>>>>> There are 4 EAP-6 nodes with Keycloak adapters and 2 Keycloak 1.9.4
>>>>>> standalone servers running in 2 clusters respectively.
>>>>>>
>>>>>> We experience logout failures approximately after one and a half days
>>>>>> of operation.
>>>>>> Restarting EAP 6 nodes temporary resolves the logout problem.
>>>>>>
>>>>>> Durable load tests in out test environment showed that login and
>>>>>> logout of existing users don't result in above behaviour.
>>>>>> We added to the durable load test additional scenario creating new
>>>>>> users and were able to reproduce logout failure: users are getting empty
>>>>>> page and not the login screen as expected. Page reload navigates back into
>>>>>> the protected web application .
>>>>>>
>>>>>> Logout is accomplished in a Java web applictaion by calling OIDC
>>>>>> logout endpoint:
>>>>>>
>>>>>>
>>>>>>
>>>>>>
>>>>>>
>>>>>> *FacesContext                .getCurrentInstance()
>>>>>> .getExternalContext()
>>>>>> .redirect(keycloakDeployment.getLogoutUrl().queryParam("redirect_uri",
>>>>>> redirectURL).toTemplate());*
>>>>>>
>>>>>> Logout is initiated via h:commandLink, so I suppose that the OIDC
>>>>>> logout endpoint is called via the GET method. Should we use the POST method
>>>>>> instead?
>>>>>>
>>>>>> Has servlet logout any advantages?
>>>>>>
>>>>>>
>>>>>>
>>>>>> *((HttpServletRequest)
>>>>>> FacesContext.getCurrentInstance().getExternalContext().getRequest()).logout();*
>>>>>> I'd appreciate quick response*, *because restarting production EAP
>>>>>> cluster every day is not a pleasant option ;-)
>>>>>>
>>>>>> Thank you in advance
>>>>>>
>>>>>> Kind regards
>>>>>> Valerij Timofeev
>>>>>>
>>>>>
>>>>>
>>>>
>>>
>>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160719/82b4bcc0/attachment-0001.html 

From rllavallee at hotmail.com  Tue Jul 19 15:05:57 2016
From: rllavallee at hotmail.com (Richard Lavallee)
Date: Tue, 19 Jul 2016 19:05:57 +0000
Subject: [keycloak-user] Password algorithm into Keycloak
Message-ID: <BLU181-W22C547964D2C47143307F6CB370@phx.gbl>

Is it feasible to import username and hashed-password strings to Keycloak in one batch?  Must I migrate the bcrypt algorithm we use along with it onto Keycloak somehow?   Looking for guidance/documentation for doing such please.
-Richard
 		 	   		  
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160719/606de359/attachment.html 

From sthorger at redhat.com  Wed Jul 20 02:09:49 2016
From: sthorger at redhat.com (Stian Thorgersen)
Date: Wed, 20 Jul 2016 08:09:49 +0200
Subject: [keycloak-user] Password algorithm into Keycloak
In-Reply-To: <BLU181-W22C547964D2C47143307F6CB370@phx.gbl>
References: <BLU181-W22C547964D2C47143307F6CB370@phx.gbl>
Message-ID: <CAJgngAd7nF+jJv1o_YpL16=6wHMUWwzQBiQ0GM_QtxiSJs=Oiw@mail.gmail.com>

You can import users via the rest API or import from JSON. For import from
JSON you have to options either partial import in the admin console or
import at startup [1].

In either case you have to implement a bcrypt password hashing provider.
There's no documentation for this yet, but you'd need to implement a
provider for PasswordHashProvider [2]. There's general docs for
implementing a custom provider though [3].

[1]
https://keycloak.gitbooks.io/server-adminstration-guide/content/topics/export-import.html
[2]
https://github.com/keycloak/keycloak/blob/master/server-spi/src/main/java/org/keycloak/hash/PasswordHashProvider.java
[3]
https://keycloak.gitbooks.io/server-developer-guide/content/topics/providers.html

On 19 July 2016 at 21:05, Richard Lavallee <rllavallee at hotmail.com> wrote:

> Is it feasible to import username and hashed-password strings to Keycloak
> in one batch?  Must I migrate the bcrypt algorithm we use along with it
> onto Keycloak somehow?   Looking for guidance/documentation for doing such
> please.
>
> -Richard
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160720/697622b2/attachment.html 

From pires at littlebits.cc  Wed Jul 20 05:52:54 2016
From: pires at littlebits.cc (Paulo Pires)
Date: Wed, 20 Jul 2016 09:52:54 +0000
Subject: [keycloak-user] How to migrate users and roles from in-house storage
Message-ID: <CAO8YOYXtZtJ2QPBM9G9QUyeZrTDWPBZ9HbtEg9GWtW+tFfCRaA@mail.gmail.com>

Hi all,

I'm in the process of migrating from an in-house user-role storage to
Keycloak and I'm looking for programmatic (Java) ways to migrate all
current users to the new storage. And I need your help to figure out the
best approach.

At first, when reading KC documentation, I believed I could easily achieve
this by implementing a User Federation provider but after diving a little
more into it, and looking for examples, I can't see a way to migrate all
users on-demand but simply one user at a time, possible during log-in.

Next, I tried and look into ways, such as admin-cli, REST, etc but nothing
strikes me as the solution to use.

Here's what I was hoping to deliver:
* Get all roles and users from my soon-to-be deprecated storage, e.g. MySQL
tables
* Add roles to KC
* Iterate users and add user to KC + map roles + update password hashes
(here I know I need to implement a HashProvider)

Any hints will be appreciated!

Pires
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160720/30b26e04/attachment.html 

From freez3 at me.com  Wed Jul 20 06:58:00 2016
From: freez3 at me.com (Tobias Schmidt)
Date: Wed, 20 Jul 2016 10:58:00 +0000 (GMT)
Subject: [keycloak-user] Some Keycloak Questions
Message-ID: <11525992-0f44-418f-b1e7-b07ad6471e8b@me.com>

Hi,
is there a solution for this issue??https://issues.jboss.org/browse/KEYCLOAK-3067
We trapped in exactly this problem by using Keycloak with too many realms, maybe we haven't understood how to use it in the right way. 
We have the need to have many Users with different grants per realm, we trying to have as many realms as possible and 20 realms per server instance will not work for us.
?
Is there a List or a statement, why we should not use the Wildfly overlay for our needs?
Found the statement on the website:?http://www.keycloak.org/downloads.html
"Overlay -?Server add-on for WildFly. Not recommended in production."
?
Thank you for your patience.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160720/4e66a8df/attachment.html 

From guybowdler at dorsetnetworks.com  Wed Jul 20 07:14:49 2016
From: guybowdler at dorsetnetworks.com (Guy Bowdler)
Date: Wed, 20 Jul 2016 11:14:49 +0000
Subject: [keycloak-user] Redirect Issue with keycloak behind proxy and
 app behind Keycloak security proxy
In-Reply-To: <729a3e21e420eb8d2bb61393fa58a702@dorsetnetworks.com>
References: <729a3e21e420eb8d2bb61393fa58a702@dorsetnetworks.com>
Message-ID: <45f65210aea29777b252c43934a45542@dorsetnetworks.com>

To close this issue off, we have fixed (worked around?) this.   Having 
established that trailing slashes in the config files cause different 
symptoms, we found that the URL without a trailing slash (ie 
host.domain.tld/sitename) downloaded the main document but relative URLs 
were not created correctly and missed out the "sitename".  Manually 
adding the trailing slash or setting a base tag in the site code worked 
around this but ultimately we fixed this using a rewrite rule in nginx 
(rewrite ^/sitename$ https://host.domain/tld/sitename/;).

This seemed to be just a symptom of having chained proxies and is 
nothing specific of the keycloak security proxy, or NGINX.

thanks to those that offered help.

kind regards

Guy



On 2016-06-22 12:22, Guy Bowdler wrote:
> hi all,
> 
> We have the following set up with two DMZ boxes, one running a single
> KeyCloak security proxy and sending requests to a local NGINX proxy
> which farms out requests to internal applications.  This should allow 
> us
> to maintain a single namespace for all applications (<hostname>/appname
> redirects to appname.local) and gives authenticated visibility of who's
> accessing what at the front end proxy.
> 
> 
>     DMZ: [KeyCloakSecProxy:80 ---> NGINX:8080]  ---> TRUST: [Various
> applications]
>                                                 ---> TRUST: [Various
> applications]
> 
> 
> 
> Keycloak runs on its own server and is published via an NGINX proxy in
> the DMZ
> 
> 
>     DMZ: [NGINX:80] ---> TRUST: [Keycloak:8080]
> 
> 
> So clients hit the KeyCloak security Proxy, are redirected to KeyCloak
> and then after logging in, we get an "invalid Redirect URI" error from
> Keycloak.   We've found that for some reason, the redirect URL from
> KeyCloak is appending the :8080 port value from the KeyCloak Security
> proxy (verified as if we change this port number, the value changes in
> the redirect URL).  It's like KeyCloak is redirecting back to the
> NGINX:8080 proxy direct rather than back to the KeyCloak security 
> proxy,
> which is what we were expecting.   This is possibly by design, or
> possibly a bug, or possibly a side effect of our configuration.
> 
> Has anyone tried using the KeyCloak security proxy in this manner?  
> It's
> clear that the intended use is as a single instance adapter for a 
> single
> local application, whereas our application happens to be an nginx proxy
> redirecting to different applications using location directives.
> 
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

From ssilvert at redhat.com  Wed Jul 20 07:17:07 2016
From: ssilvert at redhat.com (Stan Silvert)
Date: Wed, 20 Jul 2016 07:17:07 -0400
Subject: [keycloak-user] How to migrate users and roles from in-house
 storage
In-Reply-To: <CAO8YOYXtZtJ2QPBM9G9QUyeZrTDWPBZ9HbtEg9GWtW+tFfCRaA@mail.gmail.com>
References: <CAO8YOYXtZtJ2QPBM9G9QUyeZrTDWPBZ9HbtEg9GWtW+tFfCRaA@mail.gmail.com>
Message-ID: <578F5DB3.2050504@redhat.com>

If I understand, you want to do a mass migration all at once?  You could 
export to json in the format that Keycloak expects, then do an import.

On 7/20/2016 5:52 AM, Paulo Pires wrote:
> Hi all,
>
> I'm in the process of migrating from an in-house user-role storage to 
> Keycloak and I'm looking for programmatic (Java) ways to migrate all 
> current users to the new storage. And I need your help to figure out 
> the best approach.
>
> At first, when reading KC documentation, I believed I could easily 
> achieve this by implementing a User Federation provider but after 
> diving a little more into it, and looking for examples, I can't see a 
> way to migrate all users on-demand but simply one user at a time, 
> possible during log-in.
>
> Next, I tried and look into ways, such as admin-cli, REST, etc but 
> nothing strikes me as the solution to use.
>
> Here's what I was hoping to deliver:
> * Get all roles and users from my soon-to-be deprecated storage, e.g. 
> MySQL tables
> * Add roles to KC
> * Iterate users and add user to KC + map roles + update password 
> hashes (here I know I need to implement a HashProvider)
>
> Any hints will be appreciated!
>
> Pires
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160720/1ff79ac2/attachment.html 

From sthorger at redhat.com  Wed Jul 20 08:35:03 2016
From: sthorger at redhat.com (Stian Thorgersen)
Date: Wed, 20 Jul 2016 14:35:03 +0200
Subject: [keycloak-user] Some Keycloak Questions
In-Reply-To: <11525992-0f44-418f-b1e7-b07ad6471e8b@me.com>
References: <11525992-0f44-418f-b1e7-b07ad6471e8b@me.com>
Message-ID: <CAJgngAcao_shtggF25TVUvWoVkheb93u62iB8bNXU6H-5OdzJA@mail.gmail.com>

On 20 July 2016 at 12:58, Tobias Schmidt <freez3 at me.com> wrote:

> Hi,
>
> is there a solution for this issue?
> https://issues.jboss.org/browse/KEYCLOAK-3067
>
> We trapped in exactly this problem by using Keycloak with too many realms,
> maybe we haven't understood how to use it in the right way.
> We have the need to have many Users with different grants per realm, we
> trying to have as many realms as possible and 20 realms per server instance
> will not work for us.
>
 There's no short term solution planned for that issue. In the long term
we're getting rid of the master realm so this issue will go away. Keycloak
has not been designed for a large amount of realms though and we had
initially thought there would be only a handful realms per-server.

>
>
> Is there a List or a statement, why we should not use the Wildfly overlay
> for our needs?
> Found the statement on the website: http://www.keycloak.org/downloads.html
> "Overlay - Server add-on for WildFly. Not recommended in production."
>

There's 3 main reasons - a specific version of Keycloak is only tested to
with one specific version of WildFly so you may have issues when upgrading
in the future. Second reason is that your configurations and your
applications may conflict with Keycloak server's needs. Finally your IdP
should be isolated from your applications as this reduces the chance of
there being vulnerabilities.


>
>
> Thank you for your patience.
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160720/efc52174/attachment.html 

From sthorger at redhat.com  Wed Jul 20 08:56:33 2016
From: sthorger at redhat.com (Stian Thorgersen)
Date: Wed, 20 Jul 2016 14:56:33 +0200
Subject: [keycloak-user] How to migrate users and roles from in-house
	storage
In-Reply-To: <CAO8YOYXtZtJ2QPBM9G9QUyeZrTDWPBZ9HbtEg9GWtW+tFfCRaA@mail.gmail.com>
References: <CAO8YOYXtZtJ2QPBM9G9QUyeZrTDWPBZ9HbtEg9GWtW+tFfCRaA@mail.gmail.com>
Message-ID: <CAJgngAdBpQCuacX1Wc0vUXBwanYwSjNctSjdWcNO1JUhwjWJNw@mail.gmail.com>

Depending on the amount of users I'd use either partial import through the
admin console (if you don't have more than a thousand or so users) or use
the admin REST endpoints if you have quite a lot of users.

On 20 July 2016 at 11:52, Paulo Pires <pires at littlebits.cc> wrote:

> Hi all,
>
> I'm in the process of migrating from an in-house user-role storage to
> Keycloak and I'm looking for programmatic (Java) ways to migrate all
> current users to the new storage. And I need your help to figure out the
> best approach.
>
> At first, when reading KC documentation, I believed I could easily achieve
> this by implementing a User Federation provider but after diving a little
> more into it, and looking for examples, I can't see a way to migrate all
> users on-demand but simply one user at a time, possible during log-in.
>
> Next, I tried and look into ways, such as admin-cli, REST, etc but nothing
> strikes me as the solution to use.
>
> Here's what I was hoping to deliver:
> * Get all roles and users from my soon-to-be deprecated storage, e.g.
> MySQL tables
> * Add roles to KC
> * Iterate users and add user to KC + map roles + update password hashes
> (here I know I need to implement a HashProvider)
>
> Any hints will be appreciated!
>
> Pires
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160720/5367759c/attachment.html 

From pires at littlebits.cc  Wed Jul 20 09:33:07 2016
From: pires at littlebits.cc (Paulo Pires)
Date: Wed, 20 Jul 2016 09:33:07 -0400
Subject: [keycloak-user] How to migrate users and roles from in-house
	storage
In-Reply-To: <CAJgngAdBpQCuacX1Wc0vUXBwanYwSjNctSjdWcNO1JUhwjWJNw@mail.gmail.com>
References: <CAO8YOYXtZtJ2QPBM9G9QUyeZrTDWPBZ9HbtEg9GWtW+tFfCRaA@mail.gmail.com>
	<CAJgngAdBpQCuacX1Wc0vUXBwanYwSjNctSjdWcNO1JUhwjWJNw@mail.gmail.com>
Message-ID: <CAO8YOYW8d6XcLqWpfR31F12wxDoREq8Jvt4SNvQByz-0GsY+CA@mail.gmail.com>

More than 150k. Is there a Java library for the REST api?

On Jul 20, 2016 13:56, "Stian Thorgersen" <sthorger at redhat.com> wrote:

> Depending on the amount of users I'd use either partial import through the
> admin console (if you don't have more than a thousand or so users) or use
> the admin REST endpoints if you have quite a lot of users.
>
> On 20 July 2016 at 11:52, Paulo Pires <pires at littlebits.cc> wrote:
>
>> Hi all,
>>
>> I'm in the process of migrating from an in-house user-role storage to
>> Keycloak and I'm looking for programmatic (Java) ways to migrate all
>> current users to the new storage. And I need your help to figure out the
>> best approach.
>>
>> At first, when reading KC documentation, I believed I could easily
>> achieve this by implementing a User Federation provider but after diving a
>> little more into it, and looking for examples, I can't see a way to migrate
>> all users on-demand but simply one user at a time, possible during log-in.
>>
>> Next, I tried and look into ways, such as admin-cli, REST, etc but
>> nothing strikes me as the solution to use.
>>
>> Here's what I was hoping to deliver:
>> * Get all roles and users from my soon-to-be deprecated storage, e.g.
>> MySQL tables
>> * Add roles to KC
>> * Iterate users and add user to KC + map roles + update password hashes
>> (here I know I need to implement a HashProvider)
>>
>> Any hints will be appreciated!
>>
>> Pires
>>
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160720/59bfc1d8/attachment-0001.html 

From sthorger at redhat.com  Wed Jul 20 09:52:20 2016
From: sthorger at redhat.com (Stian Thorgersen)
Date: Wed, 20 Jul 2016 15:52:20 +0200
Subject: [keycloak-user] How to migrate users and roles from in-house
	storage
In-Reply-To: <CAO8YOYW8d6XcLqWpfR31F12wxDoREq8Jvt4SNvQByz-0GsY+CA@mail.gmail.com>
References: <CAO8YOYXtZtJ2QPBM9G9QUyeZrTDWPBZ9HbtEg9GWtW+tFfCRaA@mail.gmail.com>
	<CAJgngAdBpQCuacX1Wc0vUXBwanYwSjNctSjdWcNO1JUhwjWJNw@mail.gmail.com>
	<CAO8YOYW8d6XcLqWpfR31F12wxDoREq8Jvt4SNvQByz-0GsY+CA@mail.gmail.com>
Message-ID: <CAJgngAe8v8Xq22UfbqNRSv8bf6RJTJ_7K3e2SoS39fhEJ8o8qA@mail.gmail.com>

Yep, take a look at
https://keycloak.gitbooks.io/server-developer-guide/content/topics/admin-rest-api.html

On 20 July 2016 at 15:33, Paulo Pires <pires at littlebits.cc> wrote:

> More than 150k. Is there a Java library for the REST api?
>
> On Jul 20, 2016 13:56, "Stian Thorgersen" <sthorger at redhat.com> wrote:
>
>> Depending on the amount of users I'd use either partial import through
>> the admin console (if you don't have more than a thousand or so users) or
>> use the admin REST endpoints if you have quite a lot of users.
>>
>> On 20 July 2016 at 11:52, Paulo Pires <pires at littlebits.cc> wrote:
>>
>>> Hi all,
>>>
>>> I'm in the process of migrating from an in-house user-role storage to
>>> Keycloak and I'm looking for programmatic (Java) ways to migrate all
>>> current users to the new storage. And I need your help to figure out the
>>> best approach.
>>>
>>> At first, when reading KC documentation, I believed I could easily
>>> achieve this by implementing a User Federation provider but after diving a
>>> little more into it, and looking for examples, I can't see a way to migrate
>>> all users on-demand but simply one user at a time, possible during log-in.
>>>
>>> Next, I tried and look into ways, such as admin-cli, REST, etc but
>>> nothing strikes me as the solution to use.
>>>
>>> Here's what I was hoping to deliver:
>>> * Get all roles and users from my soon-to-be deprecated storage, e.g.
>>> MySQL tables
>>> * Add roles to KC
>>> * Iterate users and add user to KC + map roles + update password hashes
>>> (here I know I need to implement a HashProvider)
>>>
>>> Any hints will be appreciated!
>>>
>>> Pires
>>>
>>> _______________________________________________
>>> keycloak-user mailing list
>>> keycloak-user at lists.jboss.org
>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>
>>
>>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160720/e3528f93/attachment.html 

From pires at littlebits.cc  Wed Jul 20 13:01:13 2016
From: pires at littlebits.cc (Paulo Pires)
Date: Wed, 20 Jul 2016 17:01:13 +0000
Subject: [keycloak-user] How to migrate users and roles from in-house
	storage
In-Reply-To: <CAJgngAe8v8Xq22UfbqNRSv8bf6RJTJ_7K3e2SoS39fhEJ8o8qA@mail.gmail.com>
References: <CAO8YOYXtZtJ2QPBM9G9QUyeZrTDWPBZ9HbtEg9GWtW+tFfCRaA@mail.gmail.com>
	<CAJgngAdBpQCuacX1Wc0vUXBwanYwSjNctSjdWcNO1JUhwjWJNw@mail.gmail.com>
	<CAO8YOYW8d6XcLqWpfR31F12wxDoREq8Jvt4SNvQByz-0GsY+CA@mail.gmail.com>
	<CAJgngAe8v8Xq22UfbqNRSv8bf6RJTJ_7K3e2SoS39fhEJ8o8qA@mail.gmail.com>
Message-ID: <CAO8YOYVPMh4A1CSpoqqx2bAmYconxWPGN=VZ+JKa5=oTOEi=HA@mail.gmail.com>

I did check the admin-cli JAR but it's not clear how to add roles and
users, or if it's even implemented (I did check the REST API and there's
endpoints for that).

Thank you very much for clarifying,
Pires

On Wed, Jul 20, 2016 at 2:52 PM Stian Thorgersen <sthorger at redhat.com>
wrote:

> Yep, take a look at
> https://keycloak.gitbooks.io/server-developer-guide/content/topics/admin-rest-api.html
>
> On 20 July 2016 at 15:33, Paulo Pires <pires at littlebits.cc> wrote:
>
>> More than 150k. Is there a Java library for the REST api?
>>
>> On Jul 20, 2016 13:56, "Stian Thorgersen" <sthorger at redhat.com> wrote:
>>
>>> Depending on the amount of users I'd use either partial import through
>>> the admin console (if you don't have more than a thousand or so users) or
>>> use the admin REST endpoints if you have quite a lot of users.
>>>
>>> On 20 July 2016 at 11:52, Paulo Pires <pires at littlebits.cc> wrote:
>>>
>>>> Hi all,
>>>>
>>>> I'm in the process of migrating from an in-house user-role storage to
>>>> Keycloak and I'm looking for programmatic (Java) ways to migrate all
>>>> current users to the new storage. And I need your help to figure out the
>>>> best approach.
>>>>
>>>> At first, when reading KC documentation, I believed I could easily
>>>> achieve this by implementing a User Federation provider but after diving a
>>>> little more into it, and looking for examples, I can't see a way to migrate
>>>> all users on-demand but simply one user at a time, possible during log-in.
>>>>
>>>> Next, I tried and look into ways, such as admin-cli, REST, etc but
>>>> nothing strikes me as the solution to use.
>>>>
>>>> Here's what I was hoping to deliver:
>>>> * Get all roles and users from my soon-to-be deprecated storage, e.g.
>>>> MySQL tables
>>>> * Add roles to KC
>>>> * Iterate users and add user to KC + map roles + update password hashes
>>>> (here I know I need to implement a HashProvider)
>>>>
>>>> Any hints will be appreciated!
>>>>
>>>> Pires
>>>>
>>>> _______________________________________________
>>>> keycloak-user mailing list
>>>> keycloak-user at lists.jboss.org
>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>>
>>>
>>>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160720/3b280718/attachment.html 

From keith.dev at pobox.com  Wed Jul 20 14:41:06 2016
From: keith.dev at pobox.com (Keith Dev)
Date: Wed, 20 Jul 2016 18:41:06 +0000
Subject: [keycloak-user] Picketlink -> Keycloak
Message-ID: <CA+e59AEcfkvL3ns_BTLECRbSK_5TLkb-faNAL_Ur_HDq=3X3=A@mail.gmail.com>

I'm moving a web application with REST services from Picketlink to
Keycloak. This is a multi-tentant application (1k+ tenants) where single
user accounts can belong to multiple tenants. In Picketlink, this was
accomplished using Tiers. So there is a single realm, but one Tier per
tenant. Its not clear what the analog is in Keycloak.

We considered multiple realms, but both the number of tenants and the hard
requirement to allow a single user cross tenants seems to make this a
nonstarter.

The best idea we have so far is to have a single realm, but create
namespaced security artifacts: e.g. Tenant1.Admins. This is not ideal as we
were hoping for more separation between tenants. I did see this
<http://lists.jboss.org/pipermail/keycloak-dev/2013-July/000116.html> which
suggests that Picketlink Tiers equate to Resources, but its not clear how.
Certainly there does not seem to be any separation of security artifacts
within a Resource per se.

Advice?
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160720/46233a94/attachment.html 

From bburke at redhat.com  Wed Jul 20 15:16:04 2016
From: bburke at redhat.com (Bill Burke)
Date: Wed, 20 Jul 2016 15:16:04 -0400
Subject: [keycloak-user] Picketlink -> Keycloak
In-Reply-To: <CA+e59AEcfkvL3ns_BTLECRbSK_5TLkb-faNAL_Ur_HDq=3X3=A@mail.gmail.com>
References: <CA+e59AEcfkvL3ns_BTLECRbSK_5TLkb-faNAL_Ur_HDq=3X3=A@mail.gmail.com>
Message-ID: <24ce831a-e740-029b-bdca-8cbf3a382805@redhat.com>

Define "tenant" and what it accomplishes and how you are using tiers to 
implement this functionality and I might be able to help.


On 7/20/16 2:41 PM, Keith Dev wrote:
> I'm moving a web application with REST services from Picketlink to 
> Keycloak. This is a multi-tentant application (1k+ tenants) where 
> single user accounts can belong to multiple tenants. In Picketlink, 
> this was accomplished using Tiers. So there is a single realm, but one 
> Tier per tenant. Its not clear what the analog is in Keycloak.
>
> We considered multiple realms, but both the number of tenants and the 
> hard requirement to allow a single user cross tenants seems to make 
> this a nonstarter.
>
> The best idea we have so far is to have a single realm, but create 
> namespaced security artifacts: e.g. Tenant1.Admins. This is not ideal 
> as we were hoping for more separation between tenants. I did see this 
> <http://lists.jboss.org/pipermail/keycloak-dev/2013-July/000116.html> which 
> suggests that Picketlink Tiers equate to Resources, but its not clear 
> how. Certainly there does not seem to be any separation of security 
> artifacts within a Resource per se.
>
> Advice?
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160720/af2d9d73/attachment.html 

From keith.dev at pobox.com  Wed Jul 20 15:44:25 2016
From: keith.dev at pobox.com (Keith Dev)
Date: Wed, 20 Jul 2016 19:44:25 +0000
Subject: [keycloak-user] Picketlink -> Keycloak
In-Reply-To: <24ce831a-e740-029b-bdca-8cbf3a382805@redhat.com>
References: <CA+e59AEcfkvL3ns_BTLECRbSK_5TLkb-faNAL_Ur_HDq=3X3=A@mail.gmail.com>
	<24ce831a-e740-029b-bdca-8cbf3a382805@redhat.com>
Message-ID: <CA+e59AEJ8BMEL4kOrmzJyLLj=q1xcyR+gTGD8bXymdi3SfKHhw@mail.gmail.com>

Consider an independent contractor (user) that works for two companies
(tenant) on different projects (resource). Control of the project belongs
to the company, not the contractor, so the security artifacts (resources,
groups, roles) belong with the company. But we want to provide a user
interface to the contractor where they do not have to manage multiple
accounts.

Tiers in picketlink allow for each tenant to have their own set of groups
and roles (though they have duplicate meanings for each).

I'm open to any solutions, including revisiting one realm per tenant
(though I have some concerns
<https://issues.jboss.org/browse/KEYCLOAK-3067> about
whether or not keycloak is meant to support 1k+ realms).

Is that sufficient explanation?

Thanks, Keith

On Wed, Jul 20, 2016 at 2:18 PM Bill Burke <bburke at redhat.com> wrote:

> Define "tenant" and what it accomplishes and how you are using tiers to
> implement this functionality and I might be able to help.
>
> On 7/20/16 2:41 PM, Keith Dev wrote:
>
> I'm moving a web application with REST services from Picketlink to
> Keycloak. This is a multi-tentant application (1k+ tenants) where single
> user accounts can belong to multiple tenants. In Picketlink, this was
> accomplished using Tiers. So there is a single realm, but one Tier per
> tenant. Its not clear what the analog is in Keycloak.
>
> We considered multiple realms, but both the number of tenants and the hard
> requirement to allow a single user cross tenants seems to make this a
> nonstarter.
>
> The best idea we have so far is to have a single realm, but create
> namespaced security artifacts: e.g. Tenant1.Admins. This is not ideal as we
> were hoping for more separation between tenants. I did see this
> <http://lists.jboss.org/pipermail/keycloak-dev/2013-July/000116.html> which
> suggests that Picketlink Tiers equate to Resources, but its not clear how.
> Certainly there does not seem to be any separation of security artifacts
> within a Resource per se.
>
> Advice?
>
>
> _______________________________________________
> keycloak-user mailing listkeycloak-user at lists.jboss.orghttps://lists.jboss.org/mailman/listinfo/keycloak-user
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160720/6777e42c/attachment-0001.html 

From bruno at abstractj.org  Wed Jul 20 16:30:18 2016
From: bruno at abstractj.org (Bruno Oliveira)
Date: Wed, 20 Jul 2016 17:30:18 -0300
Subject: [keycloak-user] How to migrate users and roles from in-house
 storage
In-Reply-To: <CAO8YOYVPMh4A1CSpoqqx2bAmYconxWPGN=VZ+JKa5=oTOEi=HA@mail.gmail.com>
References: <CAO8YOYXtZtJ2QPBM9G9QUyeZrTDWPBZ9HbtEg9GWtW+tFfCRaA@mail.gmail.com>
	<CAJgngAdBpQCuacX1Wc0vUXBwanYwSjNctSjdWcNO1JUhwjWJNw@mail.gmail.com>
	<CAO8YOYW8d6XcLqWpfR31F12wxDoREq8Jvt4SNvQByz-0GsY+CA@mail.gmail.com>
	<CAJgngAe8v8Xq22UfbqNRSv8bf6RJTJ_7K3e2SoS39fhEJ8o8qA@mail.gmail.com>
	<CAO8YOYVPMh4A1CSpoqqx2bAmYconxWPGN=VZ+JKa5=oTOEi=HA@mail.gmail.com>
Message-ID: <20160720203018.GA8462@abstractj.org>

Note sure if it helps, but an example about how to do it
programatically is here[1].

I just adapted from the admin-client[2].


[1] - https://gist.github.com/abstractj/78b127e8c9273cdcea6eb82a1cfc153c
[2] - https://github.com/keycloak/keycloak/tree/master/examples/admin-client

On 2016-07-20, Paulo Pires wrote:
> I did check the admin-cli JAR but it's not clear how to add roles and
> users, or if it's even implemented (I did check the REST API and there's
> endpoints for that).
>
> Thank you very much for clarifying,
> Pires
>
> On Wed, Jul 20, 2016 at 2:52 PM Stian Thorgersen <sthorger at redhat.com>
> wrote:
>
> > Yep, take a look at
> > https://keycloak.gitbooks.io/server-developer-guide/content/topics/admin-rest-api.html
> >
> > On 20 July 2016 at 15:33, Paulo Pires <pires at littlebits.cc> wrote:
> >
> >> More than 150k. Is there a Java library for the REST api?
> >>
> >> On Jul 20, 2016 13:56, "Stian Thorgersen" <sthorger at redhat.com> wrote:
> >>
> >>> Depending on the amount of users I'd use either partial import through
> >>> the admin console (if you don't have more than a thousand or so users) or
> >>> use the admin REST endpoints if you have quite a lot of users.
> >>>
> >>> On 20 July 2016 at 11:52, Paulo Pires <pires at littlebits.cc> wrote:
> >>>
> >>>> Hi all,
> >>>>
> >>>> I'm in the process of migrating from an in-house user-role storage to
> >>>> Keycloak and I'm looking for programmatic (Java) ways to migrate all
> >>>> current users to the new storage. And I need your help to figure out the
> >>>> best approach.
> >>>>
> >>>> At first, when reading KC documentation, I believed I could easily
> >>>> achieve this by implementing a User Federation provider but after diving a
> >>>> little more into it, and looking for examples, I can't see a way to migrate
> >>>> all users on-demand but simply one user at a time, possible during log-in.
> >>>>
> >>>> Next, I tried and look into ways, such as admin-cli, REST, etc but
> >>>> nothing strikes me as the solution to use.
> >>>>
> >>>> Here's what I was hoping to deliver:
> >>>> * Get all roles and users from my soon-to-be deprecated storage, e.g.
> >>>> MySQL tables
> >>>> * Add roles to KC
> >>>> * Iterate users and add user to KC + map roles + update password hashes
> >>>> (here I know I need to implement a HashProvider)
> >>>>
> >>>> Any hints will be appreciated!
> >>>>
> >>>> Pires
> >>>>
> >>>> _______________________________________________
> >>>> keycloak-user mailing list
> >>>> keycloak-user at lists.jboss.org
> >>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
> >>>>
> >>>
> >>>
> >

> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user


--

abstractj
PGP: 0x84DC9914

From bburke at redhat.com  Wed Jul 20 17:23:44 2016
From: bburke at redhat.com (Bill Burke)
Date: Wed, 20 Jul 2016 17:23:44 -0400
Subject: [keycloak-user] Picketlink -> Keycloak
In-Reply-To: <CA+e59AEJ8BMEL4kOrmzJyLLj=q1xcyR+gTGD8bXymdi3SfKHhw@mail.gmail.com>
References: <CA+e59AEcfkvL3ns_BTLECRbSK_5TLkb-faNAL_Ur_HDq=3X3=A@mail.gmail.com>
	<24ce831a-e740-029b-bdca-8cbf3a382805@redhat.com>
	<CA+e59AEJ8BMEL4kOrmzJyLLj=q1xcyR+gTGD8bXymdi3SfKHhw@mail.gmail.com>
Message-ID: <2ed43d48-f1e2-7914-1696-232dc42e3d1f@redhat.com>

Keycloak was written as an authentication server.  Its initial 
authorization features were quite limited to role-based apps.

One realm manages a set of users, roles, groups,and clients 
(applications).  There is a realm-level namespace for roles.  Each 
client has a role namespace.  Groups can be managed in a hierarchy and 
associated with roles.  Groups can have their own role mappings and 
attributes.  Users can join groups.  Users can be assigned roles.

Keycloak 2.0 has an Authorization feature where you can define Resources 
and access policies based on those resources.  Companies could each be a 
group.  Then I think you can say things like "If user belong to group A 
and role B he can access resource C".

Meh, doesn't really map well to your use case.  What we've found is that 
everybody has their own structure that is very different or slightly 
different than anyone else.

On 7/20/16 3:44 PM, Keith Dev wrote:
> Consider an independent contractor (user) that works for two companies 
> (tenant) on different projects (resource). Control of the project 
> belongs to the company, not the contractor, so the security artifacts 
> (resources, groups, roles) belong with the company. But we want to 
> provide a user interface to the contractor where they do not have to 
> manage multiple accounts.
>
> Tiers in picketlink allow for each tenant to have their own set of 
> groups and roles (though they have duplicate meanings for each).
>
> I'm open to any solutions, including revisiting one realm per tenant 
> (though I have some concerns 
> <https://issues.jboss.org/browse/KEYCLOAK-3067> about whether or not 
> keycloak is meant to support 1k+ realms).
>
> Is that sufficient explanation?
>
> Thanks, Keith
>
> On Wed, Jul 20, 2016 at 2:18 PM Bill Burke <bburke at redhat.com 
> <mailto:bburke at redhat.com>> wrote:
>
>     Define "tenant" and what it accomplishes and how you are using
>     tiers to implement this functionality and I might be able to help.
>
>
>     On 7/20/16 2:41 PM, Keith Dev wrote:
>>     I'm moving a web application with REST services from Picketlink
>>     to Keycloak. This is a multi-tentant application (1k+ tenants)
>>     where single user accounts can belong to multiple tenants. In
>>     Picketlink, this was accomplished using Tiers. So there is a
>>     single realm, but one Tier per tenant. Its not clear what the
>>     analog is in Keycloak.
>>
>>     We considered multiple realms, but both the number of tenants and
>>     the hard requirement to allow a single user cross tenants seems
>>     to make this a nonstarter.
>>
>>     The best idea we have so far is to have a single realm, but
>>     create namespaced security artifacts: e.g. Tenant1.Admins. This
>>     is not ideal as we were hoping for more separation between
>>     tenants. I did see this
>>     <http://lists.jboss.org/pipermail/keycloak-dev/2013-July/000116.html> which
>>     suggests that Picketlink Tiers equate to Resources, but its not
>>     clear how. Certainly there does not seem to be any separation of
>>     security artifacts within a Resource per se.
>>
>>     Advice?
>>
>>
>>     _______________________________________________
>>     keycloak-user mailing list
>>     keycloak-user at lists.jboss.org <mailto:keycloak-user at lists.jboss.org>
>>     https://lists.jboss.org/mailman/listinfo/keycloak-user
>
>     _______________________________________________
>     keycloak-user mailing list
>     keycloak-user at lists.jboss.org <mailto:keycloak-user at lists.jboss.org>
>     https://lists.jboss.org/mailman/listinfo/keycloak-user
>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160720/996828d1/attachment.html 

From keith.dev at pobox.com  Wed Jul 20 17:52:27 2016
From: keith.dev at pobox.com (Keith Dev)
Date: Wed, 20 Jul 2016 21:52:27 +0000
Subject: [keycloak-user] Picketlink -> Keycloak
In-Reply-To: <2ed43d48-f1e2-7914-1696-232dc42e3d1f@redhat.com>
References: <CA+e59AEcfkvL3ns_BTLECRbSK_5TLkb-faNAL_Ur_HDq=3X3=A@mail.gmail.com>
	<24ce831a-e740-029b-bdca-8cbf3a382805@redhat.com>
	<CA+e59AEJ8BMEL4kOrmzJyLLj=q1xcyR+gTGD8bXymdi3SfKHhw@mail.gmail.com>
	<2ed43d48-f1e2-7914-1696-232dc42e3d1f@redhat.com>
Message-ID: <CA+e59AGBxYNLBDE6NjJTDQujzzBDvivBJTDoeqtsqEZf4qXGAw@mail.gmail.com>

Yea - I've tried to swizzle things around to get something approaching what
we already have. Its not been straightforward, but I think with some
creative naming, we can get there.

Btw - regarding the Client Roles: I don't think you can't add one to a Role
Policy in Clients > ${client} > Authorization > Policies > Add Role Policy.
Only Realm Roles show up in the search/drop down for Roles.

Thanks, Keith

On Wed, Jul 20, 2016 at 4:23 PM Bill Burke <bburke at redhat.com> wrote:

> Keycloak was written as an authentication server.  Its initial
> authorization features were quite limited to role-based apps.
>
> One realm manages a set of users, roles, groups,and clients
> (applications).  There is a realm-level namespace for roles.  Each client
> has a role namespace.  Groups can be managed in a hierarchy and associated
> with roles.  Groups can have their own role mappings and attributes.  Users
> can join groups.  Users can be assigned roles.
>
> Keycloak 2.0 has an Authorization feature where you can define Resources
> and access policies based on those resources.  Companies could each be a
> group.  Then I think you can say things like "If user belong to group A and
> role B he can access resource C".
>
> Meh, doesn't really map well to your use case.  What we've found is that
> everybody has their own structure that is very different or slightly
> different than anyone else.
>
>
> On 7/20/16 3:44 PM, Keith Dev wrote:
>
> Consider an independent contractor (user) that works for two companies
> (tenant) on different projects (resource). Control of the project belongs
> to the company, not the contractor, so the security artifacts (resources,
> groups, roles) belong with the company. But we want to provide a user
> interface to the contractor where they do not have to manage multiple
> accounts.
>
> Tiers in picketlink allow for each tenant to have their own set of groups
> and roles (though they have duplicate meanings for each).
>
> I'm open to any solutions, including revisiting one realm per tenant
> (though I have some concerns
> <https://issues.jboss.org/browse/KEYCLOAK-3067> about whether or not
> keycloak is meant to support 1k+ realms).
>
> Is that sufficient explanation?
>
> Thanks, Keith
>
> On Wed, Jul 20, 2016 at 2:18 PM Bill Burke <bburke at redhat.com> wrote:
>
>> Define "tenant" and what it accomplishes and how you are using tiers to
>> implement this functionality and I might be able to help.
>>
>> On 7/20/16 2:41 PM, Keith Dev wrote:
>>
>> I'm moving a web application with REST services from Picketlink to
>> Keycloak. This is a multi-tentant application (1k+ tenants) where single
>> user accounts can belong to multiple tenants. In Picketlink, this was
>> accomplished using Tiers. So there is a single realm, but one Tier per
>> tenant. Its not clear what the analog is in Keycloak.
>>
>> We considered multiple realms, but both the number of tenants and the
>> hard requirement to allow a single user cross tenants seems to make this a
>> nonstarter.
>>
>> The best idea we have so far is to have a single realm, but create
>> namespaced security artifacts: e.g. Tenant1.Admins. This is not ideal as we
>> were hoping for more separation between tenants. I did see this
>> <http://lists.jboss.org/pipermail/keycloak-dev/2013-July/000116.html> which
>> suggests that Picketlink Tiers equate to Resources, but its not clear how.
>> Certainly there does not seem to be any separation of security artifacts
>> within a Resource per se.
>>
>> Advice?
>>
>>
>> _______________________________________________
>> keycloak-user mailing listkeycloak-user at lists.jboss.orghttps://lists.jboss.org/mailman/listinfo/keycloak-user
>>
>>
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160720/c2a7a0e8/attachment-0001.html 

From psilva at redhat.com  Wed Jul 20 19:18:27 2016
From: psilva at redhat.com (Pedro Igor Silva)
Date: Wed, 20 Jul 2016 19:18:27 -0400 (EDT)
Subject: [keycloak-user] Picketlink -> Keycloak
In-Reply-To: <CA+e59AGBxYNLBDE6NjJTDQujzzBDvivBJTDoeqtsqEZf4qXGAw@mail.gmail.com>
References: <CA+e59AEcfkvL3ns_BTLECRbSK_5TLkb-faNAL_Ur_HDq=3X3=A@mail.gmail.com>
	<24ce831a-e740-029b-bdca-8cbf3a382805@redhat.com>
	<CA+e59AEJ8BMEL4kOrmzJyLLj=q1xcyR+gTGD8bXymdi3SfKHhw@mail.gmail.com>
	<2ed43d48-f1e2-7914-1696-232dc42e3d1f@redhat.com>
	<CA+e59AGBxYNLBDE6NjJTDQujzzBDvivBJTDoeqtsqEZf4qXGAw@mail.gmail.com>
Message-ID: <1695233840.16365841.1469056707539.JavaMail.zimbra@redhat.com>

----- Original Message -----
> From: "Keith Dev" <keith.dev at pobox.com>
> To: "Bill Burke" <bburke at redhat.com>, keycloak-user at lists.jboss.org
> Sent: Wednesday, July 20, 2016 6:52:27 PM
> Subject: Re: [keycloak-user] Picketlink -> Keycloak
> 
> Yea - I've tried to swizzle things around to get something approaching what
> we already have. Its not been straightforward, but I think with some
> creative naming, we can get there.
> 
> Btw - regarding the Client Roles: I don't think you can't add one to a Role
> Policy in Clients > ${client} > Authorization > Policies > Add Role Policy.
> Only Realm Roles show up in the search/drop down for Roles.

We are changing the role policy to include client roles :)

Regarding your use case, there is nothing similar to PL Tiers in Keycloak. Not 100% sure, but I think you would be able to do that with role namespaces. @Stian can give you more details about that feature.

About protected resources, they are really related with a client application. If I got your design correctly, you probably have a single application serving different companies. In this case, if each tenant has its own set of projects you are able to define policies for each of these projects. Where you may have resources with a type (typed resources) that is specific for a company and apply policies specific for the projects in that company.

Your use case looks very interesting and made me think about some improvements to authorization services. We could create a concept of resource groups and group hierarchy (something already mentioned by Juca from Hawkular). 

Regards.
Pedro Igor

> 
> Thanks, Keith
> 
> On Wed, Jul 20, 2016 at 4:23 PM Bill Burke < bburke at redhat.com > wrote:
> 
> 
> 
> Keycloak was written as an authentication server. Its initial authorization
> features were quite limited to role-based apps.
> 
> One realm manages a set of users, roles, groups,and clients (applications).
> There is a realm-level namespace for roles. Each client has a role
> namespace. Groups can be managed in a hierarchy and associated with roles.
> Groups can have their own role mappings and attributes. Users can join
> groups. Users can be assigned roles.
> 
> Keycloak 2.0 has an Authorization feature where you can define Resources and
> access policies based on those resources. Companies could each be a group.
> Then I think you can say things like "If user belong to group A and role B
> he can access resource C".
> 
> Meh, doesn't really map well to your use case. What we've found is that
> everybody has their own structure that is very different or slightly
> different than anyone else.
> 
> 
> On 7/20/16 3:44 PM, Keith Dev wrote:
> 
> 
> 
> Consider an independent contractor (user) that works for two companies
> (tenant) on different projects (resource). Control of the project belongs to
> the company, not the contractor, so the security artifacts (resources,
> groups, roles) belong with the company. But we want to provide a user
> interface to the contractor where they do not have to manage multiple
> accounts.
> 
> Tiers in picketlink allow for each tenant to have their own set of groups and
> roles (though they have duplicate meanings for each).
> 
> I'm open to any solutions, including revisiting one realm per tenant (though
> I have some concerns about whether or not keycloak is meant to support 1k+
> realms).
> 
> Is that sufficient explanation?
> 
> Thanks, Keith
> 
> On Wed, Jul 20, 2016 at 2:18 PM Bill Burke < bburke at redhat.com > wrote:
> 
> 
> 
> 
> 
> Define "tenant" and what it accomplishes and how you are using tiers to
> implement this functionality and I might be able to help.
> 
> On 7/20/16 2:41 PM, Keith Dev wrote:
> 
> 
> 
> I'm moving a web application with REST services from Picketlink to Keycloak.
> This is a multi-tentant application (1k+ tenants) where single user accounts
> can belong to multiple tenants. In Picketlink, this was accomplished using
> Tiers. So there is a single realm, but one Tier per tenant. Its not clear
> what the analog is in Keycloak.
> 
> We considered multiple realms, but both the number of tenants and the hard
> requirement to allow a single user cross tenants seems to make this a
> nonstarter.
> 
> The best idea we have so far is to have a single realm, but create namespaced
> security artifacts: e.g. Tenant1.Admins. This is not ideal as we were hoping
> for more separation between tenants. I did see this which suggests that
> Picketlink Tiers equate to Resources, but its not clear how. Certainly there
> does not seem to be any separation of security artifacts within a Resource
> per se.
> 
> Advice?
> 
> 
> 
> 
> 
> _______________________________________________
> keycloak-user mailing list keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
> 
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
> 
> 
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

From pires at littlebits.cc  Thu Jul 21 03:47:11 2016
From: pires at littlebits.cc (Paulo Pires)
Date: Thu, 21 Jul 2016 07:47:11 +0000
Subject: [keycloak-user] How to migrate users and roles from in-house
	storage
In-Reply-To: <20160720203018.GA8462@abstractj.org>
References: <CAO8YOYXtZtJ2QPBM9G9QUyeZrTDWPBZ9HbtEg9GWtW+tFfCRaA@mail.gmail.com>
	<CAJgngAdBpQCuacX1Wc0vUXBwanYwSjNctSjdWcNO1JUhwjWJNw@mail.gmail.com>
	<CAO8YOYW8d6XcLqWpfR31F12wxDoREq8Jvt4SNvQByz-0GsY+CA@mail.gmail.com>
	<CAJgngAe8v8Xq22UfbqNRSv8bf6RJTJ_7K3e2SoS39fhEJ8o8qA@mail.gmail.com>
	<CAO8YOYVPMh4A1CSpoqqx2bAmYconxWPGN=VZ+JKa5=oTOEi=HA@mail.gmail.com>
	<20160720203018.GA8462@abstractj.org>
Message-ID: <CAO8YOYXES7btCwY8T+=XKcRucFVsMBH_5Z5Eq4T5j84mLh=O-w@mail.gmail.com>

Thank you Bruno, I haven't been able to verify your code but I assume
you're sharing it because it works.

It seems pretty trivial, awesome!

Cheers,
Pires

On Wed, Jul 20, 2016 at 9:30 PM Bruno Oliveira <bruno at abstractj.org> wrote:

> Note sure if it helps, but an example about how to do it
> programatically is here[1].
>
> I just adapted from the admin-client[2].
>
>
> [1] - https://gist.github.com/abstractj/78b127e8c9273cdcea6eb82a1cfc153c
> [2] -
> https://github.com/keycloak/keycloak/tree/master/examples/admin-client
>
> On 2016-07-20, Paulo Pires wrote:
> > I did check the admin-cli JAR but it's not clear how to add roles and
> > users, or if it's even implemented (I did check the REST API and there's
> > endpoints for that).
> >
> > Thank you very much for clarifying,
> > Pires
> >
> > On Wed, Jul 20, 2016 at 2:52 PM Stian Thorgersen <sthorger at redhat.com>
> > wrote:
> >
> > > Yep, take a look at
> > >
> https://keycloak.gitbooks.io/server-developer-guide/content/topics/admin-rest-api.html
> > >
> > > On 20 July 2016 at 15:33, Paulo Pires <pires at littlebits.cc> wrote:
> > >
> > >> More than 150k. Is there a Java library for the REST api?
> > >>
> > >> On Jul 20, 2016 13:56, "Stian Thorgersen" <sthorger at redhat.com>
> wrote:
> > >>
> > >>> Depending on the amount of users I'd use either partial import
> through
> > >>> the admin console (if you don't have more than a thousand or so
> users) or
> > >>> use the admin REST endpoints if you have quite a lot of users.
> > >>>
> > >>> On 20 July 2016 at 11:52, Paulo Pires <pires at littlebits.cc> wrote:
> > >>>
> > >>>> Hi all,
> > >>>>
> > >>>> I'm in the process of migrating from an in-house user-role storage
> to
> > >>>> Keycloak and I'm looking for programmatic (Java) ways to migrate all
> > >>>> current users to the new storage. And I need your help to figure
> out the
> > >>>> best approach.
> > >>>>
> > >>>> At first, when reading KC documentation, I believed I could easily
> > >>>> achieve this by implementing a User Federation provider but after
> diving a
> > >>>> little more into it, and looking for examples, I can't see a way to
> migrate
> > >>>> all users on-demand but simply one user at a time, possible during
> log-in.
> > >>>>
> > >>>> Next, I tried and look into ways, such as admin-cli, REST, etc but
> > >>>> nothing strikes me as the solution to use.
> > >>>>
> > >>>> Here's what I was hoping to deliver:
> > >>>> * Get all roles and users from my soon-to-be deprecated storage,
> e.g.
> > >>>> MySQL tables
> > >>>> * Add roles to KC
> > >>>> * Iterate users and add user to KC + map roles + update password
> hashes
> > >>>> (here I know I need to implement a HashProvider)
> > >>>>
> > >>>> Any hints will be appreciated!
> > >>>>
> > >>>> Pires
> > >>>>
> > >>>> _______________________________________________
> > >>>> keycloak-user mailing list
> > >>>> keycloak-user at lists.jboss.org
> > >>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
> > >>>>
> > >>>
> > >>>
> > >
>
> > _______________________________________________
> > keycloak-user mailing list
> > keycloak-user at lists.jboss.org
> > https://lists.jboss.org/mailman/listinfo/keycloak-user
>
>
> --
>
> abstractj
> PGP: 0x84DC9914
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160721/491cfc89/attachment.html 

From pires at littlebits.cc  Thu Jul 21 07:03:11 2016
From: pires at littlebits.cc (Paulo Pires)
Date: Thu, 21 Jul 2016 11:03:11 +0000
Subject: [keycloak-user] How to migrate users and roles from in-house
	storage
In-Reply-To: <CAO8YOYXES7btCwY8T+=XKcRucFVsMBH_5Z5Eq4T5j84mLh=O-w@mail.gmail.com>
References: <CAO8YOYXtZtJ2QPBM9G9QUyeZrTDWPBZ9HbtEg9GWtW+tFfCRaA@mail.gmail.com>
	<CAJgngAdBpQCuacX1Wc0vUXBwanYwSjNctSjdWcNO1JUhwjWJNw@mail.gmail.com>
	<CAO8YOYW8d6XcLqWpfR31F12wxDoREq8Jvt4SNvQByz-0GsY+CA@mail.gmail.com>
	<CAJgngAe8v8Xq22UfbqNRSv8bf6RJTJ_7K3e2SoS39fhEJ8o8qA@mail.gmail.com>
	<CAO8YOYVPMh4A1CSpoqqx2bAmYconxWPGN=VZ+JKa5=oTOEi=HA@mail.gmail.com>
	<20160720203018.GA8462@abstractj.org>
	<CAO8YOYXES7btCwY8T+=XKcRucFVsMBH_5Z5Eq4T5j84mLh=O-w@mail.gmail.com>
Message-ID: <CAO8YOYUHpTLoFBw-dxt8syyOrpORq0rio-kk5F9s-vp3zrzz9Q@mail.gmail.com>

It's working like a charm :)

Some things I learned:
* Need to import resteasy deps for keycloak-admin-cli explicitly
* Methods won't return errors but will throw InvocationTargetException
(must be checked)

Question: is there a way to set default roles? I can't seem to find it in
the Java code but it is available through REST.

Thanks,
Pires

On Thu, Jul 21, 2016 at 8:47 AM Paulo Pires <pires at littlebits.cc> wrote:

> Thank you Bruno, I haven't been able to verify your code but I assume
> you're sharing it because it works.
>
> It seems pretty trivial, awesome!
>
> Cheers,
> Pires
>
> On Wed, Jul 20, 2016 at 9:30 PM Bruno Oliveira <bruno at abstractj.org>
> wrote:
>
>> Note sure if it helps, but an example about how to do it
>> programatically is here[1].
>>
>> I just adapted from the admin-client[2].
>>
>>
>> [1] - https://gist.github.com/abstractj/78b127e8c9273cdcea6eb82a1cfc153c
>> [2] -
>> https://github.com/keycloak/keycloak/tree/master/examples/admin-client
>>
>> On 2016-07-20, Paulo Pires wrote:
>> > I did check the admin-cli JAR but it's not clear how to add roles and
>> > users, or if it's even implemented (I did check the REST API and there's
>> > endpoints for that).
>> >
>> > Thank you very much for clarifying,
>> > Pires
>> >
>> > On Wed, Jul 20, 2016 at 2:52 PM Stian Thorgersen <sthorger at redhat.com>
>> > wrote:
>> >
>> > > Yep, take a look at
>> > >
>> https://keycloak.gitbooks.io/server-developer-guide/content/topics/admin-rest-api.html
>> > >
>> > > On 20 July 2016 at 15:33, Paulo Pires <pires at littlebits.cc> wrote:
>> > >
>> > >> More than 150k. Is there a Java library for the REST api?
>> > >>
>> > >> On Jul 20, 2016 13:56, "Stian Thorgersen" <sthorger at redhat.com>
>> wrote:
>> > >>
>> > >>> Depending on the amount of users I'd use either partial import
>> through
>> > >>> the admin console (if you don't have more than a thousand or so
>> users) or
>> > >>> use the admin REST endpoints if you have quite a lot of users.
>> > >>>
>> > >>> On 20 July 2016 at 11:52, Paulo Pires <pires at littlebits.cc> wrote:
>> > >>>
>> > >>>> Hi all,
>> > >>>>
>> > >>>> I'm in the process of migrating from an in-house user-role storage
>> to
>> > >>>> Keycloak and I'm looking for programmatic (Java) ways to migrate
>> all
>> > >>>> current users to the new storage. And I need your help to figure
>> out the
>> > >>>> best approach.
>> > >>>>
>> > >>>> At first, when reading KC documentation, I believed I could easily
>> > >>>> achieve this by implementing a User Federation provider but after
>> diving a
>> > >>>> little more into it, and looking for examples, I can't see a way
>> to migrate
>> > >>>> all users on-demand but simply one user at a time, possible during
>> log-in.
>> > >>>>
>> > >>>> Next, I tried and look into ways, such as admin-cli, REST, etc but
>> > >>>> nothing strikes me as the solution to use.
>> > >>>>
>> > >>>> Here's what I was hoping to deliver:
>> > >>>> * Get all roles and users from my soon-to-be deprecated storage,
>> e.g.
>> > >>>> MySQL tables
>> > >>>> * Add roles to KC
>> > >>>> * Iterate users and add user to KC + map roles + update password
>> hashes
>> > >>>> (here I know I need to implement a HashProvider)
>> > >>>>
>> > >>>> Any hints will be appreciated!
>> > >>>>
>> > >>>> Pires
>> > >>>>
>> > >>>> _______________________________________________
>> > >>>> keycloak-user mailing list
>> > >>>> keycloak-user at lists.jboss.org
>> > >>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>> > >>>>
>> > >>>
>> > >>>
>> > >
>>
>> > _______________________________________________
>> > keycloak-user mailing list
>> > keycloak-user at lists.jboss.org
>> > https://lists.jboss.org/mailman/listinfo/keycloak-user
>>
>>
>> --
>>
>> abstractj
>> PGP: 0x84DC9914
>>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160721/cadd0c6a/attachment-0001.html 

From pires at littlebits.cc  Thu Jul 21 07:06:10 2016
From: pires at littlebits.cc (Paulo Pires)
Date: Thu, 21 Jul 2016 11:06:10 +0000
Subject: [keycloak-user] How to migrate users and roles from in-house
	storage
In-Reply-To: <CAO8YOYUHpTLoFBw-dxt8syyOrpORq0rio-kk5F9s-vp3zrzz9Q@mail.gmail.com>
References: <CAO8YOYXtZtJ2QPBM9G9QUyeZrTDWPBZ9HbtEg9GWtW+tFfCRaA@mail.gmail.com>
	<CAJgngAdBpQCuacX1Wc0vUXBwanYwSjNctSjdWcNO1JUhwjWJNw@mail.gmail.com>
	<CAO8YOYW8d6XcLqWpfR31F12wxDoREq8Jvt4SNvQByz-0GsY+CA@mail.gmail.com>
	<CAJgngAe8v8Xq22UfbqNRSv8bf6RJTJ_7K3e2SoS39fhEJ8o8qA@mail.gmail.com>
	<CAO8YOYVPMh4A1CSpoqqx2bAmYconxWPGN=VZ+JKa5=oTOEi=HA@mail.gmail.com>
	<20160720203018.GA8462@abstractj.org>
	<CAO8YOYXES7btCwY8T+=XKcRucFVsMBH_5Z5Eq4T5j84mLh=O-w@mail.gmail.com>
	<CAO8YOYUHpTLoFBw-dxt8syyOrpORq0rio-kk5F9s-vp3zrzz9Q@mail.gmail.com>
Message-ID: <CAO8YOYVoK_KC1yk5LQZ=6Q+kKXLAcN+EVuybPmUcZxz0aHKDWQ@mail.gmail.com>

Something like this should work though:

@GET
@Produces({"application/json"})
@Path("default-roles")
List<RoleRepresentation> getDefaultRoles();

@PUT
@Path("default-roles/{roleId}")
void addDefaultRole(@PathParam("roleId") String roleId);

@DELETE
@Path("default-roles/{roleId}")
void removeDefaultRole(@PathParam("roleId") String roleId);

On Thu, Jul 21, 2016 at 12:03 PM Paulo Pires <pires at littlebits.cc> wrote:

> It's working like a charm :)
>
> Some things I learned:
> * Need to import resteasy deps for keycloak-admin-cli explicitly
> * Methods won't return errors but will throw InvocationTargetException
> (must be checked)
>
> Question: is there a way to set default roles? I can't seem to find it in
> the Java code but it is available through REST.
>
> Thanks,
> Pires
>
> On Thu, Jul 21, 2016 at 8:47 AM Paulo Pires <pires at littlebits.cc> wrote:
>
>> Thank you Bruno, I haven't been able to verify your code but I assume
>> you're sharing it because it works.
>>
>> It seems pretty trivial, awesome!
>>
>> Cheers,
>> Pires
>>
>> On Wed, Jul 20, 2016 at 9:30 PM Bruno Oliveira <bruno at abstractj.org>
>> wrote:
>>
>>> Note sure if it helps, but an example about how to do it
>>> programatically is here[1].
>>>
>>> I just adapted from the admin-client[2].
>>>
>>>
>>> [1] - https://gist.github.com/abstractj/78b127e8c9273cdcea6eb82a1cfc153c
>>> [2] -
>>> https://github.com/keycloak/keycloak/tree/master/examples/admin-client
>>>
>>> On 2016-07-20, Paulo Pires wrote:
>>> > I did check the admin-cli JAR but it's not clear how to add roles and
>>> > users, or if it's even implemented (I did check the REST API and
>>> there's
>>> > endpoints for that).
>>> >
>>> > Thank you very much for clarifying,
>>> > Pires
>>> >
>>> > On Wed, Jul 20, 2016 at 2:52 PM Stian Thorgersen <sthorger at redhat.com>
>>> > wrote:
>>> >
>>> > > Yep, take a look at
>>> > >
>>> https://keycloak.gitbooks.io/server-developer-guide/content/topics/admin-rest-api.html
>>> > >
>>> > > On 20 July 2016 at 15:33, Paulo Pires <pires at littlebits.cc> wrote:
>>> > >
>>> > >> More than 150k. Is there a Java library for the REST api?
>>> > >>
>>> > >> On Jul 20, 2016 13:56, "Stian Thorgersen" <sthorger at redhat.com>
>>> wrote:
>>> > >>
>>> > >>> Depending on the amount of users I'd use either partial import
>>> through
>>> > >>> the admin console (if you don't have more than a thousand or so
>>> users) or
>>> > >>> use the admin REST endpoints if you have quite a lot of users.
>>> > >>>
>>> > >>> On 20 July 2016 at 11:52, Paulo Pires <pires at littlebits.cc> wrote:
>>> > >>>
>>> > >>>> Hi all,
>>> > >>>>
>>> > >>>> I'm in the process of migrating from an in-house user-role
>>> storage to
>>> > >>>> Keycloak and I'm looking for programmatic (Java) ways to migrate
>>> all
>>> > >>>> current users to the new storage. And I need your help to figure
>>> out the
>>> > >>>> best approach.
>>> > >>>>
>>> > >>>> At first, when reading KC documentation, I believed I could easily
>>> > >>>> achieve this by implementing a User Federation provider but after
>>> diving a
>>> > >>>> little more into it, and looking for examples, I can't see a way
>>> to migrate
>>> > >>>> all users on-demand but simply one user at a time, possible
>>> during log-in.
>>> > >>>>
>>> > >>>> Next, I tried and look into ways, such as admin-cli, REST, etc but
>>> > >>>> nothing strikes me as the solution to use.
>>> > >>>>
>>> > >>>> Here's what I was hoping to deliver:
>>> > >>>> * Get all roles and users from my soon-to-be deprecated storage,
>>> e.g.
>>> > >>>> MySQL tables
>>> > >>>> * Add roles to KC
>>> > >>>> * Iterate users and add user to KC + map roles + update password
>>> hashes
>>> > >>>> (here I know I need to implement a HashProvider)
>>> > >>>>
>>> > >>>> Any hints will be appreciated!
>>> > >>>>
>>> > >>>> Pires
>>> > >>>>
>>> > >>>> _______________________________________________
>>> > >>>> keycloak-user mailing list
>>> > >>>> keycloak-user at lists.jboss.org
>>> > >>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>> > >>>>
>>> > >>>
>>> > >>>
>>> > >
>>>
>>> > _______________________________________________
>>> > keycloak-user mailing list
>>> > keycloak-user at lists.jboss.org
>>> > https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>
>>>
>>> --
>>>
>>> abstractj
>>> PGP: 0x84DC9914
>>>
>>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160721/2b5f9919/attachment.html 

From pires at littlebits.cc  Thu Jul 21 07:13:44 2016
From: pires at littlebits.cc (Paulo Pires)
Date: Thu, 21 Jul 2016 11:13:44 +0000
Subject: [keycloak-user] How to migrate users and roles from in-house
	storage
In-Reply-To: <CAO8YOYVoK_KC1yk5LQZ=6Q+kKXLAcN+EVuybPmUcZxz0aHKDWQ@mail.gmail.com>
References: <CAO8YOYXtZtJ2QPBM9G9QUyeZrTDWPBZ9HbtEg9GWtW+tFfCRaA@mail.gmail.com>
	<CAJgngAdBpQCuacX1Wc0vUXBwanYwSjNctSjdWcNO1JUhwjWJNw@mail.gmail.com>
	<CAO8YOYW8d6XcLqWpfR31F12wxDoREq8Jvt4SNvQByz-0GsY+CA@mail.gmail.com>
	<CAJgngAe8v8Xq22UfbqNRSv8bf6RJTJ_7K3e2SoS39fhEJ8o8qA@mail.gmail.com>
	<CAO8YOYVPMh4A1CSpoqqx2bAmYconxWPGN=VZ+JKa5=oTOEi=HA@mail.gmail.com>
	<20160720203018.GA8462@abstractj.org>
	<CAO8YOYXES7btCwY8T+=XKcRucFVsMBH_5Z5Eq4T5j84mLh=O-w@mail.gmail.com>
	<CAO8YOYUHpTLoFBw-dxt8syyOrpORq0rio-kk5F9s-vp3zrzz9Q@mail.gmail.com>
	<CAO8YOYVoK_KC1yk5LQZ=6Q+kKXLAcN+EVuybPmUcZxz0aHKDWQ@mail.gmail.com>
Message-ID: <CAO8YOYVZuQbY_v=fDtc3JUXdH_bJqo10RPEnuZZCTjCgxGYxvw@mail.gmail.com>

I went ahead, cowboy style and opened a PR for it
https://github.com/keycloak/keycloak/pull/3056

Couldn't find tests so didn't add any.

Pires

On Thu, Jul 21, 2016 at 12:06 PM Paulo Pires <pires at littlebits.cc> wrote:

> Something like this should work though:
>
> @GET
> @Produces({"application/json"})
> @Path("default-roles")
> List<RoleRepresentation> getDefaultRoles();
>
> @PUT
> @Path("default-roles/{roleId}")
> void addDefaultRole(@PathParam("roleId") String roleId);
>
> @DELETE
> @Path("default-roles/{roleId}")
> void removeDefaultRole(@PathParam("roleId") String roleId);
>
> On Thu, Jul 21, 2016 at 12:03 PM Paulo Pires <pires at littlebits.cc> wrote:
>
>> It's working like a charm :)
>>
>> Some things I learned:
>> * Need to import resteasy deps for keycloak-admin-cli explicitly
>> * Methods won't return errors but will throw InvocationTargetException
>> (must be checked)
>>
>> Question: is there a way to set default roles? I can't seem to find it in
>> the Java code but it is available through REST.
>>
>> Thanks,
>> Pires
>>
>> On Thu, Jul 21, 2016 at 8:47 AM Paulo Pires <pires at littlebits.cc> wrote:
>>
>>> Thank you Bruno, I haven't been able to verify your code but I assume
>>> you're sharing it because it works.
>>>
>>> It seems pretty trivial, awesome!
>>>
>>> Cheers,
>>> Pires
>>>
>>> On Wed, Jul 20, 2016 at 9:30 PM Bruno Oliveira <bruno at abstractj.org>
>>> wrote:
>>>
>>>> Note sure if it helps, but an example about how to do it
>>>> programatically is here[1].
>>>>
>>>> I just adapted from the admin-client[2].
>>>>
>>>>
>>>> [1] -
>>>> https://gist.github.com/abstractj/78b127e8c9273cdcea6eb82a1cfc153c
>>>> [2] -
>>>> https://github.com/keycloak/keycloak/tree/master/examples/admin-client
>>>>
>>>> On 2016-07-20, Paulo Pires wrote:
>>>> > I did check the admin-cli JAR but it's not clear how to add roles and
>>>> > users, or if it's even implemented (I did check the REST API and
>>>> there's
>>>> > endpoints for that).
>>>> >
>>>> > Thank you very much for clarifying,
>>>> > Pires
>>>> >
>>>> > On Wed, Jul 20, 2016 at 2:52 PM Stian Thorgersen <sthorger at redhat.com
>>>> >
>>>> > wrote:
>>>> >
>>>> > > Yep, take a look at
>>>> > >
>>>> https://keycloak.gitbooks.io/server-developer-guide/content/topics/admin-rest-api.html
>>>> > >
>>>> > > On 20 July 2016 at 15:33, Paulo Pires <pires at littlebits.cc> wrote:
>>>> > >
>>>> > >> More than 150k. Is there a Java library for the REST api?
>>>> > >>
>>>> > >> On Jul 20, 2016 13:56, "Stian Thorgersen" <sthorger at redhat.com>
>>>> wrote:
>>>> > >>
>>>> > >>> Depending on the amount of users I'd use either partial import
>>>> through
>>>> > >>> the admin console (if you don't have more than a thousand or so
>>>> users) or
>>>> > >>> use the admin REST endpoints if you have quite a lot of users.
>>>> > >>>
>>>> > >>> On 20 July 2016 at 11:52, Paulo Pires <pires at littlebits.cc>
>>>> wrote:
>>>> > >>>
>>>> > >>>> Hi all,
>>>> > >>>>
>>>> > >>>> I'm in the process of migrating from an in-house user-role
>>>> storage to
>>>> > >>>> Keycloak and I'm looking for programmatic (Java) ways to migrate
>>>> all
>>>> > >>>> current users to the new storage. And I need your help to figure
>>>> out the
>>>> > >>>> best approach.
>>>> > >>>>
>>>> > >>>> At first, when reading KC documentation, I believed I could
>>>> easily
>>>> > >>>> achieve this by implementing a User Federation provider but
>>>> after diving a
>>>> > >>>> little more into it, and looking for examples, I can't see a way
>>>> to migrate
>>>> > >>>> all users on-demand but simply one user at a time, possible
>>>> during log-in.
>>>> > >>>>
>>>> > >>>> Next, I tried and look into ways, such as admin-cli, REST, etc
>>>> but
>>>> > >>>> nothing strikes me as the solution to use.
>>>> > >>>>
>>>> > >>>> Here's what I was hoping to deliver:
>>>> > >>>> * Get all roles and users from my soon-to-be deprecated storage,
>>>> e.g.
>>>> > >>>> MySQL tables
>>>> > >>>> * Add roles to KC
>>>> > >>>> * Iterate users and add user to KC + map roles + update password
>>>> hashes
>>>> > >>>> (here I know I need to implement a HashProvider)
>>>> > >>>>
>>>> > >>>> Any hints will be appreciated!
>>>> > >>>>
>>>> > >>>> Pires
>>>> > >>>>
>>>> > >>>> _______________________________________________
>>>> > >>>> keycloak-user mailing list
>>>> > >>>> keycloak-user at lists.jboss.org
>>>> > >>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>> > >>>>
>>>> > >>>
>>>> > >>>
>>>> > >
>>>>
>>>> > _______________________________________________
>>>> > keycloak-user mailing list
>>>> > keycloak-user at lists.jboss.org
>>>> > https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>>
>>>>
>>>> --
>>>>
>>>> abstractj
>>>> PGP: 0x84DC9914
>>>>
>>>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160721/cb06e7ea/attachment-0001.html 

From sthorger at redhat.com  Thu Jul 21 08:13:42 2016
From: sthorger at redhat.com (Stian Thorgersen)
Date: Thu, 21 Jul 2016 14:13:42 +0200
Subject: [keycloak-user] How to migrate users and roles from in-house
	storage
In-Reply-To: <CAO8YOYVZuQbY_v=fDtc3JUXdH_bJqo10RPEnuZZCTjCgxGYxvw@mail.gmail.com>
References: <CAO8YOYXtZtJ2QPBM9G9QUyeZrTDWPBZ9HbtEg9GWtW+tFfCRaA@mail.gmail.com>
	<CAJgngAdBpQCuacX1Wc0vUXBwanYwSjNctSjdWcNO1JUhwjWJNw@mail.gmail.com>
	<CAO8YOYW8d6XcLqWpfR31F12wxDoREq8Jvt4SNvQByz-0GsY+CA@mail.gmail.com>
	<CAJgngAe8v8Xq22UfbqNRSv8bf6RJTJ_7K3e2SoS39fhEJ8o8qA@mail.gmail.com>
	<CAO8YOYVPMh4A1CSpoqqx2bAmYconxWPGN=VZ+JKa5=oTOEi=HA@mail.gmail.com>
	<20160720203018.GA8462@abstractj.org>
	<CAO8YOYXES7btCwY8T+=XKcRucFVsMBH_5Z5Eq4T5j84mLh=O-w@mail.gmail.com>
	<CAO8YOYUHpTLoFBw-dxt8syyOrpORq0rio-kk5F9s-vp3zrzz9Q@mail.gmail.com>
	<CAO8YOYVoK_KC1yk5LQZ=6Q+kKXLAcN+EVuybPmUcZxz0aHKDWQ@mail.gmail.com>
	<CAO8YOYVZuQbY_v=fDtc3JUXdH_bJqo10RPEnuZZCTjCgxGYxvw@mail.gmail.com>
Message-ID: <CAJgngAceA5iL9=1YW4gJR-tKCjFk5ahZcOc9QvJaWyPR27V+_Q@mail.gmail.com>

We like cowboy style :)

Could you add a JIRA please?

Also you could add tests to
https://github.com/keycloak/keycloak/blob/master/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/realm/RealmTest.java

On 21 July 2016 at 13:13, Paulo Pires <pires at littlebits.cc> wrote:

> I went ahead, cowboy style and opened a PR for it
> https://github.com/keycloak/keycloak/pull/3056
>
> Couldn't find tests so didn't add any.
>
> Pires
>
> On Thu, Jul 21, 2016 at 12:06 PM Paulo Pires <pires at littlebits.cc> wrote:
>
>> Something like this should work though:
>>
>> @GET
>> @Produces({"application/json"})
>> @Path("default-roles")
>> List<RoleRepresentation> getDefaultRoles();
>>
>> @PUT
>> @Path("default-roles/{roleId}")
>> void addDefaultRole(@PathParam("roleId") String roleId);
>>
>> @DELETE
>> @Path("default-roles/{roleId}")
>> void removeDefaultRole(@PathParam("roleId") String roleId);
>>
>> On Thu, Jul 21, 2016 at 12:03 PM Paulo Pires <pires at littlebits.cc> wrote:
>>
>>> It's working like a charm :)
>>>
>>> Some things I learned:
>>> * Need to import resteasy deps for keycloak-admin-cli explicitly
>>> * Methods won't return errors but will throw InvocationTargetException
>>> (must be checked)
>>>
>>> Question: is there a way to set default roles? I can't seem to find it
>>> in the Java code but it is available through REST.
>>>
>>> Thanks,
>>> Pires
>>>
>>> On Thu, Jul 21, 2016 at 8:47 AM Paulo Pires <pires at littlebits.cc> wrote:
>>>
>>>> Thank you Bruno, I haven't been able to verify your code but I assume
>>>> you're sharing it because it works.
>>>>
>>>> It seems pretty trivial, awesome!
>>>>
>>>> Cheers,
>>>> Pires
>>>>
>>>> On Wed, Jul 20, 2016 at 9:30 PM Bruno Oliveira <bruno at abstractj.org>
>>>> wrote:
>>>>
>>>>> Note sure if it helps, but an example about how to do it
>>>>> programatically is here[1].
>>>>>
>>>>> I just adapted from the admin-client[2].
>>>>>
>>>>>
>>>>> [1] -
>>>>> https://gist.github.com/abstractj/78b127e8c9273cdcea6eb82a1cfc153c
>>>>> [2] -
>>>>> https://github.com/keycloak/keycloak/tree/master/examples/admin-client
>>>>>
>>>>> On 2016-07-20, Paulo Pires wrote:
>>>>> > I did check the admin-cli JAR but it's not clear how to add roles and
>>>>> > users, or if it's even implemented (I did check the REST API and
>>>>> there's
>>>>> > endpoints for that).
>>>>> >
>>>>> > Thank you very much for clarifying,
>>>>> > Pires
>>>>> >
>>>>> > On Wed, Jul 20, 2016 at 2:52 PM Stian Thorgersen <
>>>>> sthorger at redhat.com>
>>>>> > wrote:
>>>>> >
>>>>> > > Yep, take a look at
>>>>> > >
>>>>> https://keycloak.gitbooks.io/server-developer-guide/content/topics/admin-rest-api.html
>>>>> > >
>>>>> > > On 20 July 2016 at 15:33, Paulo Pires <pires at littlebits.cc> wrote:
>>>>> > >
>>>>> > >> More than 150k. Is there a Java library for the REST api?
>>>>> > >>
>>>>> > >> On Jul 20, 2016 13:56, "Stian Thorgersen" <sthorger at redhat.com>
>>>>> wrote:
>>>>> > >>
>>>>> > >>> Depending on the amount of users I'd use either partial import
>>>>> through
>>>>> > >>> the admin console (if you don't have more than a thousand or so
>>>>> users) or
>>>>> > >>> use the admin REST endpoints if you have quite a lot of users.
>>>>> > >>>
>>>>> > >>> On 20 July 2016 at 11:52, Paulo Pires <pires at littlebits.cc>
>>>>> wrote:
>>>>> > >>>
>>>>> > >>>> Hi all,
>>>>> > >>>>
>>>>> > >>>> I'm in the process of migrating from an in-house user-role
>>>>> storage to
>>>>> > >>>> Keycloak and I'm looking for programmatic (Java) ways to
>>>>> migrate all
>>>>> > >>>> current users to the new storage. And I need your help to
>>>>> figure out the
>>>>> > >>>> best approach.
>>>>> > >>>>
>>>>> > >>>> At first, when reading KC documentation, I believed I could
>>>>> easily
>>>>> > >>>> achieve this by implementing a User Federation provider but
>>>>> after diving a
>>>>> > >>>> little more into it, and looking for examples, I can't see a
>>>>> way to migrate
>>>>> > >>>> all users on-demand but simply one user at a time, possible
>>>>> during log-in.
>>>>> > >>>>
>>>>> > >>>> Next, I tried and look into ways, such as admin-cli, REST, etc
>>>>> but
>>>>> > >>>> nothing strikes me as the solution to use.
>>>>> > >>>>
>>>>> > >>>> Here's what I was hoping to deliver:
>>>>> > >>>> * Get all roles and users from my soon-to-be deprecated
>>>>> storage, e.g.
>>>>> > >>>> MySQL tables
>>>>> > >>>> * Add roles to KC
>>>>> > >>>> * Iterate users and add user to KC + map roles + update
>>>>> password hashes
>>>>> > >>>> (here I know I need to implement a HashProvider)
>>>>> > >>>>
>>>>> > >>>> Any hints will be appreciated!
>>>>> > >>>>
>>>>> > >>>> Pires
>>>>> > >>>>
>>>>> > >>>> _______________________________________________
>>>>> > >>>> keycloak-user mailing list
>>>>> > >>>> keycloak-user at lists.jboss.org
>>>>> > >>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>>> > >>>>
>>>>> > >>>
>>>>> > >>>
>>>>> > >
>>>>>
>>>>> > _______________________________________________
>>>>> > keycloak-user mailing list
>>>>> > keycloak-user at lists.jboss.org
>>>>> > https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>>>
>>>>>
>>>>> --
>>>>>
>>>>> abstractj
>>>>> PGP: 0x84DC9914
>>>>>
>>>>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160721/1f2f702e/attachment.html 

From Edgar at info.nl  Thu Jul 21 08:34:10 2016
From: Edgar at info.nl (Edgar Vonk - Info.nl)
Date: Thu, 21 Jul 2016 12:34:10 +0000
Subject: [keycloak-user] Keycloak unable to open JDBC connection
Message-ID: <91099E82-6F64-40F6-9A84-971D76ED78C1@info.nl>

We also recently had an issue where Keycloak stopped working because it could no longer get any (Oracle) DB connections from the connection pool. This was not after a restart but just during normal operation.

We had configured the DB connection pool to use background-validation and this has worked fine until recently.

As mentioned in http://stackoverflow.com/questions/28707650/wildfly-and-auto-reconnect-to-the-database (linked from: https://issues.jboss.org/browse/KEYCLOAK-3204) the issue seems to be that starting from Wildfly 10 (?) this background validation no longer works due to a bug in Wildfly. As suggested there we have now configured the connection pool with validate-on-match set to true and we hope this will resolve the issue.

We only started to see this issue after upgrading to Keycloak 2.0.0 and I think that is where Wildfly was upgraded to version 10? Or maybe it was just bad luck..

The stack trace we had:


Caused by: java.sql.SQLException: javax.resource.ResourceException: IJ000453: Unable to get managed connection for java:jboss/datasources/KeycloakDS
	at org.jboss.jca.adapters.jdbc.WrapperDataSource.getConnection(WrapperDataSource.java:146)
	at org.jboss.as.connector.subsystems.datasources.WildFlyDataSource.getConnection(WildFlyDataSource.java:66)
	at org.hibernate.engine.jdbc.connections.internal.DatasourceConnectionProviderImpl.getConnection(DatasourceConnectionProviderImpl.java:122)
	at org.hibernate.internal.AbstractSessionImpl$NonContextualJdbcConnectionAccess.obtainConnection(AbstractSessionImpl.java:386)
	at org.hibernate.resource.jdbc.internal.LogicalConnectionManagedImpl.acquireConnectionIfNeeded(LogicalConnectionManagedImpl.java:87)
	... 71 more
Caused by: javax.resource.ResourceException: IJ000453: Unable to get managed connection for java:jboss/datasources/KeycloakDS
	at org.jboss.jca.core.connectionmanager.AbstractConnectionManager.getManagedConnection(AbstractConnectionManager.java:656)
	at org.jboss.jca.core.connectionmanager.tx.TxConnectionManagerImpl.getManagedConnection(TxConnectionManagerImpl.java:429)
	at org.jboss.jca.core.connectionmanager.AbstractConnectionManager.allocateConnection(AbstractConnectionManager.java:747)
	at org.jboss.jca.adapters.jdbc.WrapperDataSource.getConnection(WrapperDataSource.java:138)
	... 75 more
Caused by: javax.resource.ResourceException: IJ000655: No managed connections available within configured blocking timeout (30000 [ms])
	at org.jboss.jca.core.connectionmanager.pool.mcp.SemaphoreConcurrentLinkedDequeManagedConnectionPool.getConnection(SemaphoreConcurrentLinkedDequeManagedConnectionPool.java:564)
	at org.jboss.jca.core.connectionmanager.pool.AbstractPool.getSimpleConnection(AbstractPool.java:626)
	at org.jboss.jca.core.connectionmanager.pool.AbstractPool.getConnection(AbstractPool.java:598)
	at org.jboss.jca.core.connectionmanager.AbstractConnectionManager.getManagedConnection(AbstractConnectionManager.java:590)
	... 78 more 

From pires at littlebits.cc  Thu Jul 21 08:46:28 2016
From: pires at littlebits.cc (Paulo Pires)
Date: Thu, 21 Jul 2016 12:46:28 +0000
Subject: [keycloak-user] How to migrate users and roles from in-house
	storage
In-Reply-To: <CAJgngAceA5iL9=1YW4gJR-tKCjFk5ahZcOc9QvJaWyPR27V+_Q@mail.gmail.com>
References: <CAO8YOYXtZtJ2QPBM9G9QUyeZrTDWPBZ9HbtEg9GWtW+tFfCRaA@mail.gmail.com>
	<CAJgngAdBpQCuacX1Wc0vUXBwanYwSjNctSjdWcNO1JUhwjWJNw@mail.gmail.com>
	<CAO8YOYW8d6XcLqWpfR31F12wxDoREq8Jvt4SNvQByz-0GsY+CA@mail.gmail.com>
	<CAJgngAe8v8Xq22UfbqNRSv8bf6RJTJ_7K3e2SoS39fhEJ8o8qA@mail.gmail.com>
	<CAO8YOYVPMh4A1CSpoqqx2bAmYconxWPGN=VZ+JKa5=oTOEi=HA@mail.gmail.com>
	<20160720203018.GA8462@abstractj.org>
	<CAO8YOYXES7btCwY8T+=XKcRucFVsMBH_5Z5Eq4T5j84mLh=O-w@mail.gmail.com>
	<CAO8YOYUHpTLoFBw-dxt8syyOrpORq0rio-kk5F9s-vp3zrzz9Q@mail.gmail.com>
	<CAO8YOYVoK_KC1yk5LQZ=6Q+kKXLAcN+EVuybPmUcZxz0aHKDWQ@mail.gmail.com>
	<CAO8YOYVZuQbY_v=fDtc3JUXdH_bJqo10RPEnuZZCTjCgxGYxvw@mail.gmail.com>
	<CAJgngAceA5iL9=1YW4gJR-tKCjFk5ahZcOc9QvJaWyPR27V+_Q@mail.gmail.com>
Message-ID: <CAO8YOYW8MeFo4N0S3dy96qzqyJvd51APrq3UJjwh-gbKMjhO1Q@mail.gmail.com>

Oh, awesome! Going to add tests, open JIRA ticket and update PR.

Thanks Stian,
Pires

On Thu, Jul 21, 2016 at 1:13 PM Stian Thorgersen <sthorger at redhat.com>
wrote:

> We like cowboy style :)
>
> Could you add a JIRA please?
>
> Also you could add tests to
> https://github.com/keycloak/keycloak/blob/master/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/realm/RealmTest.java
>
> On 21 July 2016 at 13:13, Paulo Pires <pires at littlebits.cc> wrote:
>
>> I went ahead, cowboy style and opened a PR for it
>> https://github.com/keycloak/keycloak/pull/3056
>>
>> Couldn't find tests so didn't add any.
>>
>> Pires
>>
>> On Thu, Jul 21, 2016 at 12:06 PM Paulo Pires <pires at littlebits.cc> wrote:
>>
>>> Something like this should work though:
>>>
>>> @GET
>>> @Produces({"application/json"})
>>> @Path("default-roles")
>>> List<RoleRepresentation> getDefaultRoles();
>>>
>>> @PUT
>>> @Path("default-roles/{roleId}")
>>> void addDefaultRole(@PathParam("roleId") String roleId);
>>>
>>> @DELETE
>>> @Path("default-roles/{roleId}")
>>> void removeDefaultRole(@PathParam("roleId") String roleId);
>>>
>>> On Thu, Jul 21, 2016 at 12:03 PM Paulo Pires <pires at littlebits.cc>
>>> wrote:
>>>
>>>> It's working like a charm :)
>>>>
>>>> Some things I learned:
>>>> * Need to import resteasy deps for keycloak-admin-cli explicitly
>>>> * Methods won't return errors but will throw InvocationTargetException
>>>> (must be checked)
>>>>
>>>> Question: is there a way to set default roles? I can't seem to find it
>>>> in the Java code but it is available through REST.
>>>>
>>>> Thanks,
>>>> Pires
>>>>
>>>> On Thu, Jul 21, 2016 at 8:47 AM Paulo Pires <pires at littlebits.cc>
>>>> wrote:
>>>>
>>>>> Thank you Bruno, I haven't been able to verify your code but I assume
>>>>> you're sharing it because it works.
>>>>>
>>>>> It seems pretty trivial, awesome!
>>>>>
>>>>> Cheers,
>>>>> Pires
>>>>>
>>>>> On Wed, Jul 20, 2016 at 9:30 PM Bruno Oliveira <bruno at abstractj.org>
>>>>> wrote:
>>>>>
>>>>>> Note sure if it helps, but an example about how to do it
>>>>>> programatically is here[1].
>>>>>>
>>>>>> I just adapted from the admin-client[2].
>>>>>>
>>>>>>
>>>>>> [1] -
>>>>>> https://gist.github.com/abstractj/78b127e8c9273cdcea6eb82a1cfc153c
>>>>>> [2] -
>>>>>> https://github.com/keycloak/keycloak/tree/master/examples/admin-client
>>>>>>
>>>>>> On 2016-07-20, Paulo Pires wrote:
>>>>>> > I did check the admin-cli JAR but it's not clear how to add roles
>>>>>> and
>>>>>> > users, or if it's even implemented (I did check the REST API and
>>>>>> there's
>>>>>> > endpoints for that).
>>>>>> >
>>>>>> > Thank you very much for clarifying,
>>>>>> > Pires
>>>>>> >
>>>>>> > On Wed, Jul 20, 2016 at 2:52 PM Stian Thorgersen <
>>>>>> sthorger at redhat.com>
>>>>>> > wrote:
>>>>>> >
>>>>>> > > Yep, take a look at
>>>>>> > >
>>>>>> https://keycloak.gitbooks.io/server-developer-guide/content/topics/admin-rest-api.html
>>>>>> > >
>>>>>> > > On 20 July 2016 at 15:33, Paulo Pires <pires at littlebits.cc>
>>>>>> wrote:
>>>>>> > >
>>>>>> > >> More than 150k. Is there a Java library for the REST api?
>>>>>> > >>
>>>>>> > >> On Jul 20, 2016 13:56, "Stian Thorgersen" <sthorger at redhat.com>
>>>>>> wrote:
>>>>>> > >>
>>>>>> > >>> Depending on the amount of users I'd use either partial import
>>>>>> through
>>>>>> > >>> the admin console (if you don't have more than a thousand or so
>>>>>> users) or
>>>>>> > >>> use the admin REST endpoints if you have quite a lot of users.
>>>>>> > >>>
>>>>>> > >>> On 20 July 2016 at 11:52, Paulo Pires <pires at littlebits.cc>
>>>>>> wrote:
>>>>>> > >>>
>>>>>> > >>>> Hi all,
>>>>>> > >>>>
>>>>>> > >>>> I'm in the process of migrating from an in-house user-role
>>>>>> storage to
>>>>>> > >>>> Keycloak and I'm looking for programmatic (Java) ways to
>>>>>> migrate all
>>>>>> > >>>> current users to the new storage. And I need your help to
>>>>>> figure out the
>>>>>> > >>>> best approach.
>>>>>> > >>>>
>>>>>> > >>>> At first, when reading KC documentation, I believed I could
>>>>>> easily
>>>>>> > >>>> achieve this by implementing a User Federation provider but
>>>>>> after diving a
>>>>>> > >>>> little more into it, and looking for examples, I can't see a
>>>>>> way to migrate
>>>>>> > >>>> all users on-demand but simply one user at a time, possible
>>>>>> during log-in.
>>>>>> > >>>>
>>>>>> > >>>> Next, I tried and look into ways, such as admin-cli, REST, etc
>>>>>> but
>>>>>> > >>>> nothing strikes me as the solution to use.
>>>>>> > >>>>
>>>>>> > >>>> Here's what I was hoping to deliver:
>>>>>> > >>>> * Get all roles and users from my soon-to-be deprecated
>>>>>> storage, e.g.
>>>>>> > >>>> MySQL tables
>>>>>> > >>>> * Add roles to KC
>>>>>> > >>>> * Iterate users and add user to KC + map roles + update
>>>>>> password hashes
>>>>>> > >>>> (here I know I need to implement a HashProvider)
>>>>>> > >>>>
>>>>>> > >>>> Any hints will be appreciated!
>>>>>> > >>>>
>>>>>> > >>>> Pires
>>>>>> > >>>>
>>>>>> > >>>> _______________________________________________
>>>>>> > >>>> keycloak-user mailing list
>>>>>> > >>>> keycloak-user at lists.jboss.org
>>>>>> > >>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>>>> > >>>>
>>>>>> > >>>
>>>>>> > >>>
>>>>>> > >
>>>>>>
>>>>>> > _______________________________________________
>>>>>> > keycloak-user mailing list
>>>>>> > keycloak-user at lists.jboss.org
>>>>>> > https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>>>>
>>>>>>
>>>>>> --
>>>>>>
>>>>>> abstractj
>>>>>> PGP: 0x84DC9914
>>>>>>
>>>>>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160721/f831804b/attachment-0001.html 

From sthorger at redhat.com  Thu Jul 21 08:53:55 2016
From: sthorger at redhat.com (Stian Thorgersen)
Date: Thu, 21 Jul 2016 14:53:55 +0200
Subject: [keycloak-user] Keycloak unable to open JDBC connection
In-Reply-To: <91099E82-6F64-40F6-9A84-971D76ED78C1@info.nl>
References: <91099E82-6F64-40F6-9A84-971D76ED78C1@info.nl>
Message-ID: <CAJgngAdH-oxoF_2VCSw-Mz=rLtucYR_e9D+mkbT4S6n3Ci-zQQ@mail.gmail.com>

Do you have any reference to the bug in WildFly?

We upgraded to WildFly 10 a long time ago in 1.8.1.

On 21 July 2016 at 14:34, Edgar Vonk - Info.nl <Edgar at info.nl> wrote:

> We also recently had an issue where Keycloak stopped working because it
> could no longer get any (Oracle) DB connections from the connection pool.
> This was not after a restart but just during normal operation.
>
> We had configured the DB connection pool to use background-validation and
> this has worked fine until recently.
>
> As mentioned in
> http://stackoverflow.com/questions/28707650/wildfly-and-auto-reconnect-to-the-database
> (linked from: https://issues.jboss.org/browse/KEYCLOAK-3204) the issue
> seems to be that starting from Wildfly 10 (?) this background validation no
> longer works due to a bug in Wildfly. As suggested there we have now
> configured the connection pool with validate-on-match set to true and we
> hope this will resolve the issue.
>
> We only started to see this issue after upgrading to Keycloak 2.0.0 and I
> think that is where Wildfly was upgraded to version 10? Or maybe it was
> just bad luck..
>
> The stack trace we had:
>
>
> Caused by: java.sql.SQLException: javax.resource.ResourceException:
> IJ000453: Unable to get managed connection for
> java:jboss/datasources/KeycloakDS
>         at
> org.jboss.jca.adapters.jdbc.WrapperDataSource.getConnection(WrapperDataSource.java:146)
>         at
> org.jboss.as.connector.subsystems.datasources.WildFlyDataSource.getConnection(WildFlyDataSource.java:66)
>         at
> org.hibernate.engine.jdbc.connections.internal.DatasourceConnectionProviderImpl.getConnection(DatasourceConnectionProviderImpl.java:122)
>         at
> org.hibernate.internal.AbstractSessionImpl$NonContextualJdbcConnectionAccess.obtainConnection(AbstractSessionImpl.java:386)
>         at
> org.hibernate.resource.jdbc.internal.LogicalConnectionManagedImpl.acquireConnectionIfNeeded(LogicalConnectionManagedImpl.java:87)
>         ... 71 more
> Caused by: javax.resource.ResourceException: IJ000453: Unable to get
> managed connection for java:jboss/datasources/KeycloakDS
>         at
> org.jboss.jca.core.connectionmanager.AbstractConnectionManager.getManagedConnection(AbstractConnectionManager.java:656)
>         at
> org.jboss.jca.core.connectionmanager.tx.TxConnectionManagerImpl.getManagedConnection(TxConnectionManagerImpl.java:429)
>         at
> org.jboss.jca.core.connectionmanager.AbstractConnectionManager.allocateConnection(AbstractConnectionManager.java:747)
>         at
> org.jboss.jca.adapters.jdbc.WrapperDataSource.getConnection(WrapperDataSource.java:138)
>         ... 75 more
> Caused by: javax.resource.ResourceException: IJ000655: No managed
> connections available within configured blocking timeout (30000 [ms])
>         at
> org.jboss.jca.core.connectionmanager.pool.mcp.SemaphoreConcurrentLinkedDequeManagedConnectionPool.getConnection(SemaphoreConcurrentLinkedDequeManagedConnectionPool.java:564)
>         at
> org.jboss.jca.core.connectionmanager.pool.AbstractPool.getSimpleConnection(AbstractPool.java:626)
>         at
> org.jboss.jca.core.connectionmanager.pool.AbstractPool.getConnection(AbstractPool.java:598)
>         at
> org.jboss.jca.core.connectionmanager.AbstractConnectionManager.getManagedConnection(AbstractConnectionManager.java:590)
>         ... 78 more
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160721/c98b252a/attachment.html 

From Edgar at info.nl  Thu Jul 21 09:20:16 2016
From: Edgar at info.nl (Edgar Vonk - Info.nl)
Date: Thu, 21 Jul 2016 13:20:16 +0000
Subject: [keycloak-user] Keycloak unable to open JDBC connection
In-Reply-To: <CAJgngAdH-oxoF_2VCSw-Mz=rLtucYR_e9D+mkbT4S6n3Ci-zQQ@mail.gmail.com>
References: <91099E82-6F64-40F6-9A84-971D76ED78C1@info.nl>
	<CAJgngAdH-oxoF_2VCSw-Mz=rLtucYR_e9D+mkbT4S6n3Ci-zQQ@mail.gmail.com>
Message-ID: <4812DC7B-7E31-43F8-BA9E-DF356D9A433E@info.nl>

Hi Stian,

Ok, thanks. I see. Maybe it is not related to Wildfly 10 after all.. I honestly do not know.

I just read this comment 'I can confirm that on Wildfly 10 you need validate-on-match true otherwise Wildfly will never reconnect successfully to the connection pool if you bounce MySQL. I've tried background validation and is doesn't work. I think this is a bug. ? (http://stackoverflow.com/questions/28707650/wildfly-and-auto-reconnect-to-the-database) and did not investigate it any further..

cheers

Edgar



On 21 Jul 2016, at 14:53, Stian Thorgersen <sthorger at redhat.com<mailto:sthorger at redhat.com>> wrote:

Do you have any reference to the bug in WildFly?

We upgraded to WildFly 10 a long time ago in 1.8.1.

On 21 July 2016 at 14:34, Edgar Vonk - Info.nl<http://info.nl> <Edgar at info.nl<mailto:Edgar at info.nl>> wrote:
We also recently had an issue where Keycloak stopped working because it could no longer get any (Oracle) DB connections from the connection pool. This was not after a restart but just during normal operation.

We had configured the DB connection pool to use background-validation and this has worked fine until recently.

As mentioned in http://stackoverflow.com/questions/28707650/wildfly-and-auto-reconnect-to-the-database (linked from: https://issues.jboss.org/browse/KEYCLOAK-3204) the issue seems to be that starting from Wildfly 10 (?) this background validation no longer works due to a bug in Wildfly. As suggested there we have now configured the connection pool with validate-on-match set to true and we hope this will resolve the issue.

We only started to see this issue after upgrading to Keycloak 2.0.0 and I think that is where Wildfly was upgraded to version 10? Or maybe it was just bad luck..

The stack trace we had:


Caused by: java.sql.SQLException: javax.resource.ResourceException: IJ000453: Unable to get managed connection for java:jboss/datasources/KeycloakDS
        at org.jboss.jca.adapters.jdbc.WrapperDataSource.getConnection(WrapperDataSource.java:146)
        at org.jboss.as.connector.subsystems.datasources.WildFlyDataSource.getConnection(WildFlyDataSource.java:66)
        at org.hibernate.engine.jdbc.connections.internal.DatasourceConnectionProviderImpl.getConnection(DatasourceConnectionProviderImpl.java:122)
        at org.hibernate.internal.AbstractSessionImpl$NonContextualJdbcConnectionAccess.obtainConnection(AbstractSessionImpl.java:386)
        at org.hibernate.resource.jdbc.internal.LogicalConnectionManagedImpl.acquireConnectionIfNeeded(LogicalConnectionManagedImpl.java:87)
        ... 71 more
Caused by: javax.resource.ResourceException: IJ000453: Unable to get managed connection for java:jboss/datasources/KeycloakDS
        at org.jboss.jca.core.connectionmanager.AbstractConnectionManager.getManagedConnection(AbstractConnectionManager.java:656)
        at org.jboss.jca.core.connectionmanager.tx.TxConnectionManagerImpl.getManagedConnection(TxConnectionManagerImpl.java:429)
        at org.jboss.jca.core.connectionmanager.AbstractConnectionManager.allocateConnection(AbstractConnectionManager.java:747)
        at org.jboss.jca.adapters.jdbc.WrapperDataSource.getConnection(WrapperDataSource.java:138)
        ... 75 more
Caused by: javax.resource.ResourceException: IJ000655: No managed connections available within configured blocking timeout (30000 [ms])
        at org.jboss.jca.core.connectionmanager.pool.mcp.SemaphoreConcurrentLinkedDequeManagedConnectionPool.getConnection(SemaphoreConcurrentLinkedDequeManagedConnectionPool.java:564)
        at org.jboss.jca.core.connectionmanager.pool.AbstractPool.getSimpleConnection(AbstractPool.java:626)
        at org.jboss.jca.core.connectionmanager.pool.AbstractPool.getConnection(AbstractPool.java:598)
        at org.jboss.jca.core.connectionmanager.AbstractConnectionManager.getManagedConnection(AbstractConnectionManager.java:590)
        ... 78 more
_______________________________________________
keycloak-user mailing list
keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>
https://lists.jboss.org/mailman/listinfo/keycloak-user


-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160721/817edbec/attachment-0001.html 

From derek.visch at gmail.com  Thu Jul 21 17:21:09 2016
From: derek.visch at gmail.com (Derek Visch)
Date: Thu, 21 Jul 2016 17:21:09 -0400
Subject: [keycloak-user] Reverse Proxy - SSL Termination - Invalid
	parameter: redirect uri
Message-ID: <CADhyb+H00T7O-1YAggkX2-5OBt75WbpyxJYk=cyFJuq8SSXM8A@mail.gmail.com>

Trying to setup reverse SSL for keycloak. Having issues finding
documentation about this, it's mentioned in
https://keycloak.gitbooks.io/server-installation-and-configuration/content/v/2.0/topics/network/https.html
but the extra detail that's supposed to be in
https://keycloak.gitbooks.io/server-adminstration-guide/content/ I could
not find in regards to reverse SSL proxys.

Regardless I ended up following
http://lists.jboss.org/pipermail/keycloak-user/2014-June/000453.html

>From that previous mailling list post:

Follow the documentation for your web server to enable SSL and
configure reverse proxy for Keycloak. It is important that you make
sure the web server sets the X-Forwarded-For and X-Forwarded-Proto
headers on the requests made to Keycloak. Next you need to enable
proxy-address-forwarding on the Keycloak http connector. Assuming that
your reverse proxy doesn't use port 8443 for SSL you also need to
configure what port http traffic is redirected to. This is done by
editing standalone/configuration/standalone.xml.

First add proxy-address-forwarding and redirect-socket to the
http-listener element:

<subsystem xmlns="urn:jboss:domain:undertow:1.1">
    ...
    <http-listener name="default" socket-binding="http"
proxy-address-forwarding="true" redirect-socket="proxy-https"/>
    ...
</subsystem>

Then add a new socket-binding element to the socket-binding-group element:

<socket-binding-group name="standard-sockets"
default-interface="public"
port-offset="${jboss.socket.binding.port-offset:0}">
    ...
    <socket-binding name="proxy-https" port="443"/>
    ...
</socket-binding-group>



but now when I go to log on to the admin console I get "We're sorry ...
Invalid aparameter: redirect uri".



Tried stack overflow / google / IRC. No luck so far.

Any help would be appreciated :D

Thanks
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160721/e5746744/attachment.html 

From Markus.Lauer at co-met.info  Fri Jul 22 03:47:13 2016
From: Markus.Lauer at co-met.info (Lauer Markus)
Date: Fri, 22 Jul 2016 07:47:13 +0000
Subject: [keycloak-user] jetty-maven-plugin + Keycloak Jetty Adapter
Message-ID: <1469173574.4265.11.camel@co-met.info>

Hi,

Is there a way to use the keycloak adapter with jetty-maven-plugin?

I tried with no success:

<plugin>
  <groupId>org.eclipse.jetty</groupId>
  <artifactId>jetty-maven-plugin</artifactId>
  <version>9.2.3.v20140905</version>
  <configuration>
    <webApp>
<extraClasspath>${keycloak-jetty-adapter}/lib/keycloak/bcpkix-jdk15on-1.52.jar;
${keycloak-jetty-adapter}/lib/keycloak/commons-logging-1.2.jar;
${keycloak-jetty-adapter}/lib/keycloak/jackson-annotations-2.5.4.jar;
${keycloak-jetty-adapter}/lib/keycloak/jboss-logging-3.3.0.Final.jar;
${keycloak-jetty-adapter}/lib/keycloak/keycloak-common-2.0.0.Final.jar;
${keycloak-jetty-adapter}/lib/keycloak/keycloak-jetty-adapter-spi-2.0.0.Final.jar;
${keycloak-jetty-adapter}/lib/keycloak/bcprov-jdk15on-1.52.jar;
${keycloak-jetty-adapter}/lib/keycloak/httpclient-4.5.jar;
${keycloak-jetty-adapter}/lib/keycloak/jackson-core-2.5.4.jar;
${keycloak-jetty-adapter}/lib/keycloak/keycloak-adapter-core-2.0.0.Final.jar;
${keycloak-jetty-adapter}/lib/keycloak/keycloak-core-2.0.0.Final.jar;
${keycloak-jetty-adapter}/lib/keycloak/keycloak-jetty-core-2.0.0.Final.jar;
${keycloak-jetty-adapter}/lib/keycloak/commons-codec-1.9.jar;
${keycloak-jetty-adapter}/lib/keycloak/httpcore-4.4.1.jar;
${keycloak-jetty-adapter}/lib/keycloak/jackson-databind-2.5.4.jar;
${keycloak-jetty-adapter}/lib/keycloak/keycloak-adapter-spi-2.0.0.Final.jar;
${keycloak-jetty-adapter}/lib/keycloak/keycloak-jetty92-adapter-2.0.0.Final.jar
      </extraClasspath>
    </webApp>
    <scanIntervalSeconds>2</scanIntervalSeconds>
  </configuration>
</plugin>


Where ${keycloak-jetty-adapter} is a path with the contents of
keycloak-jetty92-adapter-dist-2.0.0.Final.tar.gz


Running mvn jetty:run throws a ClassNotFoundException:

[WARNING] FAILED
org.eclipse.jetty.security.ConstraintSecurityHandler at 834e986:
java.lang.NoClassDefFoundError:
org/eclipse/jetty/server/handler/ContextHandler
java.lang.NoClassDefFoundError:
org/eclipse/jetty/server/handler/ContextHandler
at
org.keycloak.adapters.jetty.core.AbstractKeycloakJettyAuthenticator.initializeKeycloak(AbstractKeycloakJettyAuthenticator.java:221)
at
org.keycloak.adapters.jetty.core.AbstractKeycloakJettyAuthenticator.setConfiguration(AbstractKeycloakJettyAuthenticator.java:175)
at
org.eclipse.jetty.security.SecurityHandler.doStart(SecurityHandler.java:384)
...



Thanks,

Markus.






________________________________

Zum Lesen der rechtlichen Hinweise dieser Mail, kopieren Sie bitte die aufgef?hrte URL in Ihren Browser oder folgen Sie dem Link.

http://disclaimer.tec-saar.de/co-met.htm
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 4628 bytes
Desc: not available
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20160722/b8af20f1/attachment.bin 

From velias at redhat.com  Fri Jul 22 04:33:44 2016
From: velias at redhat.com (Vlastimil Elias)
Date: Fri, 22 Jul 2016 10:33:44 +0200
Subject: [keycloak-user] Initiation of Registration form instead of Login
 form from OIDC client Java adapter
Message-ID: <973411d1-44a5-1235-de49-2e8bf2ec1838@redhat.com>

Hi,

we use OIDC client Java adapter to authenticate our java app deployed in 
EAP 6 with keycloak. Now we have a requirement to show Keycloak's 
Registration form instead of Login form.
Is this somehow possible with java client adapter (as it is possible 
with javascript adapter). I was not able to find this feature in 
documentation.

Ideal solution should be if client java app should be able to 
dynamically request which form to show, but hard config solution which 
will always point reg form may work also.

Thanks a lot in advance for your help

Vlastimil

-- 
Vlastimil Elias
Principal Software Engineer
Red Hat Developer | Engineering


From velias at redhat.com  Fri Jul 22 04:54:14 2016
From: velias at redhat.com (Vlastimil Elias)
Date: Fri, 22 Jul 2016 10:54:14 +0200
Subject: [keycloak-user] One click social-account linking widgets on website
 autheticated by Keycloak JS adapter
Message-ID: <ea7740b3-1632-cee5-2f81-474aa641ae41@redhat.com>

Hi,

we have a requirement to implement 'One click social-account linking 
widgets' on website autheticated by Keycloak JS adapter. To achieve this 
a button would be placed on the website with the following flow:

 1. User logs into the website (keycloak JS adapter)
 2. User browser to a part of the site requiring social account linking
    (site checks linking status of current user for given social login
    provider based on info in token - we wrote our mapper for this)
 3. User clicks on a button to link the required social account with his
    Keycloak account
 4. User is directed through the linking process (which is similar as
    Social Link action in Account app)
 5. User is returned to original page on successful account linking
    (token in js client must be refreshed to contain actual info about
    social links).

Is there any way how to achieve this? I tried to call JS client login 
method with idpHint when user is logged in 
(keycloak.login({"idpHint":"github"})), but it doesn't work as expected.

Thanks a lot in advance

Vlastimil

-- 
Vlastimil Elias
Principal Software Engineer
Red Hat Developer | Engineering

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160722/82da8f97/attachment.html 

From Markus.Lauer at co-met.info  Fri Jul 22 05:05:53 2016
From: Markus.Lauer at co-met.info (Lauer Markus)
Date: Fri, 22 Jul 2016 09:05:53 +0000
Subject: [keycloak-user] jetty-maven-plugin + Keycloak Jetty Adapter
In-Reply-To: <1469173574.4265.11.camel@co-met.info>
References: <1469173574.4265.11.camel@co-met.info>
Message-ID: <1469178294.4265.15.camel@co-met.info>

Finally found an easy way:

<plugin>
  <groupId>org.eclipse.jetty</groupId>
  <artifactId>jetty-maven-plugin</artifactId>
  <version>9.2.3.v20140905</version>
  <configuration>
    <scanIntervalSeconds>2</scanIntervalSeconds>
  </configuration>
  <dependencies>
    <dependency>
      <groupId>org.keycloak</groupId>
      <artifactId>keycloak-jetty92-adapter</artifactId>
      <version>2.0.0.Final</version>
    </dependency>
  </dependencies>
</plugin>

Maybe someone wants to add this to
https://keycloak.gitbooks.io/securing-client-applications-guide/content/v/2.0/topics/oidc/java/jetty9-adapter.html


Am Freitag, den 22.07.2016, 07:47 +0000 schrieb Lauer Markus:
> Hi,
> 
> Is there a way to use the keycloak adapter with jetty-maven-plugin?
> 
> I tried with no success:
> 
> <plugin>
>   <groupId>org.eclipse.jetty</groupId>
>   <artifactId>jetty-maven-plugin</artifactId>
>   <version>9.2.3.v20140905</version>
>   <configuration>
>     <webApp>
> <extraClasspath>${keycloak-jetty-adapter}/lib/keycloak/bcpkix-jdk15on-1.52.jar;
> ${keycloak-jetty-adapter}/lib/keycloak/commons-logging-1.2.jar;
> ${keycloak-jetty-adapter}/lib/keycloak/jackson-annotations-2.5.4.jar;
> ${keycloak-jetty-adapter}/lib/keycloak/jboss-logging-3.3.0.Final.jar;
> ${keycloak-jetty-adapter}/lib/keycloak/keycloak-common-2.0.0.Final.jar;
> ${keycloak-jetty-adapter}/lib/keycloak/keycloak-jetty-adapter-spi-2.0.0.Final.jar;
> ${keycloak-jetty-adapter}/lib/keycloak/bcprov-jdk15on-1.52.jar;
> ${keycloak-jetty-adapter}/lib/keycloak/httpclient-4.5.jar;
> ${keycloak-jetty-adapter}/lib/keycloak/jackson-core-2.5.4.jar;
> ${keycloak-jetty-adapter}/lib/keycloak/keycloak-adapter-core-2.0.0.Final.jar;
> ${keycloak-jetty-adapter}/lib/keycloak/keycloak-core-2.0.0.Final.jar;
> ${keycloak-jetty-adapter}/lib/keycloak/keycloak-jetty-core-2.0.0.Final.jar;
> ${keycloak-jetty-adapter}/lib/keycloak/commons-codec-1.9.jar;
> ${keycloak-jetty-adapter}/lib/keycloak/httpcore-4.4.1.jar;
> ${keycloak-jetty-adapter}/lib/keycloak/jackson-databind-2.5.4.jar;
> ${keycloak-jetty-adapter}/lib/keycloak/keycloak-adapter-spi-2.0.0.Final.jar;
> ${keycloak-jetty-adapter}/lib/keycloak/keycloak-jetty92-adapter-2.0.0.Final.jar
>       </extraClasspath>
>     </webApp>
>     <scanIntervalSeconds>2</scanIntervalSeconds>
>   </configuration>
> </plugin>
> 
> 
> Where ${keycloak-jetty-adapter} is a path with the contents of
> keycloak-jetty92-adapter-dist-2.0.0.Final.tar.gz
> 
> 
> Running mvn jetty:run throws a ClassNotFoundException:
> 
> [WARNING] FAILED
> org.eclipse.jetty.security.ConstraintSecurityHandler at 834e986:
> java.lang.NoClassDefFoundError:
> org/eclipse/jetty/server/handler/ContextHandler
> java.lang.NoClassDefFoundError:
> org/eclipse/jetty/server/handler/ContextHandler
> at
> org.keycloak.adapters.jetty.core.AbstractKeycloakJettyAuthenticator.initializeKeycloak(AbstractKeycloakJettyAuthenticator.java:221)
> at
> org.keycloak.adapters.jetty.core.AbstractKeycloakJettyAuthenticator.setConfiguration(AbstractKeycloakJettyAuthenticator.java:175)
> at
> org.eclipse.jetty.security.SecurityHandler.doStart(SecurityHandler.java:384)
> ...
> 
> 
> 
> Thanks,
> 
> Markus.
> 
> 
> 
> 
> 
> 
> ________________________________
> 
> Zum Lesen der rechtlichen Hinweise dieser Mail, kopieren Sie bitte die aufgef?hrte URL in Ihren Browser oder folgen Sie dem Link.
> 
> http://disclaimer.tec-saar.de/co-met.htm
> +----------------------------------------------------------------------+
> | SecureMail-Gateway - Stadtwerke Saarbruecken
>                         |
> | Ein Dienst fr EMail Signatur und Verschluesselung                   |
> +----------------------------------------------------------------------+
> | - Die Nachricht war weder verschluesselt noch digital unterschrieben |
> +----------------------------------------------------------------------+
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
> +----------------------------------------------------------------------+
> | SecureMail-Gateway - Stadtwerke Saarbruecken
>                         |
> | Ein Dienst fr EMail Signatur und Verschluesselung                   |
> +----------------------------------------------------------------------+
> | - Die Nachricht war weder verschluesselt noch digital unterschrieben |
> +----------------------------------------------------------------------+

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 4628 bytes
Desc: not available
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20160722/18adf707/attachment-0001.bin 

From valerij.timofeev at gmail.com  Fri Jul 22 05:18:21 2016
From: valerij.timofeev at gmail.com (Valerij Timofeev)
Date: Fri, 22 Jul 2016 11:18:21 +0200
Subject: [keycloak-user] [KEYCLOAK-2741] Don't remove KEYCLOAK_REMEMBERME
 cookie when sso session expires. Add timeout for KEYCLOAK_REMEMBERME cookie
 - JBoss Issue Tracker
Message-ID: <CAOy2obGGXk4zZb9=r4GYcE7+OVYkhpsiLhvA5EMuVGoUhbqCyw@mail.gmail.com>

https://issues.jboss.org/browse/KEYCLOAK-2741

Hi,

are there any concret plans to implement this ticket?

The current implementation does not find any positive feedback by our
customers. We are even thinking about increasing SSO timeout from 30
minutes to a couple of days to compensate at least a little bit the current
drawback. Would this break normal operation of the Keycloak servers?

Would it be enough to implement this ticket to provide full "remember me"
feature? Can cookie authenticator (auth-cookie) start a new SSO session if
the initial one is already expired?

Kind regards
Valerij Timofeev
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160722/8dd0f7cd/attachment.html 

From pires at littlebits.cc  Fri Jul 22 05:41:20 2016
From: pires at littlebits.cc (Paulo Pires)
Date: Fri, 22 Jul 2016 09:41:20 +0000
Subject: [keycloak-user] How to migrate users and roles from in-house
	storage
In-Reply-To: <CAO8YOYW8MeFo4N0S3dy96qzqyJvd51APrq3UJjwh-gbKMjhO1Q@mail.gmail.com>
References: <CAO8YOYXtZtJ2QPBM9G9QUyeZrTDWPBZ9HbtEg9GWtW+tFfCRaA@mail.gmail.com>
	<CAJgngAdBpQCuacX1Wc0vUXBwanYwSjNctSjdWcNO1JUhwjWJNw@mail.gmail.com>
	<CAO8YOYW8d6XcLqWpfR31F12wxDoREq8Jvt4SNvQByz-0GsY+CA@mail.gmail.com>
	<CAJgngAe8v8Xq22UfbqNRSv8bf6RJTJ_7K3e2SoS39fhEJ8o8qA@mail.gmail.com>
	<CAO8YOYVPMh4A1CSpoqqx2bAmYconxWPGN=VZ+JKa5=oTOEi=HA@mail.gmail.com>
	<20160720203018.GA8462@abstractj.org>
	<CAO8YOYXES7btCwY8T+=XKcRucFVsMBH_5Z5Eq4T5j84mLh=O-w@mail.gmail.com>
	<CAO8YOYUHpTLoFBw-dxt8syyOrpORq0rio-kk5F9s-vp3zrzz9Q@mail.gmail.com>
	<CAO8YOYVoK_KC1yk5LQZ=6Q+kKXLAcN+EVuybPmUcZxz0aHKDWQ@mail.gmail.com>
	<CAO8YOYVZuQbY_v=fDtc3JUXdH_bJqo10RPEnuZZCTjCgxGYxvw@mail.gmail.com>
	<CAJgngAceA5iL9=1YW4gJR-tKCjFk5ahZcOc9QvJaWyPR27V+_Q@mail.gmail.com>
	<CAO8YOYW8MeFo4N0S3dy96qzqyJvd51APrq3UJjwh-gbKMjhO1Q@mail.gmail.com>
Message-ID: <CAO8YOYVbHt-kA+m69AP5Z8fakLNE_Kzn_HEmfy5G+MZDcbxG0A@mail.gmail.com>

Updated PR!

But now I'm hitting another wall: password migration.

The app I'm replacing generated a random salt per user, stored it and then
used SHA-512(password, iterations, pepper, salt) to hash the password -
iterations and pepper are static. Now, I want to import this to Keycloak
and use bcrypt to hash the old hash. Obviously, I'll still need to be able
to generate the old hash when validating on KC log-in, right?

I also want that new users to just have bcrypt and not the old hashing
thing.

Now, I know that I can implement a PasswordHashProvider, but I'm not sure
exactly where to store and how to read information like the old salt, or
how to split between users that were migrated and need to use old hash +
brcrypt hash AND users that were created directly in KC and just need
bcrypt hash.

Any help is highly appreciated,
Pires

On Thu, Jul 21, 2016 at 1:46 PM Paulo Pires <pires at littlebits.cc> wrote:

> Oh, awesome! Going to add tests, open JIRA ticket and update PR.
>
> Thanks Stian,
> Pires
>
> On Thu, Jul 21, 2016 at 1:13 PM Stian Thorgersen <sthorger at redhat.com>
> wrote:
>
>> We like cowboy style :)
>>
>> Could you add a JIRA please?
>>
>> Also you could add tests to
>> https://github.com/keycloak/keycloak/blob/master/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/realm/RealmTest.java
>>
>> On 21 July 2016 at 13:13, Paulo Pires <pires at littlebits.cc> wrote:
>>
>>> I went ahead, cowboy style and opened a PR for it
>>> https://github.com/keycloak/keycloak/pull/3056
>>>
>>> Couldn't find tests so didn't add any.
>>>
>>> Pires
>>>
>>> On Thu, Jul 21, 2016 at 12:06 PM Paulo Pires <pires at littlebits.cc>
>>> wrote:
>>>
>>>> Something like this should work though:
>>>>
>>>> @GET
>>>> @Produces({"application/json"})
>>>> @Path("default-roles")
>>>> List<RoleRepresentation> getDefaultRoles();
>>>>
>>>> @PUT
>>>> @Path("default-roles/{roleId}")
>>>> void addDefaultRole(@PathParam("roleId") String roleId);
>>>>
>>>> @DELETE
>>>> @Path("default-roles/{roleId}")
>>>> void removeDefaultRole(@PathParam("roleId") String roleId);
>>>>
>>>> On Thu, Jul 21, 2016 at 12:03 PM Paulo Pires <pires at littlebits.cc>
>>>> wrote:
>>>>
>>>>> It's working like a charm :)
>>>>>
>>>>> Some things I learned:
>>>>> * Need to import resteasy deps for keycloak-admin-cli explicitly
>>>>> * Methods won't return errors but will throw InvocationTargetException
>>>>> (must be checked)
>>>>>
>>>>> Question: is there a way to set default roles? I can't seem to find it
>>>>> in the Java code but it is available through REST.
>>>>>
>>>>> Thanks,
>>>>> Pires
>>>>>
>>>>> On Thu, Jul 21, 2016 at 8:47 AM Paulo Pires <pires at littlebits.cc>
>>>>> wrote:
>>>>>
>>>>>> Thank you Bruno, I haven't been able to verify your code but I assume
>>>>>> you're sharing it because it works.
>>>>>>
>>>>>> It seems pretty trivial, awesome!
>>>>>>
>>>>>> Cheers,
>>>>>> Pires
>>>>>>
>>>>>> On Wed, Jul 20, 2016 at 9:30 PM Bruno Oliveira <bruno at abstractj.org>
>>>>>> wrote:
>>>>>>
>>>>>>> Note sure if it helps, but an example about how to do it
>>>>>>> programatically is here[1].
>>>>>>>
>>>>>>> I just adapted from the admin-client[2].
>>>>>>>
>>>>>>>
>>>>>>> [1] -
>>>>>>> https://gist.github.com/abstractj/78b127e8c9273cdcea6eb82a1cfc153c
>>>>>>> [2] -
>>>>>>> https://github.com/keycloak/keycloak/tree/master/examples/admin-client
>>>>>>>
>>>>>>> On 2016-07-20, Paulo Pires wrote:
>>>>>>> > I did check the admin-cli JAR but it's not clear how to add roles
>>>>>>> and
>>>>>>> > users, or if it's even implemented (I did check the REST API and
>>>>>>> there's
>>>>>>> > endpoints for that).
>>>>>>> >
>>>>>>> > Thank you very much for clarifying,
>>>>>>> > Pires
>>>>>>> >
>>>>>>> > On Wed, Jul 20, 2016 at 2:52 PM Stian Thorgersen <
>>>>>>> sthorger at redhat.com>
>>>>>>> > wrote:
>>>>>>> >
>>>>>>> > > Yep, take a look at
>>>>>>> > >
>>>>>>> https://keycloak.gitbooks.io/server-developer-guide/content/topics/admin-rest-api.html
>>>>>>> > >
>>>>>>> > > On 20 July 2016 at 15:33, Paulo Pires <pires at littlebits.cc>
>>>>>>> wrote:
>>>>>>> > >
>>>>>>> > >> More than 150k. Is there a Java library for the REST api?
>>>>>>> > >>
>>>>>>> > >> On Jul 20, 2016 13:56, "Stian Thorgersen" <sthorger at redhat.com>
>>>>>>> wrote:
>>>>>>> > >>
>>>>>>> > >>> Depending on the amount of users I'd use either partial import
>>>>>>> through
>>>>>>> > >>> the admin console (if you don't have more than a thousand or
>>>>>>> so users) or
>>>>>>> > >>> use the admin REST endpoints if you have quite a lot of users.
>>>>>>> > >>>
>>>>>>> > >>> On 20 July 2016 at 11:52, Paulo Pires <pires at littlebits.cc>
>>>>>>> wrote:
>>>>>>> > >>>
>>>>>>> > >>>> Hi all,
>>>>>>> > >>>>
>>>>>>> > >>>> I'm in the process of migrating from an in-house user-role
>>>>>>> storage to
>>>>>>> > >>>> Keycloak and I'm looking for programmatic (Java) ways to
>>>>>>> migrate all
>>>>>>> > >>>> current users to the new storage. And I need your help to
>>>>>>> figure out the
>>>>>>> > >>>> best approach.
>>>>>>> > >>>>
>>>>>>> > >>>> At first, when reading KC documentation, I believed I could
>>>>>>> easily
>>>>>>> > >>>> achieve this by implementing a User Federation provider but
>>>>>>> after diving a
>>>>>>> > >>>> little more into it, and looking for examples, I can't see a
>>>>>>> way to migrate
>>>>>>> > >>>> all users on-demand but simply one user at a time, possible
>>>>>>> during log-in.
>>>>>>> > >>>>
>>>>>>> > >>>> Next, I tried and look into ways, such as admin-cli, REST,
>>>>>>> etc but
>>>>>>> > >>>> nothing strikes me as the solution to use.
>>>>>>> > >>>>
>>>>>>> > >>>> Here's what I was hoping to deliver:
>>>>>>> > >>>> * Get all roles and users from my soon-to-be deprecated
>>>>>>> storage, e.g.
>>>>>>> > >>>> MySQL tables
>>>>>>> > >>>> * Add roles to KC
>>>>>>> > >>>> * Iterate users and add user to KC + map roles + update
>>>>>>> password hashes
>>>>>>> > >>>> (here I know I need to implement a HashProvider)
>>>>>>> > >>>>
>>>>>>> > >>>> Any hints will be appreciated!
>>>>>>> > >>>>
>>>>>>> > >>>> Pires
>>>>>>> > >>>>
>>>>>>> > >>>> _______________________________________________
>>>>>>> > >>>> keycloak-user mailing list
>>>>>>> > >>>> keycloak-user at lists.jboss.org
>>>>>>> > >>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>>>>> > >>>>
>>>>>>> > >>>
>>>>>>> > >>>
>>>>>>> > >
>>>>>>>
>>>>>>> > _______________________________________________
>>>>>>> > keycloak-user mailing list
>>>>>>> > keycloak-user at lists.jboss.org
>>>>>>> > https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>>>>>
>>>>>>>
>>>>>>> --
>>>>>>>
>>>>>>> abstractj
>>>>>>> PGP: 0x84DC9914
>>>>>>>
>>>>>>
>>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160722/2271702f/attachment.html 

From nielsbne at gmail.com  Fri Jul 22 05:49:13 2016
From: nielsbne at gmail.com (Niels Bertram)
Date: Fri, 22 Jul 2016 19:49:13 +1000
Subject: [keycloak-user] Reverse Proxy - SSL Termination - Invalid
 parameter: redirect uri
In-Reply-To: <CADhyb+H00T7O-1YAggkX2-5OBt75WbpyxJYk=cyFJuq8SSXM8A@mail.gmail.com>
References: <CADhyb+H00T7O-1YAggkX2-5OBt75WbpyxJYk=cyFJuq8SSXM8A@mail.gmail.com>
Message-ID: <CAPLPygnivq1SP0T_ox=jgS6K+HJebLgbaNAek9sRuDz4+AOQAw@mail.gmail.com>

You may be missing the ProxyPeerHandler filter registration with your
undertow subsystem. Below example of running keycloak behind a stock
standard Apache Reverse proxy configuration with the corresponsing undertow
subsystem configuration.

I never understood what that proxy-https port configuration in the binding
was good for (I think its a copy paste habit or legacy) using the default
8443 one has always worked for me.

<subsystem xmlns="urn:jboss:domain:undertow:3.0">
    <buffer-cache name="default"/>
    <server name="default-server">
        <ajp-listener name="ajp-default" socket-binding="ajp"
redirect-socket="https" scheme="https"/>
        <http-listener name="http-default" socket-binding="http"
redirect-socket="https" proxy-address-forwarding="true"/>
        <host name="default-host" alias="localhost">
            <location name="/" handler="welcome-content"/>
            <filter-ref name="server-header"/>
            <filter-ref name="x-powered-by-header"/>
            <filter-ref name="proxy-peer"/>
            <filter-ref name="request-dumper" priority="30"/>
        </host>
    </server>
    <servlet-container name="default">
        <jsp-config/>
        <websockets/>
    </servlet-container>
    <handlers>
        <file name="welcome-content"
path="${jboss.home.dir}/welcome-content"/>
    </handlers>
    <filters>
        <response-header name="server-header" header-name="Server"
header-value="WildFly/10"/>
        <response-header name="x-powered-by-header"
header-name="X-Powered-By" header-value="Undertow/1"/>
        <filter name="proxy-peer" module="io.undertow.core"
class-name="io.undertow.server.handlers.ProxyPeerAddressHandler"/>
        <filter name="request-dumper" module="io.undertow.core"
class-name="io.undertow.server.handlers.RequestDumpingHandler"/>
    </filters>
</subsystem>

The socket config

<socket-binding-group name="standard-sockets" default-interface="public"
port-offset="${jboss.socket.binding.port-offset:0}">
    <socket-binding name="management-http" interface="management"
port="${jboss.management.http.port:9990}"/>
    <socket-binding name="management-https" interface="management"
port="${jboss.management.https.port:9993}"/>
    <socket-binding name="ajp" port="${jboss.ajp.port:8009}"/>
    <socket-binding name="http" port="${jboss.http.port:8080}"/>
    <socket-binding name="https" port="${jboss.https.port:8443}"/>
    <socket-binding name="txn-recovery-environment" port="4712"/>
    <socket-binding name="txn-status-manager" port="4713"/>
    <outbound-socket-binding name="mail-smtp">
        <remote-destination host="localhost" port="25"/>
    </outbound-socket-binding>
</socket-binding-group>

And the minimalistic snippet that goes into the apache vhost config (apache
2.4)

<VirtualHost *:80>
  DocumentRoot /var/www
  ServerName your.server.com
  RewriteEngine On
  RewriteCond %{HTTPS} !=on
  RewriteRule ^/?(.*) https://%{SERVER_NAME}/$1 [R=301,L]
  ... logging config
</VirtualHost>

<VirtualHost *:443>
  DocumentRoot /var/www
  ServerName your.server.com
  ... ssl config

  ProxyRequests Off
  ProxyPreserveHost On
  <Proxy *>
    RequestHeader set X-Forwarded-Proto "https"
    Require all granted
  </Proxy>

  # ajp works a charm
  ProxyPass /auth ajp://127.0.0.1:8009/auth
  ProxyPassReverse /auth ajp://127.0.0.1:8009/auth

  # or hit the http port
  ProxyPass /auth http://127.0.0.1:8080/auth
  ProxyPassReverse /auth http://127.0.0.1:8080/auth

  ... logging config
</VirtualHost>


Hope this solves your problem.

Cheers,
Niels


On Fri, Jul 22, 2016 at 7:21 AM, Derek Visch <derek.visch at gmail.com> wrote:

> Trying to setup reverse SSL for keycloak. Having issues finding
> documentation about this, it's mentioned in
> https://keycloak.gitbooks.io/server-installation-and-configuration/content/v/2.0/topics/network/https.html
> but the extra detail that's supposed to be in
> https://keycloak.gitbooks.io/server-adminstration-guide/content/ I could
> not find in regards to reverse SSL proxys.
>
> Regardless I ended up following
> http://lists.jboss.org/pipermail/keycloak-user/2014-June/000453.html
>
> From that previous mailling list post:
>
> Follow the documentation for your web server to enable SSL and configure reverse proxy for Keycloak. It is important that you make sure the web server sets the X-Forwarded-For and X-Forwarded-Proto headers on the requests made to Keycloak. Next you need to enable proxy-address-forwarding on the Keycloak http connector. Assuming that your reverse proxy doesn't use port 8443 for SSL you also need to configure what port http traffic is redirected to. This is done by editing standalone/configuration/standalone.xml.
>
> First add proxy-address-forwarding and redirect-socket to the http-listener element:
>
> <subsystem xmlns="urn:jboss:domain:undertow:1.1">
>     ...
>     <http-listener name="default" socket-binding="http" proxy-address-forwarding="true" redirect-socket="proxy-https"/>
>     ...
> </subsystem>
>
> Then add a new socket-binding element to the socket-binding-group element:
>
> <socket-binding-group name="standard-sockets" default-interface="public" port-offset="${jboss.socket.binding.port-offset:0}">
>     ...
>     <socket-binding name="proxy-https" port="443"/>
>     ...
> </socket-binding-group>
>
>
>
> but now when I go to log on to the admin console I get "We're sorry ...
> Invalid aparameter: redirect uri".
>
>
>
> Tried stack overflow / google / IRC. No luck so far.
>
> Any help would be appreciated :D
>
> Thanks
>
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160722/1f55e55f/attachment-0001.html 

From pires at littlebits.cc  Fri Jul 22 06:25:39 2016
From: pires at littlebits.cc (Paulo Pires)
Date: Fri, 22 Jul 2016 10:25:39 +0000
Subject: [keycloak-user] How to migrate users and roles from in-house
	storage
In-Reply-To: <CAO8YOYVbHt-kA+m69AP5Z8fakLNE_Kzn_HEmfy5G+MZDcbxG0A@mail.gmail.com>
References: <CAO8YOYXtZtJ2QPBM9G9QUyeZrTDWPBZ9HbtEg9GWtW+tFfCRaA@mail.gmail.com>
	<CAJgngAdBpQCuacX1Wc0vUXBwanYwSjNctSjdWcNO1JUhwjWJNw@mail.gmail.com>
	<CAO8YOYW8d6XcLqWpfR31F12wxDoREq8Jvt4SNvQByz-0GsY+CA@mail.gmail.com>
	<CAJgngAe8v8Xq22UfbqNRSv8bf6RJTJ_7K3e2SoS39fhEJ8o8qA@mail.gmail.com>
	<CAO8YOYVPMh4A1CSpoqqx2bAmYconxWPGN=VZ+JKa5=oTOEi=HA@mail.gmail.com>
	<20160720203018.GA8462@abstractj.org>
	<CAO8YOYXES7btCwY8T+=XKcRucFVsMBH_5Z5Eq4T5j84mLh=O-w@mail.gmail.com>
	<CAO8YOYUHpTLoFBw-dxt8syyOrpORq0rio-kk5F9s-vp3zrzz9Q@mail.gmail.com>
	<CAO8YOYVoK_KC1yk5LQZ=6Q+kKXLAcN+EVuybPmUcZxz0aHKDWQ@mail.gmail.com>
	<CAO8YOYVZuQbY_v=fDtc3JUXdH_bJqo10RPEnuZZCTjCgxGYxvw@mail.gmail.com>
	<CAJgngAceA5iL9=1YW4gJR-tKCjFk5ahZcOc9QvJaWyPR27V+_Q@mail.gmail.com>
	<CAO8YOYW8MeFo4N0S3dy96qzqyJvd51APrq3UJjwh-gbKMjhO1Q@mail.gmail.com>
	<CAO8YOYVbHt-kA+m69AP5Z8fakLNE_Kzn_HEmfy5G+MZDcbxG0A@mail.gmail.com>
Message-ID: <CAO8YOYX6gdu+-_22z9K8zOn4mbqG75YcAXvVyLQQeySHucKX0g@mail.gmail.com>

Allow me some rubber-ducking here..

1) Add user attributes (old salt, etc.) when migrating a user
2) Implement authenticator that:
  2.1) Get user by username/email, if not present, fail
  2.2) Retrieve user attributes
  2.3) If user attributes include old salt, hence user has been migrated,
hash input password (cleartext) and pass it to
context.getSession().users().validCredentials(...)
  2.4) If user attributes don't include old salt, hence user was created in
KC, pass input password(cleartext) to
context.getSession().users().validCredentials(...)

If this is proven to work - and there's no better way to do it - one may
verify validCredentials(...) return-value, and if it is validated
successfully, and the user is migrated, can we replace current user model
password with a new one?

Pires

On Fri, Jul 22, 2016 at 10:41 AM Paulo Pires <pires at littlebits.cc> wrote:

> Updated PR!
>
> But now I'm hitting another wall: password migration.
>
> The app I'm replacing generated a random salt per user, stored it and then
> used SHA-512(password, iterations, pepper, salt) to hash the password -
> iterations and pepper are static. Now, I want to import this to Keycloak
> and use bcrypt to hash the old hash. Obviously, I'll still need to be able
> to generate the old hash when validating on KC log-in, right?
>
> I also want that new users to just have bcrypt and not the old hashing
> thing.
>
> Now, I know that I can implement a PasswordHashProvider, but I'm not sure
> exactly where to store and how to read information like the old salt, or
> how to split between users that were migrated and need to use old hash +
> brcrypt hash AND users that were created directly in KC and just need
> bcrypt hash.
>
> Any help is highly appreciated,
> Pires
>
> On Thu, Jul 21, 2016 at 1:46 PM Paulo Pires <pires at littlebits.cc> wrote:
>
>> Oh, awesome! Going to add tests, open JIRA ticket and update PR.
>>
>> Thanks Stian,
>> Pires
>>
>> On Thu, Jul 21, 2016 at 1:13 PM Stian Thorgersen <sthorger at redhat.com>
>> wrote:
>>
>>> We like cowboy style :)
>>>
>>> Could you add a JIRA please?
>>>
>>> Also you could add tests to
>>> https://github.com/keycloak/keycloak/blob/master/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/realm/RealmTest.java
>>>
>>> On 21 July 2016 at 13:13, Paulo Pires <pires at littlebits.cc> wrote:
>>>
>>>> I went ahead, cowboy style and opened a PR for it
>>>> https://github.com/keycloak/keycloak/pull/3056
>>>>
>>>> Couldn't find tests so didn't add any.
>>>>
>>>> Pires
>>>>
>>>> On Thu, Jul 21, 2016 at 12:06 PM Paulo Pires <pires at littlebits.cc>
>>>> wrote:
>>>>
>>>>> Something like this should work though:
>>>>>
>>>>> @GET
>>>>> @Produces({"application/json"})
>>>>> @Path("default-roles")
>>>>> List<RoleRepresentation> getDefaultRoles();
>>>>>
>>>>> @PUT
>>>>> @Path("default-roles/{roleId}")
>>>>> void addDefaultRole(@PathParam("roleId") String roleId);
>>>>>
>>>>> @DELETE
>>>>> @Path("default-roles/{roleId}")
>>>>> void removeDefaultRole(@PathParam("roleId") String roleId);
>>>>>
>>>>> On Thu, Jul 21, 2016 at 12:03 PM Paulo Pires <pires at littlebits.cc>
>>>>> wrote:
>>>>>
>>>>>> It's working like a charm :)
>>>>>>
>>>>>> Some things I learned:
>>>>>> * Need to import resteasy deps for keycloak-admin-cli explicitly
>>>>>> * Methods won't return errors but will throw
>>>>>> InvocationTargetException (must be checked)
>>>>>>
>>>>>> Question: is there a way to set default roles? I can't seem to find
>>>>>> it in the Java code but it is available through REST.
>>>>>>
>>>>>> Thanks,
>>>>>> Pires
>>>>>>
>>>>>> On Thu, Jul 21, 2016 at 8:47 AM Paulo Pires <pires at littlebits.cc>
>>>>>> wrote:
>>>>>>
>>>>>>> Thank you Bruno, I haven't been able to verify your code but I
>>>>>>> assume you're sharing it because it works.
>>>>>>>
>>>>>>> It seems pretty trivial, awesome!
>>>>>>>
>>>>>>> Cheers,
>>>>>>> Pires
>>>>>>>
>>>>>>> On Wed, Jul 20, 2016 at 9:30 PM Bruno Oliveira <bruno at abstractj.org>
>>>>>>> wrote:
>>>>>>>
>>>>>>>> Note sure if it helps, but an example about how to do it
>>>>>>>> programatically is here[1].
>>>>>>>>
>>>>>>>> I just adapted from the admin-client[2].
>>>>>>>>
>>>>>>>>
>>>>>>>> [1] -
>>>>>>>> https://gist.github.com/abstractj/78b127e8c9273cdcea6eb82a1cfc153c
>>>>>>>> [2] -
>>>>>>>> https://github.com/keycloak/keycloak/tree/master/examples/admin-client
>>>>>>>>
>>>>>>>> On 2016-07-20, Paulo Pires wrote:
>>>>>>>> > I did check the admin-cli JAR but it's not clear how to add roles
>>>>>>>> and
>>>>>>>> > users, or if it's even implemented (I did check the REST API and
>>>>>>>> there's
>>>>>>>> > endpoints for that).
>>>>>>>> >
>>>>>>>> > Thank you very much for clarifying,
>>>>>>>> > Pires
>>>>>>>> >
>>>>>>>> > On Wed, Jul 20, 2016 at 2:52 PM Stian Thorgersen <
>>>>>>>> sthorger at redhat.com>
>>>>>>>> > wrote:
>>>>>>>> >
>>>>>>>> > > Yep, take a look at
>>>>>>>> > >
>>>>>>>> https://keycloak.gitbooks.io/server-developer-guide/content/topics/admin-rest-api.html
>>>>>>>> > >
>>>>>>>> > > On 20 July 2016 at 15:33, Paulo Pires <pires at littlebits.cc>
>>>>>>>> wrote:
>>>>>>>> > >
>>>>>>>> > >> More than 150k. Is there a Java library for the REST api?
>>>>>>>> > >>
>>>>>>>> > >> On Jul 20, 2016 13:56, "Stian Thorgersen" <sthorger at redhat.com>
>>>>>>>> wrote:
>>>>>>>> > >>
>>>>>>>> > >>> Depending on the amount of users I'd use either partial
>>>>>>>> import through
>>>>>>>> > >>> the admin console (if you don't have more than a thousand or
>>>>>>>> so users) or
>>>>>>>> > >>> use the admin REST endpoints if you have quite a lot of users.
>>>>>>>> > >>>
>>>>>>>> > >>> On 20 July 2016 at 11:52, Paulo Pires <pires at littlebits.cc>
>>>>>>>> wrote:
>>>>>>>> > >>>
>>>>>>>> > >>>> Hi all,
>>>>>>>> > >>>>
>>>>>>>> > >>>> I'm in the process of migrating from an in-house user-role
>>>>>>>> storage to
>>>>>>>> > >>>> Keycloak and I'm looking for programmatic (Java) ways to
>>>>>>>> migrate all
>>>>>>>> > >>>> current users to the new storage. And I need your help to
>>>>>>>> figure out the
>>>>>>>> > >>>> best approach.
>>>>>>>> > >>>>
>>>>>>>> > >>>> At first, when reading KC documentation, I believed I could
>>>>>>>> easily
>>>>>>>> > >>>> achieve this by implementing a User Federation provider but
>>>>>>>> after diving a
>>>>>>>> > >>>> little more into it, and looking for examples, I can't see a
>>>>>>>> way to migrate
>>>>>>>> > >>>> all users on-demand but simply one user at a time, possible
>>>>>>>> during log-in.
>>>>>>>> > >>>>
>>>>>>>> > >>>> Next, I tried and look into ways, such as admin-cli, REST,
>>>>>>>> etc but
>>>>>>>> > >>>> nothing strikes me as the solution to use.
>>>>>>>> > >>>>
>>>>>>>> > >>>> Here's what I was hoping to deliver:
>>>>>>>> > >>>> * Get all roles and users from my soon-to-be deprecated
>>>>>>>> storage, e.g.
>>>>>>>> > >>>> MySQL tables
>>>>>>>> > >>>> * Add roles to KC
>>>>>>>> > >>>> * Iterate users and add user to KC + map roles + update
>>>>>>>> password hashes
>>>>>>>> > >>>> (here I know I need to implement a HashProvider)
>>>>>>>> > >>>>
>>>>>>>> > >>>> Any hints will be appreciated!
>>>>>>>> > >>>>
>>>>>>>> > >>>> Pires
>>>>>>>> > >>>>
>>>>>>>> > >>>> _______________________________________________
>>>>>>>> > >>>> keycloak-user mailing list
>>>>>>>> > >>>> keycloak-user at lists.jboss.org
>>>>>>>> > >>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>>>>>> > >>>>
>>>>>>>> > >>>
>>>>>>>> > >>>
>>>>>>>> > >
>>>>>>>>
>>>>>>>> > _______________________________________________
>>>>>>>> > keycloak-user mailing list
>>>>>>>> > keycloak-user at lists.jboss.org
>>>>>>>> > https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>>>>>>
>>>>>>>>
>>>>>>>> --
>>>>>>>>
>>>>>>>> abstractj
>>>>>>>> PGP: 0x84DC9914
>>>>>>>>
>>>>>>>
>>>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160722/56962890/attachment.html 

From petervn1 at yahoo.com  Fri Jul 22 09:29:57 2016
From: petervn1 at yahoo.com (Peter Nalyvayko)
Date: Fri, 22 Jul 2016 13:29:57 +0000 (UTC)
Subject: [keycloak-user] OpenID 2.0 authentcation in keycloak
References: <234933781.3930805.1469194197363.JavaMail.yahoo.ref@mail.yahoo.com>
Message-ID: <234933781.3930805.1469194197363.JavaMail.yahoo@mail.yahoo.com>

Hi,Can anyone suggest a library or an existing keycloak extension, or perhaps share their experiences with respect to enabling OpenID 2.0 authentication in keycloak, in addition to OIDC and SAML authentication? I am looking for a way to integrate keycloak with Kentico content management, however Kentico offers out of the box support for OpenID 2.0 and WS-Federation only (claims based authentication that is), and their out of the box implementation of ws-fed appears to be lacking compared to OpenID 2.0.?Regards,Peter
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160722/c5fc866a/attachment.html 

From pires at littlebits.cc  Fri Jul 22 10:19:52 2016
From: pires at littlebits.cc (Paulo Pires)
Date: Fri, 22 Jul 2016 14:19:52 +0000
Subject: [keycloak-user] How to migrate users and roles from in-house
	storage
In-Reply-To: <CAO8YOYX6gdu+-_22z9K8zOn4mbqG75YcAXvVyLQQeySHucKX0g@mail.gmail.com>
References: <CAO8YOYXtZtJ2QPBM9G9QUyeZrTDWPBZ9HbtEg9GWtW+tFfCRaA@mail.gmail.com>
	<CAJgngAdBpQCuacX1Wc0vUXBwanYwSjNctSjdWcNO1JUhwjWJNw@mail.gmail.com>
	<CAO8YOYW8d6XcLqWpfR31F12wxDoREq8Jvt4SNvQByz-0GsY+CA@mail.gmail.com>
	<CAJgngAe8v8Xq22UfbqNRSv8bf6RJTJ_7K3e2SoS39fhEJ8o8qA@mail.gmail.com>
	<CAO8YOYVPMh4A1CSpoqqx2bAmYconxWPGN=VZ+JKa5=oTOEi=HA@mail.gmail.com>
	<20160720203018.GA8462@abstractj.org>
	<CAO8YOYXES7btCwY8T+=XKcRucFVsMBH_5Z5Eq4T5j84mLh=O-w@mail.gmail.com>
	<CAO8YOYUHpTLoFBw-dxt8syyOrpORq0rio-kk5F9s-vp3zrzz9Q@mail.gmail.com>
	<CAO8YOYVoK_KC1yk5LQZ=6Q+kKXLAcN+EVuybPmUcZxz0aHKDWQ@mail.gmail.com>
	<CAO8YOYVZuQbY_v=fDtc3JUXdH_bJqo10RPEnuZZCTjCgxGYxvw@mail.gmail.com>
	<CAJgngAceA5iL9=1YW4gJR-tKCjFk5ahZcOc9QvJaWyPR27V+_Q@mail.gmail.com>
	<CAO8YOYW8MeFo4N0S3dy96qzqyJvd51APrq3UJjwh-gbKMjhO1Q@mail.gmail.com>
	<CAO8YOYVbHt-kA+m69AP5Z8fakLNE_Kzn_HEmfy5G+MZDcbxG0A@mail.gmail.com>
	<CAO8YOYX6gdu+-_22z9K8zOn4mbqG75YcAXvVyLQQeySHucKX0g@mail.gmail.com>
Message-ID: <CAO8YOYUt7LexghW1u31Hy=i1FHGEUyoEar-4v6hcEHGuasqkLg@mail.gmail.com>

Got everything to work!

Cheers,
Pires

On Fri, Jul 22, 2016 at 11:25 AM Paulo Pires <pires at littlebits.cc> wrote:

> Allow me some rubber-ducking here..
>
> 1) Add user attributes (old salt, etc.) when migrating a user
> 2) Implement authenticator that:
>   2.1) Get user by username/email, if not present, fail
>   2.2) Retrieve user attributes
>   2.3) If user attributes include old salt, hence user has been migrated,
> hash input password (cleartext) and pass it to
> context.getSession().users().validCredentials(...)
>   2.4) If user attributes don't include old salt, hence user was created
> in KC, pass input password(cleartext) to
> context.getSession().users().validCredentials(...)
>
> If this is proven to work - and there's no better way to do it - one may
> verify validCredentials(...) return-value, and if it is validated
> successfully, and the user is migrated, can we replace current user model
> password with a new one?
>
> Pires
>
> On Fri, Jul 22, 2016 at 10:41 AM Paulo Pires <pires at littlebits.cc> wrote:
>
>> Updated PR!
>>
>> But now I'm hitting another wall: password migration.
>>
>> The app I'm replacing generated a random salt per user, stored it and
>> then used SHA-512(password, iterations, pepper, salt) to hash the password
>> - iterations and pepper are static. Now, I want to import this to Keycloak
>> and use bcrypt to hash the old hash. Obviously, I'll still need to be able
>> to generate the old hash when validating on KC log-in, right?
>>
>> I also want that new users to just have bcrypt and not the old hashing
>> thing.
>>
>> Now, I know that I can implement a PasswordHashProvider, but I'm not sure
>> exactly where to store and how to read information like the old salt, or
>> how to split between users that were migrated and need to use old hash +
>> brcrypt hash AND users that were created directly in KC and just need
>> bcrypt hash.
>>
>> Any help is highly appreciated,
>> Pires
>>
>> On Thu, Jul 21, 2016 at 1:46 PM Paulo Pires <pires at littlebits.cc> wrote:
>>
>>> Oh, awesome! Going to add tests, open JIRA ticket and update PR.
>>>
>>> Thanks Stian,
>>> Pires
>>>
>>> On Thu, Jul 21, 2016 at 1:13 PM Stian Thorgersen <sthorger at redhat.com>
>>> wrote:
>>>
>>>> We like cowboy style :)
>>>>
>>>> Could you add a JIRA please?
>>>>
>>>> Also you could add tests to
>>>> https://github.com/keycloak/keycloak/blob/master/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/realm/RealmTest.java
>>>>
>>>> On 21 July 2016 at 13:13, Paulo Pires <pires at littlebits.cc> wrote:
>>>>
>>>>> I went ahead, cowboy style and opened a PR for it
>>>>> https://github.com/keycloak/keycloak/pull/3056
>>>>>
>>>>> Couldn't find tests so didn't add any.
>>>>>
>>>>> Pires
>>>>>
>>>>> On Thu, Jul 21, 2016 at 12:06 PM Paulo Pires <pires at littlebits.cc>
>>>>> wrote:
>>>>>
>>>>>> Something like this should work though:
>>>>>>
>>>>>> @GET
>>>>>> @Produces({"application/json"})
>>>>>> @Path("default-roles")
>>>>>> List<RoleRepresentation> getDefaultRoles();
>>>>>>
>>>>>> @PUT
>>>>>> @Path("default-roles/{roleId}")
>>>>>> void addDefaultRole(@PathParam("roleId") String roleId);
>>>>>>
>>>>>> @DELETE
>>>>>> @Path("default-roles/{roleId}")
>>>>>> void removeDefaultRole(@PathParam("roleId") String roleId);
>>>>>>
>>>>>> On Thu, Jul 21, 2016 at 12:03 PM Paulo Pires <pires at littlebits.cc>
>>>>>> wrote:
>>>>>>
>>>>>>> It's working like a charm :)
>>>>>>>
>>>>>>> Some things I learned:
>>>>>>> * Need to import resteasy deps for keycloak-admin-cli explicitly
>>>>>>> * Methods won't return errors but will throw
>>>>>>> InvocationTargetException (must be checked)
>>>>>>>
>>>>>>> Question: is there a way to set default roles? I can't seem to find
>>>>>>> it in the Java code but it is available through REST.
>>>>>>>
>>>>>>> Thanks,
>>>>>>> Pires
>>>>>>>
>>>>>>> On Thu, Jul 21, 2016 at 8:47 AM Paulo Pires <pires at littlebits.cc>
>>>>>>> wrote:
>>>>>>>
>>>>>>>> Thank you Bruno, I haven't been able to verify your code but I
>>>>>>>> assume you're sharing it because it works.
>>>>>>>>
>>>>>>>> It seems pretty trivial, awesome!
>>>>>>>>
>>>>>>>> Cheers,
>>>>>>>> Pires
>>>>>>>>
>>>>>>>> On Wed, Jul 20, 2016 at 9:30 PM Bruno Oliveira <bruno at abstractj.org>
>>>>>>>> wrote:
>>>>>>>>
>>>>>>>>> Note sure if it helps, but an example about how to do it
>>>>>>>>> programatically is here[1].
>>>>>>>>>
>>>>>>>>> I just adapted from the admin-client[2].
>>>>>>>>>
>>>>>>>>>
>>>>>>>>> [1] -
>>>>>>>>> https://gist.github.com/abstractj/78b127e8c9273cdcea6eb82a1cfc153c
>>>>>>>>> [2] -
>>>>>>>>> https://github.com/keycloak/keycloak/tree/master/examples/admin-client
>>>>>>>>>
>>>>>>>>> On 2016-07-20, Paulo Pires wrote:
>>>>>>>>> > I did check the admin-cli JAR but it's not clear how to add
>>>>>>>>> roles and
>>>>>>>>> > users, or if it's even implemented (I did check the REST API and
>>>>>>>>> there's
>>>>>>>>> > endpoints for that).
>>>>>>>>> >
>>>>>>>>> > Thank you very much for clarifying,
>>>>>>>>> > Pires
>>>>>>>>> >
>>>>>>>>> > On Wed, Jul 20, 2016 at 2:52 PM Stian Thorgersen <
>>>>>>>>> sthorger at redhat.com>
>>>>>>>>> > wrote:
>>>>>>>>> >
>>>>>>>>> > > Yep, take a look at
>>>>>>>>> > >
>>>>>>>>> https://keycloak.gitbooks.io/server-developer-guide/content/topics/admin-rest-api.html
>>>>>>>>> > >
>>>>>>>>> > > On 20 July 2016 at 15:33, Paulo Pires <pires at littlebits.cc>
>>>>>>>>> wrote:
>>>>>>>>> > >
>>>>>>>>> > >> More than 150k. Is there a Java library for the REST api?
>>>>>>>>> > >>
>>>>>>>>> > >> On Jul 20, 2016 13:56, "Stian Thorgersen" <
>>>>>>>>> sthorger at redhat.com> wrote:
>>>>>>>>> > >>
>>>>>>>>> > >>> Depending on the amount of users I'd use either partial
>>>>>>>>> import through
>>>>>>>>> > >>> the admin console (if you don't have more than a thousand or
>>>>>>>>> so users) or
>>>>>>>>> > >>> use the admin REST endpoints if you have quite a lot of
>>>>>>>>> users.
>>>>>>>>> > >>>
>>>>>>>>> > >>> On 20 July 2016 at 11:52, Paulo Pires <pires at littlebits.cc>
>>>>>>>>> wrote:
>>>>>>>>> > >>>
>>>>>>>>> > >>>> Hi all,
>>>>>>>>> > >>>>
>>>>>>>>> > >>>> I'm in the process of migrating from an in-house user-role
>>>>>>>>> storage to
>>>>>>>>> > >>>> Keycloak and I'm looking for programmatic (Java) ways to
>>>>>>>>> migrate all
>>>>>>>>> > >>>> current users to the new storage. And I need your help to
>>>>>>>>> figure out the
>>>>>>>>> > >>>> best approach.
>>>>>>>>> > >>>>
>>>>>>>>> > >>>> At first, when reading KC documentation, I believed I could
>>>>>>>>> easily
>>>>>>>>> > >>>> achieve this by implementing a User Federation provider but
>>>>>>>>> after diving a
>>>>>>>>> > >>>> little more into it, and looking for examples, I can't see
>>>>>>>>> a way to migrate
>>>>>>>>> > >>>> all users on-demand but simply one user at a time, possible
>>>>>>>>> during log-in.
>>>>>>>>> > >>>>
>>>>>>>>> > >>>> Next, I tried and look into ways, such as admin-cli, REST,
>>>>>>>>> etc but
>>>>>>>>> > >>>> nothing strikes me as the solution to use.
>>>>>>>>> > >>>>
>>>>>>>>> > >>>> Here's what I was hoping to deliver:
>>>>>>>>> > >>>> * Get all roles and users from my soon-to-be deprecated
>>>>>>>>> storage, e.g.
>>>>>>>>> > >>>> MySQL tables
>>>>>>>>> > >>>> * Add roles to KC
>>>>>>>>> > >>>> * Iterate users and add user to KC + map roles + update
>>>>>>>>> password hashes
>>>>>>>>> > >>>> (here I know I need to implement a HashProvider)
>>>>>>>>> > >>>>
>>>>>>>>> > >>>> Any hints will be appreciated!
>>>>>>>>> > >>>>
>>>>>>>>> > >>>> Pires
>>>>>>>>> > >>>>
>>>>>>>>> > >>>> _______________________________________________
>>>>>>>>> > >>>> keycloak-user mailing list
>>>>>>>>> > >>>> keycloak-user at lists.jboss.org
>>>>>>>>> > >>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>>>>>>> > >>>>
>>>>>>>>> > >>>
>>>>>>>>> > >>>
>>>>>>>>> > >
>>>>>>>>>
>>>>>>>>> > _______________________________________________
>>>>>>>>> > keycloak-user mailing list
>>>>>>>>> > keycloak-user at lists.jboss.org
>>>>>>>>> > https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>>>>>>>
>>>>>>>>>
>>>>>>>>> --
>>>>>>>>>
>>>>>>>>> abstractj
>>>>>>>>> PGP: 0x84DC9914
>>>>>>>>>
>>>>>>>>
>>>>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160722/c7fe10e9/attachment-0001.html 

From bburke at redhat.com  Fri Jul 22 10:36:32 2016
From: bburke at redhat.com (Bill Burke)
Date: Fri, 22 Jul 2016 10:36:32 -0400
Subject: [keycloak-user] OpenID 2.0 authentcation in keycloak
In-Reply-To: <234933781.3930805.1469194197363.JavaMail.yahoo@mail.yahoo.com>
References: <234933781.3930805.1469194197363.JavaMail.yahoo.ref@mail.yahoo.com>
	<234933781.3930805.1469194197363.JavaMail.yahoo@mail.yahoo.com>
Message-ID: <89c71c5e-9adc-0f1d-c3c7-ab6f3c35ac5e@redhat.com>

We have an private SPI for plugging in new auth protocols, but no 
support for OpenID 2.0.


On 7/22/16 9:29 AM, Peter Nalyvayko wrote:
> Hi,
> Can anyone suggest a library or an existing keycloak extension, or 
> perhaps share their experiences with respect to enabling OpenID 2.0 
> authentication in keycloak, in addition to OIDC and SAML 
> authentication? I am looking for a way to integrate keycloak with 
> Kentico content management, however Kentico offers out of the box 
> support for OpenID 2.0 and WS-Federation only (claims based 
> authentication that is), and their out of the box implementation of 
> ws-fed appears to be lacking compared to OpenID 2.0.
> Regards,
> Peter
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160722/0c7267b2/attachment.html 

From valerij.timofeev at gmail.com  Fri Jul 22 10:36:57 2016
From: valerij.timofeev at gmail.com (Valerij Timofeev)
Date: Fri, 22 Jul 2016 16:36:57 +0200
Subject: [keycloak-user] Client roles for 'security-admin-console'
 application are not fine grained enough
Message-ID: <CAOy2obFSOB4Rc+8bUv3HYGG8FC_FbbDBO456wBam0h6hoBvbVA@mail.gmail.com>

Hi,

after reading the ticket KEYCLOAK-528 I've encountered two other issues in
the "security-admin-console" application (tested on RH SSO 7.0.0):

1) As soon as a realm user gets the 'manage-users' role, he can manage
"User federation" settings and even delete it. This can result in
unintentional removal of all users linked with the user federation provider
and thus affect potentially millions of users.

2) Users having 'view-users' role can view "User Federation". "Delete"
button is visible as well although it does not work finally.

IMO "User federation" should be covered by the realm management roles
instead.

Additionally the provided roles for the 'realm-management' client are not
fine grained enough IMO. One role per REST method would be ideal and, I
suppose, simplier to consider in the Keycloak Admin API.

The "security-admin-console" application without fine grained roles exposes
too much risk in real life scenarios and so makes it unusable. One use case
in mind: prevent deletion of any kind for Helpdesk employees e.g. managing
users. Having dedicated roles for DELETE operation would make such task
possible.

Kind regards
Valerij Timofeev
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160722/f4da7c6a/attachment.html 

From chairfield at gmail.com  Fri Jul 22 14:09:04 2016
From: chairfield at gmail.com (Chris Hairfield)
Date: Fri, 22 Jul 2016 18:09:04 +0000
Subject: [keycloak-user] Browser Caching in Custom Theme not working
Message-ID: <CALr83iD0Ca4pnmPWFBZ-2vMETVRQ=FNDPXROJVnoURnxwdJPsw@mail.gmail.com>

Hello,

We've started deploying our custom login and account themes to persistent
environments and are finding that our browser caches aren't updating
properly as we push code. We are using Docker, so upgrades entail
destroying the existing container and starting a new one with our updates.

An instance of this is with the Join functionality where the form itself
didn't show after an upgrade, but we worked around it by entering an
incognito window.

This is the approach we've learned to use when developing as well: test in
an incognito window.

I'm curious, what are your suggestions for deploying Keycloak in such a way
as to properly update client browsers when our themes are updated?

Thanks!
Chris
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160722/18ef59bc/attachment.html 

From lingvisa at gmail.com  Fri Jul 22 20:13:33 2016
From: lingvisa at gmail.com (Martin Min)
Date: Fri, 22 Jul 2016 17:13:33 -0700
Subject: [keycloak-user] Keycloak datasource problem
Message-ID: <CAKUZDO6w2U0hBdN=_TvdO85t6SV=rS4e=gK_GCt_oDs9Kjo1rQ@mail.gmail.com>

Hi, All:

I received this database connection failure issue. Any idea of how to fix
it? Thank you.


Caused by: java.lang.RuntimeException: Failed to connect to database
        at
org.keycloak.connections.jpa.DefaultJpaConnectionProviderFactory.getConnection(DefaultJpaConnectionProviderFactory.java:209)
        at
org.keycloak.connections.jpa.DefaultJpaConnectionProviderFactory.lazyInit(DefaultJpaConnectionProviderFactory.java:130)
        at
org.keycloak.connections.jpa.DefaultJpaConnectionProviderFactory.create(DefaultJpaConnectionProviderFactory.java:42)
        at
org.keycloak.connections.jpa.DefaultJpaConnectionProviderFactory.create(DefaultJpaConnectionProviderFactory.java:30)
        at
org.keycloak.services.DefaultKeycloakSession.getProvider(DefaultKeycloakSession.java:103)
        at
org.keycloak.models.jpa.JpaRealmProviderFactory.create(JpaRealmProviderFactory.java:34)
        at
org.keycloak.models.jpa.JpaRealmProviderFactory.create(JpaRealmProviderFactory.java:16)
        at
org.keycloak.services.DefaultKeycloakSession.getProvider(DefaultKeycloakSession.java:103)
        at
org.keycloak.models.cache.infinispan.DefaultCacheRealmProvider.getDelegate(DefaultCacheRealmProvider.java:59)
        at
org.keycloak.models.cache.infinispan.DefaultCacheRealmProvider.getRealm(DefaultCacheRealmProvider.java:161)
        at
org.keycloak.services.managers.ApplianceBootstrap.setupDefaultRealm(ApplianceBootstrap.java:32)
        at
org.keycloak.services.resources.KeycloakApplication.<init>(KeycloakApplication.java:81)
        at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native
Method)
        at
sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62)
        at
sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
        at java.lang.reflect.Constructor.newInstance(Constructor.java:422)
        at
org.jboss.resteasy.core.ConstructorInjectorImpl.construct(ConstructorInjectorImpl.java:148)
        ... 19 more
Caused by: javax.naming.NameNotFoundException: datasources/KeycloakDS --
service jboss.naming.context.java.jboss.datasources.KeycloakDS
        at
org.jboss.as.naming.ServiceBasedNamingStore.lookup(ServiceBasedNamingStore.java:106)
        at org.jboss.as.naming.NamingContext.lookup(NamingContext.java:207)
        at org.jboss.as.naming.NamingContext.lookup(NamingContext.java:184)
        at
org.jboss.as.naming.InitialContext$DefaultInitialContext.lookup(InitialContext.java:237)
        at org.jboss.as.naming.NamingContext.lookup(NamingContext.java:193)
        at org.jboss.as.naming.NamingContext.lookup(NamingContext.java:189)
        at javax.naming.InitialContext.lookup(InitialContext.java:417)
        at javax.naming.InitialContext.lookup(InitialContext.java:417)
        at
org.keycloak.connections.jpa.DefaultJpaConnectionProviderFactory.getConnection(DefaultJpaConnectionProviderFactory.java:202)
        ... 35 more
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160722/f641ba1e/attachment.html 

From lingvisa at gmail.com  Sun Jul 24 01:23:56 2016
From: lingvisa at gmail.com (Martin Min)
Date: Sat, 23 Jul 2016 22:23:56 -0700
Subject: [keycloak-user] Keycloak subsystem is not in standalone.xml?
Message-ID: <CAKUZDO6H=b93uePypZLGuM=LB1CtFVkK7YCd6ue0DkkAHb8=SQ@mail.gmail.com>

Hello,

I am following the tutorial here:
https://keycloak.gitbooks.io/getting-started-tutorials/content/v/2.0/topics/secure-jboss-app/subsystem.html

to configure the demo KeyCloak server 2.0 and Wildfly 10 Final.

The tutorial says to search for this section:

<subsystem xmlns="urn:jboss:domain:keycloak:1.1"/>

However, there is no such  an entry in standalone.xml of Wildfly 10's
configuration/standalone.xml.

I manually added this part, then it gives me an error as I start the
application server.

Is this because the tutorial is not updated to the Wildfly 10 final
release? Thank you.

Error message:

22:22:33,022 INFO  [org.jboss.as] (MSC service thread 1-6) WFLYSRV0049:
WildFly Full 10.0.0.Final (WildFly Core 2.0.10.Final) starting
22:22:33,535 ERROR [org.jboss.as.server] (Controller Boot Thread)
WFLYSRV0055: Caught exception during boot:
org.jboss.as.controller.persistence.ConfigurationPersistenceException:
WFLYCTL0085: Failed to parse configuration
        at
org.jboss.as.controller.persistence.XmlConfigurationPersister.load(XmlConfigurationPersister.java:131)
        at org.jboss.as.server.ServerService.boot(ServerService.java:356)
        at
org.jboss.as.controller.AbstractControllerService$1.run(AbstractControllerService.java:299)
        at java.lang.Thread.run(Thread.java:745)
Caused by: javax.xml.stream.XMLStreamException: ParseError at
[row,col]:[216,2]
Message: Unexpected element '{urn:jboss:domain:keycloak:1.1}subsystem'
        at
org.jboss.staxmapper.XMLMapperImpl.processNested(XMLMapperImpl.java:108)
        at
org.jboss.staxmapper.XMLExtendedStreamReaderImpl.handleAny(XMLExtendedStreamReaderImpl.java:69)
        at
org.jboss.as.server.parsing.StandaloneXml_4.parseServerProfile(StandaloneXml_4.java:546)
        at
org.jboss.as.server.parsing.StandaloneXml_4.readServerElement(StandaloneXml_4.java:242)
        at
org.jboss.as.server.parsing.StandaloneXml_4.readElement(StandaloneXml_4.java:141)
        at
org.jboss.as.server.parsing.StandaloneXml.readElement(StandaloneXml.java:103)
        at
org.jboss.as.server.parsing.StandaloneXml.readElement(StandaloneXml.java:49)
        at
org.jboss.staxmapper.XMLMapperImpl.processNested(XMLMapperImpl.java:110)
        at
org.jboss.staxmapper.XMLMapperImpl.parseDocument(XMLMapperImpl.java:69)
        at
org.jboss.as.controller.persistence.XmlConfigurationPersister.load(XmlConfigurationPersister.java:123)
        ... 3 more

22:22:33,536 FATAL [org.jboss.as.server] (Controller Boot Thread)
WFLYSRV0056: Server boot has failed in an unrecoverable manner; exiting.
See previous messages for details.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160723/4ca31bc2/attachment-0001.html 

From irum at redhat.com  Sun Jul 24 05:32:02 2016
From: irum at redhat.com (Ilya Rum)
Date: Sun, 24 Jul 2016 11:32:02 +0200
Subject: [keycloak-user] Keycloak subsystem is not in standalone.xml?
In-Reply-To: <CAKUZDO6H=b93uePypZLGuM=LB1CtFVkK7YCd6ue0DkkAHb8=SQ@mail.gmail.com>
References: <CAKUZDO6H=b93uePypZLGuM=LB1CtFVkK7YCd6ue0DkkAHb8=SQ@mail.gmail.com>
Message-ID: <20160724093202.GA19899@wv-toplap>

Hello, Martin!

Have you installed the keycloak adapter on your wildfly instance?

Here you can download the adapter itself: http://www.keycloak.org/downloads.html

Here you can find info on installing the adapter:
https://keycloak.gitbooks.io/getting-started-tutorials/content/v/2.0/topics/secure-jboss-app/install-client-adapter.html

On Sat, Jul 23, 2016 at 10:23:56PM -0700, Martin Min wrote:
> Hello,
> 
> I am following the tutorial here:
> https://keycloak.gitbooks.io/getting-started-tutorials/content/v/2.0/topics/secure-jboss-app/subsystem.html
> 
> to configure the demo KeyCloak server 2.0 and Wildfly 10 Final.
> 
> The tutorial says to search for this section:
> 
> <subsystem xmlns="urn:jboss:domain:keycloak:1.1"/>
> 
> However, there is no such  an entry in standalone.xml of Wildfly 10's
> configuration/standalone.xml.
> 
> I manually added this part, then it gives me an error as I start the
> application server.
> 
> Is this because the tutorial is not updated to the Wildfly 10 final
> release? Thank you.
> 
> Error message:
> 
> 22:22:33,022 INFO  [org.jboss.as] (MSC service thread 1-6) WFLYSRV0049:
> WildFly Full 10.0.0.Final (WildFly Core 2.0.10.Final) starting
> 22:22:33,535 ERROR [org.jboss.as.server] (Controller Boot Thread)
> WFLYSRV0055: Caught exception during boot:
> org.jboss.as.controller.persistence.ConfigurationPersistenceException:
> WFLYCTL0085: Failed to parse configuration
>         at
> org.jboss.as.controller.persistence.XmlConfigurationPersister.load(XmlConfigurationPersister.java:131)
>         at org.jboss.as.server.ServerService.boot(ServerService.java:356)
>         at
> org.jboss.as.controller.AbstractControllerService$1.run(AbstractControllerService.java:299)
>         at java.lang.Thread.run(Thread.java:745)
> Caused by: javax.xml.stream.XMLStreamException: ParseError at
> [row,col]:[216,2]
> Message: Unexpected element '{urn:jboss:domain:keycloak:1.1}subsystem'
>         at
> org.jboss.staxmapper.XMLMapperImpl.processNested(XMLMapperImpl.java:108)
>         at
> org.jboss.staxmapper.XMLExtendedStreamReaderImpl.handleAny(XMLExtendedStreamReaderImpl.java:69)
>         at
> org.jboss.as.server.parsing.StandaloneXml_4.parseServerProfile(StandaloneXml_4.java:546)
>         at
> org.jboss.as.server.parsing.StandaloneXml_4.readServerElement(StandaloneXml_4.java:242)
>         at
> org.jboss.as.server.parsing.StandaloneXml_4.readElement(StandaloneXml_4.java:141)
>         at
> org.jboss.as.server.parsing.StandaloneXml.readElement(StandaloneXml.java:103)
>         at
> org.jboss.as.server.parsing.StandaloneXml.readElement(StandaloneXml.java:49)
>         at
> org.jboss.staxmapper.XMLMapperImpl.processNested(XMLMapperImpl.java:110)
>         at
> org.jboss.staxmapper.XMLMapperImpl.parseDocument(XMLMapperImpl.java:69)
>         at
> org.jboss.as.controller.persistence.XmlConfigurationPersister.load(XmlConfigurationPersister.java:123)
>         ... 3 more
> 
> 22:22:33,536 FATAL [org.jboss.as.server] (Controller Boot Thread)
> WFLYSRV0056: Server boot has failed in an unrecoverable manner; exiting.
> See previous messages for details.

> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user


From haimv at perfectomobile.com  Mon Jul 25 03:01:02 2016
From: haimv at perfectomobile.com (Haim Vana)
Date: Mon, 25 Jul 2016 07:01:02 +0000
Subject: [keycloak-user] Offline tokens with external IDP
Message-ID: <VI1PR0301MB231752EC0FCB23CCBC4F2D4ED20D0@VI1PR0301MB2317.eurprd03.prod.outlook.com>

Hi,

We are using KeyCloak for a several weeks now, one of the flows is user script authentication with offline token:


1.       The user log in to the UI

2.       Generates offline token by entering his password again

3.       Put the offline token in his script

4.       Executes the script

Now we want to add external IDP support, first is it possible to generate offline tokens for extremal IDP in KeyCloak ? if so how ?

Second in section #2 above the user enters his password to generate the offline token, with external IDP we can't use his password, one alternative is to always generate the offline token in the login (add offline_access), however is it make sense to create offline token for every login ?


Thanks,
Haim.
The information contained in this message is proprietary to the sender, protected from disclosure, and may be privileged. The information is intended to be conveyed only to the designated recipient(s) of the message. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, use, distribution or copying of this communication is strictly prohibited and may be unlawful. If you have received this communication in error, please notify us immediately by replying to the message and deleting it from your computer. Thank you.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160725/d4bbf3bc/attachment.html 

From manfred.duchrow at caprica.biz  Mon Jul 25 03:26:19 2016
From: manfred.duchrow at caprica.biz (Manfred Duchrow)
Date: Mon, 25 Jul 2016 09:26:19 +0200
Subject: [keycloak-user] Logout at security proxy fails
Message-ID: <7a762a26-c522-a340-335e-f7ee2aefffbd@caprica.biz>

Hi,

a few days ago I created the Jira issue KEYCLOAK-3311.

Its about the following exception when "k_logout" request from the
keycloak server is coming in:

IllegalStateException: UT000126: Attempted to do blocking IO from the IO
thread. This is prohibited as it may result in deadlocks

Has anybody experienced the same? Is there a workaround?

Currently this error prevents the logout from the secure proxy and
therefore the protected
application can still be reached (for a while) even if the user's
session on the keycloak server
has been terminated.

Cheers,
   Manfred

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160725/04ec807c/attachment.html 

From vineet.reynolds at gmail.com  Mon Jul 25 04:28:06 2016
From: vineet.reynolds at gmail.com (Vineet Reynolds)
Date: Mon, 25 Jul 2016 13:58:06 +0530
Subject: [keycloak-user] Support for transactional email providers like
	SendGrid, Mailgun or Mandrill
Message-ID: <CAONaNYL3HCiRJJKBDMc2xUUBOqv74tsP3s+aDBWRZ-h5=L2LVw@mail.gmail.com>

Hi everybody,

    Has anyone managed to configure Keycloak 2.0.0.Final to use a
transactional email API instead of configuring an SMTP server? I would
prefer to have Keycloak send emails using a rest API like Sendgrid,
Mandrill, Mailgun or Amazon SES (the cloud-native way) instead of running
an SMTP server.

   I'd also appreciate if this is possible through the SPI providers.

   * Should I implement both EmailSenderProvider and EmailTemplateProvider
SPIs ?
   * I cannot get my custom EmailSenderProvider SPI implementation to work,
as the FreemarkerEmailTemplateProvider implementation fails to obtain the
implementation of the EmailSenderProvider. Stack trace is below

13:17:53,991 ERROR
[org.keycloak.forms.login.freemarker.FreeMarkerLoginFormsProvider] (default
task-39) Failed to send verification email:
org.keycloak.email.EmailException: Failed to template email
at
org.keycloak.email.freemarker.FreeMarkerEmailTemplateProvider.send(FreeMarkerEmailTemplateProvider.java:179)
at
org.keycloak.email.freemarker.FreeMarkerEmailTemplateProvider.send(FreeMarkerEmailTemplateProvider.java:150)
at
org.keycloak.email.freemarker.FreeMarkerEmailTemplateProvider.sendVerifyEmail(FreeMarkerEmailTemplateProvider.java:146)
at
org.keycloak.forms.login.freemarker.FreeMarkerLoginFormsProvider.createResponse(FreeMarkerLoginFormsProvider.java:156)
at
org.keycloak.authentication.requiredactions.VerifyEmail.requiredActionChallenge(VerifyEmail.java:73)
at
org.keycloak.services.managers.AuthenticationManager.executionActions(AuthenticationManager.java:559)
at
org.keycloak.services.managers.AuthenticationManager.actionRequired(AuthenticationManager.java:490)
at
org.keycloak.services.managers.AuthenticationManager.nextActionAfterAuthentication(AuthenticationManager.java:412)
at
org.keycloak.services.resources.LoginActionsService$Checks.verifyRequiredAction(LoginActionsService.java:299)
at
org.keycloak.services.resources.LoginActionsService.processRequireAction(LoginActionsService.java:853)
at
org.keycloak.services.resources.LoginActionsService.requiredActionGET(LoginActionsService.java:846)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at
sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
at
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:498)
at
org.jboss.resteasy.core.MethodInjectorImpl.invoke(MethodInjectorImpl.java:139)
at
org.jboss.resteasy.core.ResourceMethodInvoker.invokeOnTarget(ResourceMethodInvoker.java:295)
at
org.jboss.resteasy.core.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:249)
at
org.jboss.resteasy.core.ResourceLocatorInvoker.invokeOnTargetObject(ResourceLocatorInvoker.java:138)
at
org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorInvoker.java:101)
at
org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:395)
at
org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:202)
at
org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.service(ServletContainerDispatcher.java:221)
at
org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:56)
at
org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:51)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:790)
at
io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:85)
at
io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:129)
at
org.keycloak.services.filters.KeycloakSessionServletFilter.doFilter(KeycloakSessionServletFilter.java:90)
at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:60)
at
io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
at
io.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.java:84)
at
io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:62)
at
io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36)
at
org.wildfly.extension.undertow.security.SecurityContextAssociationHandler.handleRequest(SecurityContextAssociationHandler.java:78)
at
io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
at
io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:131)
at
io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:57)
at
io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
at
io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:46)
at
io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64)
at
io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:60)
at
io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:77)
at
io.undertow.security.handlers.NotificationReceiverHandler.handleRequest(NotificationReceiverHandler.java:50)
at
io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43)
at
io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
at
org.wildfly.extension.undertow.security.jacc.JACCContextIdHandler.handleRequest(JACCContextIdHandler.java:61)
at
io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
at
io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
at
io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:284)
at
io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:263)
at
io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:81)
at
io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:174)
at io.undertow.server.Connectors.executeRootHandler(Connectors.java:202)
at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:793)
at
java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
at
java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
at java.lang.Thread.run(Thread.java:745)
Caused by: java.lang.NullPointerException
at
org.keycloak.email.freemarker.FreeMarkerEmailTemplateProvider.send(FreeMarkerEmailTemplateProvider.java:185)
at
org.keycloak.email.freemarker.FreeMarkerEmailTemplateProvider.send(FreeMarkerEmailTemplateProvider.java:177)
... 57 more



Thanks,
Vineet
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160725/0a31fe39/attachment-0001.html 

From mstrukel at redhat.com  Mon Jul 25 09:35:59 2016
From: mstrukel at redhat.com (Marko Strukelj)
Date: Mon, 25 Jul 2016 15:35:59 +0200
Subject: [keycloak-user] Logout at security proxy fails
In-Reply-To: <7a762a26-c522-a340-335e-f7ee2aefffbd@caprica.biz>
References: <7a762a26-c522-a340-335e-f7ee2aefffbd@caprica.biz>
Message-ID: <CA+1OW+gh5hA6O7F8orZ=AiqB_MT1fDQsubvxuPzLgheKEimX-w@mail.gmail.com>

Giving a cursory look at KEYCLOAK-3311, and not really knowing this part of
the code so I hope I'm not giving you a wrong lead here, but it looks like
UndertowPreAuthActionsHandler should already be present in your stacktrace,
while currently it is not.

It sounds like Wildfly adapter was not installed correctly.

On Mon, Jul 25, 2016 at 9:26 AM, Manfred Duchrow <
manfred.duchrow at caprica.biz> wrote:

> Hi,
>
> a few days ago I created the Jira issue KEYCLOAK-3311.
>
> Its about the following exception when "k_logout" request from the
> keycloak server is coming in:
>
> IllegalStateException: UT000126: Attempted to do blocking IO from the IO
> thread. This is prohibited as it may result in deadlocks
>
> Has anybody experienced the same? Is there a workaround?
>
> Currently this error prevents the logout from the secure proxy and
> therefore the protected
> application can still be reached (for a while) even if the user's session
> on the keycloak server
> has been terminated.
>
> Cheers,
>    Manfred
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160725/b202bab2/attachment.html 

From bruno at abstractj.org  Mon Jul 25 09:59:55 2016
From: bruno at abstractj.org (Bruno Oliveira)
Date: Mon, 25 Jul 2016 10:59:55 -0300
Subject: [keycloak-user] Keycloak datasource problem
In-Reply-To: <CAKUZDO6w2U0hBdN=_TvdO85t6SV=rS4e=gK_GCt_oDs9Kjo1rQ@mail.gmail.com>
References: <CAKUZDO6w2U0hBdN=_TvdO85t6SV=rS4e=gK_GCt_oDs9Kjo1rQ@mail.gmail.com>
Message-ID: <20160725135955.GA13155@abstractj.org>

Hi Martin, do you have the datasource configured?

Based on this stacktrace:

> Caused by: javax.naming.NameNotFoundException: datasources/KeycloakDS --
> service jboss.naming.context.java.jboss.datasources.KeycloakDS
>

It looks like some datasource misconfiguration. Please, take a look at the docs
here[1] and double check all the steps if possible.

[1] - https://keycloak.gitbooks.io/server-installation-and-configuration/content/topics/database/datasource.html

On 2016-07-22, Martin Min wrote:
> Hi, All:
>
> I received this database connection failure issue. Any idea of how to fix
> it? Thank you.
>
>
> Caused by: java.lang.RuntimeException: Failed to connect to database
>         at
> org.keycloak.connections.jpa.DefaultJpaConnectionProviderFactory.getConnection(DefaultJpaConnectionProviderFactory.java:209)
>         at
> org.keycloak.connections.jpa.DefaultJpaConnectionProviderFactory.lazyInit(DefaultJpaConnectionProviderFactory.java:130)
>         at
> org.keycloak.connections.jpa.DefaultJpaConnectionProviderFactory.create(DefaultJpaConnectionProviderFactory.java:42)
>         at
> org.keycloak.connections.jpa.DefaultJpaConnectionProviderFactory.create(DefaultJpaConnectionProviderFactory.java:30)
>         at
> org.keycloak.services.DefaultKeycloakSession.getProvider(DefaultKeycloakSession.java:103)
>         at
> org.keycloak.models.jpa.JpaRealmProviderFactory.create(JpaRealmProviderFactory.java:34)
>         at
> org.keycloak.models.jpa.JpaRealmProviderFactory.create(JpaRealmProviderFactory.java:16)
>         at
> org.keycloak.services.DefaultKeycloakSession.getProvider(DefaultKeycloakSession.java:103)
>         at
> org.keycloak.models.cache.infinispan.DefaultCacheRealmProvider.getDelegate(DefaultCacheRealmProvider.java:59)
>         at
> org.keycloak.models.cache.infinispan.DefaultCacheRealmProvider.getRealm(DefaultCacheRealmProvider.java:161)
>         at
> org.keycloak.services.managers.ApplianceBootstrap.setupDefaultRealm(ApplianceBootstrap.java:32)
>         at
> org.keycloak.services.resources.KeycloakApplication.<init>(KeycloakApplication.java:81)
>         at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native
> Method)
>         at
> sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62)
>         at
> sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
>         at java.lang.reflect.Constructor.newInstance(Constructor.java:422)
>         at
> org.jboss.resteasy.core.ConstructorInjectorImpl.construct(ConstructorInjectorImpl.java:148)
>         ... 19 more
> Caused by: javax.naming.NameNotFoundException: datasources/KeycloakDS --
> service jboss.naming.context.java.jboss.datasources.KeycloakDS
>         at
> org.jboss.as.naming.ServiceBasedNamingStore.lookup(ServiceBasedNamingStore.java:106)
>         at org.jboss.as.naming.NamingContext.lookup(NamingContext.java:207)
>         at org.jboss.as.naming.NamingContext.lookup(NamingContext.java:184)
>         at
> org.jboss.as.naming.InitialContext$DefaultInitialContext.lookup(InitialContext.java:237)
>         at org.jboss.as.naming.NamingContext.lookup(NamingContext.java:193)
>         at org.jboss.as.naming.NamingContext.lookup(NamingContext.java:189)
>         at javax.naming.InitialContext.lookup(InitialContext.java:417)
>         at javax.naming.InitialContext.lookup(InitialContext.java:417)
>         at
> org.keycloak.connections.jpa.DefaultJpaConnectionProviderFactory.getConnection(DefaultJpaConnectionProviderFactory.java:202)
>         ... 35 more

> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user


--

abstractj
PGP: 0x84DC9914

From bruno at abstractj.org  Mon Jul 25 10:16:59 2016
From: bruno at abstractj.org (Bruno Oliveira)
Date: Mon, 25 Jul 2016 11:16:59 -0300
Subject: [keycloak-user] jetty-maven-plugin + Keycloak Jetty Adapter
In-Reply-To: <1469178294.4265.15.camel@co-met.info>
References: <1469173574.4265.11.camel@co-met.info>
	<1469178294.4265.15.camel@co-met.info>
Message-ID: <20160725141659.GB13155@abstractj.org>

Hi Lauer, I'm not really sure if that belongs to the adapter's session,
although, I don't have a better idea right now.

I suggest to file a jira as an enhancement to 2.0.x at the docs, with what
you have in mind, in this way we don't miss it. If you can pull-request
it, even better.

On 2016-07-22, Lauer Markus wrote:
> Finally found an easy way:
>
> <plugin>
>   <groupId>org.eclipse.jetty</groupId>
>   <artifactId>jetty-maven-plugin</artifactId>
>   <version>9.2.3.v20140905</version>
>   <configuration>
>     <scanIntervalSeconds>2</scanIntervalSeconds>
>   </configuration>
>   <dependencies>
>     <dependency>
>       <groupId>org.keycloak</groupId>
>       <artifactId>keycloak-jetty92-adapter</artifactId>
>       <version>2.0.0.Final</version>
>     </dependency>
>   </dependencies>
> </plugin>
>
> Maybe someone wants to add this to
> https://keycloak.gitbooks.io/securing-client-applications-guide/content/v/2.0/topics/oidc/java/jetty9-adapter.html
>
>
> Am Freitag, den 22.07.2016, 07:47 +0000 schrieb Lauer Markus:
> > Hi,
> >
> > Is there a way to use the keycloak adapter with jetty-maven-plugin?
> >
> > I tried with no success:
> >
> > <plugin>
> >   <groupId>org.eclipse.jetty</groupId>
> >   <artifactId>jetty-maven-plugin</artifactId>
> >   <version>9.2.3.v20140905</version>
> >   <configuration>
> >     <webApp>
> > <extraClasspath>${keycloak-jetty-adapter}/lib/keycloak/bcpkix-jdk15on-1.52.jar;
> > ${keycloak-jetty-adapter}/lib/keycloak/commons-logging-1.2.jar;
> > ${keycloak-jetty-adapter}/lib/keycloak/jackson-annotations-2.5.4.jar;
> > ${keycloak-jetty-adapter}/lib/keycloak/jboss-logging-3.3.0.Final.jar;
> > ${keycloak-jetty-adapter}/lib/keycloak/keycloak-common-2.0.0.Final.jar;
> > ${keycloak-jetty-adapter}/lib/keycloak/keycloak-jetty-adapter-spi-2.0.0.Final.jar;
> > ${keycloak-jetty-adapter}/lib/keycloak/bcprov-jdk15on-1.52.jar;
> > ${keycloak-jetty-adapter}/lib/keycloak/httpclient-4.5.jar;
> > ${keycloak-jetty-adapter}/lib/keycloak/jackson-core-2.5.4.jar;
> > ${keycloak-jetty-adapter}/lib/keycloak/keycloak-adapter-core-2.0.0.Final.jar;
> > ${keycloak-jetty-adapter}/lib/keycloak/keycloak-core-2.0.0.Final.jar;
> > ${keycloak-jetty-adapter}/lib/keycloak/keycloak-jetty-core-2.0.0.Final.jar;
> > ${keycloak-jetty-adapter}/lib/keycloak/commons-codec-1.9.jar;
> > ${keycloak-jetty-adapter}/lib/keycloak/httpcore-4.4.1.jar;
> > ${keycloak-jetty-adapter}/lib/keycloak/jackson-databind-2.5.4.jar;
> > ${keycloak-jetty-adapter}/lib/keycloak/keycloak-adapter-spi-2.0.0.Final.jar;
> > ${keycloak-jetty-adapter}/lib/keycloak/keycloak-jetty92-adapter-2.0.0.Final.jar
> >       </extraClasspath>
> >     </webApp>
> >     <scanIntervalSeconds>2</scanIntervalSeconds>
> >   </configuration>
> > </plugin>
> >
> >
> > Where ${keycloak-jetty-adapter} is a path with the contents of
> > keycloak-jetty92-adapter-dist-2.0.0.Final.tar.gz
> >
> >
> > Running mvn jetty:run throws a ClassNotFoundException:
> >
> > [WARNING] FAILED
> > org.eclipse.jetty.security.ConstraintSecurityHandler at 834e986:
> > java.lang.NoClassDefFoundError:
> > org/eclipse/jetty/server/handler/ContextHandler
> > java.lang.NoClassDefFoundError:
> > org/eclipse/jetty/server/handler/ContextHandler
> > at
> > org.keycloak.adapters.jetty.core.AbstractKeycloakJettyAuthenticator.initializeKeycloak(AbstractKeycloakJettyAuthenticator.java:221)
> > at
> > org.keycloak.adapters.jetty.core.AbstractKeycloakJettyAuthenticator.setConfiguration(AbstractKeycloakJettyAuthenticator.java:175)
> > at
> > org.eclipse.jetty.security.SecurityHandler.doStart(SecurityHandler.java:384)
> > ...
> >
> >
> >
> > Thanks,
> >
> > Markus.
> >
> >
> >
> >
> >
> >
> > ________________________________
> >
> > Zum Lesen der rechtlichen Hinweise dieser Mail, kopieren Sie bitte die aufgef?hrte URL in Ihren Browser oder folgen Sie dem Link.
> >
> > http://disclaimer.tec-saar.de/co-met.htm
> > +----------------------------------------------------------------------+
> > | SecureMail-Gateway - Stadtwerke Saarbruecken
> >                         |
> > | Ein Dienst fr EMail Signatur und Verschluesselung                   |
> > +----------------------------------------------------------------------+
> > | - Die Nachricht war weder verschluesselt noch digital unterschrieben |
> > +----------------------------------------------------------------------+
> > _______________________________________________
> > keycloak-user mailing list
> > keycloak-user at lists.jboss.org
> > https://lists.jboss.org/mailman/listinfo/keycloak-user
> > +----------------------------------------------------------------------+
> > | SecureMail-Gateway - Stadtwerke Saarbruecken
> >                         |
> > | Ein Dienst fr EMail Signatur und Verschluesselung                   |
> > +----------------------------------------------------------------------+
> > | - Die Nachricht war weder verschluesselt noch digital unterschrieben |
> > +----------------------------------------------------------------------+
>



> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user


--

abstractj
PGP: 0x84DC9914

From thomas.darimont at googlemail.com  Mon Jul 25 10:23:23 2016
From: thomas.darimont at googlemail.com (Thomas Darimont)
Date: Mon, 25 Jul 2016 16:23:23 +0200
Subject: [keycloak-user] Obtaining full profile from "userinfo" endpoint
In-Reply-To: <CAC9D9d8kp92XUZtEtAZghxXFmi5LHEc8nNUnVM8aB5+Hso_rnw@mail.gmail.com>
References: <CAC9D9d9SW-Kzo8k1uFY_WDMUtmBQ2N_NrqqZJft4Mw4eZ5+1Ww@mail.gmail.com>
	<CAK-7U1g+_D7kRYc4sFJcEnucYM8rMrXh_8ybw1koPxkTRyqFvQ@mail.gmail.com>
	<CAK-7U1j7qn7FmbSJ44xkjhD+irHpfNGW3Hi=C3TkoVoK84jVzQ@mail.gmail.com>
	<CAJgngAeO76hTtCqDy55ykPnDaA43F0wF-1Ag0oTQEGY4eK3BVg@mail.gmail.com>
	<CAK-7U1hccYdt3XFzsUZeTfM6F3wCR-H97UwTXx=Zm3oREV5POw@mail.gmail.com>
	<CAJgngAejnJ1vRdTdQzT8RtSVBQpsgiYwdFo=RRr4rdfiLPtSHA@mail.gmail.com>
	<CAC9D9d8kp92XUZtEtAZghxXFmi5LHEc8nNUnVM8aB5+Hso_rnw@mail.gmail.com>
Message-ID: <CAK-7U1hvagWqpj+0EWWna8yRF8yZeaE5i09i_u0SbWt3SSMvVA@mail.gmail.com>

Hi Brian,

FYI - this feature has just been merged into master.

Cheers,
Thomas

2016-07-01 14:49 GMT+02:00 Brian Watson <watson409 at gmail.com>:

> Great! Thank you all so much for the quick response and effort!
>
> On Fri, Jul 1, 2016 at 5:24 AM, Stian Thorgersen <sthorger at redhat.com>
> wrote:
>
>> Ideally PR should come with polish and testing. Otherwise it'll just sit
>> in the queue ;)
>>
>> On 1 July 2016 at 11:19, Thomas Darimont <thomas.darimont at googlemail.com>
>> wrote:
>>
>>> Cool - shall I file a jira and issue a PR? Then you can polish it a bit
>>> ;-)
>>>
>>> Cheers,
>>> Thomas
>>>
>>> 2016-07-01 11:18 GMT+02:00 Stian Thorgersen <sthorger at redhat.com>:
>>>
>>>> +1 To the user info toggle for mappers
>>>>
>>>> On 1 July 2016 at 11:12, Thomas Darimont <
>>>> thomas.darimont at googlemail.com> wrote:
>>>>
>>>>> Hello Brian,
>>>>>
>>>>> I gave this a quick spin - I introduced an additional option that
>>>>> allows to configure whether a claim from a
>>>>> client mapper should be included in userinfo or not.
>>>>> With that in place one can now control whether a claim should be
>>>>> contained in the access-token, id-token or userinfo
>>>>> which helps to keep access-tokens lean.
>>>>>
>>>>> For the sake of simplicity I only added support for controlling user
>>>>> attributes but I think this could be a useful
>>>>> for other mappers as well.
>>>>>
>>>>> Branch is here:
>>>>>
>>>>> https://github.com/thomasdarimont/keycloak/tree/poc/KEYCLOAK-XXX-use-mapper-only-for-userinfo-endpoint
>>>>> relevant commit:
>>>>>
>>>>> https://github.com/thomasdarimont/keycloak/commit/eb25e72060f75a00afd188fc3b2c242e7b21aa7f
>>>>>
>>>>> Cheers,
>>>>> Thomas
>>>>>
>>>>> 2016-07-01 9:53 GMT+02:00 Thomas Darimont <
>>>>> thomas.darimont at googlemail.com>:
>>>>>
>>>>>> Hello Brian,
>>>>>>
>>>>>> I gave this a spin (with 1.9.x and master) and I think that currently
>>>>>> the only way to extend the information in the
>>>>>> userinfo endpoint is by defining a custom mapper and register that
>>>>>> for the client you use to get the
>>>>>> access-token.
>>>>>> The protocol mappers of this client will be used for the userinfo
>>>>>> endpoint. However the downside of this approach is that
>>>>>> this information is now also added to the access-token which you
>>>>>> wanted to avoid.
>>>>>>
>>>>>> It would be great of one had an additional switchable option for
>>>>>> custom protocol mappers like "include in userinfo".
>>>>>> With this enabled one could control very explicitly what should go
>>>>>> where.
>>>>>>
>>>>>> I added a small curl command sequence below that can be used for
>>>>>> testing.
>>>>>>
>>>>>> Cheers,
>>>>>> Thomas
>>>>>>
>>>>>> # Setup
>>>>>> KC_REALM=acme-test
>>>>>> KC_USERNAME=tester
>>>>>> KC_PASSWORD=test
>>>>>> KC_CLIENT=test-client
>>>>>> KC_CLIENT_SECRET=3ee678ac-b31b-4bb6-80fa-5f25c7817bf0
>>>>>> KC_SERVER=192.168.99.1:8080
>>>>>> KC_CONTEXT=auth
>>>>>> CURL_OPTS="-k -v --noproxy 192.168.99.1"
>>>>>>
>>>>>> # Step 1 Request Tokens for credentials
>>>>>> KC_RESPONSE=$( \
>>>>>>    curl $CURL_OPTS -X POST \
>>>>>>         -H "Content-Type: application/x-www-form-urlencoded" \
>>>>>>         -d "username=$KC_USERNAME" \
>>>>>>         -d "password=$KC_PASSWORD" \
>>>>>>         -d 'grant_type=password' \
>>>>>>         -d "client_id=$KC_CLIENT" \
>>>>>>         -d "client_secret=$KC_CLIENT_SECRET" \
>>>>>>         "http://$KC_SERVER/$KC_CONTEXT/realms/$KC_REALM/protocol/openid-connect/token"
>>>>>> \
>>>>>>     | jq .
>>>>>> )
>>>>>>
>>>>>> # Step 2 Split tokens
>>>>>> KC_ACCESS_TOKEN=$(echo $KC_RESPONSE| jq -r .access_token)
>>>>>> KC_ID_TOKEN=$(echo $KC_RESPONSE| jq -r .id_token)
>>>>>> KC_REFRESH_TOKEN=$(echo $KC_RESPONSE| jq -r .refresh_token)
>>>>>>
>>>>>> # Step 3 (Debug) Show all keycloak env variables
>>>>>> set | grep KC_*
>>>>>>
>>>>>> # Step 4 Access Keycloak User Info
>>>>>> curl $CURL_OPTS \
>>>>>>      -X POST \
>>>>>>      -H "Content-Type: application/x-www-form-urlencoded" \
>>>>>>      -d "access_token=$KC_ACCESS_TOKEN" \
>>>>>>    "http://$KC_SERVER/$KC_CONTEXT/realms/$KC_REALM/protocol/openid-connect/userinfo"
>>>>>> | jq .
>>>>>>
>>>>>> # Step 5 Define a new protocol mapper for the client test-client in
>>>>>> the admin-console
>>>>>> # via clients -> test-client -> mappers -> new -> as an example map a
>>>>>> custom user attribute -> add to access token
>>>>>> # After that a request to the userinfo endpoint will show your custom
>>>>>> attribute.
>>>>>>
>>>>>> # Step 6 Access Keycloak User Info
>>>>>> curl $CURL_OPTS \
>>>>>>      -X POST \
>>>>>>      -H "Content-Type: application/x-www-form-urlencoded" \
>>>>>>      -d "access_token=$KC_ACCESS_TOKEN" \
>>>>>>    "http://$KC_SERVER/$KC_CONTEXT/realms/$KC_REALM/protocol/openid-connect/userinfo"
>>>>>> | jq .
>>>>>>
>>>>>>
>>>>>>
>>>>>> 2016-06-30 16:41 GMT+02:00 Brian Watson <watson409 at gmail.com>:
>>>>>>
>>>>>>> Hi all,
>>>>>>>
>>>>>>> Keycloak version: 1.9.8
>>>>>>>
>>>>>>> Here is my use case: I want to keep the access token JWS as lean as
>>>>>>> possible, only containing user roles and a few custom claims I have added.
>>>>>>> I want no PII in the access token. However, I would like my internal
>>>>>>> services to obtain the full user profile (name, email, etc...) from the
>>>>>>> OIDC "/userinfo" endpoint. Unfortunately, I can only seem to obtain the
>>>>>>> "sub" claim and the few custom claims that already exist in the access
>>>>>>> token. I don't see any support for adding scope values to the request.
>>>>>>>
>>>>>>> Is there any way to accomplish what I would like, or any other ways
>>>>>>> of obtaining this info that I may be missing?
>>>>>>>
>>>>>>> Thanks in advance
>>>>>>>
>>>>>>> _______________________________________________
>>>>>>> keycloak-user mailing list
>>>>>>> keycloak-user at lists.jboss.org
>>>>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>>>>>
>>>>>>
>>>>>>
>>>>>
>>>>> _______________________________________________
>>>>> keycloak-user mailing list
>>>>> keycloak-user at lists.jboss.org
>>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>>>
>>>>
>>>>
>>>
>>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160725/f25d548d/attachment-0001.html 

From r.vanloenhout at greenvalley.nl  Mon Jul 25 10:32:53 2016
From: r.vanloenhout at greenvalley.nl (Robert van Loenhout)
Date: Mon, 25 Jul 2016 14:32:53 +0000
Subject: [keycloak-user] keycloak spring boot adapter admin url
Message-ID: <VI1PR0101MB2013116D892DA78974A6A0A08D0D0@VI1PR0101MB2013.eurprd01.prod.exchangelabs.com>

I'm using the keycloak adapter in my spring boot applications. I would like to use sign sign out. I added the openid-connect logout link to a page.
To let the keycloak server send signout requests to my web applications via the back channel I think I should configure the admin URL for each (spring boot) client.
Does the spring boot keycloak adapter implement the admin endpoint? And if so under which url is it available?

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160725/c385f4e1/attachment.html 

From derek.visch at gmail.com  Mon Jul 25 10:51:11 2016
From: derek.visch at gmail.com (Derek Visch)
Date: Mon, 25 Jul 2016 10:51:11 -0400
Subject: [keycloak-user] Reverse Proxy - SSL Termination - Invalid
	parameter: redirect uri
In-Reply-To: <CADhyb+H00T7O-1YAggkX2-5OBt75WbpyxJYk=cyFJuq8SSXM8A@mail.gmail.com>
References: <CADhyb+H00T7O-1YAggkX2-5OBt75WbpyxJYk=cyFJuq8SSXM8A@mail.gmail.com>
Message-ID: <CADhyb+E0EVEO_3FFmNEmWNDMAcGcXXrG1P-ZQMsSwDQgvXgh2A@mail.gmail.com>

To solve the redirect-uri issue I spun up a local instance of keycloak,
exported the realm configuration with redirectUri's added for my url
(Example https://testkeycloak.hi/* ).

I added redirect uri's for the following client ID"s, client, master-realm,
and security-admin-console. After I imported the configuration to my test
instance I could not login so I had to run add-user-keycloak.sh -r master
-u admin -p pw (
https://keycloak.gitbooks.io/server-adminstration-guide/content/v/2.0/topics/initialization.html)


This allowed me to login, but I have another issue being that I do not see
any of the configuration options available for the master realm (It's just
a white screen ) with the key cloak header picture below.


[image: Inline image 1]



I checked the dev console in chrome and didn't see any loads failing, and
account management screen seems to work properly.


As a few other tests I ran nc -l 8080 and made sure my headers were being
sent properly which is the case.
X-Real-IP: 127.0.0.1
X-Forwarded-For: 127.0.0.1
X-Forwarded-Proto: https



*Nginx*:
My nginx configuration looks like this:


server {
  listen 80;
  server_name keycloak_testing.leveldatadevelopment.com;
  return 301 https://$host$request_uri;
}

server {
  listen 443 ssl;
  server_name keycloak_testing.leveldatadevelopment.com;

  ssl_certificate /etc/nginx/ssl/star.blah.com.crt;
  ssl_certificate_key /etc/nginx/ssl/star.blah.com.key;

  location / {
    proxy_set_header        Host $host:$server_port;
    proxy_set_header        X-Real-IP $remote_addr;
    proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header        X-Forwarded-Proto $scheme;
    proxy_redirect http:// https://;

    proxy_pass http://172.123.123.184:8080;
  }
}


*Keycloak*:

I'm running keycloak with this command:  bin/standalone.sh -b 0.0.0.0

standalone.xml -
https://gist.github.com/visch/c9025bfc108f7c597cd1e4e263c02359

master-realm.json (Exported) -
https://gist.github.com/visch/889db21ca9efa4bcb9e1bf9f783b5602



Does anyone have any ideas for other things I should try?

I think https://issues.jboss.org/browse/KEYCLOAK-3283 is a similar issue,
but I could be wrong.



On Thu, Jul 21, 2016 at 5:21 PM, Derek Visch <derek.visch at gmail.com> wrote:

> Trying to setup reverse SSL for keycloak. Having issues finding
> documentation about this, it's mentioned in
> https://keycloak.gitbooks.io/server-installation-and-configuration/content/v/2.0/topics/network/https.html
> but the extra detail that's supposed to be in
> https://keycloak.gitbooks.io/server-adminstration-guide/content/ I could
> not find in regards to reverse SSL proxys.
>
> Regardless I ended up following
> http://lists.jboss.org/pipermail/keycloak-user/2014-June/000453.html
>
> From that previous mailling list post:
>
> Follow the documentation for your web server to enable SSL and configure reverse proxy for Keycloak. It is important that you make sure the web server sets the X-Forwarded-For and X-Forwarded-Proto headers on the requests made to Keycloak. Next you need to enable proxy-address-forwarding on the Keycloak http connector. Assuming that your reverse proxy doesn't use port 8443 for SSL you also need to configure what port http traffic is redirected to. This is done by editing standalone/configuration/standalone.xml.
>
> First add proxy-address-forwarding and redirect-socket to the http-listener element:
>
> <subsystem xmlns="urn:jboss:domain:undertow:1.1">
>     ...
>     <http-listener name="default" socket-binding="http" proxy-address-forwarding="true" redirect-socket="proxy-https"/>
>     ...
> </subsystem>
>
> Then add a new socket-binding element to the socket-binding-group element:
>
> <socket-binding-group name="standard-sockets" default-interface="public" port-offset="${jboss.socket.binding.port-offset:0}">
>     ...
>     <socket-binding name="proxy-https" port="443"/>
>     ...
> </socket-binding-group>
>
>
>
> but now when I go to log on to the admin console I get "We're sorry ...
> Invalid aparameter: redirect uri".
>
>
>
> Tried stack overflow / google / IRC. No luck so far.
>
> Any help would be appreciated :D
>
> Thanks
>
>
>


-- 

*Derek Visch* / Software Developer / Network Technician
dvisch at leveldata.com <bipema at leveldata.com> / Direct: 269-488-2037

*Level Data Inc.*
Office: 866.511.3282
4787 Campus Dr. | Kalamazoo, MI 49008
http://www.leveldata.com
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160725/e212a981/attachment-0001.html 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image.png
Type: image/png
Size: 17764 bytes
Desc: not available
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20160725/e212a981/attachment-0001.png 

From mstrukel at redhat.com  Mon Jul 25 11:16:28 2016
From: mstrukel at redhat.com (Marko Strukelj)
Date: Mon, 25 Jul 2016 17:16:28 +0200
Subject: [keycloak-user] Logout at security proxy fails
In-Reply-To: <f6c6b51b-fb3b-dda9-47d4-c7607fe83a17@caprica.biz>
References: <7a762a26-c522-a340-335e-f7ee2aefffbd@caprica.biz>
	<CA+1OW+gh5hA6O7F8orZ=AiqB_MT1fDQsubvxuPzLgheKEimX-w@mail.gmail.com>
	<f6c6b51b-fb3b-dda9-47d4-c7607fe83a17@caprica.biz>
Message-ID: <CA+1OW+ghfHcW7bUAtkpJBZu2i6Oeo8HhPKxDVSZTuMpBciYMPg@mail.gmail.com>

Ah, I was looking directly at the cause at the bottom, and missed the
UndertowPreAuthActionsHandler at the beginning of stack trace.

No idea then. If it's an out-of-the-box proxy install, and it's supposed to
just work, then maybe it's a bug.

On Mon, Jul 25, 2016 at 4:41 PM, Manfred Duchrow <
manfred.duchrow at caprica.biz> wrote:

> Hi,
>
> thanks for your response.
>
> The UndertowPreAuthActionsHandler actually is in the stacktrace. So I
> don't quite understand what you mean.
>
> The installation is out-of-the-box from the keycloak-proxy-2.0.0.Final.zip.
>
> I was assuming that in UndertowPreAuthActionsHandler#handleRequest()
> somthing like the following must happen,
> in order to execute the logout action handling in a worker thread:
>
>     public void handleRequest(HttpServerExchange exchange) throws
> Exception {
>         UndertowHttpFacade facade = createFacade(exchange);
>         SessionManagementBridge bridge = new
> SessionManagementBridge(userSessionManagement, sessionManager);
>         final PreAuthActionsHandler handler = new
> PreAuthActionsHandler(bridge, deploymentContext, facade);
>         final AtomicBoolean requestHandled = new AtomicBoolean(false);
>         if (exchange.getRequestURI().endsWith(AdapterConstants.K_LOGOUT)) {
>           HttpHandler tmpHandler = new HttpHandler()
>           {
>             @Override
>             public void handleRequest(HttpServerExchange exchange) throws
> Exception
>             {
>               requestHandled.set(handler.handleRequest());
>             }
>           };
>           exchange.dispatch(tmpHandler); // This starts the worker thread
> that allows blocking I/O
>         }
>         else {
>           requestHandled.set(handler.handleRequest());
>         }
>         if(requestHandled.get()) return;
>         next.handleRequest(exchange);
>     }
>
> Any feedback welcome.
>
> Cheers,
>   Manfred
>
> On 25.07.2016 15:35, Marko Strukelj wrote:
>
> Giving a cursory look at KEYCLOAK-3311, and not really knowing this part
> of the code so I hope I'm not giving you a wrong lead here, but it looks
> like UndertowPreAuthActionsHandler should already be present in your
> stacktrace, while currently it is not.
>
> It sounds like Wildfly adapter was not installed correctly.
>
> On Mon, Jul 25, 2016 at 9:26 AM, Manfred Duchrow <
> manfred.duchrow at caprica.biz> wrote:
>
>> Hi,
>>
>> a few days ago I created the Jira issue KEYCLOAK-3311.
>>
>> Its about the following exception when "k_logout" request from the
>> keycloak server is coming in:
>>
>> IllegalStateException: UT000126: Attempted to do blocking IO from the IO
>> thread. This is prohibited as it may result in deadlocks
>>
>> Has anybody experienced the same? Is there a workaround?
>>
>> Currently this error prevents the logout from the secure proxy and
>> therefore the protected
>> application can still be reached (for a while) even if the user's session
>> on the keycloak server
>> has been terminated.
>>
>> Cheers,
>>    Manfred
>>
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>
>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160725/a1b2c4e8/attachment.html 

From r.vanloenhout at greenvalley.nl  Mon Jul 25 11:43:02 2016
From: r.vanloenhout at greenvalley.nl (Robert van Loenhout)
Date: Mon, 25 Jul 2016 15:43:02 +0000
Subject: [keycloak-user] Invalid credentials for ldap
Message-ID: <VI1PR0101MB2013E09D175546F2D3ACC9B78D0D0@VI1PR0101MB2013.eurprd01.prod.exchangelabs.com>

I have added a novell ldap user federation. When I try to login I get an error page displaying:
Unexpected error when handling authentication request to identity provider.

In the server log it shows a WARN message with "error=invalid_user_credentials"
If I try to login with an incorrect user the message contains "error=user_not_found", so the user must have been found.
It seems that some unexpectec error occurs while verifying the password. I'm sure it is correct. And I'm assuming that I would not get an unexpected error page if the password is just incorrect.

Any help would be appreciated.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160725/89ad13ef/attachment.html 

From ssilvert at redhat.com  Mon Jul 25 12:14:36 2016
From: ssilvert at redhat.com (Stan Silvert)
Date: Mon, 25 Jul 2016 12:14:36 -0400
Subject: [keycloak-user] Keycloak subsystem is not in standalone.xml?
In-Reply-To: <CAKUZDO6H=b93uePypZLGuM=LB1CtFVkK7YCd6ue0DkkAHb8=SQ@mail.gmail.com>
References: <CAKUZDO6H=b93uePypZLGuM=LB1CtFVkK7YCd6ue0DkkAHb8=SQ@mail.gmail.com>
Message-ID: <57963AEC.6090203@redhat.com>

I don't think you downloaded the demo server.  The demo would have 
everything already set up.

On 7/24/2016 1:23 AM, Martin Min wrote:
> Hello,
>
> I am following the tutorial here:
> https://keycloak.gitbooks.io/getting-started-tutorials/content/v/2.0/topics/secure-jboss-app/subsystem.html
>
> to configure the demo KeyCloak server 2.0 and Wildfly 10 Final.
>
> The tutorial says to search for this section:
>
> |<subsystem  xmlns="urn:jboss:domain:keycloak:1.1"/>|
> However, there is no such  an entry in standalone.xml of Wildfly 10's 
> configuration/standalone.xml.
>
> I manually added this part, then it gives me an error as I start the 
> application server.
>
> Is this because the tutorial is not updated to the Wildfly 10 final 
> release? Thank you.
>
> Error message:
>
> 22:22:33,022 INFO  [org.jboss.as <http://org.jboss.as>] (MSC service 
> thread 1-6) WFLYSRV0049: WildFly Full 10.0.0.Final (WildFly Core 
> 2.0.10.Final) starting
> 22:22:33,535 ERROR [org.jboss.as.server] (Controller Boot Thread) 
> WFLYSRV0055: Caught exception during boot: 
> org.jboss.as.controller.persistence.ConfigurationPersistenceException: 
> WFLYCTL0085: Failed to parse configuration
>         at 
> org.jboss.as.controller.persistence.XmlConfigurationPersister.load(XmlConfigurationPersister.java:131)
>         at org.jboss.as.server.ServerService.boot(ServerService.java:356)
>         at 
> org.jboss.as.controller.AbstractControllerService$1.run(AbstractControllerService.java:299)
>         at java.lang.Thread.run(Thread.java:745)
> Caused by: javax.xml.stream.XMLStreamException: ParseError at 
> [row,col]:[216,2]
> Message: Unexpected element '{urn:jboss:domain:keycloak:1.1}subsystem'
>         at 
> org.jboss.staxmapper.XMLMapperImpl.processNested(XMLMapperImpl.java:108)
>         at 
> org.jboss.staxmapper.XMLExtendedStreamReaderImpl.handleAny(XMLExtendedStreamReaderImpl.java:69)
>         at 
> org.jboss.as.server.parsing.StandaloneXml_4.parseServerProfile(StandaloneXml_4.java:546)
>         at 
> org.jboss.as.server.parsing.StandaloneXml_4.readServerElement(StandaloneXml_4.java:242)
>         at 
> org.jboss.as.server.parsing.StandaloneXml_4.readElement(StandaloneXml_4.java:141)
>         at 
> org.jboss.as.server.parsing.StandaloneXml.readElement(StandaloneXml.java:103)
>         at 
> org.jboss.as.server.parsing.StandaloneXml.readElement(StandaloneXml.java:49)
>         at 
> org.jboss.staxmapper.XMLMapperImpl.processNested(XMLMapperImpl.java:110)
>         at 
> org.jboss.staxmapper.XMLMapperImpl.parseDocument(XMLMapperImpl.java:69)
>         at 
> org.jboss.as.controller.persistence.XmlConfigurationPersister.load(XmlConfigurationPersister.java:123)
>         ... 3 more
>
> 22:22:33,536 FATAL [org.jboss.as.server] (Controller Boot Thread) 
> WFLYSRV0056: Server boot has failed in an unrecoverable manner; 
> exiting. See previous messages for details.
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160725/056a0ff5/attachment-0001.html 

From thomas.darimont at googlemail.com  Mon Jul 25 13:10:59 2016
From: thomas.darimont at googlemail.com (Thomas Darimont)
Date: Mon, 25 Jul 2016 19:10:59 +0200
Subject: [keycloak-user] Token generation: possibilities to improve
	performance
In-Reply-To: <574D3660.6060807@redhat.com>
References: <61D077C6283D454FAFD06F6AC4AB74D723DDFF8E@DEFTHW99EZ1MSX.ww931.my-it-solutions.net>
	<31bfde5a-c56f-473a-de6f-95d15e32bbd9@redhat.com>
	<57488196.60104@redhat.com>
	<CAJgngAcDQE9GdMpCoV=YK37c_e9dMo+V2nLNE7ffR2eotsa9Yw@mail.gmail.com>
	<574C0448.6090108@redhat.com>
	<CAJgngAdr0iCF=4=93WnOK97HxFGUPCf5xtyFYLfHju4U4PBkoA@mail.gmail.com>
	<574C0FE8.5090003@redhat.com>
	<CAJgngAcxJcB1tbL+w8ZUQK6R0U-xxd2NfB7qsxv3gd==hJChvg@mail.gmail.com>
	<574D3660.6060807@redhat.com>
Message-ID: <CAK-7U1jio6SahQP=_w7adTwkO1oE6E5YvQTyw=_npx-rwXruTw@mail.gmail.com>

Hello,

I couldn't find the JIRA for the optional exclusion of the IDToken when
refreshing Access Tokens so I created:
https://issues.jboss.org/browse/KEYCLOAK-3360

I also did a PR which implements that:
https://github.com/keycloak/keycloak/pull/3069

Cheers,
Thomas

2016-05-31 8:59 GMT+02:00 Marek Posolda <mposolda at redhat.com>:

> On 30/05/16 21:04, Stian Thorgersen wrote:
>
>
>
> On 30 May 2016 at 12:03, Marek Posolda <mposolda at redhat.com> wrote:
>
>> On 30/05/16 11:51, Stian Thorgersen wrote:
>>
>>
>>
>> On 30 May 2016 at 11:13, Marek Posolda < <mposolda at redhat.com>
>> mposolda at redhat.com> wrote:
>>
>>> On 30/05/16 08:02, Stian Thorgersen wrote:
>>>
>>> Create a JIRA for ECDSA. I don't think we could/should change the
>>> default, but could be a configuration option for clients.
>>>
>>> Added https://issues.jboss.org/browse/KEYCLOAK-3057 with fix version
>>> 2.0.0.CR1 for now.
>>>
>>>
>>> Looking at OpenID Connect spec it looks like ID token should always be
>>> generated in token response [1]. However, it should not be generated in
>>> refresh [2] response.
>>>
>>> [1]
>>> <http://openid.net/specs/openid-connect-core-1_0.html#rfc.section.3.1.3.3>
>>> http://openid.net/specs/openid-connect-core-1_0.html#rfc.section.3.1.3.3
>>> [2]
>>> <http://openid.net/specs/openid-connect-core-1_0.html#rfc.section.12.2>
>>> http://openid.net/specs/openid-connect-core-1_0.html#rfc.section.12.2
>>>
>>> hmm... I am reading 12.2 that refresh response "might not" contain ID
>>> Token, hence it's nothing bad if it contains it. So looks we are currently
>>> specs compliant if we have IDToken in both code-to-token response and
>>> refresh response.
>>>
>>> What I mean is, that flag for skip IDToken generation might be just
>>> optional and disabled by default. So by default, IDToken is available and
>>> all the communication is OIDC compliant. However if someone doesn't need
>>> IDToken and wants to save some performance, he may skip the IDToken
>>> generation.
>>>
>>> A week before, I've tried some JProfiler testing of login-logout test
>>> and token generation was the main CPU consumption (I still had just 1
>>> hashIteration during this profiling, with 20000 it will be likely very
>>> different though). I saw 40% of CPU time in TokenManager$
>>> AccessTokenResponseBuilder.build() due there are 3 tokens signature
>>> here. The option to reduce it from 3 to 2 might slightly improve some CPU
>>> cycles "for free" (security won't be reduced).
>>>
>>
>> I'd argue that we should just include ID token from the authorization
>> response, while never in the refresh response. That results in better
>> performance without the need for a config option.
>>
>> Won't that break compatibility for some client applications, which
>> actually use IDToken and rely on the fact that it's properly refreshed
>> every time? Among other things, IDToken contains fields like "exp" , which
>> might then contain  expired value as it won't be updated during refreshes.
>> Not sure if users won't be confused due to this.
>>
>
> Surely the exp for an IDToken should be set to the session expiration and
> not to the expiration of access token though? Do we even update the profile
> details in the token or just fill it with whatever was there before?
>
> That's not what we are doing now. Right now, all IDToken claims (including
> expiration) are copied from accessToken. So IDToken expiration is by
> default defacto just 5 minutes or so. And all the claims are always updated
> during refresh. So if we don't refresh IDToken we lost this and IDToken
> will always contain claims from the time of login. Not sure if it's too bad
> or not, however some client apps, which use IDToken (like our demo for
> example) might be confused that IDToken will still contain old values after
> refresh...
>
> Marek
>
> Marek
>>
>>
>>
>>>
>>>
>>> Marek
>>>
>>>
>>> On 27 May 2016 at 19:19, Marek Posolda < <mposolda at redhat.com>
>>> mposolda at redhat.com> wrote:
>>>
>>>> Regarding this, I wonder if we should add support for ECDSA based
>>>> signatures as an alternative to RSA? Just went through some interesting
>>>> blog [1] , which mentions that 256-bits ECDSA has around 9.5 times better
>>>> performance of signature generation than 2048-bits RSA. The time of
>>>> signature verification seems to be slightly worse for ECDSA (see second
>>>> comment), however there is also increased security (256-ECDSA is
>>>> equivalient of 3248 RSA according to blog). Maybe it's something we can
>>>> look at?
>>>>
>>>> Also the optional flag to skip IDToken generation will be good too IMO.
>>>> AFAIK the point of IDToken is the compliance with OIDC specification.
>>>> However in case of Keycloak accessToken usually contains all the info like
>>>> IDToken (+ some more) and it's the accessToken, which is used in REST
>>>> endpoints. So with regards to that, most of the Keycloak-secured
>>>> applications can live just with access+refresh token and don't need ID
>>>> Token at all. So if just 2 tokens needs to be signed instead of 3, we have
>>>> performance gain "for free" (no decrease of security, just one less useless
>>>> token).
>>>>
>>>> [1]
>>>> <https://blog.cloudflare.com/ecdsa-the-digital-signature-algorithm-of-a-better-internet/>
>>>> https://blog.cloudflare.com/ecdsa-the-digital-signature-algorithm-of-a-better-internet/
>>>>
>>>> Marek
>>>>
>>>>
>>>> On 24/05/16 15:43, Bill Burke wrote:
>>>>
>>>> Are you sure the performance gains are worth less security?  What kind
>>>> of performance are you actually worried about?  Network (size of tokens) or
>>>> CPU (signatures/marshaling/unmarshalling)?  If anything, these signatures
>>>> are only going to get stronger in future releases.
>>>>
>>>> On 5/24/16 5:46 AM, Matuszak, Eduard wrote:
>>>>
>>>> Hello
>>>>
>>>> Motivated by considerations on how to improve the performance of the
>>>> token generation process I have two questions:
>>>>
>>>>
>>>>    - I noticed that Keycloak?s token generation via endpoint
>>>>    ?auth/realms/ccp/protocol/openid-connect/token? generates a triple of
>>>>    tokens (access-, refresh- and id-token). Is there any possibility to
>>>>    dispense with the id-token generation?
>>>>
>>>>
>>>>
>>>>    - Is there a possibility to cause Keycloak to generate more
>>>>    ?simple? bearer tokens then complex jwt-tokens?
>>>>
>>>>
>>>>
>>>> Best regards, Eduard Matuszak
>>>>
>>>>
>>>>
>>>> _______________________________________________
>>>> keycloak-user mailing listkeycloak-user at lists.jboss.orghttps://lists.jboss.org/mailman/listinfo/keycloak-user
>>>>
>>>>
>>>>
>>>>
>>>> _______________________________________________
>>>> keycloak-user mailing listkeycloak-user at lists.jboss.orghttps://lists.jboss.org/mailman/listinfo/keycloak-user
>>>>
>>>>
>>>>
>>>> _______________________________________________
>>>> keycloak-user mailing list
>>>> keycloak-user at lists.jboss.org
>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>>
>>>
>>>
>>>
>>
>>
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160725/92da72d5/attachment-0001.html 

From rsoares at redhat.com  Tue Jul 26 01:00:14 2016
From: rsoares at redhat.com (Rafael Soares)
Date: Tue, 26 Jul 2016 02:00:14 -0300
Subject: [keycloak-user] .NET Core OIDC auth
Message-ID: <CAK6emKN1ar4YJxKqr_Omd=NVTo=Wm=D18kmN4YPXit3_9HOPEA@mail.gmail.com>

I'm trying to integrate an ASP .NET Core client web app with Keycloak using
the .NET Core native OIDC Support.

For this I'm using a sample project available in the IdentityServer Github
repo [1]. IdentityServer is an OIDC Auth Server/Framework implementation
for .NET platform.

I forked that sample repo and changed the configuration to use the Keycloak
OIDC endpoints.
The code snippet changed to use keycloak endpoint is this one
<https://github.com/rafaeltuelho/IdentityServer4.Samples/blob/dev/MVC%20and%20API/src/AspNetCoreAuthentication/Startup.cs#L37>.


I was able to run this code on my RHEL 7 box using .NET Core for Linux [2].
In the KC side I just created a new realm and a client (see the
dotnetcore.json realm config attached). The web app starts and the secured
pages/resources redirects the user to the Keycloak endpoint, but after the
user authenticates and KC responds the request the following error occurs
on .NET client side:

"OpenIdConnectProtocolInvalidCHashException: IDX10307: *The 'c_hash' claim
was not found in the id_token*, but a 'code' was in the
OpenIdConnectMessage, id_token:
'{"alg":"RS256","typ":"JWT"}.{"jti":"cae47265-327e-4961-aeb2-6615713cc6f8","exp":1469508079,"nbf":0,"iat":1469507779,"iss":"
http://localhost:8080/auth/realms/dotnetdemo","aud":"dotnetcore","sub":"b8a10870-3abd-487b-802e-e57307eafc14","typ":"ID","azp":"dotnetcore","nonce":"636051045638599850.NTdmY2FhNWQtYzNmYi00Zjg1LWFlZjItYmViYzBmZTgwMjYzZDMwMDdlYzYtMGJiMS00OWY1LTlhZTQtY2VjNWYyMzM2Yzhl","session_state":"b3010cce-24ac-426b-969a-cccefe41711f","name":"dot
NET","preferred_username":"dotnetuser","given_name":"dot","family_name":"NET","email":"
donetuser at localhost.com"}'"

Searching for this message "*The 'c_hash' claim was not found in the
id_token*" I found the issue *KEYCLOAK-3286* [3]. Does this error have
something to do with the *KEYCLOAK-3286?*

Does some one tried to integrate a .NET app with Keycloak using OIDC
protocol?

[1] https://github.com/IdentityServer/IdentityServer4.Samples
[2] https://www.microsoft.com/net/core#redhat
[3] https://issues.jboss.org/browse/KEYCLOAK-3286

-- 

___
Rafael T. C. Soares
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160726/e8cabb52/attachment.html 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: dotnetcore.json
Type: application/json
Size: 4333 bytes
Desc: not available
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20160726/e8cabb52/attachment.bin 

From rsoares at redhat.com  Tue Jul 26 01:27:28 2016
From: rsoares at redhat.com (Rafael Soares)
Date: Tue, 26 Jul 2016 02:27:28 -0300
Subject: [keycloak-user] .NET Core OIDC auth
In-Reply-To: <CAK6emKN1ar4YJxKqr_Omd=NVTo=Wm=D18kmN4YPXit3_9HOPEA@mail.gmail.com>
References: <CAK6emKN1ar4YJxKqr_Omd=NVTo=Wm=D18kmN4YPXit3_9HOPEA@mail.gmail.com>
Message-ID: <CAK6emKMwvVLASPBVw5rz6TGwrexzC7Z_U1=gYiU_Hxn4K_uirQ@mail.gmail.com>

Hi!

After a while I managed to get this .NET sample project working (Log
in/out) with Keycloak!
I changed the .NET client code to use 'id_token' as the OIDC ResponseType.
See the line #42.
<https://github.com/rafaeltuelho/IdentityServer4.Samples/blob/dev/MVC%20and%20API/src/AspNetCoreAuthentication/Startup.cs#L42>

o/

On Tue, Jul 26, 2016 at 2:00 AM, Rafael Soares <rsoares at redhat.com> wrote:

>
> I'm trying to integrate an ASP .NET Core client web app with Keycloak
> using the .NET Core native OIDC Support.
>
> For this I'm using a sample project available in the IdentityServer Github
> repo [1]. IdentityServer is an OIDC Auth Server/Framework implementation
> for .NET platform.
>
> I forked that sample repo and changed the configuration to use the
> Keycloak OIDC endpoints.
> The code snippet changed to use keycloak endpoint is this one
> <https://github.com/rafaeltuelho/IdentityServer4.Samples/blob/dev/MVC%20and%20API/src/AspNetCoreAuthentication/Startup.cs#L37>.
>
>
> I was able to run this code on my RHEL 7 box using .NET Core for Linux
> [2]. In the KC side I just created a new realm and a client (see the
> dotnetcore.json realm config attached). The web app starts and the secured
> pages/resources redirects the user to the Keycloak endpoint, but after the
> user authenticates and KC responds the request the following error occurs
> on .NET client side:
>
> "OpenIdConnectProtocolInvalidCHashException: IDX10307: *The 'c_hash'
> claim was not found in the id_token*, but a 'code' was in the
> OpenIdConnectMessage, id_token:
> '{"alg":"RS256","typ":"JWT"}.{"jti":"cae47265-327e-4961-aeb2-6615713cc6f8","exp":1469508079,"nbf":0,"iat":1469507779,"iss":"
> http://localhost:8080/auth/realms/dotnetdemo","aud":"dotnetcore","sub":"b8a10870-3abd-487b-802e-e57307eafc14","typ":"ID","azp":"dotnetcore","nonce":"636051045638599850.NTdmY2FhNWQtYzNmYi00Zjg1LWFlZjItYmViYzBmZTgwMjYzZDMwMDdlYzYtMGJiMS00OWY1LTlhZTQtY2VjNWYyMzM2Yzhl","session_state":"b3010cce-24ac-426b-969a-cccefe41711f","name":"dot
> NET","preferred_username":"dotnetuser","given_name":"dot","family_name":"NET","email":"
> donetuser at localhost.com"}'"
>
> Searching for this message "*The 'c_hash' claim was not found in the
> id_token*" I found the issue *KEYCLOAK-3286* [3]. Does this error have
> something to do with the *KEYCLOAK-3286?*
>
> Does some one tried to integrate a .NET app with Keycloak using OIDC
> protocol?
>
> [1] https://github.com/IdentityServer/IdentityServer4.Samples
> [2] https://www.microsoft.com/net/core#redhat
> [3] https://issues.jboss.org/browse/KEYCLOAK-3286
>
> --
>
> ___
> Rafael T. C. Soares
>
>


-- 

___
Rafael T. C. Soares | Solution Architect
JBoss Enterprise Middleware | Red Hat Brazil
Mobile: +55 71 98181-3636
Phone:  +55 11 3529-6096
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160726/78157546/attachment.html 

From pnalyvayko at agi.com  Tue Jul 26 02:51:00 2016
From: pnalyvayko at agi.com (Nalyvayko, Peter)
Date: Tue, 26 Jul 2016 06:51:00 +0000
Subject: [keycloak-user] .NET Core OIDC auth
In-Reply-To: <CAK6emKN1ar4YJxKqr_Omd=NVTo=Wm=D18kmN4YPXit3_9HOPEA@mail.gmail.com>
References: <CAK6emKN1ar4YJxKqr_Omd=NVTo=Wm=D18kmN4YPXit3_9HOPEA@mail.gmail.com>
Message-ID: <DM5PR07MB2937D6D113288A732830D303DA0E0@DM5PR07MB2937.namprd07.prod.outlook.com>

Hi Rafael,

Yes, KEYCLOAK-3286 has something to do with the issue you've run into. According to the spec, when the client uses one of Hybrid flows, i.e. 'code id_token', 'code id_token token', the server is required to include c_hash claim into the id token.
Regards
Peter
 ________________________________________
From: keycloak-user-bounces at lists.jboss.org [keycloak-user-bounces at lists.jboss.org] on behalf of Rafael Soares [rsoares at redhat.com]
Sent: Tuesday, July 26, 2016 1:00 AM
To: keycloak-user
Subject: [keycloak-user] .NET Core OIDC auth

I'm trying to integrate an ASP .NET Core client web app with Keycloak using the .NET Core native OIDC Support.

For this I'm using a sample project available in the IdentityServer Github repo [1]. IdentityServer is an OIDC Auth Server/Framework implementation for .NET platform.

I forked that sample repo and changed the configuration to use the Keycloak OIDC endpoints.
The code snippet changed to use keycloak endpoint is this one<https://github.com/rafaeltuelho/IdentityServer4.Samples/blob/dev/MVC%20and%20API/src/AspNetCoreAuthentication/Startup.cs#L37>.

I was able to run this code on my RHEL 7 box using .NET Core for Linux [2]. In the KC side I just created a new realm and a client (see the dotnetcore.json realm config attached). The web app starts and the secured pages/resources redirects the user to the Keycloak endpoint, but after the user authenticates and KC responds the request the following error occurs on .NET client side:

"OpenIdConnectProtocolInvalidCHashException: IDX10307: The 'c_hash' claim was not found in the id_token, but a 'code' was in the OpenIdConnectMessage, id_token: '{"alg":"RS256","typ":"JWT"}.{"jti":"cae47265-327e-4961-aeb2-6615713cc6f8","exp":1469508079,"nbf":0,"iat":1469507779,"iss":"http://localhost:8080/auth/realms/dotnetdemo","aud":"dotnetcore","sub":"b8a10870-3abd-487b-802e-e57307eafc14","typ":"ID","azp":"dotnetcore","nonce":"636051045638599850.NTdmY2FhNWQtYzNmYi00Zjg1LWFlZjItYmViYzBmZTgwMjYzZDMwMDdlYzYtMGJiMS00OWY1LTlhZTQtY2VjNWYyMzM2Yzhl","session_state":"b3010cce-24ac-426b-969a-cccefe41711f","name":"dot NET","preferred_username":"dotnetuser","given_name":"dot","family_name":"NET","email":"donetuser at localhost.com<mailto:donetuser at localhost.com>"}'"

Searching for this message "The 'c_hash' claim was not found in the id_token" I found the issue KEYCLOAK-3286 [3]. Does this error have something to do with the KEYCLOAK-3286?

Does some one tried to integrate a .NET app with Keycloak using OIDC protocol?

[1] https://github.com/IdentityServer/IdentityServer4.Samples
[2] https://www.microsoft.com/net/core#redhat
[3] https://issues.jboss.org/browse/KEYCLOAK-3286

--

___
Rafael T. C. Soares



From jitendrachouhan03 at gmail.com  Tue Jul 26 03:00:00 2016
From: jitendrachouhan03 at gmail.com (Jitendra Chouhan)
Date: Tue, 26 Jul 2016 12:30:00 +0530
Subject: [keycloak-user] Keycloak Admin Client Jar - 1.9.8/ 2.0.0 are not
	working properly
Message-ID: <CADFocS=PtJJcC9D9F7saWX3GVZR2jNpUyD6xuVavuHoiGuNDxw@mail.gmail.com>

I am using keycloak-admin-client jar for provisioning users  in keycloak
server instance but facing issue if using keycloak-admin-client version
higher than 1.8.0.Final. Please find detailed informations about issue and
configurations used to provision user as below:

1) keycloak-server version: 1.9.8.Final or 2.0.0.Final
2) keycloak-admin-client version: 1.9.8.Final or 2.0.0.Final

Sample Code Snippet:

Keycloak kc = KeycloakBuilder.builder() //
.serverUrl("http://localhost:8080/auth") //
.realm("master")//
.username("admin") //
.password("admin") //
.clientId("admin-cli") //
// .clientId("security-admin-console") //
.resteasyClient(new
ResteasyClientBuilder().connectionPoolSize(10).build())//
.build();
// 1. User
CredentialRepresentation credential = new CredentialRepresentation();
credential.setType(CredentialRepresentation.PASSWORD);
credential.setValue("test123");
credential.setTemporary(false);

UserRepresentation user = new UserRepresentation();
user.setUsername("testuser");
user.setFirstName("Test");
user.setLastName("User");
user.setCredentials(asList(credential));
user.setEnabled(true);
user.setRealmRoles(asList("admin"));

// create a user
//Response result = kc.realm("master").users().create(user);
Response result = kc.realm("demo").users().create(user);
if (result.getStatus() != 201) {
if(result.getStatus() == 409){
System.err.println("Couldn't create user since user already exist.");
System.exit(0);
}
System.err.println("Couldn't create user.");
System.exit(0);
}
System.out.println("test user created.... verify in keycloak!");

Error stack trace::

Exception in thread "main" javax.ws.rs.client.ResponseProcessingException:
javax.ws.rs.ProcessingException:
org.codehaus.jackson.map.exc.UnrecognizedPropertyException: Unrecognized
field "access_token" (Class
org.keycloak.representations.AccessTokenResponse), not marked as ignorable
 at [Source: org.apache.http.conn.EofSensorInputStream at 6f3c660a; line: 1,
column: 18] (through reference chain:
org.keycloak.representations.AccessTokenResponse["access_token"])
at
org.jboss.resteasy.client.jaxrs.internal.ClientInvocation.extractResult(ClientInvocation.java:140)
at
org.jboss.resteasy.client.jaxrs.internal.proxy.extractors.BodyEntityExtractor.extractEntity(BodyEntityExtractor.java:58)
at
org.jboss.resteasy.client.jaxrs.internal.proxy.ClientInvoker.invoke(ClientInvoker.java:104)
at
org.jboss.resteasy.client.jaxrs.internal.proxy.ClientProxy.invoke(ClientProxy.java:62)
at com.sun.proxy.$Proxy19.grantToken(Unknown Source)
at
org.keycloak.admin.client.token.TokenManager.grantToken(TokenManager.java:85)
at
org.keycloak.admin.client.token.TokenManager.getAccessToken(TokenManager.java:65)
at
org.keycloak.admin.client.token.TokenManager.getAccessTokenString(TokenManager.java:60)
at
org.keycloak.admin.client.resource.BearerAuthFilter.filter(BearerAuthFilter.java:52)
at
org.jboss.resteasy.client.jaxrs.internal.ClientInvocation.invoke(ClientInvocation.java:384)
at
org.jboss.resteasy.client.jaxrs.internal.proxy.ClientInvoker.invoke(ClientInvoker.java:102)
at
org.jboss.resteasy.client.jaxrs.internal.proxy.ClientProxy.invoke(ClientProxy.java:62)
at com.sun.proxy.$Proxy27.create(Unknown Source)
at
com.samba.security.keycloak.KeycloakAdminClientExample.main(KeycloakAdminClientExample.java:79)
Caused by: javax.ws.rs.ProcessingException:
org.codehaus.jackson.map.exc.UnrecognizedPropertyException: Unrecognized
field "access_token" (Class
org.keycloak.representations.AccessTokenResponse), not marked as ignorable
 at [Source: org.apache.http.conn.EofSensorInputStream at 6f3c660a; line: 1,
column: 18] (through reference chain:
org.keycloak.representations.AccessTokenResponse["access_token"])
at
org.jboss.resteasy.client.jaxrs.internal.ClientResponse.readFrom(ClientResponse.java:282)
at
org.jboss.resteasy.client.jaxrs.internal.ClientResponse.readEntity(ClientResponse.java:181)
at
org.jboss.resteasy.specimpl.BuiltResponse.readEntity(BuiltResponse.java:211)
at
org.jboss.resteasy.client.jaxrs.internal.ClientInvocation.extractResult(ClientInvocation.java:104)
... 13 more
Caused by: org.codehaus.jackson.map.exc.UnrecognizedPropertyException:
Unrecognized field "access_token" (Class
org.keycloak.representations.AccessTokenResponse), not marked as ignorable
 at [Source: org.apache.http.conn.EofSensorInputStream at 6f3c660a; line: 1,
column: 18] (through reference chain:
org.keycloak.representations.AccessTokenResponse["access_token"])
at
org.codehaus.jackson.map.exc.UnrecognizedPropertyException.from(UnrecognizedPropertyException.java:53)
at
org.codehaus.jackson.map.deser.StdDeserializationContext.unknownFieldException(StdDeserializationContext.java:267)
at
org.codehaus.jackson.map.deser.std.StdDeserializer.reportUnknownProperty(StdDeserializer.java:673)
at
org.codehaus.jackson.map.deser.std.StdDeserializer.handleUnknownProperty(StdDeserializer.java:659)
at
org.codehaus.jackson.map.deser.BeanDeserializer.handleUnknownProperty(BeanDeserializer.java:1365)
at
org.codehaus.jackson.map.deser.BeanDeserializer._handleUnknown(BeanDeserializer.java:725)
at
org.codehaus.jackson.map.deser.BeanDeserializer.deserializeFromObject(BeanDeserializer.java:703)
at
org.codehaus.jackson.map.deser.BeanDeserializer.deserialize(BeanDeserializer.java:580)
at org.codehaus.jackson.map.ObjectMapper._readValue(ObjectMapper.java:2704)
at org.codehaus.jackson.map.ObjectMapper.readValue(ObjectMapper.java:1315)
at
org.codehaus.jackson.jaxrs.JacksonJsonProvider.readFrom(JacksonJsonProvider.java:419)
at
org.jboss.resteasy.core.interception.AbstractReaderInterceptorContext.readFrom(AbstractReaderInterceptorContext.java:59)
at
org.jboss.resteasy.core.interception.AbstractReaderInterceptorContext.proceed(AbstractReaderInterceptorContext.java:51)
at
org.jboss.resteasy.plugins.interceptors.encoding.GZIPDecodingInterceptor.aroundReadFrom(GZIPDecodingInterceptor.java:59)
at
org.jboss.resteasy.core.interception.AbstractReaderInterceptorContext.proceed(AbstractReaderInterceptorContext.java:53)
at
org.jboss.resteasy.client.jaxrs.internal.ClientResponse.readFrom(ClientResponse.java:248)

Same sample code with keycloak-admin-client version: 1.8.0 is working fine
and able to provision user in keycloak server. Hence there is some issue
with higher version of keycloak-client-admin bundle than 1.8.0. Please find
attached pom file for project.

Thanks,
Jitendra Chouhan
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160726/17ddecc9/attachment.html 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: pom.xml
Type: text/xml
Size: 1404 bytes
Desc: not available
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20160726/17ddecc9/attachment.xml 

From jitendrachouhan03 at gmail.com  Tue Jul 26 03:34:55 2016
From: jitendrachouhan03 at gmail.com (Jitendra Chouhan)
Date: Tue, 26 Jul 2016 13:04:55 +0530
Subject: [keycloak-user] Keycloak Reference Token Support
Message-ID: <CADFocSmzGTjyer8TRBRcRzojH4zVkqJDRgBQuFCRNCqe4sm=Ow@mail.gmail.com>

I want to know does keycloak have support for Reference/Opaque token. I
have found one feature request which is still in open submitted for
implementing reference token fetaure i.e. KEYCLOAK-1719. Today i came
across "KEYCLOAK-2738" which talks about problem related to aud is missing
from reference token.Can someone confirm, whether Reference/Opaque token
feature is provided by keycloak if yes then please provide reference point
to do configuration to generate "Reference/Opqaue" token.

Thanks,
Jitendra Chouhan
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160726/cba56033/attachment.html 

From jitendrachouhan03 at gmail.com  Tue Jul 26 03:47:44 2016
From: jitendrachouhan03 at gmail.com (Jitendra Chouhan)
Date: Tue, 26 Jul 2016 13:17:44 +0530
Subject: [keycloak-user] Keycloak Reference Token Support
In-Reply-To: <CADFocSmzGTjyer8TRBRcRzojH4zVkqJDRgBQuFCRNCqe4sm=Ow@mail.gmail.com>
References: <CADFocSmzGTjyer8TRBRcRzojH4zVkqJDRgBQuFCRNCqe4sm=Ow@mail.gmail.com>
Message-ID: <CADFocSms0y4C-aXgrvDDNSp3wejBuRbt7vZbo0+5uyrBZx05-Q@mail.gmail.com>

Please ignore information mentioned about KEYCLOAK-2738 in my previous
mail. Still my question stand whether there is any support for reference
token(generation) in keycloak or not?

Thanks

On Tue, Jul 26, 2016 at 1:04 PM, Jitendra Chouhan <
jitendrachouhan03 at gmail.com> wrote:

> I want to know does keycloak have support for Reference/Opaque token. I
> have found one feature request which is still in open submitted for
> implementing reference token fetaure i.e. KEYCLOAK-1719. Today i came
> across "KEYCLOAK-2738" which talks about problem related to aud is missing
> from reference token.Can someone confirm, whether Reference/Opaque token
> feature is provided by keycloak if yes then please provide reference point
> to do configuration to generate "Reference/Opqaue" token.
>
> Thanks,
> Jitendra Chouhan
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160726/94a89040/attachment-0001.html 

From pires at littlebits.cc  Tue Jul 26 04:23:51 2016
From: pires at littlebits.cc (Paulo Pires)
Date: Tue, 26 Jul 2016 08:23:51 +0000
Subject: [keycloak-user] Keycloak Admin Client Jar - 1.9.8/ 2.0.0 are
 not working properly
In-Reply-To: <CADFocS=PtJJcC9D9F7saWX3GVZR2jNpUyD6xuVavuHoiGuNDxw@mail.gmail.com>
References: <CADFocS=PtJJcC9D9F7saWX3GVZR2jNpUyD6xuVavuHoiGuNDxw@mail.gmail.com>
Message-ID: <CAO8YOYV6wsRkdODD1ufpPBJGbUd72Gm1nsKBYYxENpkt=5JUZQ@mail.gmail.com>

You need to explicitly provide the following dependencies:

        <dependency>
            <groupId>org.keycloak</groupId>
            <artifactId>keycloak-admin-client</artifactId>
            <version>${keycloak.version}</version>
        </dependency>
        <dependency>
            <groupId>org.jboss.resteasy</groupId>
            <artifactId>resteasy-client</artifactId>
            <version>${resteasy.version}</version>
        </dependency>
        <dependency>
            <groupId>org.jboss.resteasy</groupId>
            <artifactId>resteasy-jackson2-provider</artifactId>
            <version>${resteasy.version}</version>
        </dependency>
        <dependency>
            <groupId>org.jboss.resteasy</groupId>
            <artifactId>resteasy-multipart-provider</artifactId>
            <version>${resteasy.version}</version>
        </dependency>

Pires

On Tue, Jul 26, 2016 at 8:08 AM Jitendra Chouhan <
jitendrachouhan03 at gmail.com> wrote:

> I am using keycloak-admin-client jar for provisioning users  in keycloak
> server instance but facing issue if using keycloak-admin-client version
> higher than 1.8.0.Final. Please find detailed informations about issue and
> configurations used to provision user as below:
>
> 1) keycloak-server version: 1.9.8.Final or 2.0.0.Final
> 2) keycloak-admin-client version: 1.9.8.Final or 2.0.0.Final
>
> Sample Code Snippet:
>
> Keycloak kc = KeycloakBuilder.builder() //
> .serverUrl("http://localhost:8080/auth") //
> .realm("master")//
> .username("admin") //
> .password("admin") //
> .clientId("admin-cli") //
> // .clientId("security-admin-console") //
> .resteasyClient(new
> ResteasyClientBuilder().connectionPoolSize(10).build())//
> .build();
> // 1. User
> CredentialRepresentation credential = new CredentialRepresentation();
> credential.setType(CredentialRepresentation.PASSWORD);
> credential.setValue("test123");
> credential.setTemporary(false);
>
> UserRepresentation user = new UserRepresentation();
> user.setUsername("testuser");
> user.setFirstName("Test");
> user.setLastName("User");
> user.setCredentials(asList(credential));
> user.setEnabled(true);
> user.setRealmRoles(asList("admin"));
>
> // create a user
> //Response result = kc.realm("master").users().create(user);
> Response result = kc.realm("demo").users().create(user);
> if (result.getStatus() != 201) {
> if(result.getStatus() == 409){
> System.err.println("Couldn't create user since user already exist.");
> System.exit(0);
> }
> System.err.println("Couldn't create user.");
> System.exit(0);
> }
> System.out.println("test user created.... verify in keycloak!");
>
> Error stack trace::
>
> Exception in thread "main" javax.ws.rs.client.ResponseProcessingException:
> javax.ws.rs.ProcessingException:
> org.codehaus.jackson.map.exc.UnrecognizedPropertyException: Unrecognized
> field "access_token" (Class
> org.keycloak.representations.AccessTokenResponse), not marked as ignorable
>  at [Source: org.apache.http.conn.EofSensorInputStream at 6f3c660a; line: 1,
> column: 18] (through reference chain:
> org.keycloak.representations.AccessTokenResponse["access_token"])
> at
> org.jboss.resteasy.client.jaxrs.internal.ClientInvocation.extractResult(ClientInvocation.java:140)
> at
> org.jboss.resteasy.client.jaxrs.internal.proxy.extractors.BodyEntityExtractor.extractEntity(BodyEntityExtractor.java:58)
> at
> org.jboss.resteasy.client.jaxrs.internal.proxy.ClientInvoker.invoke(ClientInvoker.java:104)
> at
> org.jboss.resteasy.client.jaxrs.internal.proxy.ClientProxy.invoke(ClientProxy.java:62)
> at com.sun.proxy.$Proxy19.grantToken(Unknown Source)
> at
> org.keycloak.admin.client.token.TokenManager.grantToken(TokenManager.java:85)
> at
> org.keycloak.admin.client.token.TokenManager.getAccessToken(TokenManager.java:65)
> at
> org.keycloak.admin.client.token.TokenManager.getAccessTokenString(TokenManager.java:60)
> at
> org.keycloak.admin.client.resource.BearerAuthFilter.filter(BearerAuthFilter.java:52)
> at
> org.jboss.resteasy.client.jaxrs.internal.ClientInvocation.invoke(ClientInvocation.java:384)
> at
> org.jboss.resteasy.client.jaxrs.internal.proxy.ClientInvoker.invoke(ClientInvoker.java:102)
> at
> org.jboss.resteasy.client.jaxrs.internal.proxy.ClientProxy.invoke(ClientProxy.java:62)
> at com.sun.proxy.$Proxy27.create(Unknown Source)
> at
> com.samba.security.keycloak.KeycloakAdminClientExample.main(KeycloakAdminClientExample.java:79)
> Caused by: javax.ws.rs.ProcessingException:
> org.codehaus.jackson.map.exc.UnrecognizedPropertyException: Unrecognized
> field "access_token" (Class
> org.keycloak.representations.AccessTokenResponse), not marked as ignorable
>  at [Source: org.apache.http.conn.EofSensorInputStream at 6f3c660a; line: 1,
> column: 18] (through reference chain:
> org.keycloak.representations.AccessTokenResponse["access_token"])
> at
> org.jboss.resteasy.client.jaxrs.internal.ClientResponse.readFrom(ClientResponse.java:282)
> at
> org.jboss.resteasy.client.jaxrs.internal.ClientResponse.readEntity(ClientResponse.java:181)
> at
> org.jboss.resteasy.specimpl.BuiltResponse.readEntity(BuiltResponse.java:211)
> at
> org.jboss.resteasy.client.jaxrs.internal.ClientInvocation.extractResult(ClientInvocation.java:104)
> ... 13 more
> Caused by: org.codehaus.jackson.map.exc.UnrecognizedPropertyException:
> Unrecognized field "access_token" (Class
> org.keycloak.representations.AccessTokenResponse), not marked as ignorable
>  at [Source: org.apache.http.conn.EofSensorInputStream at 6f3c660a; line: 1,
> column: 18] (through reference chain:
> org.keycloak.representations.AccessTokenResponse["access_token"])
> at
> org.codehaus.jackson.map.exc.UnrecognizedPropertyException.from(UnrecognizedPropertyException.java:53)
> at
> org.codehaus.jackson.map.deser.StdDeserializationContext.unknownFieldException(StdDeserializationContext.java:267)
> at
> org.codehaus.jackson.map.deser.std.StdDeserializer.reportUnknownProperty(StdDeserializer.java:673)
> at
> org.codehaus.jackson.map.deser.std.StdDeserializer.handleUnknownProperty(StdDeserializer.java:659)
> at
> org.codehaus.jackson.map.deser.BeanDeserializer.handleUnknownProperty(BeanDeserializer.java:1365)
> at
> org.codehaus.jackson.map.deser.BeanDeserializer._handleUnknown(BeanDeserializer.java:725)
> at
> org.codehaus.jackson.map.deser.BeanDeserializer.deserializeFromObject(BeanDeserializer.java:703)
> at
> org.codehaus.jackson.map.deser.BeanDeserializer.deserialize(BeanDeserializer.java:580)
> at org.codehaus.jackson.map.ObjectMapper._readValue(ObjectMapper.java:2704)
> at org.codehaus.jackson.map.ObjectMapper.readValue(ObjectMapper.java:1315)
> at
> org.codehaus.jackson.jaxrs.JacksonJsonProvider.readFrom(JacksonJsonProvider.java:419)
> at
> org.jboss.resteasy.core.interception.AbstractReaderInterceptorContext.readFrom(AbstractReaderInterceptorContext.java:59)
> at
> org.jboss.resteasy.core.interception.AbstractReaderInterceptorContext.proceed(AbstractReaderInterceptorContext.java:51)
> at
> org.jboss.resteasy.plugins.interceptors.encoding.GZIPDecodingInterceptor.aroundReadFrom(GZIPDecodingInterceptor.java:59)
> at
> org.jboss.resteasy.core.interception.AbstractReaderInterceptorContext.proceed(AbstractReaderInterceptorContext.java:53)
> at
> org.jboss.resteasy.client.jaxrs.internal.ClientResponse.readFrom(ClientResponse.java:248)
>
> Same sample code with keycloak-admin-client version: 1.8.0 is working fine
> and able to provision user in keycloak server. Hence there is some issue
> with higher version of keycloak-client-admin bundle than 1.8.0. Please find
> attached pom file for project.
>
> Thanks,
> Jitendra Chouhan
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160726/a6d8c4da/attachment.html 

From haimv at perfectomobile.com  Tue Jul 26 04:54:24 2016
From: haimv at perfectomobile.com (Haim Vana)
Date: Tue, 26 Jul 2016 08:54:24 +0000
Subject: [keycloak-user] Authenticate externally (broker identity) or locally
Message-ID: <AM4PR0301MB230814F1369CB53C75440DBAD20E0@AM4PR0301MB2308.eurprd03.prod.outlook.com>

Hi,

In Identity provider settings using the 'Authenticate by Default'  option the user can choose between authentication with the external IDP or locally (for example).

Is there an option to achieve the same with different URL's one for local and one for external ? so it will be without the user intervention.

The motivation is that sometime we want the external user to authenticate locally, for example due to some customization we have in our login page (a plugin that injects the user/psw to the local login page).


Thanks,
Haim.
The information contained in this message is proprietary to the sender, protected from disclosure, and may be privileged. The information is intended to be conveyed only to the designated recipient(s) of the message. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, use, distribution or copying of this communication is strictly prohibited and may be unlawful. If you have received this communication in error, please notify us immediately by replying to the message and deleting it from your computer. Thank you.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160726/7187f9b0/attachment-0001.html 

From Christian.FREIMUELLER at frequentis.com  Tue Jul 26 05:29:52 2016
From: Christian.FREIMUELLER at frequentis.com (FREIMUELLER Christian)
Date: Tue, 26 Jul 2016 09:29:52 +0000
Subject: [keycloak-user] Composite roles and user federation with LDAP as
 external user storage
Message-ID: <B4432718210BAA4E8B0AA36A1620F2EFF2962BA2@vie197nt>

Dear all,

I've a question regarding the User Storage Federation (https://keycloak.gitbooks.io/server-adminstration-guide/content/v/2.0/topics/user-federation.html) with respect of LDAP as external user database and the available mappers.

Current situation:
Right now I'm able to map roles assigned to users and defined in LDAP to Keycloak with the existing Role Mapper. e.g. Administrator/User role for a specific application

The JWT output contains then a section like this:

"resource_access": {
    "myApp": {
      "roles": [
        "Administrator"
       ]
    }


Desired solution:
Is it out of the box possible to use the existing Role Mapper as described in chapter https://keycloak.gitbooks.io/server-adminstration-guide/content/v/2.0/topics/user-federation/ldap.html to map composite roles defined in Keycloak to LDAP?
The thing is I want in the end to define composite roles in LDAP to collect finer user rights for certain "container" roles - like Users, Editors, Administrator - and map them to Keycloak and respectively the finer grained rights to provide the granted user rights in the JWT.

e.g.
Rights/Roles:
-       read page
-       edit page
-       delete page
-       create page

Composite Roles:
-       User = {read page}
-       Editor = {read page, create page, edit page}
-       Administrator = {read page, delete page}


The final result in the JWT should then contain a section something like where the composite role is automatically resolved with the more specific single rights:

"resource_access": {
    "myApp": {
      "roles": [
        "read page",
        "delete page"
       ]
    }

Or is Keycloak designed in that way that the finer rights can be stored in LDAP but the composition is afterwards done in Keycloak?

Thanks,
Christian

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160726/f7f26fbb/attachment.html 

From jitendrachouhan03 at gmail.com  Tue Jul 26 06:02:31 2016
From: jitendrachouhan03 at gmail.com (Jitendra Chouhan)
Date: Tue, 26 Jul 2016 15:32:31 +0530
Subject: [keycloak-user] Keycloak Admin Client Jar - 1.9.8/ 2.0.0 are
 not working properly
In-Reply-To: <CAO8YOYV6wsRkdODD1ufpPBJGbUd72Gm1nsKBYYxENpkt=5JUZQ@mail.gmail.com>
References: <CADFocS=PtJJcC9D9F7saWX3GVZR2jNpUyD6xuVavuHoiGuNDxw@mail.gmail.com>
	<CAO8YOYV6wsRkdODD1ufpPBJGbUd72Gm1nsKBYYxENpkt=5JUZQ@mail.gmail.com>
Message-ID: <CADFocS=E4LNc+gZPhZ6xoZ=_HQDuO+WqYCLwXAjv7mQ7GxD+mA@mail.gmail.com>

Thanks Paulo. Adding last two dependencies solved root problem.

I am trying to create new realm using below code snippet but getting error.
Please find code snippet and error stack at keycloak server console which
as follows:

Code Snippet:

Keycloak kc = KeycloakBuilder.builder() //
.serverUrl("http://localhost:8080/auth") //
.realm("master")//
.username("admin") //
.password("admin") //
.clientId("admin-cli") //
// .clientId("security-admin-console") //
.resteasyClient(new ResteasyClientBuilder().connectionPoolSize(10).build())
//
.build();
RealmRepresentation realmRep = new RealmRepresentation();
realmRep.setDisplayName("Created_Realm");
realmRep.setEnabled(true);
kc.realms().create(realmRep);

Error Stack:

Caused by: java.lang.NullPointerException
        at
org.keycloak.services.managers.RealmManager.createMasterAdminManagement(RealmManager.java:289)
        at
org.keycloak.services.managers.RealmManager.setupMasterAdminManagement(RealmManager.java:281)
        at
org.keycloak.services.managers.RealmManager.importRealm(RealmManager.java:433)
        at
org.keycloak.services.resources.admin.RealmsAdminResource.importRealm(RealmsAdminResource.java:151)
        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at
sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
        at
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
        at java.lang.reflect.Method.invoke(Method.java:498)
        at
org.jboss.resteasy.core.MethodInjectorImpl.invoke(MethodInjectorImpl.java:139)
        at
org.jboss.resteasy.core.ResourceMethodInvoker.invokeOnTarget(ResourceMethodInvoker.java:295)
        at
org.jboss.resteasy.core.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:249)
        at
org.jboss.resteasy.core.ResourceLocatorInvoker.invokeOnTargetObject(ResourceLocatorInvoker.java:138)
        at
org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorInvoker.java:101)
        at
org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:395)
        ... 37 more

Upon looking into RealmManger source code at git hub found there is a
conditional check kept which compare realmName and adminRealm from
configuration

if (realm.getName().equals(Config.getAdminRealm())) inside
setupMasterAdminManagement
method

If we look above code snippet only realmDisplayName and enable attributes
are set during creation of realm(generally use to provide if create realm
using keycloak server console)
but conditional check on getName(name) of RealmModel class which might be
causing issue, there is no setName method(setter) available inside
RealmRepresentation class under keycloak client admin library.

Can someone please provide guidance on this issue or suggest a way to
create realm using keycloak-admin-client bundle.


Thanks,
Jitendra Chouhan

On Tue, Jul 26, 2016 at 1:53 PM, Paulo Pires <pires at littlebits.cc> wrote:

> You need to explicitly provide the following dependencies:
>
>         <dependency>
>             <groupId>org.keycloak</groupId>
>             <artifactId>keycloak-admin-client</artifactId>
>             <version>${keycloak.version}</version>
>         </dependency>
>         <dependency>
>             <groupId>org.jboss.resteasy</groupId>
>             <artifactId>resteasy-client</artifactId>
>             <version>${resteasy.version}</version>
>         </dependency>
>         <dependency>
>             <groupId>org.jboss.resteasy</groupId>
>             <artifactId>resteasy-jackson2-provider</artifactId>
>             <version>${resteasy.version}</version>
>         </dependency>
>         <dependency>
>             <groupId>org.jboss.resteasy</groupId>
>             <artifactId>resteasy-multipart-provider</artifactId>
>             <version>${resteasy.version}</version>
>         </dependency>
>
> Pires
>
> On Tue, Jul 26, 2016 at 8:08 AM Jitendra Chouhan <
> jitendrachouhan03 at gmail.com> wrote:
>
>> I am using keycloak-admin-client jar for provisioning users  in keycloak
>> server instance but facing issue if using keycloak-admin-client version
>> higher than 1.8.0.Final. Please find detailed informations about issue and
>> configurations used to provision user as below:
>>
>> 1) keycloak-server version: 1.9.8.Final or 2.0.0.Final
>> 2) keycloak-admin-client version: 1.9.8.Final or 2.0.0.Final
>>
>> Sample Code Snippet:
>>
>> Keycloak kc = KeycloakBuilder.builder() //
>> .serverUrl("http://localhost:8080/auth") //
>> .realm("master")//
>> .username("admin") //
>> .password("admin") //
>> .clientId("admin-cli") //
>> // .clientId("security-admin-console") //
>> .resteasyClient(new
>> ResteasyClientBuilder().connectionPoolSize(10).build())//
>> .build();
>> // 1. User
>> CredentialRepresentation credential = new CredentialRepresentation();
>> credential.setType(CredentialRepresentation.PASSWORD);
>> credential.setValue("test123");
>> credential.setTemporary(false);
>>
>> UserRepresentation user = new UserRepresentation();
>> user.setUsername("testuser");
>> user.setFirstName("Test");
>> user.setLastName("User");
>> user.setCredentials(asList(credential));
>> user.setEnabled(true);
>> user.setRealmRoles(asList("admin"));
>>
>> // create a user
>> //Response result = kc.realm("master").users().create(user);
>> Response result = kc.realm("demo").users().create(user);
>> if (result.getStatus() != 201) {
>> if(result.getStatus() == 409){
>> System.err.println("Couldn't create user since user already exist.");
>> System.exit(0);
>> }
>> System.err.println("Couldn't create user.");
>> System.exit(0);
>> }
>> System.out.println("test user created.... verify in keycloak!");
>>
>> Error stack trace::
>>
>> Exception in thread "main"
>> javax.ws.rs.client.ResponseProcessingException:
>> javax.ws.rs.ProcessingException:
>> org.codehaus.jackson.map.exc.UnrecognizedPropertyException: Unrecognized
>> field "access_token" (Class
>> org.keycloak.representations.AccessTokenResponse), not marked as ignorable
>>  at [Source: org.apache.http.conn.EofSensorInputStream at 6f3c660a; line:
>> 1, column: 18] (through reference chain:
>> org.keycloak.representations.AccessTokenResponse["access_token"])
>> at
>> org.jboss.resteasy.client.jaxrs.internal.ClientInvocation.extractResult(ClientInvocation.java:140)
>> at
>> org.jboss.resteasy.client.jaxrs.internal.proxy.extractors.BodyEntityExtractor.extractEntity(BodyEntityExtractor.java:58)
>> at
>> org.jboss.resteasy.client.jaxrs.internal.proxy.ClientInvoker.invoke(ClientInvoker.java:104)
>> at
>> org.jboss.resteasy.client.jaxrs.internal.proxy.ClientProxy.invoke(ClientProxy.java:62)
>> at com.sun.proxy.$Proxy19.grantToken(Unknown Source)
>> at
>> org.keycloak.admin.client.token.TokenManager.grantToken(TokenManager.java:85)
>> at
>> org.keycloak.admin.client.token.TokenManager.getAccessToken(TokenManager.java:65)
>> at
>> org.keycloak.admin.client.token.TokenManager.getAccessTokenString(TokenManager.java:60)
>> at
>> org.keycloak.admin.client.resource.BearerAuthFilter.filter(BearerAuthFilter.java:52)
>> at
>> org.jboss.resteasy.client.jaxrs.internal.ClientInvocation.invoke(ClientInvocation.java:384)
>> at
>> org.jboss.resteasy.client.jaxrs.internal.proxy.ClientInvoker.invoke(ClientInvoker.java:102)
>> at
>> org.jboss.resteasy.client.jaxrs.internal.proxy.ClientProxy.invoke(ClientProxy.java:62)
>> at com.sun.proxy.$Proxy27.create(Unknown Source)
>> at
>> com.samba.security.keycloak.KeycloakAdminClientExample.main(KeycloakAdminClientExample.java:79)
>> Caused by: javax.ws.rs.ProcessingException:
>> org.codehaus.jackson.map.exc.UnrecognizedPropertyException: Unrecognized
>> field "access_token" (Class
>> org.keycloak.representations.AccessTokenResponse), not marked as ignorable
>>  at [Source: org.apache.http.conn.EofSensorInputStream at 6f3c660a; line:
>> 1, column: 18] (through reference chain:
>> org.keycloak.representations.AccessTokenResponse["access_token"])
>> at
>> org.jboss.resteasy.client.jaxrs.internal.ClientResponse.readFrom(ClientResponse.java:282)
>> at
>> org.jboss.resteasy.client.jaxrs.internal.ClientResponse.readEntity(ClientResponse.java:181)
>> at
>> org.jboss.resteasy.specimpl.BuiltResponse.readEntity(BuiltResponse.java:211)
>> at
>> org.jboss.resteasy.client.jaxrs.internal.ClientInvocation.extractResult(ClientInvocation.java:104)
>> ... 13 more
>> Caused by: org.codehaus.jackson.map.exc.UnrecognizedPropertyException:
>> Unrecognized field "access_token" (Class
>> org.keycloak.representations.AccessTokenResponse), not marked as ignorable
>>  at [Source: org.apache.http.conn.EofSensorInputStream at 6f3c660a; line:
>> 1, column: 18] (through reference chain:
>> org.keycloak.representations.AccessTokenResponse["access_token"])
>> at
>> org.codehaus.jackson.map.exc.UnrecognizedPropertyException.from(UnrecognizedPropertyException.java:53)
>> at
>> org.codehaus.jackson.map.deser.StdDeserializationContext.unknownFieldException(StdDeserializationContext.java:267)
>> at
>> org.codehaus.jackson.map.deser.std.StdDeserializer.reportUnknownProperty(StdDeserializer.java:673)
>> at
>> org.codehaus.jackson.map.deser.std.StdDeserializer.handleUnknownProperty(StdDeserializer.java:659)
>> at
>> org.codehaus.jackson.map.deser.BeanDeserializer.handleUnknownProperty(BeanDeserializer.java:1365)
>> at
>> org.codehaus.jackson.map.deser.BeanDeserializer._handleUnknown(BeanDeserializer.java:725)
>> at
>> org.codehaus.jackson.map.deser.BeanDeserializer.deserializeFromObject(BeanDeserializer.java:703)
>> at
>> org.codehaus.jackson.map.deser.BeanDeserializer.deserialize(BeanDeserializer.java:580)
>> at
>> org.codehaus.jackson.map.ObjectMapper._readValue(ObjectMapper.java:2704)
>> at org.codehaus.jackson.map.ObjectMapper.readValue(ObjectMapper.java:1315)
>> at
>> org.codehaus.jackson.jaxrs.JacksonJsonProvider.readFrom(JacksonJsonProvider.java:419)
>> at
>> org.jboss.resteasy.core.interception.AbstractReaderInterceptorContext.readFrom(AbstractReaderInterceptorContext.java:59)
>> at
>> org.jboss.resteasy.core.interception.AbstractReaderInterceptorContext.proceed(AbstractReaderInterceptorContext.java:51)
>> at
>> org.jboss.resteasy.plugins.interceptors.encoding.GZIPDecodingInterceptor.aroundReadFrom(GZIPDecodingInterceptor.java:59)
>> at
>> org.jboss.resteasy.core.interception.AbstractReaderInterceptorContext.proceed(AbstractReaderInterceptorContext.java:53)
>> at
>> org.jboss.resteasy.client.jaxrs.internal.ClientResponse.readFrom(ClientResponse.java:248)
>>
>> Same sample code with keycloak-admin-client version: 1.8.0 is working
>> fine and able to provision user in keycloak server. Hence there is some
>> issue with higher version of keycloak-client-admin bundle than 1.8.0.
>> Please find attached pom file for project.
>>
>> Thanks,
>> Jitendra Chouhan
>>
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160726/08d21961/attachment-0001.html 

From Mohan.Radhakrishnan at cognizant.com  Tue Jul 26 06:29:13 2016
From: Mohan.Radhakrishnan at cognizant.com (Mohan.Radhakrishnan at cognizant.com)
Date: Tue, 26 Jul 2016 10:29:13 +0000
Subject: [keycloak-user] Implicit Flow
Message-ID: <E1B160F4999FD6449524E16C2CB94E0307986C00@CTSINCHNSXMBE.cts.com>

Hi,

I get a 'code' using this URL. How do I use the implicit flow and get the access token for my ReactJS client ? Is there doc. For this ?

curl 'http://localhost:8080/auth/realms/master/protocol/openid-connect/auth?response_type=code&redirect_uri=http%3A%2F%2Flocalhost:8000%2F&realm=master&client_id=Pearson&scope=user'


Thanks,
Mohan
This e-mail and any files transmitted with it are for the sole use of the intended recipient(s) and may contain confidential and privileged information. If you are not the intended recipient(s), please reply to the sender and destroy all copies of the original message. Any unauthorized review, use, disclosure, dissemination, forwarding, printing or copying of this email, and/or any action taken in reliance on the contents of this e-mail is strictly prohibited and may be unlawful. Where permitted by applicable law, this e-mail and other e-mail communications sent to and from Cognizant e-mail addresses may be monitored.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160726/86c4c17d/attachment.html 

From bruno at abstractj.org  Tue Jul 26 06:43:26 2016
From: bruno at abstractj.org (Bruno Oliveira)
Date: Tue, 26 Jul 2016 07:43:26 -0300
Subject: [keycloak-user] Keycloak Admin Client Jar - 1.9.8/ 2.0.0 are
 not working properly
In-Reply-To: <CADFocS=E4LNc+gZPhZ6xoZ=_HQDuO+WqYCLwXAjv7mQ7GxD+mA@mail.gmail.com>
References: <CADFocS=PtJJcC9D9F7saWX3GVZR2jNpUyD6xuVavuHoiGuNDxw@mail.gmail.com>
	<CAO8YOYV6wsRkdODD1ufpPBJGbUd72Gm1nsKBYYxENpkt=5JUZQ@mail.gmail.com>
	<CADFocS=E4LNc+gZPhZ6xoZ=_HQDuO+WqYCLwXAjv7mQ7GxD+mA@mail.gmail.com>
Message-ID: <20160726104326.GA29719@abstractj.org>

Hi Jitendra, try this code snippet[1]. I hope it helps.


[1] - https://gist.github.com/abstractj/e202d31d877552108e5448638872cd20

On 2016-07-26, Jitendra Chouhan wrote:
> Thanks Paulo. Adding last two dependencies solved root problem.
>
> I am trying to create new realm using below code snippet but getting error.
> Please find code snippet and error stack at keycloak server console which
> as follows:
>
> Code Snippet:
>
> Keycloak kc = KeycloakBuilder.builder() //
> .serverUrl("http://localhost:8080/auth") //
> .realm("master")//
> .username("admin") //
> .password("admin") //
> .clientId("admin-cli") //
> // .clientId("security-admin-console") //
> .resteasyClient(new ResteasyClientBuilder().connectionPoolSize(10).build())
> //
> .build();
> RealmRepresentation realmRep = new RealmRepresentation();
> realmRep.setDisplayName("Created_Realm");
> realmRep.setEnabled(true);
> kc.realms().create(realmRep);
>
> Error Stack:
>
> Caused by: java.lang.NullPointerException
>         at
> org.keycloak.services.managers.RealmManager.createMasterAdminManagement(RealmManager.java:289)
>         at
> org.keycloak.services.managers.RealmManager.setupMasterAdminManagement(RealmManager.java:281)
>         at
> org.keycloak.services.managers.RealmManager.importRealm(RealmManager.java:433)
>         at
> org.keycloak.services.resources.admin.RealmsAdminResource.importRealm(RealmsAdminResource.java:151)
>         at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
>         at
> sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
>         at
> sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
>         at java.lang.reflect.Method.invoke(Method.java:498)
>         at
> org.jboss.resteasy.core.MethodInjectorImpl.invoke(MethodInjectorImpl.java:139)
>         at
> org.jboss.resteasy.core.ResourceMethodInvoker.invokeOnTarget(ResourceMethodInvoker.java:295)
>         at
> org.jboss.resteasy.core.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:249)
>         at
> org.jboss.resteasy.core.ResourceLocatorInvoker.invokeOnTargetObject(ResourceLocatorInvoker.java:138)
>         at
> org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorInvoker.java:101)
>         at
> org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:395)
>         ... 37 more
>
> Upon looking into RealmManger source code at git hub found there is a
> conditional check kept which compare realmName and adminRealm from
> configuration
>
> if (realm.getName().equals(Config.getAdminRealm())) inside
> setupMasterAdminManagement
> method
>
> If we look above code snippet only realmDisplayName and enable attributes
> are set during creation of realm(generally use to provide if create realm
> using keycloak server console)
> but conditional check on getName(name) of RealmModel class which might be
> causing issue, there is no setName method(setter) available inside
> RealmRepresentation class under keycloak client admin library.
>
> Can someone please provide guidance on this issue or suggest a way to
> create realm using keycloak-admin-client bundle.
>
>
> Thanks,
> Jitendra Chouhan
>
> On Tue, Jul 26, 2016 at 1:53 PM, Paulo Pires <pires at littlebits.cc> wrote:
>
> > You need to explicitly provide the following dependencies:
> >
> >         <dependency>
> >             <groupId>org.keycloak</groupId>
> >             <artifactId>keycloak-admin-client</artifactId>
> >             <version>${keycloak.version}</version>
> >         </dependency>
> >         <dependency>
> >             <groupId>org.jboss.resteasy</groupId>
> >             <artifactId>resteasy-client</artifactId>
> >             <version>${resteasy.version}</version>
> >         </dependency>
> >         <dependency>
> >             <groupId>org.jboss.resteasy</groupId>
> >             <artifactId>resteasy-jackson2-provider</artifactId>
> >             <version>${resteasy.version}</version>
> >         </dependency>
> >         <dependency>
> >             <groupId>org.jboss.resteasy</groupId>
> >             <artifactId>resteasy-multipart-provider</artifactId>
> >             <version>${resteasy.version}</version>
> >         </dependency>
> >
> > Pires
> >
> > On Tue, Jul 26, 2016 at 8:08 AM Jitendra Chouhan <
> > jitendrachouhan03 at gmail.com> wrote:
> >
> >> I am using keycloak-admin-client jar for provisioning users  in keycloak
> >> server instance but facing issue if using keycloak-admin-client version
> >> higher than 1.8.0.Final. Please find detailed informations about issue and
> >> configurations used to provision user as below:
> >>
> >> 1) keycloak-server version: 1.9.8.Final or 2.0.0.Final
> >> 2) keycloak-admin-client version: 1.9.8.Final or 2.0.0.Final
> >>
> >> Sample Code Snippet:
> >>
> >> Keycloak kc = KeycloakBuilder.builder() //
> >> .serverUrl("http://localhost:8080/auth") //
> >> .realm("master")//
> >> .username("admin") //
> >> .password("admin") //
> >> .clientId("admin-cli") //
> >> // .clientId("security-admin-console") //
> >> .resteasyClient(new
> >> ResteasyClientBuilder().connectionPoolSize(10).build())//
> >> .build();
> >> // 1. User
> >> CredentialRepresentation credential = new CredentialRepresentation();
> >> credential.setType(CredentialRepresentation.PASSWORD);
> >> credential.setValue("test123");
> >> credential.setTemporary(false);
> >>
> >> UserRepresentation user = new UserRepresentation();
> >> user.setUsername("testuser");
> >> user.setFirstName("Test");
> >> user.setLastName("User");
> >> user.setCredentials(asList(credential));
> >> user.setEnabled(true);
> >> user.setRealmRoles(asList("admin"));
> >>
> >> // create a user
> >> //Response result = kc.realm("master").users().create(user);
> >> Response result = kc.realm("demo").users().create(user);
> >> if (result.getStatus() != 201) {
> >> if(result.getStatus() == 409){
> >> System.err.println("Couldn't create user since user already exist.");
> >> System.exit(0);
> >> }
> >> System.err.println("Couldn't create user.");
> >> System.exit(0);
> >> }
> >> System.out.println("test user created.... verify in keycloak!");
> >>
> >> Error stack trace::
> >>
> >> Exception in thread "main"
> >> javax.ws.rs.client.ResponseProcessingException:
> >> javax.ws.rs.ProcessingException:
> >> org.codehaus.jackson.map.exc.UnrecognizedPropertyException: Unrecognized
> >> field "access_token" (Class
> >> org.keycloak.representations.AccessTokenResponse), not marked as ignorable
> >>  at [Source: org.apache.http.conn.EofSensorInputStream at 6f3c660a; line:
> >> 1, column: 18] (through reference chain:
> >> org.keycloak.representations.AccessTokenResponse["access_token"])
> >> at
> >> org.jboss.resteasy.client.jaxrs.internal.ClientInvocation.extractResult(ClientInvocation.java:140)
> >> at
> >> org.jboss.resteasy.client.jaxrs.internal.proxy.extractors.BodyEntityExtractor.extractEntity(BodyEntityExtractor.java:58)
> >> at
> >> org.jboss.resteasy.client.jaxrs.internal.proxy.ClientInvoker.invoke(ClientInvoker.java:104)
> >> at
> >> org.jboss.resteasy.client.jaxrs.internal.proxy.ClientProxy.invoke(ClientProxy.java:62)
> >> at com.sun.proxy.$Proxy19.grantToken(Unknown Source)
> >> at
> >> org.keycloak.admin.client.token.TokenManager.grantToken(TokenManager.java:85)
> >> at
> >> org.keycloak.admin.client.token.TokenManager.getAccessToken(TokenManager.java:65)
> >> at
> >> org.keycloak.admin.client.token.TokenManager.getAccessTokenString(TokenManager.java:60)
> >> at
> >> org.keycloak.admin.client.resource.BearerAuthFilter.filter(BearerAuthFilter.java:52)
> >> at
> >> org.jboss.resteasy.client.jaxrs.internal.ClientInvocation.invoke(ClientInvocation.java:384)
> >> at
> >> org.jboss.resteasy.client.jaxrs.internal.proxy.ClientInvoker.invoke(ClientInvoker.java:102)
> >> at
> >> org.jboss.resteasy.client.jaxrs.internal.proxy.ClientProxy.invoke(ClientProxy.java:62)
> >> at com.sun.proxy.$Proxy27.create(Unknown Source)
> >> at
> >> com.samba.security.keycloak.KeycloakAdminClientExample.main(KeycloakAdminClientExample.java:79)
> >> Caused by: javax.ws.rs.ProcessingException:
> >> org.codehaus.jackson.map.exc.UnrecognizedPropertyException: Unrecognized
> >> field "access_token" (Class
> >> org.keycloak.representations.AccessTokenResponse), not marked as ignorable
> >>  at [Source: org.apache.http.conn.EofSensorInputStream at 6f3c660a; line:
> >> 1, column: 18] (through reference chain:
> >> org.keycloak.representations.AccessTokenResponse["access_token"])
> >> at
> >> org.jboss.resteasy.client.jaxrs.internal.ClientResponse.readFrom(ClientResponse.java:282)
> >> at
> >> org.jboss.resteasy.client.jaxrs.internal.ClientResponse.readEntity(ClientResponse.java:181)
> >> at
> >> org.jboss.resteasy.specimpl.BuiltResponse.readEntity(BuiltResponse.java:211)
> >> at
> >> org.jboss.resteasy.client.jaxrs.internal.ClientInvocation.extractResult(ClientInvocation.java:104)
> >> ... 13 more
> >> Caused by: org.codehaus.jackson.map.exc.UnrecognizedPropertyException:
> >> Unrecognized field "access_token" (Class
> >> org.keycloak.representations.AccessTokenResponse), not marked as ignorable
> >>  at [Source: org.apache.http.conn.EofSensorInputStream at 6f3c660a; line:
> >> 1, column: 18] (through reference chain:
> >> org.keycloak.representations.AccessTokenResponse["access_token"])
> >> at
> >> org.codehaus.jackson.map.exc.UnrecognizedPropertyException.from(UnrecognizedPropertyException.java:53)
> >> at
> >> org.codehaus.jackson.map.deser.StdDeserializationContext.unknownFieldException(StdDeserializationContext.java:267)
> >> at
> >> org.codehaus.jackson.map.deser.std.StdDeserializer.reportUnknownProperty(StdDeserializer.java:673)
> >> at
> >> org.codehaus.jackson.map.deser.std.StdDeserializer.handleUnknownProperty(StdDeserializer.java:659)
> >> at
> >> org.codehaus.jackson.map.deser.BeanDeserializer.handleUnknownProperty(BeanDeserializer.java:1365)
> >> at
> >> org.codehaus.jackson.map.deser.BeanDeserializer._handleUnknown(BeanDeserializer.java:725)
> >> at
> >> org.codehaus.jackson.map.deser.BeanDeserializer.deserializeFromObject(BeanDeserializer.java:703)
> >> at
> >> org.codehaus.jackson.map.deser.BeanDeserializer.deserialize(BeanDeserializer.java:580)
> >> at
> >> org.codehaus.jackson.map.ObjectMapper._readValue(ObjectMapper.java:2704)
> >> at org.codehaus.jackson.map.ObjectMapper.readValue(ObjectMapper.java:1315)
> >> at
> >> org.codehaus.jackson.jaxrs.JacksonJsonProvider.readFrom(JacksonJsonProvider.java:419)
> >> at
> >> org.jboss.resteasy.core.interception.AbstractReaderInterceptorContext.readFrom(AbstractReaderInterceptorContext.java:59)
> >> at
> >> org.jboss.resteasy.core.interception.AbstractReaderInterceptorContext.proceed(AbstractReaderInterceptorContext.java:51)
> >> at
> >> org.jboss.resteasy.plugins.interceptors.encoding.GZIPDecodingInterceptor.aroundReadFrom(GZIPDecodingInterceptor.java:59)
> >> at
> >> org.jboss.resteasy.core.interception.AbstractReaderInterceptorContext.proceed(AbstractReaderInterceptorContext.java:53)
> >> at
> >> org.jboss.resteasy.client.jaxrs.internal.ClientResponse.readFrom(ClientResponse.java:248)
> >>
> >> Same sample code with keycloak-admin-client version: 1.8.0 is working
> >> fine and able to provision user in keycloak server. Hence there is some
> >> issue with higher version of keycloak-client-admin bundle than 1.8.0.
> >> Please find attached pom file for project.
> >>
> >> Thanks,
> >> Jitendra Chouhan
> >>
> >> _______________________________________________
> >> keycloak-user mailing list
> >> keycloak-user at lists.jboss.org
> >> https://lists.jboss.org/mailman/listinfo/keycloak-user
> >
> >

> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user


--

abstractj
PGP: 0x84DC9914

From Mohan.Radhakrishnan at cognizant.com  Tue Jul 26 07:03:08 2016
From: Mohan.Radhakrishnan at cognizant.com (Mohan.Radhakrishnan at cognizant.com)
Date: Tue, 26 Jul 2016 11:03:08 +0000
Subject: [keycloak-user] Implicit Flow
Message-ID: <E1B160F4999FD6449524E16C2CB94E0307986CCD@CTSINCHNSXMBE.cts.com>

Didn't check the newer version. Got that working. Sorry to send without checking.

Mohan

From: Radhakrishnan, Mohan (Cognizant)
Sent: Tuesday, July 26, 2016 3:59 PM
To: keycloak-user at lists.jboss.org
Subject: Implicit Flow

Hi,

I get a 'code' using this URL. How do I use the implicit flow and get the access token for my ReactJS client ? Is there doc. For this ?

curl 'http://localhost:8080/auth/realms/master/protocol/openid-connect/auth?response_type=code&redirect_uri=http%3A%2F%2Flocalhost:8000%2F&realm=master&client_id=Pearson&scope=user'


Thanks,
Mohan
This e-mail and any files transmitted with it are for the sole use of the intended recipient(s) and may contain confidential and privileged information. If you are not the intended recipient(s), please reply to the sender and destroy all copies of the original message. Any unauthorized review, use, disclosure, dissemination, forwarding, printing or copying of this email, and/or any action taken in reliance on the contents of this e-mail is strictly prohibited and may be unlawful. Where permitted by applicable law, this e-mail and other e-mail communications sent to and from Cognizant e-mail addresses may be monitored.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160726/939a7348/attachment.html 

From bruno at abstractj.org  Tue Jul 26 07:18:39 2016
From: bruno at abstractj.org (Bruno Oliveira)
Date: Tue, 26 Jul 2016 08:18:39 -0300
Subject: [keycloak-user] Initiation of Registration form instead of
 Login form from OIDC client Java adapter
In-Reply-To: <973411d1-44a5-1235-de49-2e8bf2ec1838@redhat.com>
References: <973411d1-44a5-1235-de49-2e8bf2ec1838@redhat.com>
Message-ID: <20160726111839.GB29719@abstractj.org>

Hi Vlastimil,

At first glance I could say to change the browser flow to
"Registration". But that would enforce every single user to be registered and
certainly is not what you want to achieve.

I suggest to try to look at the authenticator SPI[1] and customize the flow/adapt
to your needs. Plus, there's an example available here[2].

[1] - https://keycloak.gitbooks.io/server-developer-guide/content/topics/auth-spi.html
[2] - https://github.com/keycloak/keycloak/tree/master/examples/providers/authenticator


On 2016-07-22, Vlastimil Elias wrote:
> Hi,
>
> we use OIDC client Java adapter to authenticate our java app deployed in
> EAP 6 with keycloak. Now we have a requirement to show Keycloak's
> Registration form instead of Login form.
> Is this somehow possible with java client adapter (as it is possible
> with javascript adapter). I was not able to find this feature in
> documentation.
>
> Ideal solution should be if client java app should be able to
> dynamically request which form to show, but hard config solution which
> will always point reg form may work also.
>
> Thanks a lot in advance for your help
>
> Vlastimil
>
> --
> Vlastimil Elias
> Principal Software Engineer
> Red Hat Developer | Engineering
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

--

abstractj
PGP: 0x84DC9914

From Mohan.Radhakrishnan at cognizant.com  Tue Jul 26 09:03:35 2016
From: Mohan.Radhakrishnan at cognizant.com (Mohan.Radhakrishnan at cognizant.com)
Date: Tue, 26 Jul 2016 13:03:35 +0000
Subject: [keycloak-user] Validate Implicit token
Message-ID: <E1B160F4999FD6449524E16C2CB94E0307986D41@CTSINCHNSXMBE.cts.com>

Hi,
        I have the standalone keycloak server issuing tokens. Client is going to be JavaScript. I enabled 'implicit' and issued

http://localhost:8080/auth/realms/MyRealm/protocol/openid-connect/auth?response_type=id_token%20token&redirect_uri=http%3A%2F%2Flocalhost:8000%2F&realm= MyRealm &client_id= MyRealm &scope=user

I get the id_token. I am used to getting the 'access token' in other IDP's. Are they the same in Keycloak ?

How do I verify the token inside my Tomcat ?
In other installations we run the IDP separately. So I am doing the same with Keycloak.


Thanks,
Mohan
This e-mail and any files transmitted with it are for the sole use of the intended recipient(s) and may contain confidential and privileged information. If you are not the intended recipient(s), please reply to the sender and destroy all copies of the original message. Any unauthorized review, use, disclosure, dissemination, forwarding, printing or copying of this email, and/or any action taken in reliance on the contents of this e-mail is strictly prohibited and may be unlawful. Where permitted by applicable law, this e-mail and other e-mail communications sent to and from Cognizant e-mail addresses may be monitored.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160726/ebc97bd7/attachment.html 

From bburke at redhat.com  Tue Jul 26 10:49:51 2016
From: bburke at redhat.com (Bill Burke)
Date: Tue, 26 Jul 2016 10:49:51 -0400
Subject: [keycloak-user] Validate Implicit token
In-Reply-To: <E1B160F4999FD6449524E16C2CB94E0307986D41@CTSINCHNSXMBE.cts.com>
References: <E1B160F4999FD6449524E16C2CB94E0307986D41@CTSINCHNSXMBE.cts.com>
Message-ID: <18b9a0d1-4086-e1c7-bd03-4bd21ceae00d@redhat.com>

I would use keycloak.js adapter with auth-code flow.  I personally don't 
like implicit flow for a number of reasons:

* access tokens get stored in browser history

* You have to perform the whole redirect dance when the access token expires

As far as Tomcat goes, we have an adapter for various tomcat versions.  
These tomcat instances would probably use bearer tokens to be secured.  
So, the javascript app uses keycloak.js to obtain the token.  REST 
invocations to TOMCAT are secured by a bearer token. Tomcat app has a 
keycloak adapter installed to be able to verify access tokens.


On 7/26/16 9:03 AM, Mohan.Radhakrishnan at cognizant.com wrote:
>
> Hi,
>
>         I have the standalone keycloak server issuing tokens. Client 
> is going to be JavaScript. I enabled ?implicit? and issued
>
> http://localhost:8080/auth/realms/MyRealm/protocol/openid-connect/auth?response_type=id_token%20token&redirect_uri=http%3A%2F%2Flocalhost:8000%2F&realm= 
> MyRealm &client_id= MyRealm &scope=user
>
> I get the id_token. I am used to getting the ?access token? in other 
> IDP?s. Are they the same in Keycloak ?
>
> How do I verify the token inside my Tomcat ?
>
> In other installations we run the IDP separately. So I am doing the 
> same with Keycloak.
>
> Thanks,
>
> Mohan
>
> This e-mail and any files transmitted with it are for the sole use of 
> the intended recipient(s) and may contain confidential and privileged 
> information. If you are not the intended recipient(s), please reply to 
> the sender and destroy all copies of the original message. Any 
> unauthorized review, use, disclosure, dissemination, forwarding, 
> printing or copying of this email, and/or any action taken in reliance 
> on the contents of this e-mail is strictly prohibited and may be 
> unlawful. Where permitted by applicable law, this e-mail and other 
> e-mail communications sent to and from Cognizant e-mail addresses may 
> be monitored.
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160726/5ad9b683/attachment.html 

From alex at labela.nl  Tue Jul 26 13:52:07 2016
From: alex at labela.nl (Alex Fernandes)
Date: Tue, 26 Jul 2016 19:52:07 +0200
Subject: [keycloak-user] Redirect Programmatically to the Loginpage
Message-ID: <CAOF04oPyG2O32NDVcnA0w=7s32sP4-Wo5-SKtWf2NngwOeLtpg@mail.gmail.com>

Hi,

Im green to KeyCloak; Wanted to thank the community for it, so far looking
great.

I have an issue where I want to redirect the user the loginpage on the
KeyCloak server programmatically in Java;

the UseCase is:

We have a page that is partially visible and partiallly not (when not
logged in), so I can't protect it with url pattern;

We have a login button on that page that when the user is not logged and
pressed the button, we want to redirect to the loginpage (on keycloak) and
back to the page again.

I'm using the KeyCloak adapter core (running on tomcat8)

[image: Inline afbeelding 2]


I coppied this code from the: KeycloakOIDCFilter (
https://github.com/keycloak/keycloak/blob/master/adapters/oidc/servlet-filter/src/main/java/org/keycloak/adapters/servlet/KeycloakOIDCFilter.java
)

it does show a 302 in the logs but the page doesn't redirect;

Anyone has a clue about how to go about this?

Much Appreciated,
Cheers!

Alex
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160726/e3c900f2/attachment-0001.html 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image.png
Type: image/png
Size: 64823 bytes
Desc: not available
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20160726/e3c900f2/attachment-0001.png 

From rllavallee at hotmail.com  Tue Jul 26 14:34:01 2016
From: rllavallee at hotmail.com (Richard Lavallee)
Date: Tue, 26 Jul 2016 18:34:01 +0000
Subject: [keycloak-user] Keycloak support for T&C?
In-Reply-To: <mailman.6576.1469555559.3477.keycloak-user@lists.jboss.org>
References: <mailman.6576.1469555559.3477.keycloak-user@lists.jboss.org>
Message-ID: <BLU181-W774BF9BC51FCA2AC59DD45CB0E0@phx.gbl>

Does Keycloak support new Keycloak user login general acceptance of Terms & Conditions?
Use Case:  New user logs in to Keycloak and is presented with Terms & Conditions to accept or reject.  Accepting permits user access to any Keycloak client for the Realm.  Rejecting prevents user login from proceeding into any Realm client at all.

-Richard 		 	   		  
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160726/03f7ce11/attachment.html 

From ssilvert at redhat.com  Tue Jul 26 15:06:42 2016
From: ssilvert at redhat.com (Stan Silvert)
Date: Tue, 26 Jul 2016 15:06:42 -0400
Subject: [keycloak-user] Keycloak support for T&C?
In-Reply-To: <BLU181-W774BF9BC51FCA2AC59DD45CB0E0@phx.gbl>
References: <mailman.6576.1469555559.3477.keycloak-user@lists.jboss.org>
	<BLU181-W774BF9BC51FCA2AC59DD45CB0E0@phx.gbl>
Message-ID: <5797B4C2.4040907@redhat.com>

On 7/26/2016 2:34 PM, Richard Lavallee wrote:
> Does Keycloak support new Keycloak user login general acceptance of 
> Terms & Conditions?
Yes.   You can set it as a required action.  See the docs.
>
> Use Case:  New user logs in to Keycloak and is presented with Terms & 
> Conditions to accept or reject.  Accepting permits user access to any 
> Keycloak client for the Realm.  Rejecting prevents user login from 
> proceeding into any Realm client at all.
>
>
> -Richard
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160726/6a9aa7d4/attachment.html 

From jhonnatan.orozco at hotmail.com  Tue Jul 26 15:25:34 2016
From: jhonnatan.orozco at hotmail.com (Jhonnatan Orozco Duque)
Date: Tue, 26 Jul 2016 14:25:34 -0500
Subject: [keycloak-user] create authentication tokens
Message-ID: <BAY180-W29AA8CCC1E2428D1C2975920E0@phx.gbl>

Hi,
I am new and im making a research about keycloak to check if can we use it in a new project that would be with Java and Ldap; i need to know how should i configure the keycloak to create authentication tokens?, because i havent found information about this specific topic.
thanks 

Jhonnatan Orozco DuqueIngeniero de Software 		 	   		  
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160726/b03dccd7/attachment.html 

From rsoares at redhat.com  Tue Jul 26 21:27:22 2016
From: rsoares at redhat.com (Rafael T. C. Soares)
Date: Tue, 26 Jul 2016 22:27:22 -0300
Subject: [keycloak-user] Kerberos keytab in a Clustered KC setup
Message-ID: <bd4b56e4-9214-9745-710d-8f4af631ab94@redhat.com>

Hi!

How should I generate my Kerberos keytab file to use in a KC clustered 
domain (multiple hosts)?
I have to create a keytab for each KC Host? When I create the keytab I 
have to inform the Service Principal (eg 
'HTTP/myhost.example.com at MYDOM.COM'). But how the KC will know which 
Service Principal it should use if I have different KC instances 
distributed in different hosts? Is there a way to create a Service 
Principal on a keytab that serves for the entire cluster regardless the 
KC host instance?

Thanks in advance?

-- 
___
Rafael T. C. Soares

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160726/c4aa5cf4/attachment.html 

From Mohan.Radhakrishnan at cognizant.com  Wed Jul 27 00:50:42 2016
From: Mohan.Radhakrishnan at cognizant.com (Mohan.Radhakrishnan at cognizant.com)
Date: Wed, 27 Jul 2016 04:50:42 +0000
Subject: [keycloak-user] Validate Implicit token
In-Reply-To: <18b9a0d1-4086-e1c7-bd03-4bd21ceae00d@redhat.com>
References: <E1B160F4999FD6449524E16C2CB94E0307986D41@CTSINCHNSXMBE.cts.com>,
	<18b9a0d1-4086-e1c7-bd03-4bd21ceae00d@redhat.com>
Message-ID: <E1B160F4999FD6449524E16C2CB94E0307989EF4@CTSINCHNSXMBE.cts.com>

Ok. I was thinking about this procedure.

The adapter verifies the access token. Does it have to contact the verification Rest endpoint ?

Once the token is verified I need the claims for business processing. Does it mean that I have to use the introspection endpont myself ? I don't know how to hit this endpoint because it seems to need the client secret.

So I am trying to verify and also access the claims.

Mohan
________________________________
From: keycloak-user-bounces at lists.jboss.org [keycloak-user-bounces at lists.jboss.org] on behalf of Bill Burke [bburke at redhat.com]
Sent: Tuesday, July 26, 2016 8:19 PM
To: keycloak-user at lists.jboss.org
Subject: Re: [keycloak-user] Validate Implicit token


I would use keycloak.js adapter with auth-code flow.  I personally don't like implicit flow for a number of reasons:

* access tokens get stored in browser history

* You have to perform the whole redirect dance when the access token expires

As far as Tomcat goes, we have an adapter for various tomcat versions.  These tomcat instances would probably use bearer tokens to be secured.  So, the javascript app uses keycloak.js to obtain the token.  REST invocations to TOMCAT are secured by a bearer token. Tomcat app has a keycloak adapter installed to be able to verify access tokens.

On 7/26/16 9:03 AM, Mohan.Radhakrishnan at cognizant.com<redir.aspx?REF=MHn5QiLIf34TEhUm71FhBttccA08swiSjOD070ZB1HBisxev2LXTCAFtYWlsdG86TW9oYW4uUmFkaGFrcmlzaG5hbkBjb2duaXphbnQuY29t> wrote:
Hi,
        I have the standalone keycloak server issuing tokens. Client is going to be JavaScript. I enabled ?implicit? and issued

http://localhost:8080/auth/realms/MyRealm/protocol/openid-connect/auth?response_type=id_token%20token&redirect_uri=http%3A%2F%2Flocalhost:8000%2F&realm=<redir.aspx?REF=RpMbXbiODMWF_NyemxaXOfH0GSo35bSPEryQzZMvuavFFBqv2LXTCAFodHRwOi8vbG9jYWxob3N0OjgwODAvYXV0aC9yZWFsbXMvTXlSZWFsbS9wcm90b2NvbC9vcGVuaWQtY29ubmVjdC9hdXRoP3Jlc3BvbnNlX3R5cGU9aWRfdG9rZW4lMjB0b2tlbiZyZWRpcmVjdF91cmk9aHR0cCUzQSUyRiUyRmxvY2FsaG9zdDo4MDAwJTJGJnJlYWxtPQ..> MyRealm &client_id= MyRealm &scope=user

I get the id_token. I am used to getting the ?access token? in other IDP?s. Are they the same in Keycloak ?

How do I verify the token inside my Tomcat ?
In other installations we run the IDP separately. So I am doing the same with Keycloak.


Thanks,
Mohan
This e-mail and any files transmitted with it are for the sole use of the intended recipient(s) and may contain confidential and privileged information. If you are not the intended recipient(s), please reply to the sender and destroy all copies of the original message. Any unauthorized review, use, disclosure, dissemination, forwarding, printing or copying of this email, and/or any action taken in reliance on the contents of this e-mail is strictly prohibited and may be unlawful. Where permitted by applicable law, this e-mail and other e-mail communications sent to and from Cognizant e-mail addresses may be monitored.


_______________________________________________
keycloak-user mailing list
keycloak-user at lists.jboss.org<redir.aspx?REF=bYlyhcT49YjZmY_UN16JJ2nq2a5oH7tjxyQ2cJ2EtJjFFBqv2LXTCAFtYWlsdG86a2V5Y2xvYWstdXNlckBsaXN0cy5qYm9zcy5vcmc.>
https://lists.jboss.org/mailman/listinfo/keycloak-user<redir.aspx?REF=RMsWpZpfs0Pruw-857GHYI3TOSLDtGqNcID6IxbrDMXFFBqv2LXTCAFodHRwczovL2xpc3RzLmpib3NzLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2tleWNsb2FrLXVzZXI.>

This e-mail and any files transmitted with it are for the sole use of the intended recipient(s) and may contain confidential and privileged information. If you are not the intended recipient(s), please reply to the sender and destroy all copies of the original message. Any unauthorized review, use, disclosure, dissemination, forwarding, printing or copying of this email, and/or any action taken in reliance on the contents of this e-mail is strictly prohibited and may be unlawful. Where permitted by applicable law, this e-mail and other e-mail communications sent to and from Cognizant e-mail addresses may be monitored.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160727/1274fa76/attachment.html 

From bruno at abstractj.org  Wed Jul 27 05:13:56 2016
From: bruno at abstractj.org (Bruno Oliveira)
Date: Wed, 27 Jul 2016 06:13:56 -0300
Subject: [keycloak-user] keycloak spring boot adapter admin url
In-Reply-To: <VI1PR0101MB2013116D892DA78974A6A0A08D0D0@VI1PR0101MB2013.eurprd01.prod.exchangelabs.com>
References: <VI1PR0101MB2013116D892DA78974A6A0A08D0D0@VI1PR0101MB2013.eurprd01.prod.exchangelabs.com>
Message-ID: <20160727091356.GA30971@abstractj.org>

Hi Robert, there's a community demo here[1] that might help you. I just
tested with Keycloak 2.0.0.Final and works like a charm.

[1] - https://github.com/foo4u/keycloak-spring-demo

On 2016-07-25, Robert van Loenhout wrote:
> I'm using the keycloak adapter in my spring boot applications. I would like to use sign sign out. I added the openid-connect logout link to a page.
> To let the keycloak server send signout requests to my web applications via the back channel I think I should configure the admin URL for each (spring boot) client.
> Does the spring boot keycloak adapter implement the admin endpoint? And if so under which url is it available?
>

> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user


--

abstractj
PGP: 0x84DC9914

From bruno at abstractj.org  Wed Jul 27 05:34:08 2016
From: bruno at abstractj.org (Bruno Oliveira)
Date: Wed, 27 Jul 2016 06:34:08 -0300
Subject: [keycloak-user] One click social-account linking widgets on
 website autheticated by Keycloak JS adapter
In-Reply-To: <ea7740b3-1632-cee5-2f81-474aa641ae41@redhat.com>
References: <ea7740b3-1632-cee5-2f81-474aa641ae41@redhat.com>
Message-ID: <20160727093408.GB30971@abstractj.org>

Hi Vlastimil,

I can be wrong, but I believe you have to call createLoginUrl[1].

[1] - https://github.com/keycloak/keycloak/blob/5c98b8c6ae7052b2d906156d8fc212ccd9dfd57d/examples/broker/twitter-authentication/src/main/webapp/js/app.js#L39-L51

On 2016-07-22, Vlastimil Elias wrote:
> Hi,
>
> we have a requirement to implement 'One click social-account linking
> widgets' on website autheticated by Keycloak JS adapter. To achieve this a
> button would be placed on the website with the following flow:
>
> 1. User logs into the website (keycloak JS adapter)
> 2. User browser to a part of the site requiring social account linking
>    (site checks linking status of current user for given social login
>    provider based on info in token - we wrote our mapper for this)
> 3. User clicks on a button to link the required social account with his
>    Keycloak account
> 4. User is directed through the linking process (which is similar as
>    Social Link action in Account app)
> 5. User is returned to original page on successful account linking
>    (token in js client must be refreshed to contain actual info about
>    social links).
>
> Is there any way how to achieve this? I tried to call JS client login method
> with idpHint when user is logged in (keycloak.login({"idpHint":"github"})),
> but it doesn't work as expected.
>
> Thanks a lot in advance
>
> Vlastimil
>
> --
> Vlastimil Elias
> Principal Software Engineer
> Red Hat Developer | Engineering
>

> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user


--

abstractj
PGP: 0x84DC9914

From bruno at abstractj.org  Wed Jul 27 06:02:24 2016
From: bruno at abstractj.org (Bruno Oliveira)
Date: Wed, 27 Jul 2016 07:02:24 -0300
Subject: [keycloak-user] Browser Caching in Custom Theme not working
In-Reply-To: <CALr83iD0Ca4pnmPWFBZ-2vMETVRQ=FNDPXROJVnoURnxwdJPsw@mail.gmail.com>
References: <CALr83iD0Ca4pnmPWFBZ-2vMETVRQ=FNDPXROJVnoURnxwdJPsw@mail.gmail.com>
Message-ID: <20160727100224.GC30971@abstractj.org>

Hi Chris, there was a discussion about it here[1]. Theme resources are
cached for performance reasons like mentioned in that thread.

Can you see your updates after clear the cache? If you would like
instantly see your changes during development phase, take a look at
the docs[2].

[1] - http://lists.jboss.org/pipermail/keycloak-user/2015-December/003927.html
[2] - https://keycloak.gitbooks.io/server-developer-guide/content/topics/themes.html

On 2016-07-22, Chris Hairfield wrote:
> Hello,
>
> We've started deploying our custom login and account themes to persistent
> environments and are finding that our browser caches aren't updating
> properly as we push code. We are using Docker, so upgrades entail
> destroying the existing container and starting a new one with our updates.
>
> An instance of this is with the Join functionality where the form itself
> didn't show after an upgrade, but we worked around it by entering an
> incognito window.
>
> This is the approach we've learned to use when developing as well: test in
> an incognito window.
>
> I'm curious, what are your suggestions for deploying Keycloak in such a way
> as to properly update client browsers when our themes are updated?
>
> Thanks!
> Chris

> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user


--

abstractj
PGP: 0x84DC9914

From bruno at abstractj.org  Wed Jul 27 06:56:35 2016
From: bruno at abstractj.org (Bruno Oliveira)
Date: Wed, 27 Jul 2016 07:56:35 -0300
Subject: [keycloak-user] Redirect Programmatically to the Loginpage
In-Reply-To: <CAOF04oPyG2O32NDVcnA0w=7s32sP4-Wo5-SKtWf2NngwOeLtpg@mail.gmail.com>
References: <CAOF04oPyG2O32NDVcnA0w=7s32sP4-Wo5-SKtWf2NngwOeLtpg@mail.gmail.com>
Message-ID: <20160727105635.GB10593@abstractj.org>

Hi Alex, please take a look a the examples here[1].

[1] - https://github.com/redhat-developer/redhat-sso-quickstarts

On 2016-07-26, Alex Fernandes wrote:
> Hi,
>
> Im green to KeyCloak; Wanted to thank the community for it, so far looking
> great.
>
> I have an issue where I want to redirect the user the loginpage on the
> KeyCloak server programmatically in Java;
>
> the UseCase is:
>
> We have a page that is partially visible and partiallly not (when not
> logged in), so I can't protect it with url pattern;
>
> We have a login button on that page that when the user is not logged and
> pressed the button, we want to redirect to the loginpage (on keycloak) and
> back to the page again.
>
> I'm using the KeyCloak adapter core (running on tomcat8)
>
> [image: Inline afbeelding 2]
>
>
> I coppied this code from the: KeycloakOIDCFilter (
> https://github.com/keycloak/keycloak/blob/master/adapters/oidc/servlet-filter/src/main/java/org/keycloak/adapters/servlet/KeycloakOIDCFilter.java
> )
>
> it does show a 302 in the logs but the page doesn't redirect;
>
> Anyone has a clue about how to go about this?
>
> Much Appreciated,
> Cheers!
>
> Alex



> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user


--

abstractj
PGP: 0x84DC9914

From velias at redhat.com  Wed Jul 27 06:56:44 2016
From: velias at redhat.com (Vlastimil Elias)
Date: Wed, 27 Jul 2016 12:56:44 +0200
Subject: [keycloak-user] One click social-account linking widgets on
 website autheticated by Keycloak JS adapter
In-Reply-To: <20160727093408.GB30971@abstractj.org>
References: <ea7740b3-1632-cee5-2f81-474aa641ae41@redhat.com>
	<20160727093408.GB30971@abstractj.org>
Message-ID: <8a05c13b-f03e-c960-d520-06d555772532@redhat.com>

Thanks, but which URL should I use, with which parameters? I think 
createLoginUrl() creates URL which is internally used in login() and I 
tried this, but problem is on keycloak server side flow. It asks me to 
login using github, but after this it does not link this github account 
with already logged in Keycloak user, but performs common social login flow.

Maybe I should somehow change "First Broker Login" flow to detect that 
user is logged in already and perform link. But I'm curious if Keycloak 
supports this case OOTB as I think it should be relatively common 
requirement.

Vl.

On 27.7.2016 11:34, Bruno Oliveira wrote:
> Hi Vlastimil,
>
> I can be wrong, but I believe you have to call createLoginUrl[1].
>
> [1] - https://github.com/keycloak/keycloak/blob/5c98b8c6ae7052b2d906156d8fc212ccd9dfd57d/examples/broker/twitter-authentication/src/main/webapp/js/app.js#L39-L51
>
> On 2016-07-22, Vlastimil Elias wrote:
>> Hi,
>>
>> we have a requirement to implement 'One click social-account linking
>> widgets' on website autheticated by Keycloak JS adapter. To achieve this a
>> button would be placed on the website with the following flow:
>>
>> 1. User logs into the website (keycloak JS adapter)
>> 2. User browser to a part of the site requiring social account linking
>>     (site checks linking status of current user for given social login
>>     provider based on info in token - we wrote our mapper for this)
>> 3. User clicks on a button to link the required social account with his
>>     Keycloak account
>> 4. User is directed through the linking process (which is similar as
>>     Social Link action in Account app)
>> 5. User is returned to original page on successful account linking
>>     (token in js client must be refreshed to contain actual info about
>>     social links).
>>
>> Is there any way how to achieve this? I tried to call JS client login method
>> with idpHint when user is logged in (keycloak.login({"idpHint":"github"})),
>> but it doesn't work as expected.
>>
>> Thanks a lot in advance
>>
>> Vlastimil
>>
>> --
>> Vlastimil Elias
>> Principal Software Engineer
>> Red Hat Developer | Engineering
>>
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
> --
>
> abstractj
> PGP: 0x84DC9914

-- 
Vlastimil Elias
Principal Software Engineer
Red Hat Developer | Engineering


From r.vanloenhout at greenvalley.nl  Wed Jul 27 06:59:48 2016
From: r.vanloenhout at greenvalley.nl (Robert van Loenhout)
Date: Wed, 27 Jul 2016 10:59:48 +0000
Subject: [keycloak-user] keycloak spring boot adapter admin url
In-Reply-To: <20160727091356.GA30971@abstractj.org>
References: <VI1PR0101MB2013116D892DA78974A6A0A08D0D0@VI1PR0101MB2013.eurprd01.prod.exchangelabs.com>,
	<20160727091356.GA30971@abstractj.org>
Message-ID: <VI1PR0101MB201380AA4D771EDC4BE50F378D0F0@VI1PR0101MB2013.eurprd01.prod.exchangelabs.com>

Hi Bruno,


The back-channel signout requests are send and handled now. I'm not sure why it didn't work right away. But after restarting everything and removing all cookies it is working well.



________________________________
From: Bruno Oliveira <bruno at abstractj.org>
Sent: Wednesday, July 27, 2016 11:13:56 AM
To: Robert van Loenhout
Cc: keycloak-user at lists.jboss.org
Subject: Re: [keycloak-user] keycloak spring boot adapter admin url

Hi Robert, there's a community demo here[1] that might help you. I just
tested with Keycloak 2.0.0.Final and works like a charm.

[1] - https://github.com/foo4u/keycloak-spring-demo

On 2016-07-25, Robert van Loenhout wrote:
> I'm using the keycloak adapter in my spring boot applications. I would like to use sign sign out. I added the openid-connect logout link to a page.
> To let the keycloak server send signout requests to my web applications via the back channel I think I should configure the admin URL for each (spring boot) client.
> Does the spring boot keycloak adapter implement the admin endpoint? And if so under which url is it available?
>

> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user


--

abstractj
PGP: 0x84DC9914
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160727/03b83616/attachment.html 

From bburke at redhat.com  Wed Jul 27 08:54:55 2016
From: bburke at redhat.com (Bill Burke)
Date: Wed, 27 Jul 2016 08:54:55 -0400
Subject: [keycloak-user] create authentication tokens
In-Reply-To: <BAY180-W29AA8CCC1E2428D1C2975920E0@phx.gbl>
References: <BAY180-W29AA8CCC1E2428D1C2975920E0@phx.gbl>
Message-ID: <c41765eb-4c41-5125-c096-3424638eed99@redhat.com>

You didn't look hard enough :)


http://www.keycloak.org/documentation.html


On 7/26/16 3:25 PM, Jhonnatan Orozco Duque wrote:
> Hi,
>
> I am new and im making a research about keycloak to check if can we 
> use it in a new project that would be with Java and Ldap; i need to 
> know how should i configure the keycloak to create authentication 
> tokens?, because i havent found information about this specific topic.
>
> thanks
>
>
> _*Jhonnatan Orozco Duque*_
> *Ingeniero de Software*
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160727/05c6e46f/attachment-0001.html 

From bruno at abstractj.org  Wed Jul 27 11:23:50 2016
From: bruno at abstractj.org (Bruno Oliveira)
Date: Wed, 27 Jul 2016 12:23:50 -0300
Subject: [keycloak-user] Support for transactional email providers like
 SendGrid, Mailgun or Mandrill
In-Reply-To: <CAONaNYL3HCiRJJKBDMc2xUUBOqv74tsP3s+aDBWRZ-h5=L2LVw@mail.gmail.com>
References: <CAONaNYL3HCiRJJKBDMc2xUUBOqv74tsP3s+aDBWRZ-h5=L2LVw@mail.gmail.com>
Message-ID: <20160727152350.GA9040@abstractj.org>

Maybe you can get some ideas from DefaultEmailSenderProvider[1]?

[1] - https://github.com/keycloak/keycloak/blob/master/services/src/main/java/org/keycloak/email/DefaultEmailSenderProvider.java

On 2016-07-25, Vineet Reynolds wrote:
> Hi everybody,
>
>     Has anyone managed to configure Keycloak 2.0.0.Final to use a
> transactional email API instead of configuring an SMTP server? I would
> prefer to have Keycloak send emails using a rest API like Sendgrid,
> Mandrill, Mailgun or Amazon SES (the cloud-native way) instead of running
> an SMTP server.
>
>    I'd also appreciate if this is possible through the SPI providers.
>
>    * Should I implement both EmailSenderProvider and EmailTemplateProvider
> SPIs ?
>    * I cannot get my custom EmailSenderProvider SPI implementation to work,
> as the FreemarkerEmailTemplateProvider implementation fails to obtain the
> implementation of the EmailSenderProvider. Stack trace is below
>
> 13:17:53,991 ERROR
> [org.keycloak.forms.login.freemarker.FreeMarkerLoginFormsProvider] (default
> task-39) Failed to send verification email:
> org.keycloak.email.EmailException: Failed to template email
> at
> org.keycloak.email.freemarker.FreeMarkerEmailTemplateProvider.send(FreeMarkerEmailTemplateProvider.java:179)
> at
> org.keycloak.email.freemarker.FreeMarkerEmailTemplateProvider.send(FreeMarkerEmailTemplateProvider.java:150)
> at
> org.keycloak.email.freemarker.FreeMarkerEmailTemplateProvider.sendVerifyEmail(FreeMarkerEmailTemplateProvider.java:146)
> at
> org.keycloak.forms.login.freemarker.FreeMarkerLoginFormsProvider.createResponse(FreeMarkerLoginFormsProvider.java:156)
> at
> org.keycloak.authentication.requiredactions.VerifyEmail.requiredActionChallenge(VerifyEmail.java:73)
> at
> org.keycloak.services.managers.AuthenticationManager.executionActions(AuthenticationManager.java:559)
> at
> org.keycloak.services.managers.AuthenticationManager.actionRequired(AuthenticationManager.java:490)
> at
> org.keycloak.services.managers.AuthenticationManager.nextActionAfterAuthentication(AuthenticationManager.java:412)
> at
> org.keycloak.services.resources.LoginActionsService$Checks.verifyRequiredAction(LoginActionsService.java:299)
> at
> org.keycloak.services.resources.LoginActionsService.processRequireAction(LoginActionsService.java:853)
> at
> org.keycloak.services.resources.LoginActionsService.requiredActionGET(LoginActionsService.java:846)
> at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
> at
> sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
> at
> sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
> at java.lang.reflect.Method.invoke(Method.java:498)
> at
> org.jboss.resteasy.core.MethodInjectorImpl.invoke(MethodInjectorImpl.java:139)
> at
> org.jboss.resteasy.core.ResourceMethodInvoker.invokeOnTarget(ResourceMethodInvoker.java:295)
> at
> org.jboss.resteasy.core.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:249)
> at
> org.jboss.resteasy.core.ResourceLocatorInvoker.invokeOnTargetObject(ResourceLocatorInvoker.java:138)
> at
> org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorInvoker.java:101)
> at
> org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:395)
> at
> org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:202)
> at
> org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.service(ServletContainerDispatcher.java:221)
> at
> org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:56)
> at
> org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:51)
> at javax.servlet.http.HttpServlet.service(HttpServlet.java:790)
> at
> io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:85)
> at
> io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:129)
> at
> org.keycloak.services.filters.KeycloakSessionServletFilter.doFilter(KeycloakSessionServletFilter.java:90)
> at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:60)
> at
> io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
> at
> io.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.java:84)
> at
> io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:62)
> at
> io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36)
> at
> org.wildfly.extension.undertow.security.SecurityContextAssociationHandler.handleRequest(SecurityContextAssociationHandler.java:78)
> at
> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
> at
> io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:131)
> at
> io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:57)
> at
> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
> at
> io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:46)
> at
> io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64)
> at
> io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:60)
> at
> io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:77)
> at
> io.undertow.security.handlers.NotificationReceiverHandler.handleRequest(NotificationReceiverHandler.java:50)
> at
> io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43)
> at
> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
> at
> org.wildfly.extension.undertow.security.jacc.JACCContextIdHandler.handleRequest(JACCContextIdHandler.java:61)
> at
> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
> at
> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
> at
> io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:284)
> at
> io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:263)
> at
> io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:81)
> at
> io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:174)
> at io.undertow.server.Connectors.executeRootHandler(Connectors.java:202)
> at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:793)
> at
> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
> at
> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
> at java.lang.Thread.run(Thread.java:745)
> Caused by: java.lang.NullPointerException
> at
> org.keycloak.email.freemarker.FreeMarkerEmailTemplateProvider.send(FreeMarkerEmailTemplateProvider.java:185)
> at
> org.keycloak.email.freemarker.FreeMarkerEmailTemplateProvider.send(FreeMarkerEmailTemplateProvider.java:177)
> ... 57 more
>
>
>
> Thanks,
> Vineet

> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user


--

abstractj
PGP: 0x84DC9914

From lingvisa at gmail.com  Wed Jul 27 21:45:53 2016
From: lingvisa at gmail.com (Martin Min)
Date: Wed, 27 Jul 2016 18:45:53 -0700
Subject: [keycloak-user] Why is the Base URL repeated in client
	configuration?
Message-ID: <CAKUZDO5V9a3i-5F16wt3VTR=1PbAfS8RPTCtG0ZdtWky2bMR9w@mail.gmail.com>

Hello, I am configuring a client in the KeyCloak admin console, but am
having a trouble to create an client to secure. Specifically, The Base URL
field is wrong (repeated), as I saved in the configuration page.

Please see the two attachments for an illustration of the the issue. This
looks very weird.

As you can see clearly from keycloak2.png, the base URL i typed is
repeated, thus invalid.

Thanks for any information that might be helpful.

Martin
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160727/2f9355c9/attachment-0001.html 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: keycloak1.png
Type: image/png
Size: 73164 bytes
Desc: not available
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20160727/2f9355c9/attachment-0002.png 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: keycloak2.png
Type: image/png
Size: 39248 bytes
Desc: not available
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20160727/2f9355c9/attachment-0003.png 

From freez3 at me.com  Thu Jul 28 03:55:22 2016
From: freez3 at me.com (Tobias Schmidt)
Date: Thu, 28 Jul 2016 07:55:22 +0000 (GMT)
Subject: [keycloak-user] Using KeyCloak with multiple Realms
In-Reply-To: <CAKUZDO5V9a3i-5F16wt3VTR=1PbAfS8RPTCtG0ZdtWky2bMR9w@mail.gmail.com>
Message-ID: <10f62b14-2a7a-4078-a6d2-ab91a4290eaa@me.com>

Dear Stian,
?
we faced an issue when using KeyCloak with a multiple-tenant service and came up with a working solution we would like your opinion on.
?
Our old approach was outlined as follows:
Each of our tenants was assigned a single realm. Within this realm, an "administrator" user was created that enabled the tenant to full extent within our application, but not within the KeyCloak realm itself.
?
Our software utilized the master realms root user to obtain the JSON installation files for our respective services.
Thus, we ran into the problem of roots ever growing access rights, as described in this issue:
https://issues.jboss.org/browse/KEYCLOAK-3067
?
The encoded ?list of roots rights ?in the ?Authentication? header exceeded 8KB and our web server was unable to process any requests from this point onward.
?
To get rid of this problem, we devised a literal workaround: Each realm gets its specific master user who is entitled with all rights the client ?realm-management? ?has to offer- one could say we created a local root for each realm. This master now steps up to the hole left by root and provides the public keys etc. for our services. As its rights are limited to its own realm, its bearer token remains at a constant, reasonable size.
?
?
The (scripted) creation of such a new realm works like this:
?
We manually added? a user in the master realm who has no rights besides creating new users. We access this user via the admin-cli client and create a new user ?creator?.
Creator is then assigned a random password (which is cached) and the role ?create-realm?.
?
In the next step, we access creator and create our new realm, complete with clients, roles, groups and the two users ,? the administrator and the master.
?
After successful creation of the realm, creator has fulfilled its purpose and is deleted. As he possesses full rights in the newly created realm, his continued existence presents a potential insecurity with no practical use to justify it.
?
The big downside of our new approach is the fact that the rights of the master realms root user still keep growing. So we inevitably lock ourselves out of the mater realm security console in the long run.
Of course, we?re still able to access each realms console via /auth/admin/<realm>/console with the master user.
Also, ?in the issue linked above, you commented that KeyCloak is not meant to be used with multiple realms. However, if the master realm was actually removed from KeyCloak in the future, our temporary workaround might yet turn into a long ? lasting solution. Are we right on this part?
?
Thank you very much for your consideration.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160728/97325758/attachment.html 

From akaya at expedia.com  Thu Jul 28 05:53:56 2016
From: akaya at expedia.com (Sarp Kaya)
Date: Thu, 28 Jul 2016 09:53:56 +0000
Subject: [keycloak-user] Handling SuspectExceptions in Keycloak
Message-ID: <035C5A88-0C9C-4D44-A83D-4A227AFF48B6@expedia.com>

Hello,

There is already an existing bug report for Infinispan here:
https://issues.jboss.org/browse/ISPN-6721

Currently for Keycloak, if this exception is thrown then it sends an Internal Server Error page to the browser. Essentially what would be really good is that it sends the user back to the login page instead of displaying Internal Server Error.

This happens when I am consistently sending login and logout (around 40 req/s) requests to two Keycloak instances (let?s call them kc1 and kc2), then one new keycloak instance is started kc3. Kc3 connects to kc1 and 2 in clustering mode.

Now kc1 receives a new request (such as login) and while it is processing that, kc3 is gracefully shut including the cache with this log:
2016-07-28 09:15:53,656 INFO  [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 61) WFLYCLINF0003: Stopped sessions cache from keycloak container
Just shortly after that (6 ms) kc1 throws an exception like this:
2016-07-28 09:15:53,662 ERROR [io.undertow.request] (default task-48) UT005023: Exception handling request to /auth/realms/{realm}/login-actions/authenticate: org.jboss.resteasy.spi.UnhandledException: org.infinispan.statetransfer.OutdatedTopologyException: Cache topology changed while the command was executing: expected 175, got 176
                at org.jboss.resteasy.core.ExceptionHandler.handleException(ExceptionHandler.java:247)
                at org.jboss.resteasy.core.SynchronousDispatcher.writeException(SynchronousDispatcher.java:168)
                at org.jboss.resteasy.core.SynchronousDispatcher.writeResponse(SynchronousDispatcher.java:471)
                at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:415)

then shortly after(150 ms) kc1 wants to talk to kc3 and fails to do so with this exception:
2016-07-28 09:15:53,804 ERROR [org.infinispan.interceptors.InvocationContextInterceptor] (default task-54) ISPN000136: Error executing command RemoveCommand, writing keys [f9bde276-dd03-41c9-995b-b1aaf64c1489]: org.infinispan.remoting.transport.jgroups.SuspectException: Cache not running on node kc3
                at org.infinispan.remoting.transport.AbstractTransport.checkResponse(AbstractTransport.java:46)
                at org.infinispan.remoting.transport.jgroups.JGroupsTransport.checkRsp(JGroupsTransport.java:763)
                at org.infinispan.remoting.transport.jgroups.JGroupsTransport.lambda$invokeRemotelyAsync$73(JGroupsTransport.java:612)
                at java.util.concurrent.CompletableFuture.uniApply(CompletableFuture.java:602)
                at java.util.concurrent.CompletableFuture$UniApply.tryFire(CompletableFuture.java:577)
                at java.util.concurrent.CompletableFuture.postComplete(CompletableFuture.java:474)
                at java.util.concurrent.CompletableFuture.complete(CompletableFuture.java:1962)
                at org.infinispan.remoting.transport.jgroups.RspListFuture.futureDone(RspListFuture.java:31)
                at org.jgroups.blocks.Request.checkCompletion(Request.java:169)
                at org.jgroups.blocks.GroupRequest.viewChange(GroupRequest.java:261)
                at org.jgroups.blocks.RequestCorrelator.receiveView(RequestCorrelator.java:331)
                at org.jgroups.blocks.RequestCorrelator.receive(RequestCorrelator.java:242)
                at org.jgroups.blocks.MessageDispatcher$ProtocolAdapter.up(MessageDispatcher.java:684)
                at org.jgroups.JChannel.up(JChannel.java:738)
                at org.jgroups.fork.ForkProtocolStack.up(ForkProtocolStack.java:123)
                at org.jgroups.stack.Protocol.up(Protocol.java:374)
                at org.jgroups.protocols.FORK.up(FORK.java:118)
                at org.jgroups.protocols.FRAG2.up(FRAG2.java:165)
                at org.jgroups.protocols.FlowControl.up(FlowControl.java:394)
                at org.jgroups.protocols.ENCRYPT.up(ENCRYPT.java:454)
                at org.jgroups.protocols.pbcast.GMS.installView(GMS.java:735)
                at org.jgroups.protocols.pbcast.ParticipantGmsImpl.handleViewChange(ParticipantGmsImpl.java:140)
                at org.jgroups.protocols.pbcast.GMS.up(GMS.java:922)
                at org.jgroups.stack.Protocol.up(Protocol.java:412)
                at org.jgroups.protocols.pbcast.STABLE.up(STABLE.java:294)
                at org.jgroups.protocols.UNICAST3.up(UNICAST3.java:474)
                at org.jgroups.protocols.pbcast.NAKACK2.deliverBatch(NAKACK2.java:982)
                at org.jgroups.protocols.pbcast.NAKACK2.removeAndPassUp(NAKACK2.java:912)
                at org.jgroups.protocols.pbcast.NAKACK2.handleMessage(NAKACK2.java:846)
                at org.jgroups.protocols.pbcast.NAKACK2.up(NAKACK2.java:618)
                at org.jgroups.protocols.VERIFY_SUSPECT.up(VERIFY_SUSPECT.java:155)
                at org.jgroups.protocols.FD.up(FD.java:260)
                at org.jgroups.protocols.FD_SOCK.up(FD_SOCK.java:310)
                at org.jgroups.protocols.MERGE3.up(MERGE3.java:285)
                at org.jgroups.protocols.Discovery.up(Discovery.java:295)
                at org.jgroups.protocols.TP.passMessageUp(TP.java:1577)
                at org.jgroups.protocols.TP$MyHandler.run(TP.java:1796)
                at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
                at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
                at java.lang.Thread.run(Thread.java:745)

The key that it tries to write is the user-id. After this, the browser receives an Internal Server Error page, which looks like this in html:
<html>
  <head>
    <title>
      Error
    </title>
  </head>
  <body>
    Internal Server Error
  </body>
</html>

I have configured my infinispan cache settings as following (the rest are default):
    <distributed-cache name="sessions" mode="SYNC" owners="5"/>

    <distributed-cache name="offlineSessions" mode="SYNC" owners="1"/>

    <distributed-cache name="loginFailures" mode="SYNC" owners="1"/>

I have tried many things (such as playing with owner amounts or instance amounts etc). It does not seem to fix this exception. I am well aware that this seems more Infinispan issue than Keycloak, but I believe that Keycloak at least should respond the end user a better error message (perhaps a login again page) rather than an Internal Server Error page. Could you please handle this exception?

Kind Regards,
Sarp Kaya
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160728/ecc8bb6d/attachment-0001.html 

From r.vanloenhout at greenvalley.nl  Thu Jul 28 06:20:41 2016
From: r.vanloenhout at greenvalley.nl (Robert van Loenhout)
Date: Thu, 28 Jul 2016 10:20:41 +0000
Subject: [keycloak-user] AD FS - No assertion from response
Message-ID: <VI1PR0101MB20133326A250C2EB0F34D16E8D000@VI1PR0101MB2013.eurprd01.prod.exchangelabs.com>

Hi,

I'm trying to use Keycloak 2.0.0.Final with AD FS 2.0 as an identity provider. I think I've set up everything, but I am getting an internal error from keycloak.
The server log contains
2016-07-28 11:08:32,510 ERROR [io.undertow.request] (default task-37) UT005023: Exception handling request to /auth/realms/adfs-realm/broker/adfs/endpoint: org.jboss.resteasy.spi.UnhandledException: org.keycloak.broker.provider.IdentityBrokerException: Could not process response from SAML identity provider.
The root cause is "No assertion from response"

So far the only information about this I have found so far is a keycloak issue ticket
https://issues.jboss.org/browse/KEYCLOAK-3103

Has anyone got any luck using AD FS in combination with keycloak?
Is there any configuration I could change in AD FS or Keycloak or workaround this problem?

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160728/b25115a5/attachment.html 

From marc.boorshtein at tremolosecurity.com  Thu Jul 28 06:31:39 2016
From: marc.boorshtein at tremolosecurity.com (Marc Boorshtein)
Date: Thu, 28 Jul 2016 06:31:39 -0400
Subject: [keycloak-user] AD FS - No assertion from response
In-Reply-To: <CAH2S7UD+cd---O+gZGnxFAObaajNTODQ93bvyHzPb-OLC7hPMQ@mail.gmail.com>
References: <VI1PR0101MB20133326A250C2EB0F34D16E8D000@VI1PR0101MB2013.eurprd01.prod.exchangelabs.com>
	<CAH2S7UAgzALpOaPTy=VLb12HhXrGoxanXL=rTr5grf=VNUHSDQ@mail.gmail.com>
	<CAH2S7UDMHMCXFBdEftm1XfYvExuY9r_qv8vrohJzvK2tiY_FZQ@mail.gmail.com>
	<CAH2S7UBb1bHre=scOy5B32mqdi5bGEt3=T4NijOWnZGR65sLdQ@mail.gmail.com>
	<CAH2S7UD+cd---O+gZGnxFAObaajNTODQ93bvyHzPb-OLC7hPMQ@mail.gmail.com>
Message-ID: <CAH2S7UC5as3Zw==N29kY1YNDAiuoEt6NfsPKjZPnVRrU+68_xQ@mail.gmail.com>

What does your authnrequest look like?  ADFS is really fickle about format.
Common issues with the authnrequest are:
1. Nameidformat
2. Authncontextclassref
3. Sha1 signature

#1 is the biggest issue I see. You need to write a claims rule in adfs to
make sure it maps properly or just remove the nameidformat from the
authnrequest.

Marc Boorshtein
CTO, Tremolo Security, Inc.

On Jul 28, 2016 6:22 AM, "Robert van Loenhout" <r.vanloenhout at greenvalley.nl>
wrote:

Hi,



I?m trying to use Keycloak 2.0.0.Final with AD FS 2.0 as an identity
provider. I think I?ve set up everything, but I am getting an internal
error from keycloak.

The server log contains

2016-07-28 11:08:32,510 ERROR [io.undertow.request] (default task-37)
UT005023: Exception handling request to
/auth/realms/adfs-realm/broker/adfs/endpoint:
org.jboss.resteasy.spi.UnhandledException:
org.keycloak.broker.provider.IdentityBrokerException: Could not process
response from SAML identity provider.

The root cause is ?No assertion from response?



So far the only information about this I have found so far is a keycloak
issue ticket

https://issues.jboss.org/browse/KEYCLOAK-3103



Has anyone got any luck using AD FS in combination with keycloak?

Is there any configuration I could change in AD FS or Keycloak or
workaround this problem?



_______________________________________________
keycloak-user mailing list
keycloak-user at lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160728/3aa61198/attachment.html 

From haimv at perfectomobile.com  Thu Jul 28 07:49:03 2016
From: haimv at perfectomobile.com (Haim Vana)
Date: Thu, 28 Jul 2016 11:49:03 +0000
Subject: [keycloak-user] KeyCloak multi-tenancy and third parties
Message-ID: <VI1PR0301MB2317DD05EF1D1D21E09B0A13D2000@VI1PR0301MB2317.eurprd03.prod.outlook.com>

Hi,

We are using KeyCloak with multi-tenancy, each realm represents a customer, in addition we are using a third parties (e.g. bloomfire and litmos) were we don't have much control over the code.
Those parties support SAML 2, however when a user access the third party how can KeyCloak know its tenant ? since we can't change the third parties, is it possible to somehow first ask the user its tenant and then redirect him to the login page ?

Any advice will be appreciated.


Thanks,
Haim.
The information contained in this message is proprietary to the sender, protected from disclosure, and may be privileged. The information is intended to be conveyed only to the designated recipient(s) of the message. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, use, distribution or copying of this communication is strictly prohibited and may be unlawful. If you have received this communication in error, please notify us immediately by replying to the message and deleting it from your computer. Thank you.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160728/789f9d69/attachment.html 

From r.vanloenhout at greenvalley.nl  Thu Jul 28 07:55:41 2016
From: r.vanloenhout at greenvalley.nl (Robert van Loenhout)
Date: Thu, 28 Jul 2016 11:55:41 +0000
Subject: [keycloak-user] AD FS - No assertion from response
In-Reply-To: <CAH2S7UC5as3Zw==N29kY1YNDAiuoEt6NfsPKjZPnVRrU+68_xQ@mail.gmail.com>
References: <VI1PR0101MB20133326A250C2EB0F34D16E8D000@VI1PR0101MB2013.eurprd01.prod.exchangelabs.com>
	<CAH2S7UAgzALpOaPTy=VLb12HhXrGoxanXL=rTr5grf=VNUHSDQ@mail.gmail.com>
	<CAH2S7UDMHMCXFBdEftm1XfYvExuY9r_qv8vrohJzvK2tiY_FZQ@mail.gmail.com>
	<CAH2S7UBb1bHre=scOy5B32mqdi5bGEt3=T4NijOWnZGR65sLdQ@mail.gmail.com>
	<CAH2S7UD+cd---O+gZGnxFAObaajNTODQ93bvyHzPb-OLC7hPMQ@mail.gmail.com>
	<CAH2S7UC5as3Zw==N29kY1YNDAiuoEt6NfsPKjZPnVRrU+68_xQ@mail.gmail.com>
Message-ID: <VI1PR0101MB201366E17430F19DBC9EE52F8D000@VI1PR0101MB2013.eurprd01.prod.exchangelabs.com>

I have changed the NameID Policy Format in Keycloak from ?Persistent? to ?Unspecified? that was initially set after importing the FederationMetadata.xml.
I don?t see any error anymore in the AD FS log.

However I now get a decryption error in the keycloak server log

Caused by: org.apache.xml.security.encryption.XMLEncryptionException: Unwrapping failed
Original Exception was java.security.InvalidKeyException: Unwrapping failed
               at org.apache.xml.security.encryption.XMLCipher.decryptKey(XMLCipher.java:1532)
               at org.keycloak.saml.processing.core.util.XMLEncryptionUtil.decryptElementInDocument(XMLEncryptionUtil.java:472)
               ... 55 more
Caused by: java.security.InvalidKeyException: Unwrapping failed
               at com.sun.crypto.provider.RSACipher.engineUnwrap(RSACipher.java:445)
               at javax.crypto.Cipher.unwrap(Cipher.java:2550)
               at org.apache.xml.security.encryption.XMLCipher.decryptKey(XMLCipher.java:1530)
               ... 56 more
Caused by: javax.crypto.BadPaddingException: Decryption error
               at sun.security.rsa.RSAPadding.unpadOAEP(RSAPadding.java:499)
               at sun.security.rsa.RSAPadding.unpad(RSAPadding.java:293)
               at com.sun.crypto.provider.RSACipher.doFinal(RSACipher.java:363)
               at com.sun.crypto.provider.RSACipher.engineUnwrap(RSACipher.java:440)
               ... 58 more


From: Marc Boorshtein [mailto:marc.boorshtein at tremolosecurity.com]
Sent: 28 July 2016 12:32
To: Robert van Loenhout <r.vanloenhout at greenvalley.nl>
Cc: keycloak-user <keycloak-user at lists.jboss.org>
Subject: Re: [keycloak-user] AD FS - No assertion from response


What does your authnrequest look like?  ADFS is really fickle about format. Common issues with the authnrequest are:
1. Nameidformat
2. Authncontextclassref
3. Sha1 signature

#1 is the biggest issue I see. You need to write a claims rule in adfs to make sure it maps properly or just remove the nameidformat from the authnrequest.

Marc Boorshtein
CTO, Tremolo Security, Inc.

On Jul 28, 2016 6:22 AM, "Robert van Loenhout" <r.vanloenhout at greenvalley.nl<mailto:r.vanloenhout at greenvalley.nl>> wrote:
Hi,

I?m trying to use Keycloak 2.0.0.Final with AD FS 2.0 as an identity provider. I think I?ve set up everything, but I am getting an internal error from keycloak.
The server log contains
2016-07-28 11:08:32,510 ERROR [io.undertow.request] (default task-37) UT005023: Exception handling request to /auth/realms/adfs-realm/broker/adfs/endpoint: org.jboss.resteasy.spi.UnhandledException: org.keycloak.broker.provider.IdentityBrokerException: Could not process response from SAML identity provider.
The root cause is ?No assertion from response?

So far the only information about this I have found so far is a keycloak issue ticket
https://issues.jboss.org/browse/KEYCLOAK-3103

Has anyone got any luck using AD FS in combination with keycloak?
Is there any configuration I could change in AD FS or Keycloak or workaround this problem?


_______________________________________________
keycloak-user mailing list
keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>
https://lists.jboss.org/mailman/listinfo/keycloak-user

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160728/a0475b6c/attachment-0001.html 

From tpearson at bkool.com  Thu Jul 28 10:23:02 2016
From: tpearson at bkool.com (Tom Pearson)
Date: Thu, 28 Jul 2016 16:23:02 +0200
Subject: [keycloak-user] Forgot Password Rest Api Endpoint
Message-ID: <CALHbiGK9iFXRyPaZwPOk+8MwsPDLZSNZhDDoTgyA84j-6v8jPw@mail.gmail.com>

Hi,

Is there a way in the Rest Api to initiate the forgot password flow passing
over the username? Ideally the same thing the
*/auth/realms/{realm}/login-actions/reset-credentials...
*form does.

I know the */admin/realms/{realm}/users/{id}/reset-password *endpoint
exists but I can't even use it as a workaround as passing temporary=true
doesn't seem to force the user to reset their password on subsequent login.

Would be great if something like
*/admin/realms/{realm}/users/{id}/forgot-password
*were to exist.

Best regards,
Tom
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160728/840e2745/attachment.html 

From bruno at abstractj.org  Thu Jul 28 10:31:17 2016
From: bruno at abstractj.org (Bruno Oliveira)
Date: Thu, 28 Jul 2016 11:31:17 -0300
Subject: [keycloak-user] Forgot Password Rest Api Endpoint
In-Reply-To: <CALHbiGK9iFXRyPaZwPOk+8MwsPDLZSNZhDDoTgyA84j-6v8jPw@mail.gmail.com>
References: <CALHbiGK9iFXRyPaZwPOk+8MwsPDLZSNZhDDoTgyA84j-6v8jPw@mail.gmail.com>
Message-ID: <20160728143117.GD27219@abstractj.org>

Hi Tom,

I believe that what you're looking for is to setup a required action for
your user[1]. Where a required action, could be "UPDATE_PASSWORD", for
example.


[1] - http://www.keycloak.org/docs/rest-api/index.html#_update_required_action

On 2016-07-28, Tom Pearson wrote:
> Hi,
>
> Is there a way in the Rest Api to initiate the forgot password flow passing
> over the username? Ideally the same thing the
> */auth/realms/{realm}/login-actions/reset-credentials...
> *form does.
>
> I know the */admin/realms/{realm}/users/{id}/reset-password *endpoint
> exists but I can't even use it as a workaround as passing temporary=true
> doesn't seem to force the user to reset their password on subsequent login.
>
> Would be great if something like
> */admin/realms/{realm}/users/{id}/forgot-password
> *were to exist.
>
> Best regards,
> Tom

> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user


--

abstractj
PGP: 0x84DC9914

From tpearson at bkool.com  Thu Jul 28 10:35:55 2016
From: tpearson at bkool.com (Tom Pearson)
Date: Thu, 28 Jul 2016 16:35:55 +0200
Subject: [keycloak-user] Forgot Password Rest Api Endpoint
In-Reply-To: <20160728143117.GD27219@abstractj.org>
References: <CALHbiGK9iFXRyPaZwPOk+8MwsPDLZSNZhDDoTgyA84j-6v8jPw@mail.gmail.com>
	<20160728143117.GD27219@abstractj.org>
Message-ID: <CALHbiGL+rSv-ymc2rsyfgOZcPtzGmzUSSczZS2j_xXRNq0RwPw@mail.gmail.com>

Hi Bruno,

Not exactly, ideally I'd like to send a username over to Keycloak and have
it send the appropriate email to the user as the forgot your password page
does.

If that proves not to be possible then yes, a required action could be
viable workaround.

Cheers,
Tom

2016-07-28 16:31 GMT+02:00 Bruno Oliveira <bruno at abstractj.org>:

> Hi Tom,
>
> I believe that what you're looking for is to setup a required action for
> your user[1]. Where a required action, could be "UPDATE_PASSWORD", for
> example.
>
>
> [1] -
> http://www.keycloak.org/docs/rest-api/index.html#_update_required_action
>
> On 2016-07-28, Tom Pearson wrote:
> > Hi,
> >
> > Is there a way in the Rest Api to initiate the forgot password flow
> passing
> > over the username? Ideally the same thing the
> > */auth/realms/{realm}/login-actions/reset-credentials...
> > *form does.
> >
> > I know the */admin/realms/{realm}/users/{id}/reset-password *endpoint
> > exists but I can't even use it as a workaround as passing temporary=true
> > doesn't seem to force the user to reset their password on subsequent
> login.
> >
> > Would be great if something like
> > */admin/realms/{realm}/users/{id}/forgot-password
> > *were to exist.
> >
> > Best regards,
> > Tom
>
> > _______________________________________________
> > keycloak-user mailing list
> > keycloak-user at lists.jboss.org
> > https://lists.jboss.org/mailman/listinfo/keycloak-user
>
>
> --
>
> abstractj
> PGP: 0x84DC9914
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160728/3b5a75ea/attachment.html 

From leo.nunes at gjccorp.com.br  Thu Jul 28 10:58:23 2016
From: leo.nunes at gjccorp.com.br (LEONARDO NUNES)
Date: Thu, 28 Jul 2016 14:58:23 +0000
Subject: [keycloak-user] Redirect Programmatically to the Loginpage
In-Reply-To: <20160727105635.GB10593@abstractj.org>
References: <CAOF04oPyG2O32NDVcnA0w=7s32sP4-Wo5-SKtWf2NngwOeLtpg@mail.gmail.com>
	<20160727105635.GB10593@abstractj.org>
Message-ID: <D3BF9E89.2EF94%leo.nunes@ojc.com.br>

Hi Alex,

You can redirect the user to the URL below when the login button is pressed.

Direct link to Login:
http://keycloak-domain:8080/auth/realms/your-realm-name/protocol/openid-connect/auth?client_id=your-client-id&response_mode=fragment&response_type=code&login=true&redirect_uri=http://your-application-domain.com/page-you-want-to-return

Direct link to Registration:
http://keycloak-domain:8080/auth/realms/your-realm-name/protocol/openid-connect/registrations?client_id=your-client-id&response_mode=fragment&response_type=code&redirect_uri=http://your-application-domain.com/page-you-want-to-return

You could also call request.authenticate(response), but in this case you won?t be able to specify the redirect_uri and there?s no way to indicate you want to go directly to login page or registration page.

I think we have the same situation as yours.
Some of our pages are partially visible when the user is not logged in, so we can?t protect it with url pattern.
There?s a bug when you login and get redirected to a page that it?s url is not protected.
The user session data will not be available until you navigate to a page that has the url protected.
We had to do a workaround to solve a part of the problem.
When we go to the login page our redirect_uri is a servlet that is protected, this servlet only redirects back to my page that is not protected.
There?s an issue open at: https://issues.jboss.org/browse/KEYCLOAK-2784

Please let me know if this solved your problem, or if you found a better solution.



--
Leonardo Nunes




On 27/07/16 07:56, "keycloak-user-bounces at lists.jboss.org<mailto:keycloak-user-bounces at lists.jboss.org> on behalf of Bruno Oliveira" <keycloak-user-bounces at lists.jboss.org<mailto:keycloak-user-bounces at lists.jboss.org> on behalf of bruno at abstractj.org<mailto:bruno at abstractj.org>> wrote:

Hi Alex, please take a look a the examples here[1].

[1] - https://github.com/redhat-developer/redhat-sso-quickstarts

On 2016-07-26, Alex Fernandes wrote:
Hi,

Im green to KeyCloak; Wanted to thank the community for it, so far looking
great.

I have an issue where I want to redirect the user the loginpage on the
KeyCloak server programmatically in Java;

the UseCase is:

We have a page that is partially visible and partiallly not (when not
logged in), so I can't protect it with url pattern;

We have a login button on that page that when the user is not logged and
pressed the button, we want to redirect to the loginpage (on keycloak) and
back to the page again.

I'm using the KeyCloak adapter core (running on tomcat8)

[image: Inline afbeelding 2]


I coppied this code from the: KeycloakOIDCFilter (
https://github.com/keycloak/keycloak/blob/master/adapters/oidc/servlet-filter/src/main/java/org/keycloak/adapters/servlet/KeycloakOIDCFilter.java
)

it does show a 302 in the logs but the page doesn't redirect;

Anyone has a clue about how to go about this?

Much Appreciated,
Cheers!

Alex



_______________________________________________
keycloak-user mailing list
keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>
https://lists.jboss.org/mailman/listinfo/keycloak-user


--

abstractj
PGP: 0x84DC9914
_______________________________________________
keycloak-user mailing list
keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>
https://lists.jboss.org/mailman/listinfo/keycloak-user
________________________________
Esta mensagem pode conter informa??o confidencial e/ou privilegiada. Se voc? n?o for o destinat?rio ou a pessoa autorizada a receber esta mensagem, n?o poder? usar, copiar ou divulgar as informa??es nela contidas ou tomar qualquer a??o baseada nessas informa??es. Se voc? recebeu esta mensagem por engano, por favor avise imediatamente o remetente, respondendo o e-mail e em seguida apague-o. Agradecemos sua coopera??o.

This message may contain confidential and/or privileged information. If you are not the addressee or authorized to receive this for the addressee, you must not use, copy, disclose or take any action based on this message or any information herein. If you have received this message in error, please advise the sender immediately by reply e-mail and delete this message. Thank you for your cooperation

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160728/827c221f/attachment-0001.html 

From r.vanloenhout at greenvalley.nl  Thu Jul 28 11:09:23 2016
From: r.vanloenhout at greenvalley.nl (Robert van Loenhout)
Date: Thu, 28 Jul 2016 15:09:23 +0000
Subject: [keycloak-user] AD FS - No assertion from response
In-Reply-To: <VI1PR0101MB201366E17430F19DBC9EE52F8D000@VI1PR0101MB2013.eurprd01.prod.exchangelabs.com>
References: <VI1PR0101MB20133326A250C2EB0F34D16E8D000@VI1PR0101MB2013.eurprd01.prod.exchangelabs.com>
	<CAH2S7UAgzALpOaPTy=VLb12HhXrGoxanXL=rTr5grf=VNUHSDQ@mail.gmail.com>
	<CAH2S7UDMHMCXFBdEftm1XfYvExuY9r_qv8vrohJzvK2tiY_FZQ@mail.gmail.com>
	<CAH2S7UBb1bHre=scOy5B32mqdi5bGEt3=T4NijOWnZGR65sLdQ@mail.gmail.com>
	<CAH2S7UD+cd---O+gZGnxFAObaajNTODQ93bvyHzPb-OLC7hPMQ@mail.gmail.com>
	<CAH2S7UC5as3Zw==N29kY1YNDAiuoEt6NfsPKjZPnVRrU+68_xQ@mail.gmail.com>
	<VI1PR0101MB201366E17430F19DBC9EE52F8D000@VI1PR0101MB2013.eurprd01.prod.exchangelabs.com>
Message-ID: <VI1PR0101MB20136EAFFDAFA4751002DEFE8D000@VI1PR0101MB2013.eurprd01.prod.exchangelabs.com>

I managed to make it work after using the realm certificate in AD FS (instead of my SSL certificate), installing Java Cryptography Extension, and setting up a truststore in my web app.


From: keycloak-user-bounces at lists.jboss.org [mailto:keycloak-user-bounces at lists.jboss.org] On Behalf Of Robert van Loenhout
Sent: 28 July 2016 13:56
To: Marc Boorshtein <marc.boorshtein at tremolosecurity.com>
Cc: keycloak-user <keycloak-user at lists.jboss.org>
Subject: Re: [keycloak-user] AD FS - No assertion from response

I have changed the NameID Policy Format in Keycloak from ?Persistent? to ?Unspecified? that was initially set after importing the FederationMetadata.xml.
I don?t see any error anymore in the AD FS log.

However I now get a decryption error in the keycloak server log

Caused by: org.apache.xml.security.encryption.XMLEncryptionException: Unwrapping failed
Original Exception was java.security.InvalidKeyException: Unwrapping failed
               at org.apache.xml.security.encryption.XMLCipher.decryptKey(XMLCipher.java:1532)
               at org.keycloak.saml.processing.core.util.XMLEncryptionUtil.decryptElementInDocument(XMLEncryptionUtil.java:472)
               ... 55 more
Caused by: java.security.InvalidKeyException: Unwrapping failed
               at com.sun.crypto.provider.RSACipher.engineUnwrap(RSACipher.java:445)
               at javax.crypto.Cipher.unwrap(Cipher.java:2550)
               at org.apache.xml.security.encryption.XMLCipher.decryptKey(XMLCipher.java:1530)
               ... 56 more
Caused by: javax.crypto.BadPaddingException: Decryption error
               at sun.security.rsa.RSAPadding.unpadOAEP(RSAPadding.java:499)
               at sun.security.rsa.RSAPadding.unpad(RSAPadding.java:293)
               at com.sun.crypto.provider.RSACipher.doFinal(RSACipher.java:363)
               at com.sun.crypto.provider.RSACipher.engineUnwrap(RSACipher.java:440)
               ... 58 more


From: Marc Boorshtein [mailto:marc.boorshtein at tremolosecurity.com]
Sent: 28 July 2016 12:32
To: Robert van Loenhout <r.vanloenhout at greenvalley.nl<mailto:r.vanloenhout at greenvalley.nl>>
Cc: keycloak-user <keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>>
Subject: Re: [keycloak-user] AD FS - No assertion from response


What does your authnrequest look like?  ADFS is really fickle about format. Common issues with the authnrequest are:
1. Nameidformat
2. Authncontextclassref
3. Sha1 signature

#1 is the biggest issue I see. You need to write a claims rule in adfs to make sure it maps properly or just remove the nameidformat from the authnrequest.

Marc Boorshtein
CTO, Tremolo Security, Inc.

On Jul 28, 2016 6:22 AM, "Robert van Loenhout" <r.vanloenhout at greenvalley.nl<mailto:r.vanloenhout at greenvalley.nl>> wrote:
Hi,

I?m trying to use Keycloak 2.0.0.Final with AD FS 2.0 as an identity provider. I think I?ve set up everything, but I am getting an internal error from keycloak.
The server log contains
2016-07-28 11:08:32,510 ERROR [io.undertow.request] (default task-37) UT005023: Exception handling request to /auth/realms/adfs-realm/broker/adfs/endpoint: org.jboss.resteasy.spi.UnhandledException: org.keycloak.broker.provider.IdentityBrokerException: Could not process response from SAML identity provider.
The root cause is ?No assertion from response?

So far the only information about this I have found so far is a keycloak issue ticket
https://issues.jboss.org/browse/KEYCLOAK-3103

Has anyone got any luck using AD FS in combination with keycloak?
Is there any configuration I could change in AD FS or Keycloak or workaround this problem?


_______________________________________________
keycloak-user mailing list
keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>
https://lists.jboss.org/mailman/listinfo/keycloak-user

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160728/f1a2e1e3/attachment-0001.html 

From josh.cain at redhat.com  Thu Jul 28 11:34:35 2016
From: josh.cain at redhat.com (Josh Cain)
Date: Thu, 28 Jul 2016 10:34:35 -0500
Subject: [keycloak-user] Customize Themes by Client
Message-ID: <CA+z0A8DhbZBT9rmqwaP4qMSawRqbOx6f4sVczVia2aAs=-PSKQ@mail.gmail.com>

Hi All,

I've got some SP's that want the ability to customize the look/feel of the
login page.  Couldn't find anything on the docs/jira site, but was curious
as to whether:

   - Keycloak currently supports login themes by client
   - If not, would the team be open to such a feature?


Josh Cain | Software Applications Engineer
*Identity and Access Management*
*Red Hat*
+1 843-737-1735
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160728/00d30bea/attachment.html 

From bruno at abstractj.org  Thu Jul 28 11:53:37 2016
From: bruno at abstractj.org (Bruno Oliveira)
Date: Thu, 28 Jul 2016 12:53:37 -0300
Subject: [keycloak-user] Forgot Password Rest Api Endpoint
In-Reply-To: <CALHbiGL+rSv-ymc2rsyfgOZcPtzGmzUSSczZS2j_xXRNq0RwPw@mail.gmail.com>
References: <CALHbiGK9iFXRyPaZwPOk+8MwsPDLZSNZhDDoTgyA84j-6v8jPw@mail.gmail.com>
	<20160728143117.GD27219@abstractj.org>
	<CALHbiGL+rSv-ymc2rsyfgOZcPtzGmzUSSczZS2j_xXRNq0RwPw@mail.gmail.com>
Message-ID: <20160728155337.GA12943@abstractj.org>

Gotcha, in this case, I would look at this[1].

[1] - https://github.com/keycloak/keycloak/blob/master/integration/admin-client/src/main/java/org/keycloak/admin/client/resource/UserResource.java#L87-L107

On 2016-07-28, Tom Pearson wrote:
> Hi Bruno,
>
> Not exactly, ideally I'd like to send a username over to Keycloak and have
> it send the appropriate email to the user as the forgot your password page
> does.
>
> If that proves not to be possible then yes, a required action could be
> viable workaround.
>
> Cheers,
> Tom
>
> 2016-07-28 16:31 GMT+02:00 Bruno Oliveira <bruno at abstractj.org>:
>
> > Hi Tom,
> >
> > I believe that what you're looking for is to setup a required action for
> > your user[1]. Where a required action, could be "UPDATE_PASSWORD", for
> > example.
> >
> >
> > [1] -
> > http://www.keycloak.org/docs/rest-api/index.html#_update_required_action
> >
> > On 2016-07-28, Tom Pearson wrote:
> > > Hi,
> > >
> > > Is there a way in the Rest Api to initiate the forgot password flow
> > passing
> > > over the username? Ideally the same thing the
> > > */auth/realms/{realm}/login-actions/reset-credentials...
> > > *form does.
> > >
> > > I know the */admin/realms/{realm}/users/{id}/reset-password *endpoint
> > > exists but I can't even use it as a workaround as passing temporary=true
> > > doesn't seem to force the user to reset their password on subsequent
> > login.
> > >
> > > Would be great if something like
> > > */admin/realms/{realm}/users/{id}/forgot-password
> > > *were to exist.
> > >
> > > Best regards,
> > > Tom
> >
> > > _______________________________________________
> > > keycloak-user mailing list
> > > keycloak-user at lists.jboss.org
> > > https://lists.jboss.org/mailman/listinfo/keycloak-user
> >
> >
> > --
> >
> > abstractj
> > PGP: 0x84DC9914
> >

--

abstractj
PGP: 0x84DC9914

From tpearson at bkool.com  Thu Jul 28 12:04:13 2016
From: tpearson at bkool.com (Tom Pearson)
Date: Thu, 28 Jul 2016 18:04:13 +0200
Subject: [keycloak-user] Forgot Password Rest Api Endpoint
In-Reply-To: <20160728155337.GA12943@abstractj.org>
References: <CALHbiGK9iFXRyPaZwPOk+8MwsPDLZSNZhDDoTgyA84j-6v8jPw@mail.gmail.com>
	<20160728143117.GD27219@abstractj.org>
	<CALHbiGL+rSv-ymc2rsyfgOZcPtzGmzUSSczZS2j_xXRNq0RwPw@mail.gmail.com>
	<20160728155337.GA12943@abstractj.org>
Message-ID: <CALHbiGK0QbfOEidRb7PTnK0_e5eqX2oDJzLwuRton5OhYFVn6A@mail.gmail.com>

Yup, the execute-actions-email looks like it should do the trick :)

Cheers

2016-07-28 17:53 GMT+02:00 Bruno Oliveira <bruno at abstractj.org>:

> Gotcha, in this case, I would look at this[1].
>
> [1] -
> https://github.com/keycloak/keycloak/blob/master/integration/admin-client/src/main/java/org/keycloak/admin/client/resource/UserResource.java#L87-L107
>
> On 2016-07-28, Tom Pearson wrote:
> > Hi Bruno,
> >
> > Not exactly, ideally I'd like to send a username over to Keycloak and
> have
> > it send the appropriate email to the user as the forgot your password
> page
> > does.
> >
> > If that proves not to be possible then yes, a required action could be
> > viable workaround.
> >
> > Cheers,
> > Tom
> >
> > 2016-07-28 16:31 GMT+02:00 Bruno Oliveira <bruno at abstractj.org>:
> >
> > > Hi Tom,
> > >
> > > I believe that what you're looking for is to setup a required action
> for
> > > your user[1]. Where a required action, could be "UPDATE_PASSWORD", for
> > > example.
> > >
> > >
> > > [1] -
> > >
> http://www.keycloak.org/docs/rest-api/index.html#_update_required_action
> > >
> > > On 2016-07-28, Tom Pearson wrote:
> > > > Hi,
> > > >
> > > > Is there a way in the Rest Api to initiate the forgot password flow
> > > passing
> > > > over the username? Ideally the same thing the
> > > > */auth/realms/{realm}/login-actions/reset-credentials...
> > > > *form does.
> > > >
> > > > I know the */admin/realms/{realm}/users/{id}/reset-password *endpoint
> > > > exists but I can't even use it as a workaround as passing
> temporary=true
> > > > doesn't seem to force the user to reset their password on subsequent
> > > login.
> > > >
> > > > Would be great if something like
> > > > */admin/realms/{realm}/users/{id}/forgot-password
> > > > *were to exist.
> > > >
> > > > Best regards,
> > > > Tom
> > >
> > > > _______________________________________________
> > > > keycloak-user mailing list
> > > > keycloak-user at lists.jboss.org
> > > > https://lists.jboss.org/mailman/listinfo/keycloak-user
> > >
> > >
> > > --
> > >
> > > abstractj
> > > PGP: 0x84DC9914
> > >
>
> --
>
> abstractj
> PGP: 0x84DC9914
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160728/8d8cbbd8/attachment.html 

From bruno at abstractj.org  Thu Jul 28 12:36:03 2016
From: bruno at abstractj.org (Bruno Oliveira)
Date: Thu, 28 Jul 2016 13:36:03 -0300
Subject: [keycloak-user] Customize Themes by Client
In-Reply-To: <CA+z0A8DhbZBT9rmqwaP4qMSawRqbOx6f4sVczVia2aAs=-PSKQ@mail.gmail.com>
References: <CA+z0A8DhbZBT9rmqwaP4qMSawRqbOx6f4sVczVia2aAs=-PSKQ@mail.gmail.com>
Message-ID: <20160728163603.GA16955@abstractj.org>

Hi Josh, there was a discussion about it here[1].

[1] - http://lists.jboss.org/pipermail/keycloak-user/2016-January/004288.html

On 2016-07-28, Josh Cain wrote:
> Hi All,
>
> I've got some SP's that want the ability to customize the look/feel of the
> login page.  Couldn't find anything on the docs/jira site, but was curious
> as to whether:
>
>    - Keycloak currently supports login themes by client
>    - If not, would the team be open to such a feature?
>
>
> Josh Cain | Software Applications Engineer
> *Identity and Access Management*
> *Red Hat*
> +1 843-737-1735

> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user


--

abstractj
PGP: 0x84DC9914

From raymond.zhou at moneris.com  Thu Jul 28 13:42:03 2016
From: raymond.zhou at moneris.com (Zhou, Limin (Ray))
Date: Thu, 28 Jul 2016 17:42:03 +0000
Subject: [keycloak-user] Keycloak single sign on with Keberos(AD)
In-Reply-To: <5774E2E7.3060204@redhat.com>
References: <0ABE2BE06E188B4FA117BC5D9D11ECCF5051DCDD@sq9bmexpr03.MONAD.MONERIS.COM>
	<5770F7ED.3070901@redhat.com>
	<0ABE2BE06E188B4FA117BC5D9D11ECCF5051DFCA@sq9bmexpr03.MONAD.MONERIS.COM>
	<57720E66.50307@redhat.com>
	<0ABE2BE06E188B4FA117BC5D9D11ECCF5051E202@sq9bmexpr03.MONAD.MONERIS.COM>
	<57738034.2090108@redhat.com>
	<0ABE2BE06E188B4FA117BC5D9D11ECCF5051E30E@sq9bmexpr03.MONAD.MONERIS.COM>
	<5774E2E7.3060204@redhat.com>
Message-ID: <0ABE2BE06E188B4FA117BC5D9D11ECCF5051F266@sq9bmexpr03.MONAD.MONERIS.COM>

Hello Marek or anyone else

I was busy with something else in the past days, right now I am backing to this single sign-on again, according to our sys admin, they don?t see any configuration issues on the AD side, so by test it again

I have a lot of questions around it, could you please take a look and give me some insight look, thanks ahead.

the log can be divided into 4 parts

part1 : begin - 10:47:25,500 (started the server)

part2 : 10:49:29,067 - 10:49:29,160 (open IE and hit application url) failed to login automatically, prompt to login page, in here beside the exception I am not able to see more handshake message between keycloak and browser, why? should I turn on more logging?

part3 : 10:50:22,306 - 10:50:23,476 (first try by entering username/password) failed to login manually, back to login page, from here I can see some token had been read, but it failed at the end

part4 : 10:50:41,736 - end (second try by entering username/password) succeeded to login, could you please explain why it succeeded this time.

P.S please find the latest log from the attachment

raymond

From: Marek Posolda [mailto:mposolda at redhat.com]
Sent: Thursday, June 30, 2016 5:14 AM
To: Zhou, Limin (Ray)
Cc: keycloak-user at lists.jboss.org
Subject: Re: [keycloak-user] Keycloak single sign on with Keberos(AD)

Adding list back again for tracking (Ray, please use "Reply all" when reply to the mails).

From my googling, it seems that DefectiveTokenDetected can happen for NTLM requests as well. Btv. I found some tips on StackOverflow how to prevent use NTLM instead of Kerberos5 http://stackoverflow.com/questions/2973355/defective-token-deteced-error-ntlm-not-kerberos-with-kerberos-spring-securit . Maybe something from those will help:
- Use different machines for client (browser) and keycloak server
- Ensure both machines are in windows domain
- Use some different encryptions in kerberos client file. ( krb5.ini ) file. The post mentions "arcfour-hmac-md5" however the post is 6 years old :) Still it might help to add/remove some encryptions from krb5.ini file and check if client machine and IE will use krb5 ticket instead of NTLM
- Fix DNS records or "SPN records" (I don't have a clue what it is :) So see post for more details)

Marek

On 29/06/16 16:41, Zhou, Limin (Ray) wrote:
Marek

I sent you two log files yesterday via two emails, I am able to see your analysis(such OID etc.) from the first log, but not the second logs, in the second log we were getting GSSException instead of the hand shake message,  I am wondering why it likes this, and are they the same thing regarding my issues?

Sorry to disturb you again

Raymond

P.S I have attached the two logs again for you to reference


From: Zhou, Limin (Ray)
Sent: Wednesday, June 29, 2016 10:18 AM
To: 'Marek Posolda'
Subject: RE: [keycloak-user] Keycloak single sign on with Keberos(AD)

Marek

Thank you so much for your analysis, I am wondering whether you can tell me how you mapped your diagnose with the server.log line#? I think this will help us more when we tuning either our bowser and domain setting, because I cannot see any 401 heading, first OID, the KRB5 OLD from the log file

Really appreciate your help

Raymond



From: Marek Posolda [mailto:mposolda at redhat.com]
Sent: Wednesday, June 29, 2016 4:01 AM
To: Zhou, Limin (Ray)
Cc: keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>
Subject: Re: [keycloak-user] Keycloak single sign on with Keberos(AD)

Hi Raymond,

returning keycloak-user list back for tracking purposes.

What I can see in the server.log is happening is that:
- Keycloak ask browser to send SPNEGO token (by sending 401 with "WWW-Authenticate: Negotiate" header). So far everything as expected
- Browser replies with SPNEGO token, however it uses NTLM as the preferred choice ( First OID is 1.3.6.1.4.1.311.2.2.10 ) together with NTLM token. The KRB5 OID ( 1.2.840.113554.1.2.2 ) is in the supported mechanisms too.
- Keycloak replies with NegTokenTarg token when it's asking for sending SPNEGO token backed by KRB5 instead of NTLM (as Keycloak doesn't understant NTLM atm. There is related discussion on keycloak-user http://lists.jboss.org/pipermail/keycloak-user/2016-June/006758.html )
- Browser doesn't respond to NegTokenTarg with SPNEGO+KRB5 token anymore

Not sure what are your possibilities TBH. Either somehow setup browser to reply to second request with NegTokenTarg and send SPNEGO+KRB5 token. Or re-configure your Windows domain (or client machines + browser) to skip using NTLM. Right now, I don't have any clue how to do that TBH.

Marek

On 28/06/16 21:58, Zhou, Limin (Ray) wrote:
Hi Marek

If you haven?t looked at my previous server.log, then use this one instead, in this log we were getting an exception

GSSException: Defective token detected (Mechanism level: GSSHeader did not find the right tag)

When we hit the url, maybe this will make things easier

Please let me know if you need anything more

Thanks a lot

Raymond




From: Zhou, Limin (Ray)
Sent: Tuesday, June 28, 2016 10:00 AM
To: 'Marek Posolda'
Subject: RE: [keycloak-user] Keycloak single sign on with Keberos(AD)

Hi Marek

I have attached my keycloak server log to you, after adding the two properties, we can see an exception shows up  when I hitting my url, after the exception, I think the default keycloak login page shows up, and rest of the log were generated by my manual login

Hope this can give us some clue

Thanks a lot

Raymond





From: Marek Posolda [mailto:mposolda at redhat.com]
Sent: Tuesday, June 28, 2016 1:43 AM
To: Zhou, Limin (Ray)
Subject: Re: [keycloak-user] Keycloak single sign on with Keberos(AD)

Thanks Raymond,

is it possible to also enable the system properties -Dsun.security.krb5.debug=true and -Dsun.security.spnego.debug=true and see if there are some more details in the log? You can add system properties either directly to standalone/configuration/standalone.xml file or by adding them to java opts in bin/standalone.conf

Thanks,
Marek

On 27/06/16 23:18, Zhou, Limin (Ray) wrote:
Hello Marek

Thanks for answering my post, following are the log piece after hitting the first page, hope this helps.

Please let me know if you need anything more

Thank you so much

Raymond



2016-06-27 17:11:13,453 INFO  [stdout] (default task-24) Debug is  true storeKey true useTicketCache false useKeyTab true doNotPrompt true ticketCache is null isInitiator false KeyTab is C:\FIRMS-domain\kcsso.keytab refreshKrb5Config is false principal is HTTP/t430-pbdc41e.monad.moneris.com at MONAD.MONERIS.COM<mailto:HTTP/t430-pbdc41e.monad.moneris.com at MONAD.MONERIS.COM> tryFirstPass is false useFirstPass is false storePass is false clearPass is false
2016-06-27 17:11:13,453 INFO  [stdout] (default task-24) principal is HTTP/t430-pbdc41e.monad.moneris.com at MONAD.MONERIS.COM<mailto:HTTP/t430-pbdc41e.monad.moneris.com at MONAD.MONERIS.COM>
2016-06-27 17:11:13,453 INFO  [stdout] (default task-24) Will use keytab
2016-06-27 17:11:13,453 INFO  [stdout] (default task-24) Commit Succeeded
2016-06-27 17:11:13,453 INFO  [stdout] (default task-24)
2016-06-27 17:11:13,454 INFO  [stdout] (default task-24)                               [Krb5LoginModule]: Entering logout
2016-06-27 17:11:13,454 INFO  [stdout] (default task-24)                               [Krb5LoginModule]: logged out Subject

From: Marek Posolda [mailto:mposolda at redhat.com]
Sent: Monday, June 27, 2016 5:55 AM
To: Zhou, Limin (Ray); keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>
Subject: Re: [keycloak-user] Keycloak single sign on with Keberos(AD)

It may help if you enable all the possible debug/trace logging and post the log here. This may give more info what is the issue. See docs how to enable logging : https://keycloak.gitbooks.io/server-adminstration-guide/content/v/2.0/topics/authentication/kerberos.html

Try to send the log from the point once you trigger the authentication request (or from the point when you hit your app URL)

Thanks,
Marek

On 24/06/16 20:22, Zhou, Limin (Ray) wrote:
Hello everyone

I am new to Keycloak and new to here

Our web application is running on Jboss EAP 7, We have configured KeyCloak standalone server 1.9.7 running on different port(same server box) to manage the user authentication and authorization, behind KeyCloak we have configured Keberos in User Federation to talk our company AD server, we are able to login by using our AD account, but not in single sign on way, each time when we hitting the our app URL, the Keycloak login page will show up.

It looks like the TGT or ST hand shake was not successful, is there any document I can reference it to debug the issue?

Any comments or suggestion would be very welcome

thanks in advance
raymond
________________________________
Moneris Solutions Corporation | 3300 Bloor Street West | Toronto | Ontario | M8X 2X2 | Canada www.moneris.com<http://www.moneris.com> 1-866-319-7450
If you wish to unsubscribe from future updates from Moneris, please click here<https://www.moneris.com/en/About-Moneris/Contact-Moneris/Unsubscribe.aspx>. Please see the Moneris Privacy Policy here<http://www.moneris.com/Home/Legal/Website-Policies/Privacy-Policy.aspx>.

This e-mail may be privileged and/or confidential, and the sender does not waive any related rights and obligations. Any distribution, use or copying of this e-mail or the information it contains by other than an intended recipient is unauthorized. If you received this e-mail in error, please advise me (by return e-mail or otherwise) immediately.
________________________________
Corporation Solutions Moneris | 3300, rue Bloor Ouest | Toronto | Ontario | M8X 2X2 | Canada www.moneris.com<http://www.moneris.com> 1-866-319-7450
Si vous d?sirez enlever votre nom de la liste d?envoi de Moneris, veuillez cliquer ici<https://www.moneris.com/about-moneris/contact-moneris/unsubscribe?sc_lang=fr-CA>. Veuillez consulter la Politique de confidentialit? de Moneris ici<http://www.moneris.com/Home/Legal/Website-Policies/Privacy-Policy.aspx?sc_lang=fr-CA%20>.

Ce courriel peut contenir des renseignements confidentiels ou privil?gi?s, et son exp?diteur ne renonce ? aucun droit ni ? aucune obligation connexe. La distribution, l?utilisation ou la reproduction du pr?sent courriel ou des renseignements qu?il contient par une personne autre que son destinataire pr?vu sont interdites. Si vous avez re?u ce courriel par erreur, veuillez m?en aviser imm?diatement (par retour de courriel ou autrement).




_______________________________________________

keycloak-user mailing list

keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>

https://lists.jboss.org/mailman/listinfo/keycloak-user

________________________________
Moneris Solutions Corporation | 3300 Bloor Street West | Toronto | Ontario | M8X 2X2 | Canada www.moneris.com<http://www.moneris.com> 1-866-319-7450
If you wish to unsubscribe from future updates from Moneris, please click here<https://www.moneris.com/en/About-Moneris/Contact-Moneris/Unsubscribe.aspx>. Please see the Moneris Privacy Policy here<http://www.moneris.com/Home/Legal/Website-Policies/Privacy-Policy.aspx>.

This e-mail may be privileged and/or confidential, and the sender does not waive any related rights and obligations. Any distribution, use or copying of this e-mail or the information it contains by other than an intended recipient is unauthorized. If you received this e-mail in error, please advise me (by return e-mail or otherwise) immediately.
________________________________
Corporation Solutions Moneris | 3300, rue Bloor Ouest | Toronto | Ontario | M8X 2X2 | Canada www.moneris.com<http://www.moneris.com> 1-866-319-7450
Si vous d?sirez enlever votre nom de la liste d?envoi de Moneris, veuillez cliquer ici<https://www.moneris.com/about-moneris/contact-moneris/unsubscribe?sc_lang=fr-CA>. Veuillez consulter la Politique de confidentialit? de Moneris ici<http://www.moneris.com/Home/Legal/Website-Policies/Privacy-Policy.aspx?sc_lang=fr-CA%20>.

Ce courriel peut contenir des renseignements confidentiels ou privil?gi?s, et son exp?diteur ne renonce ? aucun droit ni ? aucune obligation connexe. La distribution, l?utilisation ou la reproduction du pr?sent courriel ou des renseignements qu?il contient par une personne autre que son destinataire pr?vu sont interdites. Si vous avez re?u ce courriel par erreur, veuillez m?en aviser imm?diatement (par retour de courriel ou autrement).

________________________________
Moneris Solutions Corporation | 3300 Bloor Street West | Toronto | Ontario | M8X 2X2 | Canada www.moneris.com<http://www.moneris.com> 1-866-319-7450
If you wish to unsubscribe from future updates from Moneris, please click here<https://www.moneris.com/en/About-Moneris/Contact-Moneris/Unsubscribe.aspx>. Please see the Moneris Privacy Policy here<http://www.moneris.com/Home/Legal/Website-Policies/Privacy-Policy.aspx>.

This e-mail may be privileged and/or confidential, and the sender does not waive any related rights and obligations. Any distribution, use or copying of this e-mail or the information it contains by other than an intended recipient is unauthorized. If you received this e-mail in error, please advise me (by return e-mail or otherwise) immediately.
________________________________
Corporation Solutions Moneris | 3300, rue Bloor Ouest | Toronto | Ontario | M8X 2X2 | Canada www.moneris.com<http://www.moneris.com> 1-866-319-7450
Si vous d?sirez enlever votre nom de la liste d?envoi de Moneris, veuillez cliquer ici<https://www.moneris.com/about-moneris/contact-moneris/unsubscribe?sc_lang=fr-CA>. Veuillez consulter la Politique de confidentialit? de Moneris ici<http://www.moneris.com/Home/Legal/Website-Policies/Privacy-Policy.aspx?sc_lang=fr-CA%20>.

Ce courriel peut contenir des renseignements confidentiels ou privil?gi?s, et son exp?diteur ne renonce ? aucun droit ni ? aucune obligation connexe. La distribution, l?utilisation ou la reproduction du pr?sent courriel ou des renseignements qu?il contient par une personne autre que son destinataire pr?vu sont interdites. Si vous avez re?u ce courriel par erreur, veuillez m?en aviser imm?diatement (par retour de courriel ou autrement).

________________________________
Moneris Solutions Corporation | 3300 Bloor Street West | Toronto | Ontario | M8X 2X2 | Canada www.moneris.com<http://www.moneris.com> 1-866-319-7450
If you wish to unsubscribe from future updates from Moneris, please click here<https://www.moneris.com/en/About-Moneris/Contact-Moneris/Unsubscribe.aspx>. Please see the Moneris Privacy Policy here<http://www.moneris.com/Home/Legal/Website-Policies/Privacy-Policy.aspx>.

This e-mail may be privileged and/or confidential, and the sender does not waive any related rights and obligations. Any distribution, use or copying of this e-mail or the information it contains by other than an intended recipient is unauthorized. If you received this e-mail in error, please advise me (by return e-mail or otherwise) immediately.
________________________________
Corporation Solutions Moneris | 3300, rue Bloor Ouest | Toronto | Ontario | M8X 2X2 | Canada www.moneris.com<http://www.moneris.com> 1-866-319-7450
Si vous d?sirez enlever votre nom de la liste d?envoi de Moneris, veuillez cliquer ici<https://www.moneris.com/about-moneris/contact-moneris/unsubscribe?sc_lang=fr-CA>. Veuillez consulter la Politique de confidentialit? de Moneris ici<http://www.moneris.com/Home/Legal/Website-Policies/Privacy-Policy.aspx?sc_lang=fr-CA%20>.

Ce courriel peut contenir des renseignements confidentiels ou privil?gi?s, et son exp?diteur ne renonce ? aucun droit ni ? aucune obligation connexe. La distribution, l?utilisation ou la reproduction du pr?sent courriel ou des renseignements qu?il contient par une personne autre que son destinataire pr?vu sont interdites. Si vous avez re?u ce courriel par erreur, veuillez m?en aviser imm?diatement (par retour de courriel ou autrement).

________________________________
Moneris Solutions Corporation | 3300 Bloor Street West | Toronto | Ontario | M8X 2X2 | Canada www.moneris.com 1-866-319-7450
If you wish to unsubscribe from future updates from Moneris, please click here<https://www.moneris.com/en/About-Moneris/Contact-Moneris/Unsubscribe.aspx>. Please see the Moneris Privacy Policy here<http://www.moneris.com/Home/Legal/Website-Policies/Privacy-Policy.aspx>.

This e-mail may be privileged and/or confidential, and the sender does not waive any related rights and obligations. Any distribution, use or copying of this e-mail or the information it contains by other than an intended recipient is unauthorized. If you received this e-mail in error, please advise me (by return e-mail or otherwise) immediately.
________________________________
Corporation Solutions Moneris | 3300, rue Bloor Ouest | Toronto | Ontario | M8X 2X2 | Canada www.moneris.com 1-866-319-7450
Si vous d?sirez enlever votre nom de la liste d?envoi de Moneris, veuillez cliquer ici<https://www.moneris.com/about-moneris/contact-moneris/unsubscribe?sc_lang=fr-CA>. Veuillez consulter la Politique de confidentialit? de Moneris ici<http://www.moneris.com/Home/Legal/Website-Policies/Privacy-Policy.aspx?sc_lang=fr-CA>.

Ce courriel peut contenir des renseignements confidentiels ou privil?gi?s, et son exp?diteur ne renonce ? aucun droit ni ? aucune obligation connexe. La distribution, l?utilisation ou la reproduction du pr?sent courriel ou des renseignements qu?il contient par une personne autre que son destinataire pr?vu sont interdites. Si vous avez re?u ce courriel par erreur, veuillez m?en aviser imm?diatement (par retour de courriel ou autrement).
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160728/dc0c1496/attachment-0001.html 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 07-28.log
Type: application/octet-stream
Size: 52073 bytes
Desc: 07-28.log
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20160728/dc0c1496/attachment-0001.obj 

From josh.cain at redhat.com  Thu Jul 28 14:24:18 2016
From: josh.cain at redhat.com (Josh Cain)
Date: Thu, 28 Jul 2016 13:24:18 -0500
Subject: [keycloak-user] Customize Themes by Client
In-Reply-To: <20160728163603.GA16955@abstractj.org>
References: <CA+z0A8DhbZBT9rmqwaP4qMSawRqbOx6f4sVczVia2aAs=-PSKQ@mail.gmail.com>
	<20160728163603.GA16955@abstractj.org>
Message-ID: <CA+z0A8ACoDdoQAbdf7ZMb1-abSNw1We+pKPpvnzSb7JsqNtrhQ@mail.gmail.com>

Bruno,

Thanks for the link!  Wasn't on this list when it was discussed.  So if I
understand the thread correctly:

   - This feature has already been given a 'No' response by the Keycloak
   team.
   - Best way to implement client-specific theme functionality, as per the
   thread, is to use the client variable + conditionals in the template to
   change how a page renders.

I'm a bit disappointed - I also have this requirement.  Don't want to go
back through and re-hash the reasons why (most were already covered on the
previous thread), but a client config for a theme would be immensely
helpful.

As a side note, I'll be doing the work to either a) provide a mechanism for
clients to arbitrarily theme the login template, or b) allow clients to
select a login theme in Keycloak proper.  I'd much prefer b), but it looks
like a) might be my only option...


Josh Cain | Software Applications Engineer
*Identity and Access Management*
*Red Hat*
+1 843-737-1735

On Thu, Jul 28, 2016 at 11:36 AM, Bruno Oliveira <bruno at abstractj.org>
wrote:

> Hi Josh, there was a discussion about it here[1].
>
> [1] -
> http://lists.jboss.org/pipermail/keycloak-user/2016-January/004288.html
>
> On 2016-07-28, Josh Cain wrote:
> > Hi All,
> >
> > I've got some SP's that want the ability to customize the look/feel of
> the
> > login page.  Couldn't find anything on the docs/jira site, but was
> curious
> > as to whether:
> >
> >    - Keycloak currently supports login themes by client
> >    - If not, would the team be open to such a feature?
> >
> >
> > Josh Cain | Software Applications Engineer
> > *Identity and Access Management*
> > *Red Hat*
> > +1 843-737-1735
>
> > _______________________________________________
> > keycloak-user mailing list
> > keycloak-user at lists.jboss.org
> > https://lists.jboss.org/mailman/listinfo/keycloak-user
>
>
> --
>
> abstractj
> PGP: 0x84DC9914
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160728/e4b970c3/attachment.html 

From mitya at cargosoft.ru  Thu Jul 28 14:40:49 2016
From: mitya at cargosoft.ru (Dmitry Telegin)
Date: Thu, 28 Jul 2016 21:40:49 +0300
Subject: [keycloak-user] OpenID 2.0 authentcation in keycloak
In-Reply-To: <234933781.3930805.1469194197363.JavaMail.yahoo@mail.yahoo.com>
References: <234933781.3930805.1469194197363.JavaMail.yahoo.ref@mail.yahoo.com>
	<234933781.3930805.1469194197363.JavaMail.yahoo@mail.yahoo.com>
Message-ID: <1469731249.27953.8.camel@cargosoft.ru>

Hi Peter,

Despite having been superseded by OpenID Connect, I think OpenID 2.0 is
still of great importance - especially in the context of an ultra-
conservative enterprise landscape. For example, a de facto standard for
accounting software in ex-USSR is 1C (think "Russian Navision"). It
does support OpenID 2.0 for external authentication, but I'm pretty
sure they won't upgrade to OIDC in the next five years or so.

Meanwhile, our company is exploring possibilities of adding
sophisticated external auth to 1C. That's why I think I'll be
implementing OID2 for KeyCloak soon (or at least a subset of it that
would be suitable for 1C). If you're interested in collaborating,
please let me know.

Dmitry

> Hi,
> > > > > > > > Can anyone suggest a library or an existing keycloak extension, or
perhaps share their experiences with respect to enabling OpenID 2.0
authentication in keycloak, in addition to OIDC and SAML
authentication? I am looking for a way to integrate keycloak with
Kentico content management, however Kentico offers out of the box
support for OpenID 2.0 and WS-Federation only (claims based
authentication that is), and their out of the box implementation of
ws-fed appears to be lacking compared to OpenID 2.0.?
> Regards,
> Peter
> 
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160728/34bff35b/attachment.html 

From bruno at abstractj.org  Thu Jul 28 16:37:20 2016
From: bruno at abstractj.org (Bruno Oliveira)
Date: Thu, 28 Jul 2016 17:37:20 -0300
Subject: [keycloak-user] Customize Themes by Client
In-Reply-To: <CA+z0A8ACoDdoQAbdf7ZMb1-abSNw1We+pKPpvnzSb7JsqNtrhQ@mail.gmail.com>
References: <CA+z0A8DhbZBT9rmqwaP4qMSawRqbOx6f4sVczVia2aAs=-PSKQ@mail.gmail.com>
	<20160728163603.GA16955@abstractj.org>
	<CA+z0A8ACoDdoQAbdf7ZMb1-abSNw1We+pKPpvnzSb7JsqNtrhQ@mail.gmail.com>
Message-ID: <20160728203720.GA23642@abstractj.org>

Hi Josh, some answers inline.

On 2016-07-28, Josh Cain wrote:
> Bruno,
>
> Thanks for the link!  Wasn't on this list when it was discussed.  So if I
> understand the thread correctly:
>
>    - This feature has already been given a 'No' response by the Keycloak
>    team.

I'd say yes/no. From what I understood on that thread Stian suggested to
expose a theme SPI. Which gives more flexibility.

>    - Best way to implement client-specific theme functionality, as per the
>    thread, is to use the client variable + conditionals in the template to
>    change how a page renders.

At the moment yes, you are correct.

>
> I'm a bit disappointed - I also have this requirement.  Don't want to go
> back through and re-hash the reasons why (most were already covered on the
> previous thread), but a client config for a theme would be immensely
> helpful.
>
> As a side note, I'll be doing the work to either a) provide a mechanism for
> clients to arbitrarily theme the login template, or b) allow clients to
> select a login theme in Keycloak proper.  I'd much prefer b), but it looks
> like a) might be my only option...

Wouldn't the theme SPI sufficient for your use cases? If yes, I'd
suggest to file a Jira and maybe start a thread at keycloak-dev. Stian
is not here and I cannot speak on his behalf. But based on that thread
I believe that having a theme SPI is a fair request.

>
>
> Josh Cain | Software Applications Engineer
> *Identity and Access Management*
> *Red Hat*
> +1 843-737-1735
>
> On Thu, Jul 28, 2016 at 11:36 AM, Bruno Oliveira <bruno at abstractj.org>
> wrote:
>
> > Hi Josh, there was a discussion about it here[1].
> >
> > [1] -
> > http://lists.jboss.org/pipermail/keycloak-user/2016-January/004288.html
> >
> > On 2016-07-28, Josh Cain wrote:
> > > Hi All,
> > >
> > > I've got some SP's that want the ability to customize the look/feel of
> > the
> > > login page.  Couldn't find anything on the docs/jira site, but was
> > curious
> > > as to whether:
> > >
> > >    - Keycloak currently supports login themes by client
> > >    - If not, would the team be open to such a feature?
> > >
> > >
> > > Josh Cain | Software Applications Engineer
> > > *Identity and Access Management*
> > > *Red Hat*
> > > +1 843-737-1735
> >
> > > _______________________________________________
> > > keycloak-user mailing list
> > > keycloak-user at lists.jboss.org
> > > https://lists.jboss.org/mailman/listinfo/keycloak-user
> >
> >
> > --
> >
> > abstractj
> > PGP: 0x84DC9914
> >

--

abstractj
PGP: 0x84DC9914

From josh.cain at redhat.com  Thu Jul 28 16:53:13 2016
From: josh.cain at redhat.com (Josh Cain)
Date: Thu, 28 Jul 2016 15:53:13 -0500
Subject: [keycloak-user] Customize Themes by Client
In-Reply-To: <20160728203720.GA23642@abstractj.org>
References: <CA+z0A8DhbZBT9rmqwaP4qMSawRqbOx6f4sVczVia2aAs=-PSKQ@mail.gmail.com>
	<20160728163603.GA16955@abstractj.org>
	<CA+z0A8ACoDdoQAbdf7ZMb1-abSNw1We+pKPpvnzSb7JsqNtrhQ@mail.gmail.com>
	<20160728203720.GA23642@abstractj.org>
Message-ID: <CA+z0A8ANJ_=M9B8QMhU06OvnawNzcgzteOtsTSbuCWTqVm9CaQ@mail.gmail.com>

Sounds good!  KEYCLOAK-3370 filed, the only thing I think we might have to
discuss is how configuration of said SPI extension would work.  We're
trying to keep out-of-band configs to a minimum, and something like an SPI
would still have to be configured against clients in any particular realm,
which would make the GUI seem like an appropriate choice for the
configuration (IMO anyway).

I'll take the discussion there, thanks for pointing me in the right
direction.


Josh Cain | Software Applications Engineer
*Identity and Access Management*
*Red Hat*
+1 843-737-1735

On Thu, Jul 28, 2016 at 3:37 PM, Bruno Oliveira <bruno at abstractj.org> wrote:

> Hi Josh, some answers inline.
>
> On 2016-07-28, Josh Cain wrote:
> > Bruno,
> >
> > Thanks for the link!  Wasn't on this list when it was discussed.  So if I
> > understand the thread correctly:
> >
> >    - This feature has already been given a 'No' response by the Keycloak
> >    team.
>
> I'd say yes/no. From what I understood on that thread Stian suggested to
> expose a theme SPI. Which gives more flexibility.
>
> >    - Best way to implement client-specific theme functionality, as per
> the
> >    thread, is to use the client variable + conditionals in the template
> to
> >    change how a page renders.
>
> At the moment yes, you are correct.
>
> >
> > I'm a bit disappointed - I also have this requirement.  Don't want to go
> > back through and re-hash the reasons why (most were already covered on
> the
> > previous thread), but a client config for a theme would be immensely
> > helpful.
> >
> > As a side note, I'll be doing the work to either a) provide a mechanism
> for
> > clients to arbitrarily theme the login template, or b) allow clients to
> > select a login theme in Keycloak proper.  I'd much prefer b), but it
> looks
> > like a) might be my only option...
>
> Wouldn't the theme SPI sufficient for your use cases? If yes, I'd
> suggest to file a Jira and maybe start a thread at keycloak-dev. Stian
> is not here and I cannot speak on his behalf. But based on that thread
> I believe that having a theme SPI is a fair request.
>
> >
> >
> > Josh Cain | Software Applications Engineer
> > *Identity and Access Management*
> > *Red Hat*
> > +1 843-737-1735
> >
> > On Thu, Jul 28, 2016 at 11:36 AM, Bruno Oliveira <bruno at abstractj.org>
> > wrote:
> >
> > > Hi Josh, there was a discussion about it here[1].
> > >
> > > [1] -
> > >
> http://lists.jboss.org/pipermail/keycloak-user/2016-January/004288.html
> > >
> > > On 2016-07-28, Josh Cain wrote:
> > > > Hi All,
> > > >
> > > > I've got some SP's that want the ability to customize the look/feel
> of
> > > the
> > > > login page.  Couldn't find anything on the docs/jira site, but was
> > > curious
> > > > as to whether:
> > > >
> > > >    - Keycloak currently supports login themes by client
> > > >    - If not, would the team be open to such a feature?
> > > >
> > > >
> > > > Josh Cain | Software Applications Engineer
> > > > *Identity and Access Management*
> > > > *Red Hat*
> > > > +1 843-737-1735
> > >
> > > > _______________________________________________
> > > > keycloak-user mailing list
> > > > keycloak-user at lists.jboss.org
> > > > https://lists.jboss.org/mailman/listinfo/keycloak-user
> > >
> > >
> > > --
> > >
> > > abstractj
> > > PGP: 0x84DC9914
> > >
>
> --
>
> abstractj
> PGP: 0x84DC9914
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160728/be674930/attachment.html 

From Mohan.Radhakrishnan at cognizant.com  Fri Jul 29 04:26:13 2016
From: Mohan.Radhakrishnan at cognizant.com (Mohan.Radhakrishnan at cognizant.com)
Date: Fri, 29 Jul 2016 08:26:13 +0000
Subject: [keycloak-user] Implicit flow test
Message-ID: <E1B160F4999FD6449524E16C2CB94E030798AB0F@CTSINCHNSXMBE.cts.com>

Hi,

I am using keycloak-2.0.0.Final standalone server and I have enabled 'Implicit'

http://localhost:8080/auth/realms/Pearson/protocol/openid-connect/auth?response_type=id_token&redirect_uri=http://localhost:8000/keycloak/greeting/&realm=Pearson&client_id=Pearson&scope=user

The URL shown above shows me the login page and redirects after obtaining the id_token and I get the proper output in the  b rowser.

http://localhost:8000/keycloak/greeting/#id_token=eyJhbGciOiJSUzI1NiJ9.eyJqdGkiOiTc3NjM2ZS1lOWI0LTRhOGQtOTZiOS0yNTQ5NDc5ZjZmZWQiLCJleHAiOjE0Njk3ODEwODMsIm5iZiI6MCwiaWF0IjoxNDY5NzgwMTgzLCJpc3MiOiJodHRwOi8vbG9jYWxob3N0OjgwODAvYXV0aC9yZWFsbXMvUGVhcnNvbiIsImF1ZCI6IlBlYXJzb24iLCJzdWIiOiJmMTQ1ZmRhZi00Yzk4LTQ2OGYtYmRkOC0yYTM3ZTFlMzViYjgiLCJ0eXAiOiJJRCIsImF6cCI6IlBlYXJzb24iLCJzZXNzaW9uX3N0YXRlIjoiZmNmNTNiN2ItNDUzNi00MjRhLTk0OWItYmZiZmQ4NzQ2N2FmIiwibmFtZSI6IiIsInByZWZlcnJlZF91c2VybmFtZSI6ImFkbWluIn0.OmtVkjW8gGxMpbkH1LIL6rd97J7BYza5BETp86R4t_hM826rCgOpVbH4O9ZLqJ6TsnYlKOHpsU3N1Nu-vrQuwfI1gTgR3ulDHyg1PJbv-Q9hgycT2nQC-3uLW3i5nzaXEWQDsCVqe1kJHMq-UcwgshGyu7rKSxyLFOZDBRLmLDL1-vOsUk4-bRe6ulC9QL3cCqvNh8X8rzxEtTPc9LihNpphcURYW5-5r7oVFSA2-RaKbhMwsDEtZVZAbPH2HqQM17poPEJFKPwFhmH8RivMuX7x_ThwYc0VimPUSBIi0O4mQ9Kl3kb-wanj01jzelzR8LrTFZbRaMUig8o-FwvhjA&not-before-policy=0

My filter configuration is this.

    @Bean
    public FilterRegistrationBean someFilterRegistration() {

        FilterRegistrationBean registration = new FilterRegistrationBean();
        registration.setFilter(keycloakOIDCFilter());
        registration.addUrlPatterns("/keycloak/*");
        registration.addInitParameter("keycloak.config.file", "D:/OpenIDM/keycloak.json");
        registration.setName("keycloakOIDCFilter");
        registration.setOrder(1);
        return registration;
    }

Is the id_token getting validated by the filter ? How do I know that it is ? Have I misunderstood the validation ? Logging for the filter or keycloak should be enabled. How ?

Thanks,
Mohan
This e-mail and any files transmitted with it are for the sole use of the intended recipient(s) and may contain confidential and privileged information. If you are not the intended recipient(s), please reply to the sender and destroy all copies of the original message. Any unauthorized review, use, disclosure, dissemination, forwarding, printing or copying of this email, and/or any action taken in reliance on the contents of this e-mail is strictly prohibited and may be unlawful. Where permitted by applicable law, this e-mail and other e-mail communications sent to and from Cognizant e-mail addresses may be monitored.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160729/450ef5d1/attachment-0001.html 

From bvs78 at rediffmail.com  Fri Jul 29 06:51:09 2016
From: bvs78 at rediffmail.com (Subrahmanyam BV)
Date: 29 Jul 2016 10:51:09 -0000
Subject: [keycloak-user] =?utf-8?q?Multi_tenancy_-Groups?=
Message-ID: <20160729105109.30817.qmail@f4mail-235-117.rediffmail.com>

Hi,&nbsp; &nbsp; Here are few questions regarding Groups and multi tenancy approaches.
&nbsp; 1. &nbsp;Assuming a scenario where one client (application) in keycloak to be accessible by couple of customers (customer 1 and customer 2). Then what is the possible approaches.
&nbsp; &nbsp; 2. Can I have one realm per customer, in this case the client has to be duplicated against per realm and Keycloak.json file has to be updated every time when a new customer comes in.
&nbsp; &nbsp; 3. If we have one realm and a group per customer, then I should be able to restrict the access (user management) per group.


Please suggest on this.

Regards,Subrahmanyam.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160729/17741787/attachment.html 

From Mohan.Radhakrishnan at cognizant.com  Fri Jul 29 07:28:18 2016
From: Mohan.Radhakrishnan at cognizant.com (Mohan.Radhakrishnan at cognizant.com)
Date: Fri, 29 Jul 2016 11:28:18 +0000
Subject: [keycloak-user] Implicit flow test
Message-ID: <E1B160F4999FD6449524E16C2CB94E030798ABE1@CTSINCHNSXMBE.cts.com>

The messages that I see in the command-line are these.

If I comment

registration.addInitParameter("keycloak.config.file", "D:/OpenIDM/keycloak.json");

I see

15:13:03,404 WARN  [org.keycloak.events] (default task-48) type=LOGIN_ERROR, rea
lmId=master, clientId=null, userId=null, ipAddress=127.0.0.1, error=invalid_code

If I don't comment that line I see this. I am assuming in this case the filter is validating but don't know what this means.

13:37:34,896 WARN  [org.keycloak.events] (default task-38) type=REFRESH_TOKEN_ER
ROR, realmId=master, clientId=Pearson, userId=f145fdaf-4c98-468f-bdd8-2a37e1e35b
b8, ipAddress=127.0.0.1, error=invalid_token, grant_type=refresh_token, refresh_
token_type=Refresh, refresh_token_id=48565291-f694-4961-8bc5-8f36910de464, clien
t_auth_method=client-secret

Thanks,
Mohan
From: Radhakrishnan, Mohan (Cognizant)
Sent: Friday, July 29, 2016 1:56 PM
To: 'keycloak-user at lists.jboss.org' <keycloak-user at lists.jboss.org>
Subject: Implicit flow test

Hi,

I am using keycloak-2.0.0.Final standalone server and I have enabled 'Implicit'

http://localhost:8080/auth/realms/Pearson/protocol/openid-connect/auth?response_type=id_token&redirect_uri=http://localhost:8000/keycloak/greeting/&realm=Pearson&client_id=Pearson&scope=user

The URL shown above shows me the login page and redirects after obtaining the id_token and I get the proper output in the  b rowser.

http://localhost:8000/keycloak/greeting/#id_token=eyJhbGciOiJSUzI1NiJ9.eyJqdGkiOiTc3NjM2ZS1lOWI0LTRhOGQtOTZiOS0yNTQ5NDc5ZjZmZWQiLCJleHAiOjE0Njk3ODEwODMsIm5iZiI6MCwiaWF0IjoxNDY5NzgwMTgzLCJpc3MiOiJodHRwOi8vbG9jYWxob3N0OjgwODAvYXV0aC9yZWFsbXMvUGVhcnNvbiIsImF1ZCI6IlBlYXJzb24iLCJzdWIiOiJmMTQ1ZmRhZi00Yzk4LTQ2OGYtYmRkOC0yYTM3ZTFlMzViYjgiLCJ0eXAiOiJJRCIsImF6cCI6IlBlYXJzb24iLCJzZXNzaW9uX3N0YXRlIjoiZmNmNTNiN2ItNDUzNi00MjRhLTk0OWItYmZiZmQ4NzQ2N2FmIiwibmFtZSI6IiIsInByZWZlcnJlZF91c2VybmFtZSI6ImFkbWluIn0.OmtVkjW8gGxMpbkH1LIL6rd97J7BYza5BETp86R4t_hM826rCgOpVbH4O9ZLqJ6TsnYlKOHpsU3N1Nu-vrQuwfI1gTgR3ulDHyg1PJbv-Q9hgycT2nQC-3uLW3i5nzaXEWQDsCVqe1kJHMq-UcwgshGyu7rKSxyLFOZDBRLmLDL1-vOsUk4-bRe6ulC9QL3cCqvNh8X8rzxEtTPc9LihNpphcURYW5-5r7oVFSA2-RaKbhMwsDEtZVZAbPH2HqQM17poPEJFKPwFhmH8RivMuX7x_ThwYc0VimPUSBIi0O4mQ9Kl3kb-wanj01jzelzR8LrTFZbRaMUig8o-FwvhjA&not-before-policy=0

My filter configuration is this.

    @Bean
    public FilterRegistrationBean someFilterRegistration() {

        FilterRegistrationBean registration = new FilterRegistrationBean();
        registration.setFilter(keycloakOIDCFilter());
        registration.addUrlPatterns("/keycloak/*");
        registration.addInitParameter("keycloak.config.file", "D:/OpenIDM/keycloak.json");
        registration.setName("keycloakOIDCFilter");
        registration.setOrder(1);
        return registration;
    }

Is the id_token getting validated by the filter ? How do I know that it is ? Have I misunderstood the validation ? Logging for the filter or keycloak should be enabled. How ?

Thanks,
Mohan
This e-mail and any files transmitted with it are for the sole use of the intended recipient(s) and may contain confidential and privileged information. If you are not the intended recipient(s), please reply to the sender and destroy all copies of the original message. Any unauthorized review, use, disclosure, dissemination, forwarding, printing or copying of this email, and/or any action taken in reliance on the contents of this e-mail is strictly prohibited and may be unlawful. Where permitted by applicable law, this e-mail and other e-mail communications sent to and from Cognizant e-mail addresses may be monitored.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160729/21fcc5e3/attachment.html 

From Mohan.Radhakrishnan at cognizant.com  Fri Jul 29 09:18:50 2016
From: Mohan.Radhakrishnan at cognizant.com (Mohan.Radhakrishnan at cognizant.com)
Date: Fri, 29 Jul 2016 13:18:50 +0000
Subject: [keycloak-user] OIDCFilterSessionStore
Message-ID: <E1B160F4999FD6449524E16C2CB94E030798AC77@CTSINCHNSXMBE.cts.com>

Hi,
            I have some doubts. I am using spring boot. The servlet filter adapter actually uses sessions. Is that right ? I was thinking the token will be required for every Rest endpoint access. But unless I clear jsessionid it is not required. Have I understood this correctly ?

How do I get the claims from my implicit token ? Do I need the spring boot adapter ? Can I see an example combining implicit token and boot adapter ?

Thanks,
Mohan
This e-mail and any files transmitted with it are for the sole use of the intended recipient(s) and may contain confidential and privileged information. If you are not the intended recipient(s), please reply to the sender and destroy all copies of the original message. Any unauthorized review, use, disclosure, dissemination, forwarding, printing or copying of this email, and/or any action taken in reliance on the contents of this e-mail is strictly prohibited and may be unlawful. Where permitted by applicable law, this e-mail and other e-mail communications sent to and from Cognizant e-mail addresses may be monitored.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160729/57efcf8b/attachment.html 

From vineet.reynolds at gmail.com  Fri Jul 29 11:01:35 2016
From: vineet.reynolds at gmail.com (Vineet Reynolds)
Date: Fri, 29 Jul 2016 20:31:35 +0530
Subject: [keycloak-user] Support for transactional email providers like
 SendGrid, Mailgun or Mandrill
In-Reply-To: <20160727152350.GA9040@abstractj.org>
References: <CAONaNYL3HCiRJJKBDMc2xUUBOqv74tsP3s+aDBWRZ-h5=L2LVw@mail.gmail.com>
	<20160727152350.GA9040@abstractj.org>
Message-ID: <CAONaNYKxMd3bMqJEUp9Ct_L8kR3h4X6OGZtuPX2ijkqd_zXDEA@mail.gmail.com>

Thanks Bruno. I got this working with SendGrid. The issue was with the SPI
provider registration.

On Wed, Jul 27, 2016 at 8:53 PM, Bruno Oliveira <bruno at abstractj.org> wrote:

> Maybe you can get some ideas from DefaultEmailSenderProvider[1]?
>
> [1] -
> https://github.com/keycloak/keycloak/blob/master/services/src/main/java/org/keycloak/email/DefaultEmailSenderProvider.java
>
> On 2016-07-25, Vineet Reynolds wrote:
> > Hi everybody,
> >
> >     Has anyone managed to configure Keycloak 2.0.0.Final to use a
> > transactional email API instead of configuring an SMTP server? I would
> > prefer to have Keycloak send emails using a rest API like Sendgrid,
> > Mandrill, Mailgun or Amazon SES (the cloud-native way) instead of running
> > an SMTP server.
> >
> >    I'd also appreciate if this is possible through the SPI providers.
> >
> >    * Should I implement both EmailSenderProvider and
> EmailTemplateProvider
> > SPIs ?
> >    * I cannot get my custom EmailSenderProvider SPI implementation to
> work,
> > as the FreemarkerEmailTemplateProvider implementation fails to obtain the
> > implementation of the EmailSenderProvider. Stack trace is below
> >
> > 13:17:53,991 ERROR
> > [org.keycloak.forms.login.freemarker.FreeMarkerLoginFormsProvider]
> (default
> > task-39) Failed to send verification email:
> > org.keycloak.email.EmailException: Failed to template email
> > at
> >
> org.keycloak.email.freemarker.FreeMarkerEmailTemplateProvider.send(FreeMarkerEmailTemplateProvider.java:179)
> > at
> >
> org.keycloak.email.freemarker.FreeMarkerEmailTemplateProvider.send(FreeMarkerEmailTemplateProvider.java:150)
> > at
> >
> org.keycloak.email.freemarker.FreeMarkerEmailTemplateProvider.sendVerifyEmail(FreeMarkerEmailTemplateProvider.java:146)
> > at
> >
> org.keycloak.forms.login.freemarker.FreeMarkerLoginFormsProvider.createResponse(FreeMarkerLoginFormsProvider.java:156)
> > at
> >
> org.keycloak.authentication.requiredactions.VerifyEmail.requiredActionChallenge(VerifyEmail.java:73)
> > at
> >
> org.keycloak.services.managers.AuthenticationManager.executionActions(AuthenticationManager.java:559)
> > at
> >
> org.keycloak.services.managers.AuthenticationManager.actionRequired(AuthenticationManager.java:490)
> > at
> >
> org.keycloak.services.managers.AuthenticationManager.nextActionAfterAuthentication(AuthenticationManager.java:412)
> > at
> >
> org.keycloak.services.resources.LoginActionsService$Checks.verifyRequiredAction(LoginActionsService.java:299)
> > at
> >
> org.keycloak.services.resources.LoginActionsService.processRequireAction(LoginActionsService.java:853)
> > at
> >
> org.keycloak.services.resources.LoginActionsService.requiredActionGET(LoginActionsService.java:846)
> > at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
> > at
> >
> sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
> > at
> >
> sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
> > at java.lang.reflect.Method.invoke(Method.java:498)
> > at
> >
> org.jboss.resteasy.core.MethodInjectorImpl.invoke(MethodInjectorImpl.java:139)
> > at
> >
> org.jboss.resteasy.core.ResourceMethodInvoker.invokeOnTarget(ResourceMethodInvoker.java:295)
> > at
> >
> org.jboss.resteasy.core.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:249)
> > at
> >
> org.jboss.resteasy.core.ResourceLocatorInvoker.invokeOnTargetObject(ResourceLocatorInvoker.java:138)
> > at
> >
> org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorInvoker.java:101)
> > at
> >
> org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:395)
> > at
> >
> org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:202)
> > at
> >
> org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.service(ServletContainerDispatcher.java:221)
> > at
> >
> org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:56)
> > at
> >
> org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:51)
> > at javax.servlet.http.HttpServlet.service(HttpServlet.java:790)
> > at
> >
> io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:85)
> > at
> >
> io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:129)
> > at
> >
> org.keycloak.services.filters.KeycloakSessionServletFilter.doFilter(KeycloakSessionServletFilter.java:90)
> > at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:60)
> > at
> >
> io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
> > at
> >
> io.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.java:84)
> > at
> >
> io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:62)
> > at
> >
> io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36)
> > at
> >
> org.wildfly.extension.undertow.security.SecurityContextAssociationHandler.handleRequest(SecurityContextAssociationHandler.java:78)
> > at
> >
> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
> > at
> >
> io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:131)
> > at
> >
> io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:57)
> > at
> >
> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
> > at
> >
> io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:46)
> > at
> >
> io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64)
> > at
> >
> io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:60)
> > at
> >
> io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:77)
> > at
> >
> io.undertow.security.handlers.NotificationReceiverHandler.handleRequest(NotificationReceiverHandler.java:50)
> > at
> >
> io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43)
> > at
> >
> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
> > at
> >
> org.wildfly.extension.undertow.security.jacc.JACCContextIdHandler.handleRequest(JACCContextIdHandler.java:61)
> > at
> >
> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
> > at
> >
> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
> > at
> >
> io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:284)
> > at
> >
> io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:263)
> > at
> >
> io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:81)
> > at
> >
> io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:174)
> > at io.undertow.server.Connectors.executeRootHandler(Connectors.java:202)
> > at
> io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:793)
> > at
> >
> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
> > at
> >
> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
> > at java.lang.Thread.run(Thread.java:745)
> > Caused by: java.lang.NullPointerException
> > at
> >
> org.keycloak.email.freemarker.FreeMarkerEmailTemplateProvider.send(FreeMarkerEmailTemplateProvider.java:185)
> > at
> >
> org.keycloak.email.freemarker.FreeMarkerEmailTemplateProvider.send(FreeMarkerEmailTemplateProvider.java:177)
> > ... 57 more
> >
> >
> >
> > Thanks,
> > Vineet
>
> > _______________________________________________
> > keycloak-user mailing list
> > keycloak-user at lists.jboss.org
> > https://lists.jboss.org/mailman/listinfo/keycloak-user
>
>
> --
>
> abstractj
> PGP: 0x84DC9914
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160729/04142c26/attachment-0001.html 

From lingvisa at gmail.com  Fri Jul 29 14:45:01 2016
From: lingvisa at gmail.com (Martin Min)
Date: Fri, 29 Jul 2016 11:45:01 -0700
Subject: [keycloak-user] Why is the Base URL repeated in client
	configuration?
In-Reply-To: <CAKUZDO5V9a3i-5F16wt3VTR=1PbAfS8RPTCtG0ZdtWky2bMR9w@mail.gmail.com>
References: <CAKUZDO5V9a3i-5F16wt3VTR=1PbAfS8RPTCtG0ZdtWky2bMR9w@mail.gmail.com>
Message-ID: <CAKUZDO6Z5JyrDrb=7_cLFHcYtuRw7vwSqg0yzyC=BFZNnfirww@mail.gmail.com>

Hi, Does anyone have the same issue with me? Thank you.

Martin

On Wed, Jul 27, 2016 at 6:45 PM, Martin Min <lingvisa at gmail.com> wrote:

> Hello, I am configuring a client in the KeyCloak admin console, but am
> having a trouble to create an client to secure. Specifically, The Base URL
> field is wrong (repeated), as I saved in the configuration page.
>
> Please see the two attachments for an illustration of the the issue. This
> looks very weird.
>
> As you can see clearly from keycloak2.png, the base URL i typed is
> repeated, thus invalid.
>
> Thanks for any information that might be helpful.
>
> Martin
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160729/f44fa62f/attachment.html 

From rsang at carelogistics.com  Fri Jul 29 16:23:20 2016
From: rsang at carelogistics.com (Rong Sang (CL-ATL))
Date: Fri, 29 Jul 2016 20:23:20 +0000
Subject: [keycloak-user] How to implement this using Keycloak
Message-ID: <887A447F-BE5D-4CB9-9A58-1A4CA630E68C@carelogistics.com>

Hi all,

I?m doing a POC using Keycloak. The normal authentication/authorization features work well, but I have the following requirement that cannot find a straightforward solution for. I hope some security experts in the mailing list can point me to the right direction.

Here is the requirement. A hospital has multiple units. Users should not have the access to patients in a unit that they are not authorized. I have one service that returns a list of patients across units. What?s the best way to set up authorization for this service?

As I said earlier, I cannot find a feature for me to implement this. Any idea is greatly appreciated.

Thanks,

Rong
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160729/6211fe03/attachment.html 

From bruno at abstractj.org  Fri Jul 29 16:40:14 2016
From: bruno at abstractj.org (Bruno Oliveira)
Date: Fri, 29 Jul 2016 17:40:14 -0300
Subject: [keycloak-user] Why is the Base URL repeated in client
 configuration?
In-Reply-To: <CAKUZDO5V9a3i-5F16wt3VTR=1PbAfS8RPTCtG0ZdtWky2bMR9w@mail.gmail.com>
References: <CAKUZDO5V9a3i-5F16wt3VTR=1PbAfS8RPTCtG0ZdtWky2bMR9w@mail.gmail.com>
Message-ID: <20160729204014.GA8666@abstractj.org>

Hi Martin, you can just /bword/ at the Admin URL or nothing, it depends.
Take a look at our demo distribution[1]. For example, customer-portal.

[1] - http://www.keycloak.org/downloads.html

On 2016-07-27, Martin Min wrote:
> Hello, I am configuring a client in the KeyCloak admin console, but am
> having a trouble to create an client to secure. Specifically, The Base URL
> field is wrong (repeated), as I saved in the configuration page.
>
> Please see the two attachments for an illustration of the the issue. This
> looks very weird.
>
> As you can see clearly from keycloak2.png, the base URL i typed is
> repeated, thus invalid.
>
> Thanks for any information that might be helpful.
>
> Martin



> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user


--

abstractj
PGP: 0x84DC9914

From srossillo at smartling.com  Fri Jul 29 16:57:19 2016
From: srossillo at smartling.com (Scott Rossillo)
Date: Fri, 29 Jul 2016 16:57:19 -0400
Subject: [keycloak-user] OIDCFilterSessionStore
In-Reply-To: <E1B160F4999FD6449524E16C2CB94E030798AC77@CTSINCHNSXMBE.cts.com>
References: <E1B160F4999FD6449524E16C2CB94E030798AC77@CTSINCHNSXMBE.cts.com>
Message-ID: <EA80D434-6B2A-48A9-A856-592B67B8665D@smartling.com>

For your first question, with OIDC there are three types of clients: confidential, public and bearer-only. For simplicity, let?s consider confidential, public as applications that you log into, for example, an e-commerce website. These applications have a session which stores the access token, ID token, and refresh token. When a request comes into the website the application, the session ID is used to establish who you are. This could mean making your OIDC tokens accessible to server side code.

A bearer-only application does not use sessions. It expects the OIDC access token to be sent in the authorization HTTP header on every request. It is a stateless application. Continuing your example, let?s say your e-commerce website needs to call a service that provides up to date inventory information when a user adds an item to cart. This can be a stateless service but wants to know what user is requesting inventory. The e-commerce website could retrieve the access token from the session and query the bearer-only application.

This is just one example, and a bit of an oversimplification of the things a confidential and public client can do. However, the point I?m trying to make is that by defining a client as bearer-only you are essentially saying it?s a stateless service that requires an OIDC access token on every request.

Scott Rossillo
Smartling | Senior Software Engineer
srossillo at smartling.com

> On Jul 29, 2016, at 9:18 AM, Mohan.Radhakrishnan at cognizant.com wrote:
> 
> Hi,
>             I have some doubts. I am using spring boot. The servlet filter adapter actually uses sessions. Is that right ? I was thinking the token will be required for every Rest endpoint access. But unless I clear jsessionid it is not required. Have I understood this correctly ?
>  
> How do I get the claims from my implicit token ? Do I need the spring boot adapter ? Can I see an example combining implicit token and boot adapter ?
>  
> Thanks,
> Mohan
> This e-mail and any files transmitted with it are for the sole use of the intended recipient(s) and may contain confidential and privileged information. If you are not the intended recipient(s), please reply to the sender and destroy all copies of the original message. Any unauthorized review, use, disclosure, dissemination, forwarding, printing or copying of this email, and/or any action taken in reliance on the contents of this e-mail is strictly prohibited and may be unlawful. Where permitted by applicable law, this e-mail and other e-mail communications sent to and from Cognizant e-mail addresses may be monitored. _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org <mailto:keycloak-user at lists.jboss.org>
> https://lists.jboss.org/mailman/listinfo/keycloak-user <https://lists.jboss.org/mailman/listinfo/keycloak-user>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160729/a99d3648/attachment-0001.html 

From rsoares at redhat.com  Fri Jul 29 18:26:05 2016
From: rsoares at redhat.com (Rafael T. C. Soares)
Date: Fri, 29 Jul 2016 19:26:05 -0300
Subject: [keycloak-user] Kerberos keytab in a Clustered KC setup
In-Reply-To: <bd4b56e4-9214-9745-710d-8f4af631ab94@redhat.com>
References: <bd4b56e4-9214-9745-710d-8f4af631ab94@redhat.com>
Message-ID: <1ead9315-9f7e-5a22-e6b7-a973f36a4cef@redhat.com>

Hi!

Just to share with you I applied the approach described in this MIT 
Kerberos admin guide [1]. We used an alias (an "A" DNS record with PTR 
(reverse DNS)) as the Service Principal for our keytab. Actually we used 
the DNS alias created for the front-end apache httpd used as load 
balancer in our KC setup.

[1] */Principal names and DNS/* - 
https://web.mit.edu/kerberos/krb5-1.11/doc/admin/princ_dns.html

___
Rafael T. C. Soares

On 07/26/2016 10:27 PM, Rafael T. C. Soares wrote:
>
> Hi!
>
> How should I generate my Kerberos keytab file to use in a KC clustered 
> domain (multiple hosts)?
> I have to create a keytab for each KC Host? When I create the keytab I 
> have to inform the Service Principal (eg 
> 'HTTP/myhost.example.com at MYDOM.COM'). But how the KC will know which 
> Service Principal it should use if I have different KC instances 
> distributed in different hosts? Is there a way to create a Service 
> Principal on a keytab that serves for the entire cluster regardless 
> the KC host instance?
>
> Thanks in advance?
> -- 
> ___
> Rafael T. C. Soares

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160729/e2415397/attachment.html 

From psilva at redhat.com  Fri Jul 29 19:50:42 2016
From: psilva at redhat.com (Pedro Igor Silva)
Date: Fri, 29 Jul 2016 19:50:42 -0400 (EDT)
Subject: [keycloak-user] How to implement this using Keycloak
In-Reply-To: <887A447F-BE5D-4CB9-9A58-1A4CA630E68C@carelogistics.com>
References: <887A447F-BE5D-4CB9-9A58-1A4CA630E68C@carelogistics.com>
Message-ID: <1036664292.21314157.1469836242636.JavaMail.zimbra@redhat.com>

Hi Rong,

     Can you provide more details about your use case ? For instance:

         * Are you the service owner ?
         * Is your service using a REST-style ? How the API looks like ?
         * Is your service already protected using a bearer token ?
         * How are you representing the user's unit ? Realm, Group, role or just a user claim/attribute ?
         * What is behind: "Users should not have the access to patients in a unit that they are not authorized". What "not authorized" really means ? What kinds of policies you want to apply ?

     From what you described, it seems that you can achieve what you want with different approaches. It all depends on what you really need and how fine-grained you want to be. For instance, units can be represented as groups in Keycloak. You can enforce group membership in your application by introspecting the bearer token (issued by a Keycloak server to some client). The same logic applies if you are using roles or attributes to represent units.

     In 2.0.0.Final, we have introduced Keycloak Authorization Services. This one is related with externalized and fine-grained authorization, which gives you great flexibility to define, manage, deploy and enforce authorization polices to your application and organization. Indeed, one of the protocols we are supporting (not fully, yet), UMA, is pretty much based on several healthcare use cases. For instance, you can manage the policies that apply to patient records in Keycloak and also let Keycloak enforce these policies to requests sent to your application. In this case, you can define not only a "from unit have access" policy, but also apply even more fine-grained policies to your service using the different policy providers (ABAC and Context-based, RBAC, Time-based, Rules-based, User-based, more to come...) we provide. We are still missing some very nice parts of UMA though, as currently we are focusing on API security use cases. But I hope to get those missing parts implemented soon.

Regards.
Pedro Igor
      

----- Original Message -----
From: "Rong Sang (CL-ATL)" <rsang at carelogistics.com>
To: keycloak-user at lists.jboss.org
Sent: Friday, July 29, 2016 5:23:20 PM
Subject: [keycloak-user] How to implement this using Keycloak



Hi all, 



I?m doing a POC using Keycloak. The normal authentication/authorization features work well, but I have the following requirement that cannot find a straightforward solution for. I hope some security experts in the mailing list can point me to the right direction. 



Here is the requirement. A hospital has multiple units. Users should not have the access to patients in a unit that they are not authorized. I have one service that returns a list of patients across units. What?s the best way to set up authorization for this service? 



As I said earlier, I cannot find a feature for me to implement this. Any idea is greatly appreciated. 



Thanks, 



Rong 

_______________________________________________
keycloak-user mailing list
keycloak-user at lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user


From rllavallee at hotmail.com  Fri Jul 29 20:10:06 2016
From: rllavallee at hotmail.com (Richard Lavallee)
Date: Sat, 30 Jul 2016 00:10:06 +0000
Subject: [keycloak-user] Does keycloak configuration support preventing a
 user from double simultaneous sign on?
Message-ID: <BLU181-W4004F32BFD71BB31BE2D14CB020@phx.gbl>

Does keycloak configuration support preventing a user from double simultaneous sign on?
E.g. User A on machine X logs in via Keycloak and same user A on machine B also logs in via Keycloak; both for same Realm.
-Richard 		 	   		  
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160730/23d43fde/attachment.html 

From lingvisa at gmail.com  Fri Jul 29 20:31:21 2016
From: lingvisa at gmail.com (Martin Min)
Date: Fri, 29 Jul 2016 17:31:21 -0700
Subject: [keycloak-user] Why is the Base URL repeated in client
	configuration?
In-Reply-To: <20160729204014.GA8666@abstractj.org>
References: <CAKUZDO5V9a3i-5F16wt3VTR=1PbAfS8RPTCtG0ZdtWky2bMR9w@mail.gmail.com>
	<20160729204014.GA8666@abstractj.org>
Message-ID: <CAKUZDO7S7iJEReSeF3ZTuLV+jPSQ1pxA0VdVR6XpLiSQPfkyTQ@mail.gmail.com>

Hi, Bruno:

I will try the customer-portal demo. I had made these demo working in
keycloak 1.7, but the same way configured in 2.0, it doesn't seem to work.
I need to look at these modified examples. How to delete a realm in
KeyCloak? I wanted to delete the Demo realm I created and just imported the
realm in the examples/ directory for customer-portal. I can't find a place
I can delete a realm in the Admin console.

Thank you.
Martin

On Fri, Jul 29, 2016 at 1:40 PM, Bruno Oliveira <bruno at abstractj.org> wrote:

> Hi Martin, you can just /bword/ at the Admin URL or nothing, it depends.
> Take a look at our demo distribution[1]. For example, customer-portal.
>
> [1] - http://www.keycloak.org/downloads.html
>
> On 2016-07-27, Martin Min wrote:
> > Hello, I am configuring a client in the KeyCloak admin console, but am
> > having a trouble to create an client to secure. Specifically, The Base
> URL
> > field is wrong (repeated), as I saved in the configuration page.
> >
> > Please see the two attachments for an illustration of the the issue. This
> > looks very weird.
> >
> > As you can see clearly from keycloak2.png, the base URL i typed is
> > repeated, thus invalid.
> >
> > Thanks for any information that might be helpful.
> >
> > Martin
>
>
>
> > _______________________________________________
> > keycloak-user mailing list
> > keycloak-user at lists.jboss.org
> > https://lists.jboss.org/mailman/listinfo/keycloak-user
>
>
> --
>
> abstractj
> PGP: 0x84DC9914
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160729/7e4b2bf6/attachment.html 

From traviskds at gmail.com  Fri Jul 29 20:37:02 2016
From: traviskds at gmail.com (Travis De Silva)
Date: Sat, 30 Jul 2016 00:37:02 +0000
Subject: [keycloak-user] How to implement this using Keycloak
In-Reply-To: <1036664292.21314157.1469836242636.JavaMail.zimbra@redhat.com>
References: <887A447F-BE5D-4CB9-9A58-1A4CA630E68C@carelogistics.com>
	<1036664292.21314157.1469836242636.JavaMail.zimbra@redhat.com>
Message-ID: <CACQJ6LQpkxCVh6F48P9db7W_70RjctmouxHckjpgv-hp-im3cQ@mail.gmail.com>

Hi Pedro,

I have just started looking at the Keycloak Authorization Services that was
introduced in 2.0.0.Final.

I too have a similar use case. For example, we have a project management
system where projects belong to a project manager. A project manager can
have more than one project. Each project manager has access to only their
own projects.

Project Managers in turn report to Portfolio Managers. So a Portfolio
Manager should be able to access all his/her project manager's projects.

At the moment, how we handle this is by having a seperate mapping within
the application and since we build/own the applicaiton, we filter out the
JPA query results based on the above rules.BTW, our services are REST based
(i.e. JAX-RS) KeyCloak is essentially used for Authentication via a
federated LDAP/AD provider and we use Keycloak roles to protect the
services/front end screen options.

Are you saying that we can filter the data outside the application via Keycloak
Authorization Services? Maybe I need to start looking at the demo examples
a bit more.

I believe Rong's use case is also the same so hope I have not hijacked this
thread.

Cheers
Travis





On Sat, 30 Jul 2016 at 09:51 Pedro Igor Silva <psilva at redhat.com> wrote:

> Hi Rong,
>
>      Can you provide more details about your use case ? For instance:
>
>          * Are you the service owner ?
>          * Is your service using a REST-style ? How the API looks like ?
>          * Is your service already protected using a bearer token ?
>          * How are you representing the user's unit ? Realm, Group, role
> or just a user claim/attribute ?
>          * What is behind: "Users should not have the access to patients
> in a unit that they are not authorized". What "not authorized" really means
> ? What kinds of policies you want to apply ?
>
>      From what you described, it seems that you can achieve what you want
> with different approaches. It all depends on what you really need and how
> fine-grained you want to be. For instance, units can be represented as
> groups in Keycloak. You can enforce group membership in your application by
> introspecting the bearer token (issued by a Keycloak server to some
> client). The same logic applies if you are using roles or attributes to
> represent units.
>
>      In 2.0.0.Final, we have introduced Keycloak Authorization Services.
> This one is related with externalized and fine-grained authorization, which
> gives you great flexibility to define, manage, deploy and enforce
> authorization polices to your application and organization. Indeed, one of
> the protocols we are supporting (not fully, yet), UMA, is pretty much based
> on several healthcare use cases. For instance, you can manage the policies
> that apply to patient records in Keycloak and also let Keycloak enforce
> these policies to requests sent to your application. In this case, you can
> define not only a "from unit have access" policy, but also apply even more
> fine-grained policies to your service using the different policy providers
> (ABAC and Context-based, RBAC, Time-based, Rules-based, User-based, more to
> come...) we provide. We are still missing some very nice parts of UMA
> though, as currently we are focusing on API security use cases. But I hope
> to get those missing parts implemented soon.
>
> Regards.
> Pedro Igor
>
>
> ----- Original Message -----
> From: "Rong Sang (CL-ATL)" <rsang at carelogistics.com>
> To: keycloak-user at lists.jboss.org
> Sent: Friday, July 29, 2016 5:23:20 PM
> Subject: [keycloak-user] How to implement this using Keycloak
>
>
>
> Hi all,
>
>
>
> I?m doing a POC using Keycloak. The normal authentication/authorization
> features work well, but I have the following requirement that cannot find a
> straightforward solution for. I hope some security experts in the mailing
> list can point me to the right direction.
>
>
>
> Here is the requirement. A hospital has multiple units. Users should not
> have the access to patients in a unit that they are not authorized. I have
> one service that returns a list of patients across units. What?s the best
> way to set up authorization for this service?
>
>
>
> As I said earlier, I cannot find a feature for me to implement this. Any
> idea is greatly appreciated.
>
>
>
> Thanks,
>
>
>
> Rong
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160730/7abb0d5e/attachment-0001.html 

From psilva at redhat.com  Fri Jul 29 21:27:40 2016
From: psilva at redhat.com (Pedro Igor Silva)
Date: Fri, 29 Jul 2016 21:27:40 -0400 (EDT)
Subject: [keycloak-user] How to implement this using Keycloak
In-Reply-To: <CACQJ6LQpkxCVh6F48P9db7W_70RjctmouxHckjpgv-hp-im3cQ@mail.gmail.com>
References: <887A447F-BE5D-4CB9-9A58-1A4CA630E68C@carelogistics.com>
	<1036664292.21314157.1469836242636.JavaMail.zimbra@redhat.com>
	<CACQJ6LQpkxCVh6F48P9db7W_70RjctmouxHckjpgv-hp-im3cQ@mail.gmail.com>
Message-ID: <1573453908.21321793.1469842060259.JavaMail.zimbra@redhat.com>

Hi Travis,

    You are not hijacking anything. And I'm also Silva anyways :) 

    It is pretty much related. Although different use cases. I need to get more input from Rong before going further.

    Regarding your use case, the answer is yes. I think you can address most of these requirements with our authorization services. For instance, projects are *resources* in Keycloak. You may define a resource that represents a set of one or more resources or have resource instances. In this case, resources instances inherit all permissions. You can also override permissions on a resource-basis as well. Eg.: define specific policies for a scope associated with a resource.

    Here resources can be you projects. You application, which is acting as a resource server, is also allowed to manage their own resources in Keycloak using the Protection API. Which basically provides an API to CRUD resources + other things.

    Scopes can be actions that PM, PMOs, etc, can perform on your resources. Here, you can also specify permissions for each scope individually.

    Both resources and scopes are associated with permissions, which define the authorization policies that should be applied in order to GRANT or DENY access. For last, policies represent the conditions that you actually want to enforce. We have a few policy providers that allows you to use ABAC, RBAC, Javascript, JBoss Rules/Drools, Time constraints, Users, etc. The idea is have introduce more in the future. Eg.: XACML, Group-based, etc.

    There is also an evaluation tool that you can use to simulate authorization requests and check how your permissions and policies are being evaluated. Useful when designing your policies, testing or trying to figure out issues.

    Right now, I'm working on a few improvements. If you want to get latest changes (just sent a PR now), please check both upstream doc and code.

Regards.
Pedro Igor

----- Original Message -----
From: "Travis De Silva" <traviskds at gmail.com>
To: "Pedro Igor Silva" <psilva at redhat.com>, "Rong Sang (CL-ATL)" <rsang at carelogistics.com>
Cc: keycloak-user at lists.jboss.org
Sent: Friday, July 29, 2016 9:37:02 PM
Subject: Re: [keycloak-user] How to implement this using Keycloak

Hi Pedro,

I have just started looking at the Keycloak Authorization Services that was
introduced in 2.0.0.Final.

I too have a similar use case. For example, we have a project management
system where projects belong to a project manager. A project manager can
have more than one project. Each project manager has access to only their
own projects.

Project Managers in turn report to Portfolio Managers. So a Portfolio
Manager should be able to access all his/her project manager's projects.

At the moment, how we handle this is by having a seperate mapping within
the application and since we build/own the applicaiton, we filter out the
JPA query results based on the above rules.BTW, our services are REST based
(i.e. JAX-RS) KeyCloak is essentially used for Authentication via a
federated LDAP/AD provider and we use Keycloak roles to protect the
services/front end screen options.

Are you saying that we can filter the data outside the application via Keycloak
Authorization Services? Maybe I need to start looking at the demo examples
a bit more.

I believe Rong's use case is also the same so hope I have not hijacked this
thread.

Cheers
Travis





On Sat, 30 Jul 2016 at 09:51 Pedro Igor Silva <psilva at redhat.com> wrote:

> Hi Rong,
>
>      Can you provide more details about your use case ? For instance:
>
>          * Are you the service owner ?
>          * Is your service using a REST-style ? How the API looks like ?
>          * Is your service already protected using a bearer token ?
>          * How are you representing the user's unit ? Realm, Group, role
> or just a user claim/attribute ?
>          * What is behind: "Users should not have the access to patients
> in a unit that they are not authorized". What "not authorized" really means
> ? What kinds of policies you want to apply ?
>
>      From what you described, it seems that you can achieve what you want
> with different approaches. It all depends on what you really need and how
> fine-grained you want to be. For instance, units can be represented as
> groups in Keycloak. You can enforce group membership in your application by
> introspecting the bearer token (issued by a Keycloak server to some
> client). The same logic applies if you are using roles or attributes to
> represent units.
>
>      In 2.0.0.Final, we have introduced Keycloak Authorization Services.
> This one is related with externalized and fine-grained authorization, which
> gives you great flexibility to define, manage, deploy and enforce
> authorization polices to your application and organization. Indeed, one of
> the protocols we are supporting (not fully, yet), UMA, is pretty much based
> on several healthcare use cases. For instance, you can manage the policies
> that apply to patient records in Keycloak and also let Keycloak enforce
> these policies to requests sent to your application. In this case, you can
> define not only a "from unit have access" policy, but also apply even more
> fine-grained policies to your service using the different policy providers
> (ABAC and Context-based, RBAC, Time-based, Rules-based, User-based, more to
> come...) we provide. We are still missing some very nice parts of UMA
> though, as currently we are focusing on API security use cases. But I hope
> to get those missing parts implemented soon.
>
> Regards.
> Pedro Igor
>
>
> ----- Original Message -----
> From: "Rong Sang (CL-ATL)" <rsang at carelogistics.com>
> To: keycloak-user at lists.jboss.org
> Sent: Friday, July 29, 2016 5:23:20 PM
> Subject: [keycloak-user] How to implement this using Keycloak
>
>
>
> Hi all,
>
>
>
> I?m doing a POC using Keycloak. The normal authentication/authorization
> features work well, but I have the following requirement that cannot find a
> straightforward solution for. I hope some security experts in the mailing
> list can point me to the right direction.
>
>
>
> Here is the requirement. A hospital has multiple units. Users should not
> have the access to patients in a unit that they are not authorized. I have
> one service that returns a list of patients across units. What?s the best
> way to set up authorization for this service?
>
>
>
> As I said earlier, I cannot find a feature for me to implement this. Any
> idea is greatly appreciated.
>
>
>
> Thanks,
>
>
>
> Rong
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user


From traviskds at gmail.com  Fri Jul 29 21:46:49 2016
From: traviskds at gmail.com (Travis De Silva)
Date: Sat, 30 Jul 2016 01:46:49 +0000
Subject: [keycloak-user] How to implement this using Keycloak
In-Reply-To: <1573453908.21321793.1469842060259.JavaMail.zimbra@redhat.com>
References: <887A447F-BE5D-4CB9-9A58-1A4CA630E68C@carelogistics.com>
	<1036664292.21314157.1469836242636.JavaMail.zimbra@redhat.com>
	<CACQJ6LQpkxCVh6F48P9db7W_70RjctmouxHckjpgv-hp-im3cQ@mail.gmail.com>
	<1573453908.21321793.1469842060259.JavaMail.zimbra@redhat.com>
Message-ID: <CACQJ6LR+f11VWmfaq0Hh_KRKT-O8d_A786wMEk5nHrFGZxKpgQ@mail.gmail.com>

Great. Thanks Pedro. Let me give this a go. The authorization was the
missing piece in KeyCloak and if this can fill in that gap, that's great.

On Sat, 30 Jul 2016 at 11:27 Pedro Igor Silva <psilva at redhat.com> wrote:

> Hi Travis,
>
>     You are not hijacking anything. And I'm also Silva anyways :)
>
>     It is pretty much related. Although different use cases. I need to get
> more input from Rong before going further.
>
>     Regarding your use case, the answer is yes. I think you can address
> most of these requirements with our authorization services. For instance,
> projects are *resources* in Keycloak. You may define a resource that
> represents a set of one or more resources or have resource instances. In
> this case, resources instances inherit all permissions. You can also
> override permissions on a resource-basis as well. Eg.: define specific
> policies for a scope associated with a resource.
>
>     Here resources can be you projects. You application, which is acting
> as a resource server, is also allowed to manage their own resources in
> Keycloak using the Protection API. Which basically provides an API to CRUD
> resources + other things.
>
>     Scopes can be actions that PM, PMOs, etc, can perform on your
> resources. Here, you can also specify permissions for each scope
> individually.
>
>     Both resources and scopes are associated with permissions, which
> define the authorization policies that should be applied in order to GRANT
> or DENY access. For last, policies represent the conditions that you
> actually want to enforce. We have a few policy providers that allows you to
> use ABAC, RBAC, Javascript, JBoss Rules/Drools, Time constraints, Users,
> etc. The idea is have introduce more in the future. Eg.: XACML,
> Group-based, etc.
>
>     There is also an evaluation tool that you can use to simulate
> authorization requests and check how your permissions and policies are
> being evaluated. Useful when designing your policies, testing or trying to
> figure out issues.
>
>     Right now, I'm working on a few improvements. If you want to get
> latest changes (just sent a PR now), please check both upstream doc and
> code.
>
> Regards.
> Pedro Igor
>
> ----- Original Message -----
> From: "Travis De Silva" <traviskds at gmail.com>
> To: "Pedro Igor Silva" <psilva at redhat.com>, "Rong Sang (CL-ATL)" <
> rsang at carelogistics.com>
> Cc: keycloak-user at lists.jboss.org
> Sent: Friday, July 29, 2016 9:37:02 PM
> Subject: Re: [keycloak-user] How to implement this using Keycloak
>
> Hi Pedro,
>
> I have just started looking at the Keycloak Authorization Services that was
> introduced in 2.0.0.Final.
>
> I too have a similar use case. For example, we have a project management
> system where projects belong to a project manager. A project manager can
> have more than one project. Each project manager has access to only their
> own projects.
>
> Project Managers in turn report to Portfolio Managers. So a Portfolio
> Manager should be able to access all his/her project manager's projects.
>
> At the moment, how we handle this is by having a seperate mapping within
> the application and since we build/own the applicaiton, we filter out the
> JPA query results based on the above rules.BTW, our services are REST based
> (i.e. JAX-RS) KeyCloak is essentially used for Authentication via a
> federated LDAP/AD provider and we use Keycloak roles to protect the
> services/front end screen options.
>
> Are you saying that we can filter the data outside the application via
> Keycloak
> Authorization Services? Maybe I need to start looking at the demo examples
> a bit more.
>
> I believe Rong's use case is also the same so hope I have not hijacked this
> thread.
>
> Cheers
> Travis
>
>
>
>
>
> On Sat, 30 Jul 2016 at 09:51 Pedro Igor Silva <psilva at redhat.com> wrote:
>
> > Hi Rong,
> >
> >      Can you provide more details about your use case ? For instance:
> >
> >          * Are you the service owner ?
> >          * Is your service using a REST-style ? How the API looks like ?
> >          * Is your service already protected using a bearer token ?
> >          * How are you representing the user's unit ? Realm, Group, role
> > or just a user claim/attribute ?
> >          * What is behind: "Users should not have the access to patients
> > in a unit that they are not authorized". What "not authorized" really
> means
> > ? What kinds of policies you want to apply ?
> >
> >      From what you described, it seems that you can achieve what you want
> > with different approaches. It all depends on what you really need and how
> > fine-grained you want to be. For instance, units can be represented as
> > groups in Keycloak. You can enforce group membership in your application
> by
> > introspecting the bearer token (issued by a Keycloak server to some
> > client). The same logic applies if you are using roles or attributes to
> > represent units.
> >
> >      In 2.0.0.Final, we have introduced Keycloak Authorization Services.
> > This one is related with externalized and fine-grained authorization,
> which
> > gives you great flexibility to define, manage, deploy and enforce
> > authorization polices to your application and organization. Indeed, one
> of
> > the protocols we are supporting (not fully, yet), UMA, is pretty much
> based
> > on several healthcare use cases. For instance, you can manage the
> policies
> > that apply to patient records in Keycloak and also let Keycloak enforce
> > these policies to requests sent to your application. In this case, you
> can
> > define not only a "from unit have access" policy, but also apply even
> more
> > fine-grained policies to your service using the different policy
> providers
> > (ABAC and Context-based, RBAC, Time-based, Rules-based, User-based, more
> to
> > come...) we provide. We are still missing some very nice parts of UMA
> > though, as currently we are focusing on API security use cases. But I
> hope
> > to get those missing parts implemented soon.
> >
> > Regards.
> > Pedro Igor
> >
> >
> > ----- Original Message -----
> > From: "Rong Sang (CL-ATL)" <rsang at carelogistics.com>
> > To: keycloak-user at lists.jboss.org
> > Sent: Friday, July 29, 2016 5:23:20 PM
> > Subject: [keycloak-user] How to implement this using Keycloak
> >
> >
> >
> > Hi all,
> >
> >
> >
> > I?m doing a POC using Keycloak. The normal authentication/authorization
> > features work well, but I have the following requirement that cannot
> find a
> > straightforward solution for. I hope some security experts in the mailing
> > list can point me to the right direction.
> >
> >
> >
> > Here is the requirement. A hospital has multiple units. Users should not
> > have the access to patients in a unit that they are not authorized. I
> have
> > one service that returns a list of patients across units. What?s the best
> > way to set up authorization for this service?
> >
> >
> >
> > As I said earlier, I cannot find a feature for me to implement this. Any
> > idea is greatly appreciated.
> >
> >
> >
> > Thanks,
> >
> >
> >
> > Rong
> >
> > _______________________________________________
> > keycloak-user mailing list
> > keycloak-user at lists.jboss.org
> > https://lists.jboss.org/mailman/listinfo/keycloak-user
> >
> > _______________________________________________
> > keycloak-user mailing list
> > keycloak-user at lists.jboss.org
> > https://lists.jboss.org/mailman/listinfo/keycloak-user
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160730/bb5e1510/attachment.html 

From lingvisa at gmail.com  Sat Jul 30 01:47:29 2016
From: lingvisa at gmail.com (Martin Min)
Date: Fri, 29 Jul 2016 22:47:29 -0700
Subject: [keycloak-user] How to remove a realm in KeyCloak?
Message-ID: <CAKUZDO74p8Tn3Q4dxbJZC5v=MyM5-6Nx=1GGUdmWzPaPxKGXcw@mail.gmail.com>

Is there a way to delete a realm in KeyCloak? In Admin Console, I only see
I can create,but can't delete. Is there a way to do that?

Thank you.

Martin
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160729/a062afd5/attachment-0001.html 

From abhi.raghav007 at gmail.com  Sat Jul 30 01:54:47 2016
From: abhi.raghav007 at gmail.com (abhishek raghav)
Date: Sat, 30 Jul 2016 11:24:47 +0530
Subject: [keycloak-user] How to remove a realm in KeyCloak?
In-Reply-To: <CAKUZDO74p8Tn3Q4dxbJZC5v=MyM5-6Nx=1GGUdmWzPaPxKGXcw@mail.gmail.com>
References: <CAKUZDO74p8Tn3Q4dxbJZC5v=MyM5-6Nx=1GGUdmWzPaPxKGXcw@mail.gmail.com>
Message-ID: <3c2150d3-f67d-43d3-9a24-7d0c5ee0b46b@gmail.com>

There is a recycle bin image just in front of realm name on the admin 
console. Click on that and the realm will be deleted.

Sent using CloudMagic Email 
[https://cloudmagic.com/k/d/mailapp?ct=pi&cv=7.4.15&pv=9.2&source=email_footer_2]
On Sat, Jul 30, 2016 at 11:17 AM, Martin Min <lingvisa at gmail.com> wrote:
Is there a way to delete a realm in KeyCloak? In Admin Console, I only see 
I can create,but can't delete. Is there a way to do that?
Thank you.
Martin
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160730/15deaa2a/attachment.html 

From ushanas.shastri at viteos.com  Sat Jul 30 02:52:01 2016
From: ushanas.shastri at viteos.com (Ushanas Shastri)
Date: Sat, 30 Jul 2016 06:52:01 +0000
Subject: [keycloak-user] Unable to understand authorization/get it to work
Message-ID: <1469861424224.48370@viteos.com>

Hello,


This is my first post on this mailing list, and I've been evaluating Keycloak for a couple of days.


I've been unable to get Authorization to work the way I thought it should. Maybe I've not understood it right, and could do with some help. I am using the builtin Evaluation tool to check.


Here's my scenario:


I have a web based application, where we have typical CRUD operations being performed.


For e.g. the application maintains a list of Source from which we  expect to receive data. Users have the ability to add, edit, view or delete a Source, provided the Sources belong to their Business Unit. Here's what I did in Keycloak.


- Created Source as a resource, with the 4 actions as scopes (add, edit, view and delete).

- Added a Role based Policy to a role called "ViewOnly"

- The ViewOnly role is mapped to users.

- Created a Scope based permission, where View is the only scope on the resource, attached to the ViewOnly policy.



Now, when I use the evaluation tool for scope "View", I get a permit, which is as expected.


I then check the evaluation tool for scope "Delete",  I get a a message "Could not obtain any result for the given authorization request. Check if the provided resource(s) or scope(s) are associated with any policy."  Is this as expected? Isn't this supposed to return a Deny since the Policy Enforcement Mode on the realm  is "Enforcing". Is this just a UI message, indicating the same as a Deny?


Now, I add Delete as a scope to the same permission, and check on Delete scope in the evaluation tool, but I continue to get the same message as above. Shouldn't I be receiving a PERMIT now, as the same permission was modified to include the Delete Scope?


The summary is that if I have more than one scope added to the permission, the evaluation tool returns this message. If I have only one scope in a policy, it works for me.


What am I missing?


Regards, Ushanas.



This message is for the named person's use only. It may contain confidential, proprietary or legally privileged information. No confidentiality or privilege is waived or lost by any mis-transmission. If you receive this message in error, please immediately delete it and all copies of it from your system, destroy any hard copies of it and notify the sender. You must not, directly or indirectly, use, disclose, distribute, print, or copy any part of this message if you are not the intended recipient. Viteos Capital Market Services Ltd.and any of its subsidiaries each reserve the right to monitor all e-mail communications through its networks. Any views expressed in this message are those of the individual sender, except where the message states otherwise and the sender is authorized to state them to be the views of any such entity
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160730/a27473c2/attachment.html 

From Mohan.Radhakrishnan at cognizant.com  Sat Jul 30 10:28:37 2016
From: Mohan.Radhakrishnan at cognizant.com (Mohan.Radhakrishnan at cognizant.com)
Date: Sat, 30 Jul 2016 14:28:37 +0000
Subject: [keycloak-user] OIDCFilterSessionStore
In-Reply-To: <EA80D434-6B2A-48A9-A856-592B67B8665D@smartling.com>
References: <E1B160F4999FD6449524E16C2CB94E030798AC77@CTSINCHNSXMBE.cts.com>,
	<EA80D434-6B2A-48A9-A856-592B67B8665D@smartling.com>
Message-ID: <E1B160F4999FD6449524E16C2CB94E030798AE23@CTSINCHNSXMBE.cts.com>

Earlier we weren't using sessions because our application on Azure had to scale out. So all the requests had to contain an access token so that which node handles those was immaterial. But stateful ecommerce sites may not work with this approach. I think that is what you mean. But this is Rest with sessions ? We had GUID generators to identify the user which was part of the claim.

I used the Implicit flow with an access token issued with an ID token. The client was AngularJS. What is the equivalent configuration for this ?

Now I use this. The response type should be access token ? But that type is not accepted. So I am doing something wrong.

http://localhost:8080/auth/realms/Pearson/protocol/openid-connect/auth?response_type=id_token&redirect_uri=http://localhost:8000/keycloak/claim/&realm=Pearson&client_id=Pearson&scope=user

Moreover the filter validates by contacting the server but I need to introspect and get the claims for the business process.

Thanks,
Mohan
________________________________
From: Scott Rossillo [srossillo at smartling.com]
Sent: Saturday, July 30, 2016 2:27 AM
To: Radhakrishnan, Mohan (Cognizant)
Cc: keycloak-user at lists.jboss.org
Subject: Re: [keycloak-user] OIDCFilterSessionStore

For your first question, with OIDC there are three types of clients: confidential, public and bearer-only. For simplicity, let?s consider confidential, public as applications that you log into, for example, an e-commerce website. These applications have a session which stores the access token, ID token, and refresh token. When a request comes into the website the application, the session ID is used to establish who you are. This could mean making your OIDC tokens accessible to server side code.

A bearer-only application does not use sessions. It expects the OIDC access token to be sent in the authorization HTTP header on every request. It is a stateless application. Continuing your example, let?s say your e-commerce website needs to call a service that provides up to date inventory information when a user adds an item to cart. This can be a stateless service but wants to know what user is requesting inventory. The e-commerce website could retrieve the access token from the session and query the bearer-only application.

This is just one example, and a bit of an oversimplification of the things a confidential and public client can do. However, the point I?m trying to make is that by defining a client as bearer-only you are essentially saying it?s a stateless service that requires an OIDC access token on every request.

Scott Rossillo
Smartling | Senior Software Engineer
srossillo at smartling.com<redir.aspx?REF=j6dPT32YTAtd3OSXUceWIesC4Z0rWEwRl4cn2OAlq5GtXKWOgbjTCAFtYWlsdG86c3Jvc3NpbGxvQHNtYXJ0bGluZy5jb20.>

On Jul 29, 2016, at 9:18 AM, Mohan.Radhakrishnan at cognizant.com<redir.aspx?REF=-W95hPM06aEOGa4PPERHiMKHbaBCpuH6Gz8eh78BrhUQvqeOgbjTCAFtYWlsdG86TW9oYW4uUmFkaGFrcmlzaG5hbkBjb2duaXphbnQuY29t> wrote:

Hi,
            I have some doubts. I am using spring boot. The servlet filter adapter actually uses sessions. Is that right ? I was thinking the token will be required for every Rest endpoint access. But unless I clear jsessionid it is not required. Have I understood this correctly ?

How do I get the claims from my implicit token ? Do I need the spring boot adapter ? Can I see an example combining implicit token and boot adapter ?

Thanks,
Mohan
This e-mail and any files transmitted with it are for the sole use of the intended recipient(s) and may contain confidential and privileged information. If you are not the intended recipient(s), please reply to the sender and destroy all copies of the original message. Any unauthorized review, use, disclosure, dissemination, forwarding, printing or copying of this email, and/or any action taken in reliance on the contents of this e-mail is strictly prohibited and may be unlawful. Where permitted by applicable law, this e-mail and other e-mail communications sent to and from Cognizant e-mail addresses may be monitored. _______________________________________________
keycloak-user mailing list
keycloak-user at lists.jboss.org<redir.aspx?REF=xgJMBDOPiq-hT1VvSfc8rzmjnTzdMdM4kXz3U-Ezg_8QvqeOgbjTCAFtYWlsdG86a2V5Y2xvYWstdXNlckBsaXN0cy5qYm9zcy5vcmc.>
https://lists.jboss.org/mailman/listinfo/keycloak-user<redir.aspx?REF=Xdevq_aDvjYGmmY07NtoNVPhlBs9rx9A1gFtEibGMwQQvqeOgbjTCAFodHRwczovL2xpc3RzLmpib3NzLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2tleWNsb2FrLXVzZXI.>

This e-mail and any files transmitted with it are for the sole use of the intended recipient(s) and may contain confidential and privileged information. If you are not the intended recipient(s), please reply to the sender and destroy all copies of the original message. Any unauthorized review, use, disclosure, dissemination, forwarding, printing or copying of this email, and/or any action taken in reliance on the contents of this e-mail is strictly prohibited and may be unlawful. Where permitted by applicable law, this e-mail and other e-mail communications sent to and from Cognizant e-mail addresses may be monitored.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160730/1a86dd52/attachment-0001.html 

From lingvisa at gmail.com  Sat Jul 30 19:57:08 2016
From: lingvisa at gmail.com (Martin Min)
Date: Sat, 30 Jul 2016 16:57:08 -0700
Subject: [keycloak-user] Failed to run the Customer-portal Demo on two
	machines
Message-ID: <CAKUZDO5eHbppJXtqp5fwop18BcoRk9gbT3J1OJ3NCkPAdcQKrA@mail.gmail.com>

Hi, I can run the preconfigured Customer-portal demo successfully on the
single keycloak-demo-2.0.0.Final distribution by importing the
testrealm.json file to create the realm. Everything works fine.

And also I can run this simple login/logout demo by following this
instruction to install and setup KeyCloak and Wildfly servers separately:

https://keycloak.gitbooks.io/getting-started-tutorials/content/v/2.0/topics/overview.html


However, I failed to run the Customer-Portal demo by trying to set up the
KeyClaok server and Wildfly server separately. It always gives me this
message as I clicked the "Customer Listing
<http://localhost:8080/customer-portal/customers/view.jsp>" link:

http://localhost:8080/auth/realms/demo/protocol/openid-connect/auth?response_type=code&client_id=customer-portal&redirect_uri=http%3A%2F%2Flocalhost%3A8080%2Fcustomer-portal%2Fcustomers%2Fview.jsp&state=2%2Fe8f347bf-dd8c-4c48-a060-0b01d33476db&login=true

I did exactly the same thing as I tested in the KeyCloak-demo distribution
by importing the testrealm.json.

I didn't configure the subsystem section in the Wildfly 10's
standalone.xml, since I believe the "keycloak.json" and "web.xml" in the
application's WEB-INF directory will do the same thing.  I only had this
configured in Wildfly standalone.xml?

<security-domain name="keycloak">
                    <authentication>
                        <login-module
code="org.keycloak.adapters.jboss.KeycloakLoginModule" flag="required"/>
                    </authentication>
                </security-domain>


What am I missing? Thank you for your help to this working. By the way, it
would be really great to have a full tutorial on how to set up the
customer-portal demo  on two separate KeyCloak and Wildfly servers by
configuring both Json and subsystem file.

Thank you for help.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160730/dacd2ed4/attachment.html 

From lingvisa at gmail.com  Sat Jul 30 19:58:54 2016
From: lingvisa at gmail.com (Martin Min)
Date: Sat, 30 Jul 2016 16:58:54 -0700
Subject: [keycloak-user] Failed to run the Customer-portal Demo on two
	machines
In-Reply-To: <CAKUZDO5eHbppJXtqp5fwop18BcoRk9gbT3J1OJ3NCkPAdcQKrA@mail.gmail.com>
References: <CAKUZDO5eHbppJXtqp5fwop18BcoRk9gbT3J1OJ3NCkPAdcQKrA@mail.gmail.com>
Message-ID: <CAKUZDO5mUJ5rzj-rYwaWZfv9mNHpVNbCdZsQ4Tm5JKKHTqFQhQ@mail.gmail.com>

PLEASE: the title of my email above should be renamed to " Failed to run
the Customer-portal Demo on two separate servers, KeyCloak 2.0 and Wildfly
10.0". Not on two machines, but two severs on the same machine. Sorry for
the correction.

On Sat, Jul 30, 2016 at 4:57 PM, Martin Min <lingvisa at gmail.com> wrote:

> Hi, I can run the preconfigured Customer-portal demo successfully on the
> single keycloak-demo-2.0.0.Final distribution by importing the
> testrealm.json file to create the realm. Everything works fine.
>
> And also I can run this simple login/logout demo by following this
> instruction to install and setup KeyCloak and Wildfly servers separately:
>
>
> https://keycloak.gitbooks.io/getting-started-tutorials/content/v/2.0/topics/overview.html
>
>
> However, I failed to run the Customer-Portal demo by trying to set up the
> KeyClaok server and Wildfly server separately. It always gives me this
> message as I clicked the "Customer Listing
> <http://localhost:8080/customer-portal/customers/view.jsp>" link:
>
>
> http://localhost:8080/auth/realms/demo/protocol/openid-connect/auth?response_type=code&client_id=customer-portal&redirect_uri=http%3A%2F%2Flocalhost%3A8080%2Fcustomer-portal%2Fcustomers%2Fview.jsp&state=2%2Fe8f347bf-dd8c-4c48-a060-0b01d33476db&login=true
>
> I did exactly the same thing as I tested in the KeyCloak-demo distribution
> by importing the testrealm.json.
>
> I didn't configure the subsystem section in the Wildfly 10's
> standalone.xml, since I believe the "keycloak.json" and "web.xml" in the
> application's WEB-INF directory will do the same thing.  I only had this
> configured in Wildfly standalone.xml?
>
> <security-domain name="keycloak">
>                     <authentication>
>                         <login-module
> code="org.keycloak.adapters.jboss.KeycloakLoginModule" flag="required"/>
>                     </authentication>
>                 </security-domain>
>
>
> What am I missing? Thank you for your help to this working. By the way, it
> would be really great to have a full tutorial on how to set up the
> customer-portal demo  on two separate KeyCloak and Wildfly servers by
> configuring both Json and subsystem file.
>
> Thank you for help.
>
>
>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160730/7a6a60ff/attachment.html 

From lingvisa at gmail.com  Sun Jul 31 16:48:12 2016
From: lingvisa at gmail.com (Martin Min)
Date: Sun, 31 Jul 2016 13:48:12 -0700
Subject: [keycloak-user] Failed to run the Customer-portal Demo on two
	machines
In-Reply-To: <CAKUZDO5mUJ5rzj-rYwaWZfv9mNHpVNbCdZsQ4Tm5JKKHTqFQhQ@mail.gmail.com>
References: <CAKUZDO5eHbppJXtqp5fwop18BcoRk9gbT3J1OJ3NCkPAdcQKrA@mail.gmail.com>
	<CAKUZDO5mUJ5rzj-rYwaWZfv9mNHpVNbCdZsQ4Tm5JKKHTqFQhQ@mail.gmail.com>
Message-ID: <CAKUZDO6G9Wo=isiKNTGO+o_L6sy_SQ+ud-bGroS05gpYswb-2Q@mail.gmail.com>

After I changed the relative url "/customer-portal" to its full url, "
http://localhost:8080/customer-portal", the customer listing and product
listing functionality works correctly.

However, the remaining problem is, when I click the "log out" link, I
received this error:

http://localhost:8080/auth/realms/demo/protocol/openid-connect/logout?redirect_uri=%2Fcustomer-portal

In view.jsp, the logout code is this:

 String logoutUri =
KeycloakUriBuilder.fromUri("/auth").path(ServiceUrlConstants.TOKEN_SERVICE_LOGOUT_PATH)
            .queryParam("redirect_uri",
"/customer-portal").build("demo").toString();


What could cause this error message?

On Sat, Jul 30, 2016 at 4:58 PM, Martin Min <lingvisa at gmail.com> wrote:

> PLEASE: the title of my email above should be renamed to " Failed to run
> the Customer-portal Demo on two separate servers, KeyCloak 2.0 and Wildfly
> 10.0". Not on two machines, but two severs on the same machine. Sorry for
> the correction.
>
> On Sat, Jul 30, 2016 at 4:57 PM, Martin Min <lingvisa at gmail.com> wrote:
>
>> Hi, I can run the preconfigured Customer-portal demo successfully on the
>> single keycloak-demo-2.0.0.Final distribution by importing the
>> testrealm.json file to create the realm. Everything works fine.
>>
>> And also I can run this simple login/logout demo by following this
>> instruction to install and setup KeyCloak and Wildfly servers separately:
>>
>>
>> https://keycloak.gitbooks.io/getting-started-tutorials/content/v/2.0/topics/overview.html
>>
>>
>> However, I failed to run the Customer-Portal demo by trying to set up the
>> KeyClaok server and Wildfly server separately. It always gives me this
>> message as I clicked the "Customer Listing
>> <http://localhost:8080/customer-portal/customers/view.jsp>" link:
>>
>>
>> http://localhost:8080/auth/realms/demo/protocol/openid-connect/auth?response_type=code&client_id=customer-portal&redirect_uri=http%3A%2F%2Flocalhost%3A8080%2Fcustomer-portal%2Fcustomers%2Fview.jsp&state=2%2Fe8f347bf-dd8c-4c48-a060-0b01d33476db&login=true
>>
>> I did exactly the same thing as I tested in the KeyCloak-demo
>> distribution by importing the testrealm.json.
>>
>> I didn't configure the subsystem section in the Wildfly 10's
>> standalone.xml, since I believe the "keycloak.json" and "web.xml" in the
>> application's WEB-INF directory will do the same thing.  I only had this
>> configured in Wildfly standalone.xml?
>>
>> <security-domain name="keycloak">
>>                     <authentication>
>>                         <login-module
>> code="org.keycloak.adapters.jboss.KeycloakLoginModule" flag="required"/>
>>                     </authentication>
>>                 </security-domain>
>>
>>
>> What am I missing? Thank you for your help to this working. By the way,
>> it would be really great to have a full tutorial on how to set up the
>> customer-portal demo  on two separate KeyCloak and Wildfly servers by
>> configuring both Json and subsystem file.
>>
>> Thank you for help.
>>
>>
>>
>>
>>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160731/ce6247c2/attachment.html