From tahonen at redhat.com  Tue Jan  2 04:27:42 2018
From: tahonen at redhat.com (Tero Ahonen)
Date: Tue, 2 Jan 2018 11:27:42 +0200
Subject: [keycloak-user] Correct Maven dependencies in 3.4.2 Keycloak and
	admin client
Message-ID: <B1A9F545-DAE9-4AE5-ABB3-A6153A05E451@redhat.com>

Hi,

What are correct Maven settings to get keycloak-admin-client working on Wildfly 10

From command line client it works with following below. When using same code in Wildfly with most recent keycloak module execution fails with following 


Caused by: javax.ws.rs.client.ResponseProcessingException: javax.ws.rs.ProcessingException: com.fasterxml.jackson.databind.exc.UnrecognizedPropertyException: Unrecognized field "access_token" (class org.keycloak.representations.AccessTokenResponse), not marked as ignorable (9 known properties: "notBeforePolicy", "otherClaims", "tokenType", "token", "expiresIn", "sessionState", "refreshExpiresIn", "idToken", "refreshToken"])
 at [Source: org.apache.http.conn.EofSensorInputStream at 9d6aba2; line: 1, column: 18] (through reference chain: org.keycloak.representations.AccessTokenResponse["access_token"])
I got that fixed in command line example by changing jackson provider to  resteasy-jackson2-provider

<dependency>
			<groupId>org.keycloak</groupId>
			<artifactId>keycloak-core</artifactId>
			<version>3.4.2.Final</version>
			<scope>provided</scope>
		</dependency>
		<dependency>
			<groupId>org.keycloak</groupId>
			<artifactId>keycloak-adapter-core</artifactId>
			<version>3.4.2.Final</version>
			<scope>provided</scope>
		</dependency>

		<dependency>
			<groupId>org.keycloak</groupId>
			<artifactId>keycloak-common</artifactId>
			<version>3.4.2.Final</version>
		</dependency>
		
		<dependency>
			<groupId>org.keycloak</groupId>
			<artifactId>keycloak-admin-client</artifactId>
			<version>3.4.2.Final</version>

		</dependency>
		<dependency>
			<groupId>org.jboss.resteasy</groupId>
			<artifactId>resteasy-client</artifactId>
			<version>3.0.24.Final</version>
			<scope>provided</scope>
		</dependency>
		<dependency>
			<groupId>org.jboss.resteasy</groupId>
			<artifactId>resteasy-jackson2-provider</artifactId>
			<version>3.0.24.Final</version>
			<scope>provided</scope>
		</dependency>


.t


From K.Buler at adbglobal.com  Tue Jan  2 04:27:48 2018
From: K.Buler at adbglobal.com (Karol Buler)
Date: Tue, 2 Jan 2018 10:27:48 +0100
Subject: [keycloak-user] Problem with Keys
Message-ID: <293eba41-0a7f-a1db-58de-0cd7d5d85e94@adbglobal.com>

Hi Keycloak community!

At the beginning I would wish you a Happy New Year! :)

About the problem... If we run Keycloak as a docker, every time Keycloak
is rebooted the Keys (Realm Setting -> Keys) are generated again. Result
is that each application which use Keycloak's adapter throws "Didn't
find publicKey for specified kid" error. This error occurs because the
Keys are not rotated in right way, and application does not know about
the rotation.

Have you met this problem? What is your workaround? Is it an issue?

Best regards,
Karol

[https://www.adbglobal.com/wp-content/uploads/adb.png]
adbglobal.com<https://www.adbglobal.com>


From hmlnarik at redhat.com  Tue Jan  2 04:52:20 2018
From: hmlnarik at redhat.com (Hynek Mlnarik)
Date: Tue, 2 Jan 2018 10:52:20 +0100
Subject: [keycloak-user] Deadlock Encountered while Trying Keycloak with
 Azure SQL
In-Reply-To: <CAG3o3Y+re8Uf6BgDW_4pGP7QhhWEf11w4zQSbyPASXhXk-VoaA@mail.gmail.com>
References: <CAG3o3Y+re8Uf6BgDW_4pGP7QhhWEf11w4zQSbyPASXhXk-VoaA@mail.gmail.com>
Message-ID: <CAMvXD=FpNrctB1jSvDnUOrgGbbfZ88yGXG+N+AqmKL=xEfaaig@mail.gmail.com>

There are issues with SQL server, tracked in
https://issues.jboss.org/browse/KEYCLOAK-4966

On Tue, Dec 19, 2017 at 11:35 AM, Buddhi Iroshana <gbidsilva at gmail.com>
wrote:

> HI Team,
>
> I am running the community version of Keycloak (version - 2.3.0.Final). I
> am using Azure SQL : https://azure.microsoft.com/
> en-us/services/sql-database
> as the database server for this keycloak instance.
> Keycloak instance is deployed in Azure VM in this scenario.
>
> Keycloak started successfully without any issues with Azure SQL database.
>
> I have a JMeter script which is invoking following two Keycloak's RESTFul
> endpoints with 10 parallel threads (can consider it as 10 different
> clients).
>
> 1. POST auth/admin/realms/iotpdev/users  - User creation
> 2. PUT    auth/admin/realms/iotpdev/users/<USERID>/groups/   - Adding
> users
> to a group
>
> Behaviour:
>
> During the first few invocations, above two endpoints got executed
> successfully without any issue.
> But, after sometime, keycloak was logging some database deadlock exceptions
> in the log file. Stacktrace for this exception is as follows,
>
> ---------------------------------
>
> 2017-12-19T07:13:34.084336783Z [0m [33m07:13:34,079 WARN
> [org.hibernate.engine.jdbc.spi.SqlExceptionHelper] (default task-15) SQL
> Error: 1205, SQLState: 40001
> 2017-12-19T07:13:34.084377183Z [0m [31m07:13:34,080 ERROR
> [org.hibernate.engine.jdbc.spi.SqlExceptionHelper] (default task-15)
> Transaction (Process ID 123) was deadlocked on lock resources with another
> process and has been chosen as the deadlock victim. Rerun the transaction.
> 2017-12-19T07:13:34.116059274Z [0m [31m07:13:34,097 ERROR
> [io.undertow.request] (default task-15) UT005023: Exception handling
> request to /auth/admin/realms/iotpdev/users:
> org.jboss.resteasy.spi.UnhandledException:
> javax.persistence.PersistenceException:
> org.hibernate.exception.LockAcquisitionException: could not execute
> statement
> 2017-12-19T07:13:34.116097074Z at
> org.jboss.resteasy.core.ExceptionHandler.handleApplicationException(
> ExceptionHandler.java:76)
> 2017-12-19T07:13:34.116104774Z at
> org.jboss.resteasy.core.ExceptionHandler.handleException(
> ExceptionHandler.java:212)
> 2017-12-19T07:13:34.116111874Z at
> org.jboss.resteasy.core.SynchronousDispatcher.writeException(
> SynchronousDispatcher.java:168)
> 2017-12-19T07:13:34.116118574Z at
> org.jboss.resteasy.core.SynchronousDispatcher.invoke(
> SynchronousDispatcher.java:411)
> 2017-12-19T07:13:34.116124973Z at
> org.jboss.resteasy.core.SynchronousDispatcher.invoke(
> SynchronousDispatcher.java:202)
> 2017-12-19T07:13:34.116131373Z at
> org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.
> service(ServletContainerDispatcher.java:221)
> 2017-12-19T07:13:34.116137873Z at
> org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(
> HttpServletDispatcher.java:56)
> 2017-12-19T07:13:34.116144673Z at
> org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(
> HttpServletDispatcher.java:51)
> 2017-12-19T07:13:34.116151173Z at
> javax.servlet.http.HttpServlet.service(HttpServlet.java:790)
> 2017-12-19T07:13:34.116157473Z at
> io.undertow.servlet.handlers.ServletHandler.handleRequest(
> ServletHandler.java:85)
> 2017-12-19T07:13:34.116163773Z at
> io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.
> doFilter(FilterHandler.java:129)
> 2017-12-19T07:13:34.116170273Z at
> org.keycloak.services.filters.KeycloakSessionServletFilter.doFilter(
> KeycloakSessionServletFilter.java:90)
> 2017-12-19T07:13:34.116176673Z at
> io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:60)
> 2017-12-19T07:13:34.116183072Z at
> io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.
> doFilter(FilterHandler.java:131)
> 2017-12-19T07:13:34.116189472Z at
> io.undertow.servlet.handlers.FilterHandler.handleRequest(
> FilterHandler.java:84)
> 2017-12-19T07:13:34.116195872Z at
> io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.
> handleRequest(ServletSecurityRoleHandler.java:62)
> 2017-12-19T07:13:34.116202272Z at
> io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(
> ServletDispatchingHandler.java:36)
> 2017-12-19T07:13:34.116210672Z at
> org.wildfly.extension.undertow.security.SecurityContextAssociationHand
> ler.handleRequest(SecurityContextAssociationHandler.java:78)
> 2017-12-19T07:13:34.116233672Z at
> io.undertow.server.handlers.PredicateHandler.handleRequest(
> PredicateHandler.java:43)
> 2017-12-19T07:13:34.116240472Z at
> io.undertow.servlet.handlers.security.SSLInformationAssociationHandl
> er.handleRequest(SSLInformationAssociationHandler.java:131)
> 2017-12-19T07:13:34.116246771Z at
> io.undertow.servlet.handlers.security.ServletAuthenticationCallHandl
> er.handleRequest(ServletAuthenticationCallHandler.java:57)
> 2017-12-19T07:13:34.116253171Z at
> io.undertow.server.handlers.PredicateHandler.handleRequest(
> PredicateHandler.java:43)
> 2017-12-19T07:13:34.116259271Z at
> io.undertow.security.handlers.AbstractConfidentialityHandler
> .handleRequest(AbstractConfidentialityHandler.java:46)
> 2017-12-19T07:13:34.116265471Z at
> io.undertow.servlet.handlers.security.ServletConfidentialityConstrai
> ntHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64)
> 2017-12-19T07:13:34.116271871Z at
> io.undertow.security.handlers.AuthenticationMechanismsHandle
> r.handleRequest(AuthenticationMechanismsHandler.java:60)
> 2017-12-19T07:13:34.116278071Z at
> io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHand
> ler.handleRequest(CachedAuthenticatedSessionHandler.java:77)
> 2017-12-19T07:13:34.116284371Z at
> io.undertow.security.handlers.NotificationReceiverHandler.handleRequest(
> NotificationReceiverHandler.java:50)
> 2017-12-19T07:13:34.116290571Z at
> io.undertow.security.handlers.AbstractSecurityContextAssocia
> tionHandler.handleRequest(AbstractSecurityContextAssocia
> tionHandler.java:43)
> 2017-12-19T07:13:34.116296771Z at
> io.undertow.server.handlers.PredicateHandler.handleRequest(
> PredicateHandler.java:43)
> 2017-12-19T07:13:34.116302871Z at
> org.wildfly.extension.undertow.security.jacc.JACCContextIdHandler.
> handleRequest(JACCContextIdHandler.java:61)
> 2017-12-19T07:13:34.116308970Z at
> io.undertow.server.handlers.PredicateHandler.handleRequest(
> PredicateHandler.java:43)
> 2017-12-19T07:13:34.116315270Z at
> io.undertow.server.handlers.PredicateHandler.handleRequest(
> PredicateHandler.java:43)
> 2017-12-19T07:13:34.116321470Z at
> io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(
> ServletInitialHandler.java:284)
> 2017-12-19T07:13:34.116327670Z at
> io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(
> ServletInitialHandler.java:263)
> 2017-12-19T07:13:34.116333770Z at
> io.undertow.servlet.handlers.ServletInitialHandler.access$
> 000(ServletInitialHandler.java:81)
> 2017-12-19T07:13:34.116339770Z at
> io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(
> ServletInitialHandler.java:174)
> 2017-12-19T07:13:34.116346770Z at
> io.undertow.server.Connectors.executeRootHandler(Connectors.java:202)
> 2017-12-19T07:13:34.116352770Z at
> io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:793)
> 2017-12-19T07:13:34.116358770Z at
> java.util.concurrent.ThreadPoolExecutor.runWorker(
> ThreadPoolExecutor.java:1142)
> 2017-12-19T07:13:34.116364770Z at
> java.util.concurrent.ThreadPoolExecutor$Worker.run(
> ThreadPoolExecutor.java:617)
> 2017-12-19T07:13:34.116375069Z at java.lang.Thread.run(Thread.java:745)
> 2017-12-19T07:13:34.116384569Z Caused by:
> javax.persistence.PersistenceException:
> org.hibernate.exception.LockAcquisitionException: could not execute
> statement
> 2017-12-19T07:13:34.116390969Z at
> org.hibernate.jpa.spi.AbstractEntityManagerImpl.convert(
> AbstractEntityManagerImpl.java:1692)
> 2017-12-19T07:13:34.116397269Z at
> org.hibernate.jpa.spi.AbstractEntityManagerImpl.convert(
> AbstractEntityManagerImpl.java:1602)
> 2017-12-19T07:13:34.116403369Z at
> org.hibernate.jpa.spi.AbstractEntityManagerImpl.throwPersistenceException(
> AbstractEntityManagerImpl.java:1700)
> 2017-12-19T07:13:34.116409469Z at
> org.hibernate.jpa.spi.AbstractQueryImpl.executeUpdate(
> AbstractQueryImpl.java:70)
> 2017-12-19T07:13:34.116415469Z at
> org.keycloak.models.jpa.UserAdapter.removeAttribute(UserAdapter.java:161)
> 2017-12-19T07:13:34.116421469Z at
> org.keycloak.models.jpa.UserAdapter.setAttribute(UserAdapter.java:137)
> 2017-12-19T07:13:34.116427469Z at
> org.keycloak.services.resources.admin.UsersResource.updateUserFromRep(
> UsersResource.java:267)
> 2017-12-19T07:13:34.116433468Z at
> org.keycloak.services.resources.admin.UsersResource.
> createUser(UsersResource.java:216)
> 2017-12-19T07:13:34.116439568Z at
> sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
> 2017-12-19T07:13:34.116445468Z at
> sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:
> 62)
> 2017-12-19T07:13:34.116451368Z at
> sun.reflect.DelegatingMethodAccessorImpl.invoke(
> DelegatingMethodAccessorImpl.java:43)
> 2017-12-19T07:13:34.116457368Z at
> java.lang.reflect.Method.invoke(Method.java:498)
> 2017-12-19T07:13:34.116463168Z at
> org.jboss.resteasy.core.MethodInjectorImpl.invoke(
> MethodInjectorImpl.java:139)
> 2017-12-19T07:13:34.116469168Z at
> org.jboss.resteasy.core.ResourceMethodInvoker.invokeOnTarget(
> ResourceMethodInvoker.java:295)
> 2017-12-19T07:13:34.116475168Z at
> org.jboss.resteasy.core.ResourceMethodInvoker.invoke(
> ResourceMethodInvoker.java:249)
> 2017-12-19T07:13:34.116481268Z at
> org.jboss.resteasy.core.ResourceLocatorInvoker.invokeOnTargetObject(
> ResourceLocatorInvoker.java:138)
> 2017-12-19T07:13:34.116487268Z at
> org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(
> ResourceLocatorInvoker.java:107)
> 2017-12-19T07:13:34.116494767Z at
> org.jboss.resteasy.core.ResourceLocatorInvoker.invokeOnTargetObject(
> ResourceLocatorInvoker.java:133)
> 2017-12-19T07:13:34.116500967Z at
> org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(
> ResourceLocatorInvoker.java:107)
> 2017-12-19T07:13:34.116506967Z at
> org.jboss.resteasy.core.ResourceLocatorInvoker.invokeOnTargetObject(
> ResourceLocatorInvoker.java:133)
> 2017-12-19T07:13:34.116513067Z at
> org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(
> ResourceLocatorInvoker.java:101)
> 2017-12-19T07:13:34.116519067Z at
> org.jboss.resteasy.core.SynchronousDispatcher.invoke(
> SynchronousDispatcher.java:395)
> 2017-12-19T07:13:34.116525067Z ... 37 more
> 2017-12-19T07:13:34.116530767Z Caused by:
> org.hibernate.exception.LockAcquisitionException: could not execute
> statement
> 2017-12-19T07:13:34.116541467Z at
> org.hibernate.exception.internal.SQLStateConversionDelegate.convert(
> SQLStateConversionDelegate.java:123)
> 2017-12-19T07:13:34.116547967Z at
> org.hibernate.exception.internal.StandardSQLExceptionConverter.convert(
> StandardSQLExceptionConverter.java:42)
> 2017-12-19T07:13:34.116554067Z at
> org.hibernate.engine.jdbc.spi.SqlExceptionHelper.convert(
> SqlExceptionHelper.java:109)
> 2017-12-19T07:13:34.116560166Z at
> org.hibernate.engine.jdbc.spi.SqlExceptionHelper.convert(
> SqlExceptionHelper.java:95)
> 2017-12-19T07:13:34.116566166Z at
> org.hibernate.engine.jdbc.internal.ResultSetReturnImpl.executeUpdate(
> ResultSetReturnImpl.java:207)
> 2017-12-19T07:13:34.116572366Z at
> org.hibernate.hql.internal.ast.exec.BasicExecutor.
> doExecute(BasicExecutor.java:91)
> 2017-12-19T07:13:34.116578366Z at
> org.hibernate.hql.internal.ast.exec.BasicExecutor.
> execute(BasicExecutor.java:60)
> 2017-12-19T07:13:34.116584366Z at
> org.hibernate.hql.internal.ast.exec.DeleteExecutor.
> execute(DeleteExecutor.java:111)
> 2017-12-19T07:13:34.116590566Z at
> org.hibernate.hql.internal.ast.QueryTranslatorImpl.executeUpdate(
> QueryTranslatorImpl.java:429)
> 2017-12-19T07:13:34.116596666Z at
> org.hibernate.engine.query.spi.HQLQueryPlan.performExecuteUpdate(
> HQLQueryPlan.java:374)
> 2017-12-19T07:13:34.116602666Z at
> org.hibernate.internal.SessionImpl.executeUpdate(SessionImpl.java:1348)
> 2017-12-19T07:13:34.116608666Z at
> org.hibernate.internal.QueryImpl.executeUpdate(QueryImpl.java:102)
> 2017-12-19T07:13:34.116614666Z at
> org.hibernate.jpa.internal.QueryImpl.internalExecuteUpdate(
> QueryImpl.java:405)
> 2017-12-19T07:13:34.116620665Z at
> org.hibernate.jpa.spi.AbstractQueryImpl.executeUpdate(
> AbstractQueryImpl.java:61)
> 2017-12-19T07:13:34.116626665Z ... 55 more
> 2017-12-19T07:13:34.116632465Z Caused by:
> com.microsoft.sqlserver.jdbc.SQLServerException: Transaction (Process ID
> 123) was deadlocked on lock resources with another process and has been
> chosen as the deadlock victim. Rerun the transaction.
> 2017-12-19T07:13:34.124029047Z at
> com.microsoft.sqlserver.jdbc.SQLServerException.makeFromDatabaseError(
> SQLServerException.java:216)
> 2017-12-19T07:13:34.124058646Z at
> com.microsoft.sqlserver.jdbc.SQLServerStatement.getNextResult(
> SQLServerStatement.java:1515)
> 2017-12-19T07:13:34.124066146Z at
> com.microsoft.sqlserver.jdbc.SQLServerPreparedStatement.
> doExecutePreparedStatement(SQLServerPreparedStatement.java:404)
> 2017-12-19T07:13:34.124082446Z at
> com.microsoft.sqlserver.jdbc.SQLServerPreparedStatement$
> PrepStmtExecCmd.doExecute(SQLServerPreparedStatement.java:350)
> 2017-12-19T07:13:34.124089946Z at
> com.microsoft.sqlserver.jdbc.TDSCommand.execute(IOBuffer.java:5696)
> 2017-12-19T07:13:34.124095946Z at
> com.microsoft.sqlserver.jdbc.SQLServerConnection.executeCommand(
> SQLServerConnection.java:1715)
> 2017-12-19T07:13:34.124102145Z at
> com.microsoft.sqlserver.jdbc.SQLServerStatement.executeCommand(
> SQLServerStatement.java:180)
> 2017-12-19T07:13:34.124108245Z at
> com.microsoft.sqlserver.jdbc.SQLServerStatement.executeStatement(
> SQLServerStatement.java:155)
> 2017-12-19T07:13:34.124126445Z at
> com.microsoft.sqlserver.jdbc.SQLServerPreparedStatement.executeUpdate(
> SQLServerPreparedStatement.java:314)
> 2017-12-19T07:13:34.124133245Z at
> org.jboss.jca.adapters.jdbc.WrappedPreparedStatement.executeUpdate(
> WrappedPreparedStatement.java:537)
> 2017-12-19T07:13:34.124139545Z at
> org.hibernate.engine.jdbc.internal.ResultSetReturnImpl.executeUpdate(
> ResultSetReturnImpl.java:204)
> 2017-12-19T07:13:34.124145745Z ... 64 more
> 2017-12-19T07:13:34.124151645Z
>
> -------------------------
>
> This JMeter script will create 1000 users in 10 threads. So, above user
> creation and adding to group endpoints will be invoked 1000 times each with
> typical TPS of 1 - 2 requests per second.
> When we run JMeter script several times, we can create 1000 users - means,
> when we run JMeter in first round, it will create 300 users approximately
> and other 700 requests will fail due to above deadlock issue, and once we
> run it for the second time it will create another 200 of users and so on...
> (at some point, we will get all 1000 users).
>
> The dialect which I am using for this instance is
> : org.hibernate.dialect.SQLServer2012Dialect
>
> Is there any specific configurations to be done if we are using Azure SQL
> as the database ?
> I am attaching the complete log file herewith.
>
> Appreciate your help on this.
>
>
> Regards,
> Buddhi Iroshana De Silva
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>



-- 

--Hynek

From orivat at janua.fr  Tue Jan  2 09:13:50 2018
From: orivat at janua.fr (Olivier Rivat)
Date: Tue, 2 Jan 2018 15:13:50 +0100
Subject: [keycloak-user] admin user in clustered domain
In-Reply-To: <83245872-feaa-b376-80ea-07eb25d8feb3@janua.fr>
References: <83245872-feaa-b376-80ea-07eb25d8feb3@janua.fr>
Message-ID: <17500e49-e240-d987-51de-71a0ea16eb7b@janua.fr>

Hi,

I am re-sending my email question submitted last week with further 
precisions.

other precision:

-standalone cluster works: both solutions works fine (GUI, CLI)
===============
a) GUI :
I get a boot login screen asking to enter name of administrator we want 
to use, and password

b) Using CLI script:
file keycloak-add-user.json correctly uploaded

Domain cluster:
==========
a) GUI mode:
I never get boot login screen asking to specify the administrator. I get 
immediately a normal login screen
where I am already supposed to know teh admin username

b) CLI Mode:
file keycloak-add-user.json is not uploaded

How is it possible to overcome this ?

Regards,
Olivier


Le 29/12/2017 ? 15:03, Olivier Rivat a ?crit?:
>
> Hi,
>
> I am trying to setup a clustered domain.
> I have been to boot the master and the slave as described in keycloak
>
> But when tring to login, I cannot with user admin.
>
> Troubleshooting I have done so far:
>
> 1) With standalone mode (or standalone cluster mode), first login 
> screen is welcome screen to define teh admini user and password.
>
> With clustered domain, I never obtain this, but a usual login screen, 
> asking for username/password.
> Of course, I cannot answer to this, as the admin as not yet been defined.
>
>
> 2) I have also tried teh script add-user-keycloak.sh
>
>
> bin/add-user-keycloak.sh -r master -u admin6 -p admin6? --domain
> Added 'admin6' to 
> '/home/orivat/rh_test/rh-sso-7.1/domain/configuration/keycloak-add-user.json', 
> restart server to load user
> It creates a file domain/configuration/keycloak-add-user.json, but 
> this file is never upon restart of RH-SSO domain cluster instance 
> (master or slave).
>
> (I have seen equivalent file being loaded, when doing standalone 
> clsueter tests).
>
>
> So my question is very simple:
> Ho is it possibel to get hold of an admin user allowing to connect to 
> the keycloak admin master login screen ?
>
>
> Regards,
>
> Olivier Rivat
>
>
> -- 
>
>
> <http://www.janua.fr/images/logo-big-sans.png><http://www.janua.fr/images/LogoSignature.gif>
>
> 	<http://www.janua.fr/images/6g_top.gif>
> 	
> Olivier Rivat
> CTO
> orivat at janua.fr <mailto:dchikhaoui at janua.fr>
> Gsm: +33(0)682 801 609
> T?l: +33(0)489 829 238
> Fax: +33(0)955 260 370
> http://www.janua.fr <http://www.janua.fr/>
> 	<http://www.janua.fr/images/6g_top.gif>
>
>

-- 


<http://www.janua.fr/images/logo-big-sans.png><http://www.janua.fr/images/LogoSignature.gif>

	<http://www.janua.fr/images/6g_top.gif>
	
Olivier Rivat
CTO
orivat at janua.fr <mailto:dchikhaoui at janua.fr>
Gsm: +33(0)682 801 609
T?l: +33(0)489 829 238
Fax: +33(0)955 260 370
http://www.janua.fr <http://www.janua.fr/>
	<http://www.janua.fr/images/6g_top.gif>



From psilva at redhat.com  Tue Jan  2 09:33:58 2018
From: psilva at redhat.com (Pedro Igor Silva)
Date: Tue, 2 Jan 2018 12:33:58 -0200
Subject: [keycloak-user] SSO on non-protected / public urls
In-Reply-To: <0c18e3d8-a2e6-e5de-8898-46e4f0945791@gmail.com>
References: <0c18e3d8-a2e6-e5de-8898-46e4f0945791@gmail.com>
Message-ID: <CAJrcDBd+enAyVdUy01QzGdLLGf1PEtg+i4+Ckb7EE8VnQO+wqw@mail.gmail.com>

Why do you need to create session when accessing a public resource ?

On Thu, Dec 28, 2017 at 6:01 PM, Michalis Siochos <msiochos at gmail.com>
wrote:

> Hi All,
>
> I'm evaluating keycloak and identifying the possibility to provide SSO
> services on non protected (public) pages.
>
> Assume the following environment:
>
> Portal 1
> - https://site1.example.com/public
> - https://site1.example.com/protected
>
> Portal 2
> - https://site2.example.com/public
> - https://site2.example.com/protected
>
> /protected is the restricted area of the portal, that only logged in
> users may access
> /public is the public area where both logged in and anonymous users may
> navigate
>
> I'm trying to achieve the following
> - User logs in @ https://site1.example.com
> - SSO session and site1 session are created
> - User goes to public area of site2, https://site2.example.com/public
> - User is automatically logged in (site2 session is created)
>
> It seems that the above is not possible with OIDC / SAML since the user
> has to land on a protected page to initiate federation, or perform an
> action (e.g. click a button).
>
> Any other thoughts, feedback?
>
> Thanks in advance,
> Michalis
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>

From mposolda at redhat.com  Tue Jan  2 11:21:41 2018
From: mposolda at redhat.com (Marek Posolda)
Date: Tue, 2 Jan 2018 17:21:41 +0100
Subject: [keycloak-user] Problem with Keys
In-Reply-To: <293eba41-0a7f-a1db-58de-0cd7d5d85e94@adbglobal.com>
References: <293eba41-0a7f-a1db-58de-0cd7d5d85e94@adbglobal.com>
Message-ID: <450d7ece-871a-5fbe-ae36-a16000e81365@redhat.com>

Hi,

isn't the problem that your whole database is always "restarted" during 
each keycloak reboot? Or that you always force reimport things? If you 
use docker image pointed to shared database, you won't see this problem 
though. We have docker images for databases like PostgreSQL, MySQL AFAIR.

Marek

On 02/01/18 10:27, Karol Buler wrote:
> Hi Keycloak community!
>
> At the beginning I would wish you a Happy New Year! :)
>
> About the problem... If we run Keycloak as a docker, every time Keycloak
> is rebooted the Keys (Realm Setting -> Keys) are generated again. Result
> is that each application which use Keycloak's adapter throws "Didn't
> find publicKey for specified kid" error. This error occurs because the
> Keys are not rotated in right way, and application does not know about
> the rotation.
>
> Have you met this problem? What is your workaround? Is it an issue?
>
> Best regards,
> Karol
>
> [https://www.adbglobal.com/wp-content/uploads/adb.png]
> adbglobal.com<https://www.adbglobal.com>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user



From psilva at redhat.com  Tue Jan  2 11:25:42 2018
From: psilva at redhat.com (Pedro Igor Silva)
Date: Tue, 2 Jan 2018 14:25:42 -0200
Subject: [keycloak-user] admin user in clustered domain
In-Reply-To: <17500e49-e240-d987-51de-71a0ea16eb7b@janua.fr>
References: <83245872-feaa-b376-80ea-07eb25d8feb3@janua.fr>
	<17500e49-e240-d987-51de-71a0ea16eb7b@janua.fr>
Message-ID: <CAJrcDBfmsDjPF=5EeusjiLRguHYefhhRmqAA_n4GtBLJAGzRng@mail.gmail.com>

Try creating a "configuration" directory for master server like this:

     mkdir ${KEYCLOAK_HOME}/domain/servers/${server_name}/configuration

Then copy "keycloak-add-user.json" to the directory above. Restart the
server.


On Tue, Jan 2, 2018 at 12:13 PM, Olivier Rivat <orivat at janua.fr> wrote:

> Hi,
>
> I am re-sending my email question submitted last week with further
> precisions.
>
> other precision:
>
> -standalone cluster works: both solutions works fine (GUI, CLI)
> ===============
> a) GUI :
> I get a boot login screen asking to enter name of administrator we want
> to use, and password
>
> b) Using CLI script:
> file keycloak-add-user.json correctly uploaded
>
> Domain cluster:
> ==========
> a) GUI mode:
> I never get boot login screen asking to specify the administrator. I get
> immediately a normal login screen
> where I am already supposed to know teh admin username
>
> b) CLI Mode:
> file keycloak-add-user.json is not uploaded
>
> How is it possible to overcome this ?
>
> Regards,
> Olivier
>
>
> Le 29/12/2017 ? 15:03, Olivier Rivat a ?crit :
> >
> > Hi,
> >
> > I am trying to setup a clustered domain.
> > I have been to boot the master and the slave as described in keycloak
> >
> > But when tring to login, I cannot with user admin.
> >
> > Troubleshooting I have done so far:
> >
> > 1) With standalone mode (or standalone cluster mode), first login
> > screen is welcome screen to define teh admini user and password.
> >
> > With clustered domain, I never obtain this, but a usual login screen,
> > asking for username/password.
> > Of course, I cannot answer to this, as the admin as not yet been defined.
> >
> >
> > 2) I have also tried teh script add-user-keycloak.sh
> >
> >
> > bin/add-user-keycloak.sh -r master -u admin6 -p admin6  --domain
> > Added 'admin6' to
> > '/home/orivat/rh_test/rh-sso-7.1/domain/configuration/
> keycloak-add-user.json',
> > restart server to load user
> > It creates a file domain/configuration/keycloak-add-user.json, but
> > this file is never upon restart of RH-SSO domain cluster instance
> > (master or slave).
> >
> > (I have seen equivalent file being loaded, when doing standalone
> > clsueter tests).
> >
> >
> > So my question is very simple:
> > Ho is it possibel to get hold of an admin user allowing to connect to
> > the keycloak admin master login screen ?
> >
> >
> > Regards,
> >
> > Olivier Rivat
> >
> >
> > --
> >
> >
> > <http://www.janua.fr/images/logo-big-sans.png><http://www.
> janua.fr/images/LogoSignature.gif>
> >
> >       <http://www.janua.fr/images/6g_top.gif>
> >
> > Olivier Rivat
> > CTO
> > orivat at janua.fr <mailto:dchikhaoui at janua.fr>
> > Gsm: +33(0)682 801 609
> > T?l: +33(0)489 829 238
> > Fax: +33(0)955 260 370
> > http://www.janua.fr <http://www.janua.fr/>
> >       <http://www.janua.fr/images/6g_top.gif>
> >
> >
>
> --
>
>
> <http://www.janua.fr/images/logo-big-sans.png><http://www.
> janua.fr/images/LogoSignature.gif>
>
>         <http://www.janua.fr/images/6g_top.gif>
>
> Olivier Rivat
> CTO
> orivat at janua.fr <mailto:dchikhaoui at janua.fr>
> Gsm: +33(0)682 801 609
> T?l: +33(0)489 829 238
> Fax: +33(0)955 260 370
> http://www.janua.fr <http://www.janua.fr/>
>         <http://www.janua.fr/images/6g_top.gif>
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>

From orivat at janua.fr  Tue Jan  2 11:41:39 2018
From: orivat at janua.fr (Olivier Rivat)
Date: Tue, 2 Jan 2018 17:41:39 +0100
Subject: [keycloak-user] admin user in clustered domain
In-Reply-To: <CAJrcDBfmsDjPF=5EeusjiLRguHYefhhRmqAA_n4GtBLJAGzRng@mail.gmail.com>
References: <83245872-feaa-b376-80ea-07eb25d8feb3@janua.fr>
	<17500e49-e240-d987-51de-71a0ea16eb7b@janua.fr>
	<CAJrcDBfmsDjPF=5EeusjiLRguHYefhhRmqAA_n4GtBLJAGzRng@mail.gmail.com>
Message-ID: <ca624fab-19ca-4193-d3e0-bc83e67c2d58@janua.fr>

Hi Pedro,

It works fine. Tkx for your help.
I guess such a hint should be added to RH-SSO and keycloak documentation 
as well.

Regards,
Olivier


Le 02/01/2018 ? 17:25, Pedro Igor Silva a ?crit?:
> Try creating a "configuration" directory for master server like this:
>
> ? ? ?mkdir ${KEYCLOAK_HOME}/domain/servers/${server_name}/configuration
>
> Then copy "keycloak-add-user.json" to the directory above. Restart the 
> server.
>
>
> On Tue, Jan 2, 2018 at 12:13 PM, Olivier Rivat <orivat at janua.fr 
> <mailto:orivat at janua.fr>> wrote:
>
>     Hi,
>
>     I am re-sending my email question submitted last week with further
>     precisions.
>
>     other precision:
>
>     -standalone cluster works: both solutions works fine (GUI, CLI)
>     ===============
>     a) GUI :
>     I get a boot login screen asking to enter name of administrator we
>     want
>     to use, and password
>
>     b) Using CLI script:
>     file keycloak-add-user.json correctly uploaded
>
>     Domain cluster:
>     ==========
>     a) GUI mode:
>     I never get boot login screen asking to specify the administrator.
>     I get
>     immediately a normal login screen
>     where I am already supposed to know teh admin username
>
>     b) CLI Mode:
>     file keycloak-add-user.json is not uploaded
>
>     How is it possible to overcome this ?
>
>     Regards,
>     Olivier
>
>
>     Le 29/12/2017 ? 15:03, Olivier Rivat a ?crit?:
>     >
>     > Hi,
>     >
>     > I am trying to setup a clustered domain.
>     > I have been to boot the master and the slave as described in
>     keycloak
>     >
>     > But when tring to login, I cannot with user admin.
>     >
>     > Troubleshooting I have done so far:
>     >
>     > 1) With standalone mode (or standalone cluster mode), first login
>     > screen is welcome screen to define teh admini user and password.
>     >
>     > With clustered domain, I never obtain this, but a usual login
>     screen,
>     > asking for username/password.
>     > Of course, I cannot answer to this, as the admin as not yet been
>     defined.
>     >
>     >
>     > 2) I have also tried teh script add-user-keycloak.sh
>     >
>     >
>     > bin/add-user-keycloak.sh -r master -u admin6 -p admin6? --domain
>     > Added 'admin6' to
>     >
>     '/home/orivat/rh_test/rh-sso-7.1/domain/configuration/keycloak-add-user.json',
>     > restart server to load user
>     > It creates a file domain/configuration/keycloak-add-user.json, but
>     > this file is never upon restart of RH-SSO domain cluster instance
>     > (master or slave).
>     >
>     > (I have seen equivalent file being loaded, when doing standalone
>     > clsueter tests).
>     >
>     >
>     > So my question is very simple:
>     > Ho is it possibel to get hold of an admin user allowing to
>     connect to
>     > the keycloak admin master login screen ?
>     >
>     >
>     > Regards,
>     >
>     > Olivier Rivat
>     >
>     >
>     > --
>     >
>     >
>     > <http://www.janua.fr/images/logo-big-sans.png
>     <http://www.janua.fr/images/logo-big-sans.png>><http://www.janua.fr/images/LogoSignature.gif
>     <http://www.janua.fr/images/LogoSignature.gif>>
>     >
>     >? ? ? ?<http://www.janua.fr/images/6g_top.gif
>     <http://www.janua.fr/images/6g_top.gif>>
>     >
>     > Olivier Rivat
>     > CTO
>     > orivat at janua.fr <mailto:orivat at janua.fr>
>     <mailto:dchikhaoui at janua.fr <mailto:dchikhaoui at janua.fr>>
>     > Gsm: +33(0)682 801 609 <tel:%2B33%280%29682%20801%20609>
>     > T?l: +33(0)489 829 238 <tel:%2B33%280%29489%20829%20238>
>     > Fax: +33(0)955 260 370 <tel:%2B33%280%29955%20260%20370>
>     > http://www.janua.fr <http://www.janua.fr/>
>     >? ? ? ?<http://www.janua.fr/images/6g_top.gif
>     <http://www.janua.fr/images/6g_top.gif>>
>     >
>     >
>
>     --
>
>
>     <http://www.janua.fr/images/logo-big-sans.png
>     <http://www.janua.fr/images/logo-big-sans.png>><http://www.janua.fr/images/LogoSignature.gif
>     <http://www.janua.fr/images/LogoSignature.gif>>
>
>     ? ? ? ? <http://www.janua.fr/images/6g_top.gif
>     <http://www.janua.fr/images/6g_top.gif>>
>
>     Olivier Rivat
>     CTO
>     orivat at janua.fr <mailto:orivat at janua.fr>
>     <mailto:dchikhaoui at janua.fr <mailto:dchikhaoui at janua.fr>>
>     Gsm: +33(0)682 801 609 <tel:%2B33%280%29682%20801%20609>
>     T?l: +33(0)489 829 238 <tel:%2B33%280%29489%20829%20238>
>     Fax: +33(0)955 260 370 <tel:%2B33%280%29955%20260%20370>
>     http://www.janua.fr <http://www.janua.fr/>
>     ? ? ? ? <http://www.janua.fr/images/6g_top.gif
>     <http://www.janua.fr/images/6g_top.gif>>
>
>
>     _______________________________________________
>     keycloak-user mailing list
>     keycloak-user at lists.jboss.org <mailto:keycloak-user at lists.jboss.org>
>     https://lists.jboss.org/mailman/listinfo/keycloak-user
>     <https://lists.jboss.org/mailman/listinfo/keycloak-user>
>
>

-- 


<http://www.janua.fr/images/logo-big-sans.png><http://www.janua.fr/images/LogoSignature.gif>

	<http://www.janua.fr/images/6g_top.gif>
	
Olivier Rivat
CTO
orivat at janua.fr <mailto:dchikhaoui at janua.fr>
Gsm: +33(0)682 801 609
T?l: +33(0)489 829 238
Fax: +33(0)955 260 370
http://www.janua.fr <http://www.janua.fr/>
	<http://www.janua.fr/images/6g_top.gif>



From K.Buler at adbglobal.com  Tue Jan  2 11:47:00 2018
From: K.Buler at adbglobal.com (Karol Buler)
Date: Tue, 2 Jan 2018 17:47:00 +0100
Subject: [keycloak-user] Problem with Keys
In-Reply-To: <450d7ece-871a-5fbe-ae36-a16000e81365@redhat.com>
References: <293eba41-0a7f-a1db-58de-0cd7d5d85e94@adbglobal.com>
	<450d7ece-871a-5fbe-ae36-a16000e81365@redhat.com>
Message-ID: <35aa8c1c-768c-3797-6e45-d0e675aa71ea@adbglobal.com>

Hi Marek,

thanks for the response!

Of course we use specific docker image (at this moment 
jboss/keycloak-postgres:3.2.1.Final), so database is persistent, but 
(checked twice) RSA and also HMAC from "Realm settings -> Keys" are 
different after rebooting the Keycloak's docker. The only additional 
thing we do in dockerfile is adding our User Federation's provider. Do 
you see any mistake that we could do?

Karol


On 02.01.2018 17:21, Marek Posolda wrote:
> Hi,
>
> isn't the problem that your whole database is always "restarted" 
> during each keycloak reboot? Or that you always force reimport things? 
> If you use docker image pointed to shared database, you won't see this 
> problem though. We have docker images for databases like PostgreSQL, 
> MySQL AFAIR.
>
> Marek
>
> On 02/01/18 10:27, Karol Buler wrote:
>> Hi Keycloak community!
>>
>> At the beginning I would wish you a Happy New Year! :)
>>
>> About the problem... If we run Keycloak as a docker, every time Keycloak
>> is rebooted the Keys (Realm Setting -> Keys) are generated again. Result
>> is that each application which use Keycloak's adapter throws "Didn't
>> find publicKey for specified kid" error. This error occurs because the
>> Keys are not rotated in right way, and application does not know about
>> the rotation.
>>
>> Have you met this problem? What is your workaround? Is it an issue?
>>
>> Best regards,
>> Karol
>>
>> [https://www.adbglobal.com/wp-content/uploads/adb.png]
>> adbglobal.com<https://www.adbglobal.com>
>>
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
>


From sthorger at redhat.com  Tue Jan  2 13:47:14 2018
From: sthorger at redhat.com (Stian Thorgersen)
Date: Tue, 2 Jan 2018 19:47:14 +0100
Subject: [keycloak-user] admin user in clustered domain
In-Reply-To: <ca624fab-19ca-4193-d3e0-bc83e67c2d58@janua.fr>
References: <83245872-feaa-b376-80ea-07eb25d8feb3@janua.fr>
	<17500e49-e240-d987-51de-71a0ea16eb7b@janua.fr>
	<CAJrcDBfmsDjPF=5EeusjiLRguHYefhhRmqAA_n4GtBLJAGzRng@mail.gmail.com>
	<ca624fab-19ca-4193-d3e0-bc83e67c2d58@janua.fr>
Message-ID: <CAJgngAcXP2wZMBA61VMvA6pY94gQvo2LQ8QnOb_J1oC8Fmr7-A@mail.gmail.com>

In clustered mode you can access one of the nodes directly over an SSH
tunnel and it should show you the add user form. Alternative is the
add-user script, but I believe the docs there are incorrect so you can
create a JIRA for it and we'll fix the instructions in the docs.

On 2 January 2018 at 17:41, Olivier Rivat <orivat at janua.fr> wrote:

> Hi Pedro,
>
> It works fine. Tkx for your help.
> I guess such a hint should be added to RH-SSO and keycloak documentation
> as well.
>
> Regards,
> Olivier
>
>
> Le 02/01/2018 ? 17:25, Pedro Igor Silva a ?crit :
> > Try creating a "configuration" directory for master server like this:
> >
> >      mkdir ${KEYCLOAK_HOME}/domain/servers/${server_name}/configuration
> >
> > Then copy "keycloak-add-user.json" to the directory above. Restart the
> > server.
> >
> >
> > On Tue, Jan 2, 2018 at 12:13 PM, Olivier Rivat <orivat at janua.fr
> > <mailto:orivat at janua.fr>> wrote:
> >
> >     Hi,
> >
> >     I am re-sending my email question submitted last week with further
> >     precisions.
> >
> >     other precision:
> >
> >     -standalone cluster works: both solutions works fine (GUI, CLI)
> >     ===============
> >     a) GUI :
> >     I get a boot login screen asking to enter name of administrator we
> >     want
> >     to use, and password
> >
> >     b) Using CLI script:
> >     file keycloak-add-user.json correctly uploaded
> >
> >     Domain cluster:
> >     ==========
> >     a) GUI mode:
> >     I never get boot login screen asking to specify the administrator.
> >     I get
> >     immediately a normal login screen
> >     where I am already supposed to know teh admin username
> >
> >     b) CLI Mode:
> >     file keycloak-add-user.json is not uploaded
> >
> >     How is it possible to overcome this ?
> >
> >     Regards,
> >     Olivier
> >
> >
> >     Le 29/12/2017 ? 15:03, Olivier Rivat a ?crit :
> >     >
> >     > Hi,
> >     >
> >     > I am trying to setup a clustered domain.
> >     > I have been to boot the master and the slave as described in
> >     keycloak
> >     >
> >     > But when tring to login, I cannot with user admin.
> >     >
> >     > Troubleshooting I have done so far:
> >     >
> >     > 1) With standalone mode (or standalone cluster mode), first login
> >     > screen is welcome screen to define teh admini user and password.
> >     >
> >     > With clustered domain, I never obtain this, but a usual login
> >     screen,
> >     > asking for username/password.
> >     > Of course, I cannot answer to this, as the admin as not yet been
> >     defined.
> >     >
> >     >
> >     > 2) I have also tried teh script add-user-keycloak.sh
> >     >
> >     >
> >     > bin/add-user-keycloak.sh -r master -u admin6 -p admin6  --domain
> >     > Added 'admin6' to
> >     >
> >     '/home/orivat/rh_test/rh-sso-7.1/domain/configuration/
> keycloak-add-user.json',
> >     > restart server to load user
> >     > It creates a file domain/configuration/keycloak-add-user.json, but
> >     > this file is never upon restart of RH-SSO domain cluster instance
> >     > (master or slave).
> >     >
> >     > (I have seen equivalent file being loaded, when doing standalone
> >     > clsueter tests).
> >     >
> >     >
> >     > So my question is very simple:
> >     > Ho is it possibel to get hold of an admin user allowing to
> >     connect to
> >     > the keycloak admin master login screen ?
> >     >
> >     >
> >     > Regards,
> >     >
> >     > Olivier Rivat
> >     >
> >     >
> >     > --
> >     >
> >     >
> >     > <http://www.janua.fr/images/logo-big-sans.png
> >     <http://www.janua.fr/images/logo-big-sans.png>><http://
> www.janua.fr/images/LogoSignature.gif
> >     <http://www.janua.fr/images/LogoSignature.gif>>
> >     >
> >     >       <http://www.janua.fr/images/6g_top.gif
> >     <http://www.janua.fr/images/6g_top.gif>>
> >     >
> >     > Olivier Rivat
> >     > CTO
> >     > orivat at janua.fr <mailto:orivat at janua.fr>
> >     <mailto:dchikhaoui at janua.fr <mailto:dchikhaoui at janua.fr>>
> >     > Gsm: +33(0)682 801 609 <tel:%2B33%280%29682%20801%20609>
> >     > T?l: +33(0)489 829 238 <tel:%2B33%280%29489%20829%20238>
> >     > Fax: +33(0)955 260 370 <tel:%2B33%280%29955%20260%20370>
> >     > http://www.janua.fr <http://www.janua.fr/>
> >     >       <http://www.janua.fr/images/6g_top.gif
> >     <http://www.janua.fr/images/6g_top.gif>>
> >     >
> >     >
> >
> >     --
> >
> >
> >     <http://www.janua.fr/images/logo-big-sans.png
> >     <http://www.janua.fr/images/logo-big-sans.png>><http://
> www.janua.fr/images/LogoSignature.gif
> >     <http://www.janua.fr/images/LogoSignature.gif>>
> >
> >             <http://www.janua.fr/images/6g_top.gif
> >     <http://www.janua.fr/images/6g_top.gif>>
> >
> >     Olivier Rivat
> >     CTO
> >     orivat at janua.fr <mailto:orivat at janua.fr>
> >     <mailto:dchikhaoui at janua.fr <mailto:dchikhaoui at janua.fr>>
> >     Gsm: +33(0)682 801 609 <tel:%2B33%280%29682%20801%20609>
> >     T?l: +33(0)489 829 238 <tel:%2B33%280%29489%20829%20238>
> >     Fax: +33(0)955 260 370 <tel:%2B33%280%29955%20260%20370>
> >     http://www.janua.fr <http://www.janua.fr/>
> >             <http://www.janua.fr/images/6g_top.gif
> >     <http://www.janua.fr/images/6g_top.gif>>
> >
> >
> >     _______________________________________________
> >     keycloak-user mailing list
> >     keycloak-user at lists.jboss.org <mailto:keycloak-user at lists.jboss.org>
> >     https://lists.jboss.org/mailman/listinfo/keycloak-user
> >     <https://lists.jboss.org/mailman/listinfo/keycloak-user>
> >
> >
>
> --
>
>
> <http://www.janua.fr/images/logo-big-sans.png><http://www.
> janua.fr/images/LogoSignature.gif>
>
>         <http://www.janua.fr/images/6g_top.gif>
>
> Olivier Rivat
> CTO
> orivat at janua.fr <mailto:dchikhaoui at janua.fr>
> Gsm: +33(0)682 801 609
> T?l: +33(0)489 829 238
> Fax: +33(0)955 260 370
> http://www.janua.fr <http://www.janua.fr/>
>         <http://www.janua.fr/images/6g_top.gif>
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>

From mposolda at redhat.com  Wed Jan  3 03:08:58 2018
From: mposolda at redhat.com (Marek Posolda)
Date: Wed, 3 Jan 2018 09:08:58 +0100
Subject: [keycloak-user] Problem with Keys
In-Reply-To: <35aa8c1c-768c-3797-6e45-d0e675aa71ea@adbglobal.com>
References: <293eba41-0a7f-a1db-58de-0cd7d5d85e94@adbglobal.com>
	<450d7ece-871a-5fbe-ae36-a16000e81365@redhat.com>
	<35aa8c1c-768c-3797-6e45-d0e675aa71ea@adbglobal.com>
Message-ID: <4c93abe8-b059-0cc2-de1f-015a277c2604@redhat.com>

On 02/01/18 17:47, Karol Buler wrote:
> Hi Marek,
>
> thanks for the response!
>
> Of course we use specific docker image (at this moment 
> jboss/keycloak-postgres:3.2.1.Final), so database is persistent, but 
> (checked twice) RSA and also HMAC from "Realm settings -> Keys" are 
> different after rebooting the Keycloak's docker. The only additional 
> thing we do in dockerfile is adding our User Federation's provider. Do 
> you see any mistake that we could do?
I guess you may do import (or reimport) of the realm after the reboot? 
Re-import will always generate new keys by default. You can either skip 
re-import or if skip re-import is really needed, then you may need to 
use different key provider, and perhaps hardcode the keys instead of 
always generate them.

Marek
>
> Karol
>
>
> On 02.01.2018 17:21, Marek Posolda wrote:
>> Hi,
>>
>> isn't the problem that your whole database is always "restarted" 
>> during each keycloak reboot? Or that you always force reimport 
>> things? If you use docker image pointed to shared database, you won't 
>> see this problem though. We have docker images for databases like 
>> PostgreSQL, MySQL AFAIR.
>>
>> Marek
>>
>> On 02/01/18 10:27, Karol Buler wrote:
>>> Hi Keycloak community!
>>>
>>> At the beginning I would wish you a Happy New Year! :)
>>>
>>> About the problem... If we run Keycloak as a docker, every time 
>>> Keycloak
>>> is rebooted the Keys (Realm Setting -> Keys) are generated again. 
>>> Result
>>> is that each application which use Keycloak's adapter throws "Didn't
>>> find publicKey for specified kid" error. This error occurs because the
>>> Keys are not rotated in right way, and application does not know about
>>> the rotation.
>>>
>>> Have you met this problem? What is your workaround? Is it an issue?
>>>
>>> Best regards,
>>> Karol
>>>
>>> [https://www.adbglobal.com/wp-content/uploads/adb.png]
>>> adbglobal.com<https://www.adbglobal.com>
>>>
>>> _______________________________________________
>>> keycloak-user mailing list
>>> keycloak-user at lists.jboss.org
>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>
>>
>


From K.Buler at adbglobal.com  Wed Jan  3 04:34:14 2018
From: K.Buler at adbglobal.com (Karol Buler)
Date: Wed, 3 Jan 2018 10:34:14 +0100
Subject: [keycloak-user] Problem with Keys
In-Reply-To: <4c93abe8-b059-0cc2-de1f-015a277c2604@redhat.com>
References: <293eba41-0a7f-a1db-58de-0cd7d5d85e94@adbglobal.com>
	<450d7ece-871a-5fbe-ae36-a16000e81365@redhat.com>
	<35aa8c1c-768c-3797-6e45-d0e675aa71ea@adbglobal.com>
	<4c93abe8-b059-0cc2-de1f-015a277c2604@redhat.com>
Message-ID: <05244f2c-7b82-1f21-e4ea-dcf1ab401e7e@adbglobal.com>

We don't (re)import anything after rebooting. As I said the only thing 
we do is adding our User Federation. Is it possible that Keycloak 
regenerate Keys while User Federation injecting? In other hand... where 
those keys are stored? I mean which table in DB?


On 03.01.2018 09:08, Marek Posolda wrote:
> On 02/01/18 17:47, Karol Buler wrote:
>> Hi Marek,
>>
>> thanks for the response!
>>
>> Of course we use specific docker image (at this moment 
>> jboss/keycloak-postgres:3.2.1.Final), so database is persistent, but 
>> (checked twice) RSA and also HMAC from "Realm settings -> Keys" are 
>> different after rebooting the Keycloak's docker. The only additional 
>> thing we do in dockerfile is adding our User Federation's provider. 
>> Do you see any mistake that we could do?
> I guess you may do import (or reimport) of the realm after the reboot? 
> Re-import will always generate new keys by default. You can either 
> skip re-import or if skip re-import is really needed, then you may 
> need to use different key provider, and perhaps hardcode the keys 
> instead of always generate them.
>
> Marek
>>
>> Karol
>>
>>
>> On 02.01.2018 17:21, Marek Posolda wrote:
>>> Hi,
>>>
>>> isn't the problem that your whole database is always "restarted" 
>>> during each keycloak reboot? Or that you always force reimport 
>>> things? If you use docker image pointed to shared database, you 
>>> won't see this problem though. We have docker images for databases 
>>> like PostgreSQL, MySQL AFAIR.
>>>
>>> Marek
>>>
>>> On 02/01/18 10:27, Karol Buler wrote:
>>>> Hi Keycloak community!
>>>>
>>>> At the beginning I would wish you a Happy New Year! :)
>>>>
>>>> About the problem... If we run Keycloak as a docker, every time 
>>>> Keycloak
>>>> is rebooted the Keys (Realm Setting -> Keys) are generated again. 
>>>> Result
>>>> is that each application which use Keycloak's adapter throws "Didn't
>>>> find publicKey for specified kid" error. This error occurs because the
>>>> Keys are not rotated in right way, and application does not know about
>>>> the rotation.
>>>>
>>>> Have you met this problem? What is your workaround? Is it an issue?
>>>>
>>>> Best regards,
>>>> Karol
>>>>
>>>> [https://www.adbglobal.com/wp-content/uploads/adb.png]
>>>> adbglobal.com<https://www.adbglobal.com>
>>>>
>>>> _______________________________________________
>>>> keycloak-user mailing list
>>>> keycloak-user at lists.jboss.org
>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>
>>>
>>
>


From Tony.Harris at oneadvanced.com  Wed Jan  3 06:11:29 2018
From: Tony.Harris at oneadvanced.com (Tony Harris)
Date: Wed, 3 Jan 2018 11:11:29 +0000
Subject: [keycloak-user] Password Policy API end points
Message-ID: <632ef053111d42f4babcf35bbbba42c2@SL1ACSEXCMB01.acsresource.com>

Wondering if anyone can point me in the right direction.

I want to be able to add and amend password policy setting on a realm via the Rest API, I can see how to retrieve the available PasswordPolicyTypeRepresentation from the ServerInfoRepresentation object but other than basic human readable string value representation of the password profile against the realm from the RealmRepresentation but I can not find a way of adding or amending the realm specific password policy settings, is this even currently possible with the API?

Tony

***** Email confidentiality *****

This message is private and confidential. If you have received this message in error, please notify us and remove it from your system. The dissemination, copying or distribution of this message, or related files, by anyone other than the intended recipient is strictly prohibited.



Any views or opinions expressed are solely those of the author and do not necessarily represent those of Advanced Computer Software Group Limited.



***** Email monitoring *****

Advanced Computer Software Group Limited may monitor email traffic data and also the content of email for the purposes of security and staff training.



***** Email security *****

In keeping with good computing practice, the recipient of this email should ensure that it is virus-free. Advanced Computer Software Group Limited does not accept responsibility for any virus that may be transferred by way of this email.



Email may be susceptible to data corruption, interception and/or unauthorised amendment. Advanced Computer Software Group Limited does not accept liability for any such corruption, interception or amendment or any consequences thereof.



This email has been scanned for viruses by the Symantec Email Security.cloud service.



Advanced Computer Software Group Limited

Registered office: Ditton Park, Riding Court Road, Datchet, Berkshire, SL3 9LL, UK

Registered in England under number 5965280

________________________________

Please consider the environment: Think before you print!


This message has been scanned for malware by Websense. www.websense.com

From K.Buler at adbglobal.com  Wed Jan  3 06:25:58 2018
From: K.Buler at adbglobal.com (Karol Buler)
Date: Wed, 3 Jan 2018 12:25:58 +0100
Subject: [keycloak-user] Problem with Keys
In-Reply-To: <05244f2c-7b82-1f21-e4ea-dcf1ab401e7e@adbglobal.com>
References: <293eba41-0a7f-a1db-58de-0cd7d5d85e94@adbglobal.com>
	<450d7ece-871a-5fbe-ae36-a16000e81365@redhat.com>
	<35aa8c1c-768c-3797-6e45-d0e675aa71ea@adbglobal.com>
	<4c93abe8-b059-0cc2-de1f-015a277c2604@redhat.com>
	<05244f2c-7b82-1f21-e4ea-dcf1ab401e7e@adbglobal.com>
Message-ID: <40a90382-4bab-d83b-73c0-d22345beabd9@adbglobal.com>

Hmm... I just checked again on local machine with docker-compose and 
those Keys aren't changed. It looks like this issue occurs only on 
OpenShift which we use for whole system. I have to check how it works 
step by step.


On 03.01.2018 10:34, Karol Buler wrote:
> [This sender failed our fraud detection checks and may not be who they appear to be. Learn about spoofing at http://aka.ms/LearnAboutSpoofing]
>
> We don't (re)import anything after rebooting. As I said the only thing
> we do is adding our User Federation. Is it possible that Keycloak
> regenerate Keys while User Federation injecting? In other hand... where
> those keys are stored? I mean which table in DB?
>
>
> On 03.01.2018 09:08, Marek Posolda wrote:
>> On 02/01/18 17:47, Karol Buler wrote:
>>> Hi Marek,
>>>
>>> thanks for the response!
>>>
>>> Of course we use specific docker image (at this moment
>>> jboss/keycloak-postgres:3.2.1.Final), so database is persistent, but
>>> (checked twice) RSA and also HMAC from "Realm settings -> Keys" are
>>> different after rebooting the Keycloak's docker. The only additional
>>> thing we do in dockerfile is adding our User Federation's provider.
>>> Do you see any mistake that we could do?
>> I guess you may do import (or reimport) of the realm after the reboot?
>> Re-import will always generate new keys by default. You can either
>> skip re-import or if skip re-import is really needed, then you may
>> need to use different key provider, and perhaps hardcode the keys
>> instead of always generate them.
>>
>> Marek
>>> Karol
>>>
>>>
>>> On 02.01.2018 17:21, Marek Posolda wrote:
>>>> Hi,
>>>>
>>>> isn't the problem that your whole database is always "restarted"
>>>> during each keycloak reboot? Or that you always force reimport
>>>> things? If you use docker image pointed to shared database, you
>>>> won't see this problem though. We have docker images for databases
>>>> like PostgreSQL, MySQL AFAIR.
>>>>
>>>> Marek
>>>>
>>>> On 02/01/18 10:27, Karol Buler wrote:
>>>>> Hi Keycloak community!
>>>>>
>>>>> At the beginning I would wish you a Happy New Year! :)
>>>>>
>>>>> About the problem... If we run Keycloak as a docker, every time
>>>>> Keycloak
>>>>> is rebooted the Keys (Realm Setting -> Keys) are generated again.
>>>>> Result
>>>>> is that each application which use Keycloak's adapter throws "Didn't
>>>>> find publicKey for specified kid" error. This error occurs because the
>>>>> Keys are not rotated in right way, and application does not know about
>>>>> the rotation.
>>>>>
>>>>> Have you met this problem? What is your workaround? Is it an issue?
>>>>>
>>>>> Best regards,
>>>>> Karol
>>>>>
>>>>> [https://www.adbglobal.com/wp-content/uploads/adb.png]
>>>>> adbglobal.com<https://www.adbglobal.com>
>>>>>
>>>>> _______________________________________________
>>>>> keycloak-user mailing list
>>>>> keycloak-user at lists.jboss.org
>>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user


From sthorger at redhat.com  Wed Jan  3 06:29:00 2018
From: sthorger at redhat.com (Stian Thorgersen)
Date: Wed, 3 Jan 2018 12:29:00 +0100
Subject: [keycloak-user] Password Policy API end points
In-Reply-To: <632ef053111d42f4babcf35bbbba42c2@SL1ACSEXCMB01.acsresource.com>
References: <632ef053111d42f4babcf35bbbba42c2@SL1ACSEXCMB01.acsresource.com>
Message-ID: <CAJgngAdTkWadWtpkyWNbZGh+9UbsCbtmNWYWH2eu3G_uma9FWg@mail.gmail.com>

It's just a string on the RealmRepresentation so you just need to update
the realm itself

On 3 January 2018 at 12:11, Tony Harris <Tony.Harris at oneadvanced.com> wrote:

> Wondering if anyone can point me in the right direction.
>
> I want to be able to add and amend password policy setting on a realm via
> the Rest API, I can see how to retrieve the available
> PasswordPolicyTypeRepresentation from the ServerInfoRepresentation object
> but other than basic human readable string value representation of the
> password profile against the realm from the RealmRepresentation but I can
> not find a way of adding or amending the realm specific password policy
> settings, is this even currently possible with the API?
>
> Tony
>
> ***** Email confidentiality *****
>
> This message is private and confidential. If you have received this
> message in error, please notify us and remove it from your system. The
> dissemination, copying or distribution of this message, or related files,
> by anyone other than the intended recipient is strictly prohibited.
>
>
>
> Any views or opinions expressed are solely those of the author and do not
> necessarily represent those of Advanced Computer Software Group Limited.
>
>
>
> ***** Email monitoring *****
>
> Advanced Computer Software Group Limited may monitor email traffic data
> and also the content of email for the purposes of security and staff
> training.
>
>
>
> ***** Email security *****
>
> In keeping with good computing practice, the recipient of this email
> should ensure that it is virus-free. Advanced Computer Software Group
> Limited does not accept responsibility for any virus that may be
> transferred by way of this email.
>
>
>
> Email may be susceptible to data corruption, interception and/or
> unauthorised amendment. Advanced Computer Software Group Limited does not
> accept liability for any such corruption, interception or amendment or any
> consequences thereof.
>
>
>
> This email has been scanned for viruses by the Symantec Email
> Security.cloud service.
>
>
>
> Advanced Computer Software Group Limited
>
> Registered office: Ditton Park, Riding Court Road, Datchet, Berkshire, SL3
> 9LL, UK
>
> Registered in England under number 5965280
>
> ________________________________
>
> Please consider the environment: Think before you print!
>
>
> This message has been scanned for malware by Websense. www.websense.com
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>

From Tony.Harris at oneadvanced.com  Wed Jan  3 06:30:40 2018
From: Tony.Harris at oneadvanced.com (Tony Harris)
Date: Wed, 3 Jan 2018 11:30:40 +0000
Subject: [keycloak-user] Password Policy API end points
In-Reply-To: <CAJgngAdTkWadWtpkyWNbZGh+9UbsCbtmNWYWH2eu3G_uma9FWg@mail.gmail.com>
References: <632ef053111d42f4babcf35bbbba42c2@SL1ACSEXCMB01.acsresource.com>
	<CAJgngAdTkWadWtpkyWNbZGh+9UbsCbtmNWYWH2eu3G_uma9FWg@mail.gmail.com>
Message-ID: <a7f56f97c9694684a8cafa2e548bc110@SL1ACSEXCMB01.acsresource.com>

Thanks, didn?t think it would be that simple!

From: Stian Thorgersen [mailto:sthorger at redhat.com]
Sent: 03 January 2018 11:29
To: Tony Harris <Tony.Harris at oneadvanced.com>
Cc: keycloak-user at lists.jboss.org
Subject: Re: [keycloak-user] Password Policy API end points

It's just a string on the RealmRepresentation so you just need to update the realm itself

On 3 January 2018 at 12:11, Tony Harris <Tony.Harris at oneadvanced.com<mailto:Tony.Harris at oneadvanced.com>> wrote:
Wondering if anyone can point me in the right direction.

I want to be able to add and amend password policy setting on a realm via the Rest API, I can see how to retrieve the available PasswordPolicyTypeRepresentation from the ServerInfoRepresentation object but other than basic human readable string value representation of the password profile against the realm from the RealmRepresentation but I can not find a way of adding or amending the realm specific password policy settings, is this even currently possible with the API?

Tony

***** Email confidentiality *****

This message is private and confidential. If you have received this message in error, please notify us and remove it from your system. The dissemination, copying or distribution of this message, or related files, by anyone other than the intended recipient is strictly prohibited.



Any views or opinions expressed are solely those of the author and do not necessarily represent those of Advanced Computer Software Group Limited.



***** Email monitoring *****

Advanced Computer Software Group Limited may monitor email traffic data and also the content of email for the purposes of security and staff training.



***** Email security *****

In keeping with good computing practice, the recipient of this email should ensure that it is virus-free. Advanced Computer Software Group Limited does not accept responsibility for any virus that may be transferred by way of this email.



Email may be susceptible to data corruption, interception and/or unauthorised amendment. Advanced Computer Software Group Limited does not accept liability for any such corruption, interception or amendment or any consequences thereof.



This email has been scanned for viruses by the Symantec Email Security.cloud service.



Advanced Computer Software Group Limited

Registered office: Ditton Park, Riding Court Road, Datchet, Berkshire, SL3 9LL, UK

Registered in England under number 5965280

________________________________

Please consider the environment: Think before you print!


This message has been scanned for malware by Websense. www.websense.com<http://www.websense.com>
_______________________________________________
keycloak-user mailing list
keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>
https://lists.jboss.org/mailman/listinfo/keycloak-user



Click here<https://www.mailcontrol.com/sr/ekW4Z0sowrDGX2PQPOmvUrxsj2JZCuwuYTqUkqjKCGkpCS5JVgubL9TwT8YtdtLf6W1zTO!7E+jX0F9OzBqmnw==> to report this email as spam.

***** Email confidentiality *****

This message is private and confidential. If you have received this message in error, please notify us and remove it from your system. The dissemination, copying or distribution of this message, or related files, by anyone other than the intended recipient is strictly prohibited.



Any views or opinions expressed are solely those of the author and do not necessarily represent those of Advanced Computer Software Group Limited.



***** Email monitoring *****

Advanced Computer Software Group Limited may monitor email traffic data and also the content of email for the purposes of security and staff training.



***** Email security *****

In keeping with good computing practice, the recipient of this email should ensure that it is virus-free. Advanced Computer Software Group Limited does not accept responsibility for any virus that may be transferred by way of this email.



Email may be susceptible to data corruption, interception and/or unauthorised amendment. Advanced Computer Software Group Limited does not accept liability for any such corruption, interception or amendment or any consequences thereof.



This email has been scanned for viruses by the Symantec Email Security.cloud service.



Advanced Computer Software Group Limited

Registered office: Ditton Park, Riding Court Road, Datchet, Berkshire, SL3 9LL, UK

Registered in England under number 5965280

From khirschmann at huebinet.de  Wed Jan  3 10:15:27 2018
From: khirschmann at huebinet.de (Kevin Hirschmann)
Date: Wed, 3 Jan 2018 15:15:27 +0000
Subject: [keycloak-user] custom ldap attribute mapper
Message-ID: <65646dbabdcf493d9a23a6e576395231@huebinet.de>

Hello,

I would like to add my own custom user-attribute-ldap-mapper. It is needed, because the usernames, groups and roles of a test environment are prefixed to distinguish them from production usernames etc. .
First I took the example "user-storage-simple" which worked right away.

Now I transfered this to ldap mappers. I created a maven project, added
a) A class org.keycloak.examples.ldap.mappers.XxMapperFactory
b) a file org.keycloak.storage.ldap.mappers.LDAPStorageMapperFactory and added to it the entry org.keycloak.examples.ldap.mappers.XxMapperFactory
c) I added a jboss-deployment-structure.xml file

<jboss-deployment-structure>
                <deployment>
                               <dependencies>
                                               <module name="org.keycloak.keycloak-server-spi-private" />
                               </dependencies>
                </deployment>
</jboss-deployment-structure>

I added the jboss-deployment-structure.xml because I found this https://issues.jboss.org/browse/KEYCLOAK-4428 which
matches my problem

INFO  [org.jboss.as.server.deployment] (MSC service thread 1-8) WFLYSRV0027: Starting deployment of "ldap-mapper-example.jar" (runtime-name: "ldap-mapper-example.jar")
WARN  [org.jboss.as.dependency.private] (MSC service thread 1-6) WFLYSRV0018: Deployment "deployment.ldap-mapper-example.jar" is using a private module ("org.keycloak.keycloak-server-spi-private:main") which may be changed or removed in future versions without notice.
WARN  [org.jboss.modules] (MSC service thread 1-6) Failed to define class org.keycloak.examples.ldap.mappers.XxMapperFactory in Module "deployment.ldap-mapper-example.jar:main" from Service Module Loader: java.lang.NoClassDefFoundError: Failed to link org/keycloak/examples/ldap/mappers/XxMapperFactory (Module "deployment.ldap-mapper-example.jar:main" from Service Module Loader): org/keycloak/storage/ldap/mappers/LDAPConfigDecorator
                at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
                at sun.reflect.NativeConstructorAccessorImpl.newInstance(Unknown Source)
                at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(Unknown Source)
                at java.lang.reflect.Constructor.newInstance(Unknown Source)
                at org.jboss.modules.ModuleClassLoader.defineClass(ModuleClassLoader.java:446)
                at org.jboss.modules.ModuleClassLoader.loadClassLocal(ModuleClassLoader.java:274)
                at org.jboss.modules.ModuleClassLoader$1.loadClassLocal(ModuleClassLoader.java:78)
                at org.jboss.modules.Module.loadModuleClass(Module.java:605)
                at org.jboss.modules.ModuleClassLoader.findClass(ModuleClassLoader.java:190)
                at org.jboss.modules.ConcurrentClassLoader.performLoadClassUnchecked(ConcurrentClassLoader.java:363)
                at org.jboss.modules.ConcurrentClassLoader.performLoadClass(ConcurrentClassLoader.java:351)
                at org.jboss.modules.ConcurrentClassLoader.loadClass(ConcurrentClassLoader.java:93)
                at java.lang.Class.forName0(Native Method)
                at java.lang.Class.forName(Unknown Source)
                at java.util.ServiceLoader$LazyIterator.nextService(Unknown Source)
                at java.util.ServiceLoader$LazyIterator.next(Unknown Source)
                at java.util.ServiceLoader$1.next(Unknown Source)
                at org.keycloak.provider.DefaultProviderLoader.load(DefaultProviderLoader.java:47)
                at org.keycloak.provider.ProviderManager.load(ProviderManager.java:93)
                at org.keycloak.services.DefaultKeycloakSessionFactory.loadFactories(DefaultKeycloakSessionFactory.java:206)
                at org.keycloak.services.DefaultKeycloakSessionFactory.deploy(DefaultKeycloakSessionFactory.java:112)
                at org.keycloak.provider.ProviderManagerRegistry.deploy(ProviderManagerRegistry.java:42)
                at org.keycloak.subsystem.server.extension.KeycloakProviderDeploymentProcessor.deploy(KeycloakProviderDeploymentProcessor.java:54)
                at org.jboss.as.server.deployment.DeploymentUnitPhaseService.start(DeploymentUnitPhaseService.java:147)
                at org.jboss.msc.service.ServiceControllerImpl$StartTask.startService(ServiceControllerImpl.java:1948)
                at org.jboss.msc.service.ServiceControllerImpl$StartTask.run(ServiceControllerImpl.java:1881)
                at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source)
                at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)
                at java.lang.Thread.run(Unknown Source)



But it didn't help (why would I write this mail if it did).

What have I missed?

Thx

Kevin


From s.hoffman at xsb.com  Wed Jan  3 11:39:34 2018
From: s.hoffman at xsb.com (Steve Hoffman)
Date: Wed, 3 Jan 2018 10:39:34 -0600 (CST)
Subject: [keycloak-user] Add required action "Update Password" to all users
 after Password Policy change
Message-ID: <1095562809.16778079.1514997574414.JavaMail.zimbra@xsb.com>

Currently updating the Password Policy for a realm, and I was looking for an easier (safer) way of forcing users to update password on login once we've set our new preferences.

I'm aware that I can iterate through the users in the admin console (time/cost prohibitive) or POST/Update to the Admin REST API for each individual user after a GET for the user list.

Is there another simpler built-in mechanism that I'm overlooking?

Thanks,
Stephen Hoffman

-- 
XSB, Inc

Office (631) 371-8100 Ext. 8128
Mobile (631) 579-9857
Fax (631) 382-8228

http://www.xsb.com/ 

DISCLAIMER:
This e-mail is intended for the use of the addressee(s) only and may contain privileged, confidential, or proprietary information that is exempt from disclosure under law. If you are not the intended recipient, please do not read, copy, use or disclose the contents of this communication to others.

Please notify the sender that you have received this e-mail in error by replying to the e-mail. Please then delete the e-mail and destroy any copies of it. Thank you.

From msiochos at gmail.com  Wed Jan  3 12:07:42 2018
From: msiochos at gmail.com (Michalis Siochos)
Date: Wed, 3 Jan 2018 19:07:42 +0200
Subject: [keycloak-user] SSO on non-protected / public urls
In-Reply-To: <CAJrcDBd+enAyVdUy01QzGdLLGf1PEtg+i4+Ckb7EE8VnQO+wqw@mail.gmail.com>
References: <0c18e3d8-a2e6-e5de-8898-46e4f0945791@gmail.com>
	<CAJrcDBd+enAyVdUy01QzGdLLGf1PEtg+i4+Ckb7EE8VnQO+wqw@mail.gmail.com>
Message-ID: <91a4af70-097e-cee0-e4e8-dea2ff8e476a@gmail.com>

Greetings Pedro,

We need SSO on non protected resources for a number of reasons outlined 
below:

1) We have a series of portals (company, services, products, 
subsidiaries, etc) that have both public and protected areas.
So, we need to be able to identify a user that lands on a public url 
(e.g. by following a link) in order to show personalized content.

Google offers similar functionality
- Go to https://mail.google.com
- Login
- Then go to https://www.youtube.com
- You see personalized content on a page that is obviously public

In my view, this is an important added value of SSO.

2) The main website consists of a series of applications (actually 
portals) than are put together at user interface level. So, the user may 
navigate from a protected portal to a public portal e.g.
- From: https://www.example.com/customers (protected)
- To: https://www.example.com/services (public)

As the customer navigates to public urls then the application cannot 
show logged in user information and list of available actions. This is 
bad from user experience point of view since the user will see 
himself/herself as logged in on /customers but as anonymous on /service 
while on the same website (the user cannot understand that he navigates 
to different apps)

3) We have been using this functionality for 10+ years so renouncing it 
would be a major regression.

Best Regards,
Michalis


On 01/02/2018 04:33 PM, Pedro Igor Silva wrote:
> Why do you need to create session when accessing a public resource ?
>
> On Thu, Dec 28, 2017 at 6:01 PM, Michalis Siochos <msiochos at gmail.com 
> <mailto:msiochos at gmail.com>> wrote:
>
>     Hi All,
>
>     I'm evaluating keycloak and identifying the possibility to provide SSO
>     services on non protected (public) pages.
>
>     Assume the following environment:
>
>     Portal 1
>     - https://site1.example.com/public <https://site1.example.com/public>
>     - https://site1.example.com/protected
>     <https://site1.example.com/protected>
>
>     Portal 2
>     - https://site2.example.com/public <https://site2.example.com/public>
>     - https://site2.example.com/protected
>     <https://site2.example.com/protected>
>
>     /protected is the restricted area of the portal, that only logged in
>     users may access
>     /public is the public area where both logged in and anonymous
>     users may
>     navigate
>
>     I'm trying to achieve the following
>     - User logs in @ https://site1.example.com
>     - SSO session and site1 session are created
>     - User goes to public area of site2,
>     https://site2.example.com/public <https://site2.example.com/public>
>     - User is automatically logged in (site2 session is created)
>
>     It seems that the above is not possible with OIDC / SAML since the
>     user
>     has to land on a protected page to initiate federation, or perform an
>     action (e.g. click a button).
>
>     Any other thoughts, feedback?
>
>     Thanks in advance,
>     Michalis
>
>     _______________________________________________
>     keycloak-user mailing list
>     keycloak-user at lists.jboss.org <mailto:keycloak-user at lists.jboss.org>
>     https://lists.jboss.org/mailman/listinfo/keycloak-user
>     <https://lists.jboss.org/mailman/listinfo/keycloak-user>
>
>


From psilva at redhat.com  Wed Jan  3 13:37:42 2018
From: psilva at redhat.com (Pedro Igor Silva)
Date: Wed, 3 Jan 2018 16:37:42 -0200
Subject: [keycloak-user] SSO on non-protected / public urls
In-Reply-To: <91a4af70-097e-cee0-e4e8-dea2ff8e476a@gmail.com>
References: <0c18e3d8-a2e6-e5de-8898-46e4f0945791@gmail.com>
	<CAJrcDBd+enAyVdUy01QzGdLLGf1PEtg+i4+Ckb7EE8VnQO+wqw@mail.gmail.com>
	<91a4af70-097e-cee0-e4e8-dea2ff8e476a@gmail.com>
Message-ID: <CAJrcDBeDD3AJ-z_M5jnLjg+70PVwGadotXrqXbe5i-6dKxLxTA@mail.gmail.com>

I see now.

As you noticed, the adapters rely on a set of one or more paths in order to
trigger authentication and intercept requests.

I'm not sure either how we can accomplish this, but maybe we can start by
understanding how your clients look like. For instance:

* Which adapter are you using with your clients (site1 and site2) ?
* Are these clients confidential clients ?

I think that if you are using JS in your clients (e.g.: angular or
something else) it should be easier to support these requirements.

On Wed, Jan 3, 2018 at 3:07 PM, Michalis Siochos <msiochos at gmail.com> wrote:

> Greetings Pedro,
>
> We need SSO on non protected resources for a number of reasons outlined
> below:
>
> 1) We have a series of portals (company, services, products, subsidiaries,
> etc) that have both public and protected areas.
> So, we need to be able to identify a user that lands on a public url (e.g.
> by following a link) in order to show personalized content.
>
> Google offers similar functionality
> - Go to https://mail.google.com
> - Login
> - Then go to https://www.youtube.com
> - You see personalized content on a page that is obviously public
>
> In my view, this is an important added value of SSO.
>
> 2) The main website consists of a series of applications (actually
> portals) than are put together at user interface level. So, the user may
> navigate from a protected portal to a public portal e.g.
> - From: https://www.example.com/customers (protected)
> - To: https://www.example.com/services (public)
>
> As the customer navigates to public urls then the application cannot show
> logged in user information and list of available actions. This is bad from
> user experience point of view since the user will see himself/herself as
> logged in on /customers but as anonymous on /service while on the same
> website (the user cannot understand that he navigates to different apps)
>
> 3) We have been using this functionality for 10+ years so renouncing it
> would be a major regression.
>
> Best Regards,
> Michalis
>
>
> On 01/02/2018 04:33 PM, Pedro Igor Silva wrote:
>
> Why do you need to create session when accessing a public resource ?
>
> On Thu, Dec 28, 2017 at 6:01 PM, Michalis Siochos <msiochos at gmail.com>
> wrote:
>
>> Hi All,
>>
>> I'm evaluating keycloak and identifying the possibility to provide SSO
>> services on non protected (public) pages.
>>
>> Assume the following environment:
>>
>> Portal 1
>> - https://site1.example.com/public
>> - https://site1.example.com/protected
>>
>> Portal 2
>> - https://site2.example.com/public
>> - https://site2.example.com/protected
>>
>> /protected is the restricted area of the portal, that only logged in
>> users may access
>> /public is the public area where both logged in and anonymous users may
>> navigate
>>
>> I'm trying to achieve the following
>> - User logs in @ https://site1.example.com
>> - SSO session and site1 session are created
>> - User goes to public area of site2, https://site2.example.com/public
>> - User is automatically logged in (site2 session is created)
>>
>> It seems that the above is not possible with OIDC / SAML since the user
>> has to land on a protected page to initiate federation, or perform an
>> action (e.g. click a button).
>>
>> Any other thoughts, feedback?
>>
>> Thanks in advance,
>> Michalis
>>
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>
>
>
>

From carreraariel at gmail.com  Wed Jan  3 14:13:31 2018
From: carreraariel at gmail.com (Ariel Carrera)
Date: Wed, 3 Jan 2018 16:13:31 -0300
Subject: [keycloak-user] Fwd: Trojan in Keycloak Javascript Adapter?
In-Reply-To: <CAFzO_6eDDb+uG67_uPFAZTSq6YRfmfhmmJ0VE5AjdvO37UprVA@mail.gmail.com>
References: <CAFzO_6eDDb+uG67_uPFAZTSq6YRfmfhmmJ0VE5AjdvO37UprVA@mail.gmail.com>
Message-ID: <CAFzO_6e5qPaAGfPfuj2TrcxT2=YMq1hksk=cOixRshWLWkGHBQ@mail.gmail.com>

Hi, I have downloaded Keycloak Javascript Adapter from
http://www.keycloak.org/downloads.html
and when it is done a Windows Defender's popup alerts about a Trojan inside.

Windows Defender info:

adapter file: keycloak-js-adapter-dist-3.4.2.Final.zip
trojan name: Trojan:JS/Jorv.A!cl
file: keycloak-js-adapter-dist-3.4.2.Final/keycloak.min.js

Am I the only one with this problem?

Thanks,

-- 
Ariel Carrera



-- 
Ariel Carrera

From carreraariel at gmail.com  Wed Jan  3 16:07:44 2018
From: carreraariel at gmail.com (Ariel Carrera)
Date: Wed, 03 Jan 2018 21:07:44 +0000
Subject: [keycloak-user] [keycloak-dev] Trojan in Keycloak Javascript
	Adapter?
In-Reply-To: <CAHYJo18jrXAHDRWBiAbbGkNrGVxyCxNkuW9tJL--7RPdM3okeA@mail.gmail.com>
References: <CAFzO_6eDDb+uG67_uPFAZTSq6YRfmfhmmJ0VE5AjdvO37UprVA@mail.gmail.com>
	<CAHYJo18jrXAHDRWBiAbbGkNrGVxyCxNkuW9tJL--7RPdM3okeA@mail.gmail.com>
Message-ID: <CAFzO_6e5DK4b8Mtff85h0AE9KX5mzoj-S7TRxweULgRzQQSejw@mail.gmail.com>

Thanks Ramunas, I will check My Windows defender?s definition version to
compare with you. I have Windows 10 (64 bit) updated on December 2017.


El El mi?, 3 ene. 2018 a las 17:45, Rumanas <ramunask at gmail.com> escribi?:

> * just downloaded keycloak-js-adapter-dist-3.4.2.Final.zip file
> * extracted and scanned "keycloak-js-adapter-dist-3.4.2.Final" folder with
> Windows Defender on Windows 10 - no issues found
> * checked for Windows updates. New update "Definition Update for Windows
> Defender Antivirus - KB2267602 (Definition 1.259.1141.0)" was found and
> installed.
> * scanned again. No issues found.
>
> Ram?nas
>
-- 
Ariel Carrera

From csalazar at devsu.com  Wed Jan  3 17:59:10 2018
From: csalazar at devsu.com (Cesar Salazar)
Date: Wed, 3 Jan 2018 17:59:10 -0500
Subject: [keycloak-user] GET users endpoint is making lots of requests to
 the database (its really slow!)
Message-ID: <CAJzRJ5K+fJXpJ2u28yWVh5NCwJ310qb7M4es0fpgH3LW54h+pw@mail.gmail.com>

Hi,

First of all, thanks for the great work on keycloak!

We are using keycloak for an application, and it was working great (until
we launched to production)

We have 150 users which are connected to an Active Directory using the
Federation functionality.

It works, but the endpoint GET /{realm}/users takes about 23 seconds to
respond (Keycloak running on a container in GKE backed by a mysql server on
Google Cloud SQL).

I enabled mysql logging and the problem seems to be that just for
responding this endpoint, the server makes 901 queries to the database!

These are the queries:

First query, to get the users:

select userentity0_.ID as ID1_71_, userentity0_.CREATED_TIMESTAMP as
CREATED_2_71_, userentity0_.EMAIL as EMAIL3_71_,
userentity0_.EMAIL_CONSTRAINT as EMAIL_CO4_71_, userentity0_.EMAIL_VERIFIED
as EMAIL_VE5_71_, userentity0_.ENABLED as ENABLED6_71_,
userentity0_.FEDERATION_LINK as FEDERATI7_71_, userentity0_.FIRST_NAME as
FIRST_NA8_71_, userentity0_.LAST_NAME as LAST_NAM9_71_,
userentity0_.NOT_BEFORE as NOT_BEF10_71_, userentity0_.REALM_ID as
REALM_I11_71_, userentity0_.SERVICE_ACCOUNT_CLIENT_LINK as SERVICE12_71_,
userentity0_.USERNAME as USERNAM13_71_ from USER_ENTITY userentity0_ where
userentity0_.REALM_ID='my-realm' and
(userentity0_.SERVICE_ACCOUNT_CLIENT_LINK is null) order by
userentity0_.USERNAME


Then,* for each user *a query like this, (getting user attributes I guess)

select attributes0_.USER_ID as USER_ID4_67_0_, attributes0_.ID as
ID1_67_0_, attributes0_.ID as ID1_67_1_, attributes0_.NAME as NAME2_67_1_,
attributes0_.USER_ID as USER_ID4_67_1_, attributes0_.VALUE as VALUE3_67_1_
from USER_ATTRIBUTE attributes0_ where
attributes0_.USER_ID='b920df7c-a419-4150-86bd-9f81c7ea0b70'


Then,* for each user* 4 queries similar to this, (getting credentials I
guess)

select credential0_.ID as ID1_18_, credential0_.ALGORITHM as ALGORITH2_18_,
credential0_.COUNTER as COUNTER3_18_, credential0_.CREATED_DATE as
CREATED_4_18_, credential0_.DEVICE as DEVICE5_18_, credential0_.DIGITS as
DIGITS6_18_, credential0_.HASH_ITERATIONS as HASH_ITE7_18_,
credential0_.PERIOD as PERIOD8_18_, credential0_.SALT as SALT9_18_,
credential0_.TYPE as TYPE10_18_, credential0_.USER_ID as USER_ID12_18_,
credential0_.VALUE as VALUE11_18_ from CREDENTIAL credential0_ where
credential0_.USER_ID='94525793-297b-4895-ab2b-7cf8b580e9fa' and
credential0_.TYPE='totp'


A query with type *totp* is queried 2 times, the other 2 times are queried
with type *hotp* and *password*

and finally one more query* for each user* (getting required actions I
guess)

select requiredac0_.USER_ID as USER_ID2_77_0_, requiredac0_.REQUIRED_ACTION
as REQUIRED1_77_0_, requiredac0_.REQUIRED_ACTION as REQUIRED1_77_1_,
requiredac0_.USER_ID as USER_ID2_77_1_ from USER_REQUIRED_ACTION
requiredac0_ where
requiredac0_.USER_ID='94525793-297b-4895-ab2b-7cf8b580e9fa'


So, in total, for 150 users, Keycloak is making 901 requests to the
database! If I increase the number to 500 users, will it be 30001
requests???

How can this be improved? Is there something wrong I'm doing in the
configuration? Does this happens only with Federated users?

Thanks!

-- 
*Cesar Salazar*
Development Manager
DEVSU | www.devsu.com
skype: cesarsalazar007
P: (213)-291-0752
M: +593 9 2917 160 (Ecuador)

From jonas.schoenenberger at gmail.com  Thu Jan  4 02:55:22 2018
From: jonas.schoenenberger at gmail.com (=?UTF-8?Q?Jonas_Sch=C3=B6nenberger?=)
Date: Thu, 4 Jan 2018 08:55:22 +0100
Subject: [keycloak-user] CORS in Keycloak 3.4
Message-ID: <CAP1gnsJk-KxFprmT9a3wnmRyAee_2POqV-NPRY7L1AZwqQ6MUQ@mail.gmail.com>

Hey there

I?ve been trying to figure out how to enable CORS in the later versions of
KeyCloak. I can?t seem to find a valid way to achieve this besides
hardcoding response headers in the standalone.xml. I?m using a standalone
deployment.
I know the functionality to handle preflight and other CORS scenarios is
there, so there must be surely a way to activate it?

Could somebody enlighten me please?

Thanks a lot
Jonas

From mposolda at redhat.com  Thu Jan  4 05:31:15 2018
From: mposolda at redhat.com (Marek Posolda)
Date: Thu, 4 Jan 2018 11:31:15 +0100
Subject: [keycloak-user] custom ldap attribute mapper
In-Reply-To: <65646dbabdcf493d9a23a6e576395231@huebinet.de>
References: <65646dbabdcf493d9a23a6e576395231@huebinet.de>
Message-ID: <7293e78c-b65c-d913-40db-5330b6513132@redhat.com>

I think you need few more dependencies in your 
jboss-deployment-structure.xml . At least also 
org.keycloak.keycloak-ldap-federation and maybe some more.

Marek

On 03/01/18 16:15, Kevin Hirschmann wrote:
> Hello,
>
> I would like to add my own custom user-attribute-ldap-mapper. It is needed, because the usernames, groups and roles of a test environment are prefixed to distinguish them from production usernames etc. .
> First I took the example "user-storage-simple" which worked right away.
>
> Now I transfered this to ldap mappers. I created a maven project, added
> a) A class org.keycloak.examples.ldap.mappers.XxMapperFactory
> b) a file org.keycloak.storage.ldap.mappers.LDAPStorageMapperFactory and added to it the entry org.keycloak.examples.ldap.mappers.XxMapperFactory
> c) I added a jboss-deployment-structure.xml file
>
> <jboss-deployment-structure>
>                  <deployment>
>                                 <dependencies>
>                                                 <module name="org.keycloak.keycloak-server-spi-private" />
>                                 </dependencies>
>                  </deployment>
> </jboss-deployment-structure>
>
> I added the jboss-deployment-structure.xml because I found this https://issues.jboss.org/browse/KEYCLOAK-4428 which
> matches my problem
>
> INFO  [org.jboss.as.server.deployment] (MSC service thread 1-8) WFLYSRV0027: Starting deployment of "ldap-mapper-example.jar" (runtime-name: "ldap-mapper-example.jar")
> WARN  [org.jboss.as.dependency.private] (MSC service thread 1-6) WFLYSRV0018: Deployment "deployment.ldap-mapper-example.jar" is using a private module ("org.keycloak.keycloak-server-spi-private:main") which may be changed or removed in future versions without notice.
> WARN  [org.jboss.modules] (MSC service thread 1-6) Failed to define class org.keycloak.examples.ldap.mappers.XxMapperFactory in Module "deployment.ldap-mapper-example.jar:main" from Service Module Loader: java.lang.NoClassDefFoundError: Failed to link org/keycloak/examples/ldap/mappers/XxMapperFactory (Module "deployment.ldap-mapper-example.jar:main" from Service Module Loader): org/keycloak/storage/ldap/mappers/LDAPConfigDecorator
>                  at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
>                  at sun.reflect.NativeConstructorAccessorImpl.newInstance(Unknown Source)
>                  at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(Unknown Source)
>                  at java.lang.reflect.Constructor.newInstance(Unknown Source)
>                  at org.jboss.modules.ModuleClassLoader.defineClass(ModuleClassLoader.java:446)
>                  at org.jboss.modules.ModuleClassLoader.loadClassLocal(ModuleClassLoader.java:274)
>                  at org.jboss.modules.ModuleClassLoader$1.loadClassLocal(ModuleClassLoader.java:78)
>                  at org.jboss.modules.Module.loadModuleClass(Module.java:605)
>                  at org.jboss.modules.ModuleClassLoader.findClass(ModuleClassLoader.java:190)
>                  at org.jboss.modules.ConcurrentClassLoader.performLoadClassUnchecked(ConcurrentClassLoader.java:363)
>                  at org.jboss.modules.ConcurrentClassLoader.performLoadClass(ConcurrentClassLoader.java:351)
>                  at org.jboss.modules.ConcurrentClassLoader.loadClass(ConcurrentClassLoader.java:93)
>                  at java.lang.Class.forName0(Native Method)
>                  at java.lang.Class.forName(Unknown Source)
>                  at java.util.ServiceLoader$LazyIterator.nextService(Unknown Source)
>                  at java.util.ServiceLoader$LazyIterator.next(Unknown Source)
>                  at java.util.ServiceLoader$1.next(Unknown Source)
>                  at org.keycloak.provider.DefaultProviderLoader.load(DefaultProviderLoader.java:47)
>                  at org.keycloak.provider.ProviderManager.load(ProviderManager.java:93)
>                  at org.keycloak.services.DefaultKeycloakSessionFactory.loadFactories(DefaultKeycloakSessionFactory.java:206)
>                  at org.keycloak.services.DefaultKeycloakSessionFactory.deploy(DefaultKeycloakSessionFactory.java:112)
>                  at org.keycloak.provider.ProviderManagerRegistry.deploy(ProviderManagerRegistry.java:42)
>                  at org.keycloak.subsystem.server.extension.KeycloakProviderDeploymentProcessor.deploy(KeycloakProviderDeploymentProcessor.java:54)
>                  at org.jboss.as.server.deployment.DeploymentUnitPhaseService.start(DeploymentUnitPhaseService.java:147)
>                  at org.jboss.msc.service.ServiceControllerImpl$StartTask.startService(ServiceControllerImpl.java:1948)
>                  at org.jboss.msc.service.ServiceControllerImpl$StartTask.run(ServiceControllerImpl.java:1881)
>                  at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source)
>                  at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)
>                  at java.lang.Thread.run(Unknown Source)
>
>
>
> But it didn't help (why would I write this mail if it did).
>
> What have I missed?
>
> Thx
>
> Kevin
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user



From mposolda at redhat.com  Thu Jan  4 05:39:29 2018
From: mposolda at redhat.com (Marek Posolda)
Date: Thu, 4 Jan 2018 11:39:29 +0100
Subject: [keycloak-user] GET users endpoint is making lots of requests
 to the database (its really slow!)
In-Reply-To: <CAJzRJ5K+fJXpJ2u28yWVh5NCwJ310qb7M4es0fpgH3LW54h+pw@mail.gmail.com>
References: <CAJzRJ5K+fJXpJ2u28yWVh5NCwJ310qb7M4es0fpgH3LW54h+pw@mail.gmail.com>
Message-ID: <6148174c-f714-b56d-03a6-4dc5d4309cb6@redhat.com>

On 03/01/18 23:59, Cesar Salazar wrote:
> Hi,
>
> First of all, thanks for the great work on keycloak!
>
> We are using keycloak for an application, and it was working great (until
> we launched to production)
>
> We have 150 users which are connected to an Active Directory using the
> Federation functionality.
>
> It works, but the endpoint GET /{realm}/users takes about 23 seconds to
> respond (Keycloak running on a container in GKE backed by a mysql server on
> Google Cloud SQL).
>
> I enabled mysql logging and the problem seems to be that just for
> responding this endpoint, the server makes 901 queries to the database!
>
> These are the queries:
>
> First query, to get the users:
>
> select userentity0_.ID as ID1_71_, userentity0_.CREATED_TIMESTAMP as
> CREATED_2_71_, userentity0_.EMAIL as EMAIL3_71_,
> userentity0_.EMAIL_CONSTRAINT as EMAIL_CO4_71_, userentity0_.EMAIL_VERIFIED
> as EMAIL_VE5_71_, userentity0_.ENABLED as ENABLED6_71_,
> userentity0_.FEDERATION_LINK as FEDERATI7_71_, userentity0_.FIRST_NAME as
> FIRST_NA8_71_, userentity0_.LAST_NAME as LAST_NAM9_71_,
> userentity0_.NOT_BEFORE as NOT_BEF10_71_, userentity0_.REALM_ID as
> REALM_I11_71_, userentity0_.SERVICE_ACCOUNT_CLIENT_LINK as SERVICE12_71_,
> userentity0_.USERNAME as USERNAM13_71_ from USER_ENTITY userentity0_ where
> userentity0_.REALM_ID='my-realm' and
> (userentity0_.SERVICE_ACCOUNT_CLIENT_LINK is null) order by
> userentity0_.USERNAME
>
>
> Then,* for each user *a query like this, (getting user attributes I guess)
>
> select attributes0_.USER_ID as USER_ID4_67_0_, attributes0_.ID as
> ID1_67_0_, attributes0_.ID as ID1_67_1_, attributes0_.NAME as NAME2_67_1_,
> attributes0_.USER_ID as USER_ID4_67_1_, attributes0_.VALUE as VALUE3_67_1_
> from USER_ATTRIBUTE attributes0_ where
> attributes0_.USER_ID='b920df7c-a419-4150-86bd-9f81c7ea0b70'
>
>
> Then,* for each user* 4 queries similar to this, (getting credentials I
> guess)
>
> select credential0_.ID as ID1_18_, credential0_.ALGORITHM as ALGORITH2_18_,
> credential0_.COUNTER as COUNTER3_18_, credential0_.CREATED_DATE as
> CREATED_4_18_, credential0_.DEVICE as DEVICE5_18_, credential0_.DIGITS as
> DIGITS6_18_, credential0_.HASH_ITERATIONS as HASH_ITE7_18_,
> credential0_.PERIOD as PERIOD8_18_, credential0_.SALT as SALT9_18_,
> credential0_.TYPE as TYPE10_18_, credential0_.USER_ID as USER_ID12_18_,
> credential0_.VALUE as VALUE11_18_ from CREDENTIAL credential0_ where
> credential0_.USER_ID='94525793-297b-4895-ab2b-7cf8b580e9fa' and
> credential0_.TYPE='totp'
>
>
> A query with type *totp* is queried 2 times, the other 2 times are queried
> with type *hotp* and *password*
>
> and finally one more query* for each user* (getting required actions I
> guess)
>
> select requiredac0_.USER_ID as USER_ID2_77_0_, requiredac0_.REQUIRED_ACTION
> as REQUIRED1_77_0_, requiredac0_.REQUIRED_ACTION as REQUIRED1_77_1_,
> requiredac0_.USER_ID as USER_ID2_77_1_ from USER_REQUIRED_ACTION
> requiredac0_ where
> requiredac0_.USER_ID='94525793-297b-4895-ab2b-7cf8b580e9fa'
>
>
> So, in total, for 150 users, Keycloak is making 901 requests to the
> database! If I increase the number to 500 users, will it be 30001
> requests???
>
> How can this be improved? Is there something wrong I'm doing in the
> configuration? Does this happens only with Federated users?
I don't think it is specific only for federated users. IMO the same will 
happen for 150 non-federated users too.

You can create JIRA, but not sure if we are able to fix it on our side, 
we are using JPA/Hibernate under the covers and I think it doesn't 
easily allow something like "batch" query to retrieve attributes, 
requiredActions, credentials in single SQL query for current page of 
users...

Maybe the options for you to improve this are:
- Improve DB connection and make sure that there is no big network 
latency between DB and Keycloak (It seems this is the big issue in your 
env).
- Use LDAP No-Import mode

Marek
>
> Thanks!
>


From mposolda at redhat.com  Thu Jan  4 05:44:13 2018
From: mposolda at redhat.com (Marek Posolda)
Date: Thu, 4 Jan 2018 11:44:13 +0100
Subject: [keycloak-user] Add required action "Update Password" to all
 users after Password Policy change
In-Reply-To: <1095562809.16778079.1514997574414.JavaMail.zimbra@xsb.com>
References: <1095562809.16778079.1514997574414.JavaMail.zimbra@xsb.com>
Message-ID: <c0835273-7916-9891-15d9-e4439d54b30d@redhat.com>

I guess you can go to tab "Required actions" in the admin console and 
switch the checkbox for "Update Password" required action to "default" . 
Then all new users should automatically be added to this action AFAIK.

If it's not sufficient, the easiest is likely really to update each user 
and manually add requiredAction to him. I would do it with admin REST API.

Marek

On 03/01/18 17:39, Steve Hoffman wrote:
> Currently updating the Password Policy for a realm, and I was looking for an easier (safer) way of forcing users to update password on login once we've set our new preferences.
>
> I'm aware that I can iterate through the users in the admin console (time/cost prohibitive) or POST/Update to the Admin REST API for each individual user after a GET for the user list.
>
> Is there another simpler built-in mechanism that I'm overlooking?
>
> Thanks,
> Stephen Hoffman
>


From rgshepherd at gmail.com  Thu Jan  4 06:42:36 2018
From: rgshepherd at gmail.com (Rob Shepherd)
Date: Thu, 4 Jan 2018 11:42:36 +0000
Subject: [keycloak-user] GET users endpoint is making lots of requests
 to the database (its really slow!)
In-Reply-To: <CAJzRJ5K+fJXpJ2u28yWVh5NCwJ310qb7M4es0fpgH3LW54h+pw@mail.gmail.com>
References: <CAJzRJ5K+fJXpJ2u28yWVh5NCwJ310qb7M4es0fpgH3LW54h+pw@mail.gmail.com>
Message-ID: <1F7FCB77-0DF9-4BDF-8CCA-060859FBC6D3@gmail.com>

Cesar,

Do you have Caching enabled?

Realm > User Federation > Cache Settings > Cache Policy


I posted to the list a few week ago to point out that with Caching enabled, the Keycloak was actually making More requests to a custom federated user backend.

http://lists.jboss.org/pipermail/keycloak-user/2017-November/012230.html <http://lists.jboss.org/pipermail/keycloak-user/2017-November/012230.html>


I appreciate that you use a different form of user federation, but it is the same unexpected scenario.

Rob




> On 3 Jan 2018, at 22:59, Cesar Salazar <csalazar at devsu.com> wrote:
> 
> Hi,
> 
> First of all, thanks for the great work on keycloak!
> 
> We are using keycloak for an application, and it was working great (until
> we launched to production)
> 
> We have 150 users which are connected to an Active Directory using the
> Federation functionality.
> 
> It works, but the endpoint GET /{realm}/users takes about 23 seconds to
> respond (Keycloak running on a container in GKE backed by a mysql server on
> Google Cloud SQL).
> 
> I enabled mysql logging and the problem seems to be that just for
> responding this endpoint, the server makes 901 queries to the database!
> 
> These are the queries:
> 
> First query, to get the users:
> 
> select userentity0_.ID as ID1_71_, userentity0_.CREATED_TIMESTAMP as
> CREATED_2_71_, userentity0_.EMAIL as EMAIL3_71_,
> userentity0_.EMAIL_CONSTRAINT as EMAIL_CO4_71_, userentity0_.EMAIL_VERIFIED
> as EMAIL_VE5_71_, userentity0_.ENABLED as ENABLED6_71_,
> userentity0_.FEDERATION_LINK as FEDERATI7_71_, userentity0_.FIRST_NAME as
> FIRST_NA8_71_, userentity0_.LAST_NAME as LAST_NAM9_71_,
> userentity0_.NOT_BEFORE as NOT_BEF10_71_, userentity0_.REALM_ID as
> REALM_I11_71_, userentity0_.SERVICE_ACCOUNT_CLIENT_LINK as SERVICE12_71_,
> userentity0_.USERNAME as USERNAM13_71_ from USER_ENTITY userentity0_ where
> userentity0_.REALM_ID='my-realm' and
> (userentity0_.SERVICE_ACCOUNT_CLIENT_LINK is null) order by
> userentity0_.USERNAME
> 
> 
> Then,* for each user *a query like this, (getting user attributes I guess)
> 
> select attributes0_.USER_ID as USER_ID4_67_0_, attributes0_.ID as
> ID1_67_0_, attributes0_.ID as ID1_67_1_, attributes0_.NAME as NAME2_67_1_,
> attributes0_.USER_ID as USER_ID4_67_1_, attributes0_.VALUE as VALUE3_67_1_
> from USER_ATTRIBUTE attributes0_ where
> attributes0_.USER_ID='b920df7c-a419-4150-86bd-9f81c7ea0b70'
> 
> 
> Then,* for each user* 4 queries similar to this, (getting credentials I
> guess)
> 
> select credential0_.ID as ID1_18_, credential0_.ALGORITHM as ALGORITH2_18_,
> credential0_.COUNTER as COUNTER3_18_, credential0_.CREATED_DATE as
> CREATED_4_18_, credential0_.DEVICE as DEVICE5_18_, credential0_.DIGITS as
> DIGITS6_18_, credential0_.HASH_ITERATIONS as HASH_ITE7_18_,
> credential0_.PERIOD as PERIOD8_18_, credential0_.SALT as SALT9_18_,
> credential0_.TYPE as TYPE10_18_, credential0_.USER_ID as USER_ID12_18_,
> credential0_.VALUE as VALUE11_18_ from CREDENTIAL credential0_ where
> credential0_.USER_ID='94525793-297b-4895-ab2b-7cf8b580e9fa' and
> credential0_.TYPE='totp'
> 
> 
> A query with type *totp* is queried 2 times, the other 2 times are queried
> with type *hotp* and *password*
> 
> and finally one more query* for each user* (getting required actions I
> guess)
> 
> select requiredac0_.USER_ID as USER_ID2_77_0_, requiredac0_.REQUIRED_ACTION
> as REQUIRED1_77_0_, requiredac0_.REQUIRED_ACTION as REQUIRED1_77_1_,
> requiredac0_.USER_ID as USER_ID2_77_1_ from USER_REQUIRED_ACTION
> requiredac0_ where
> requiredac0_.USER_ID='94525793-297b-4895-ab2b-7cf8b580e9fa'
> 
> 
> So, in total, for 150 users, Keycloak is making 901 requests to the
> database! If I increase the number to 500 users, will it be 30001
> requests???
> 
> How can this be improved? Is there something wrong I'm doing in the
> configuration? Does this happens only with Federated users?
> 
> Thanks!
> 
> -- 
> *Cesar Salazar*
> Development Manager
> DEVSU | www.devsu.com
> skype: cesarsalazar007
> P: (213)-291-0752
> M: +593 9 2917 160 (Ecuador)
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user


From sthorger at redhat.com  Thu Jan  4 07:09:47 2018
From: sthorger at redhat.com (Stian Thorgersen)
Date: Thu, 4 Jan 2018 13:09:47 +0100
Subject: [keycloak-user] Keycloak 3.4.3.Final released
Message-ID: <CAJgngAemewSWAuEk_J6oyumYVudNMqanPkZ7_ctxMYcXigUizw@mail.gmail.com>

http://blog.keycloak.org/2018/01/keycloak-343final-released.html

From tomas at intrahouse.com  Thu Jan  4 09:12:36 2018
From: tomas at intrahouse.com (=?UTF-8?B?VG9tw6FzIEdhcmPDrWE=?=)
Date: Thu, 04 Jan 2018 14:12:36 +0000
Subject: [keycloak-user] [Feature request] Adding scheduled tasks / change
 order of required actions / searchable user attributes
Message-ID: <CALgk1PLsVKjDaxcqDoKu3S8Ci-V1p96UTByoKL5E8P5SvQFk3g@mail.gmail.com>

Hi,

   I'm trying to fulfill the needs of the GDPR of my company in Keycloak
and I noticed these things:

- I cannot add a scheduled task. I don't know where to put code like you
have in KeycloakApplication like:
            TimerProvider timer = session.getProvider(TimerProvider.class);
            timer.schedule(new
ClusterAwareScheduledTaskRunner(sessionFactory, new ClearExpiredEvents(),
interval), interval, "ClearExpiredEvents");

, so I can add a recurrent task starting from the startup of Keycloak. My
use case is that I want to remove users that didn't verify their email or
accepted terms & conditions after a week of first registration. So I was
thinking to add a task to be run daily to do that.

- The order of required actions execution is in alphabetical order, so if I
wanted a custom required action to be run after the "Verify email" action I
need to be sure that the name of my custom required action starts with "W"
at least. An UI interface like what we already have in the Authenticators
part would be nice.

- There are no facilities inside Keycloak to search users with a specific
attribute key or value. It would be nice too to have long integers as
attibute values, in case we want to search for users with greater / less
than a specific timestamp attribute like the one you use in the terms &
conditions required action. For example, for the removal task, I'd like to
search for users without a custom attribute, then I'll remove those. I
guess I'll just extend the data model if needed to workaround this issue.

- If someone declines the terms & conditions, the user is redirected to a
blank page with an "error" in the screen. I don't care about this since I'm
going to make my custom required action if I can find an alternative for
the things I'm saying above.

If I'm wrong about something, please let me know.

Thanks,
Tom?s

From simonpayne58 at gmail.com  Thu Jan  4 09:21:05 2018
From: simonpayne58 at gmail.com (Simon Payne)
Date: Thu, 4 Jan 2018 14:21:05 +0000
Subject: [keycloak-user] cockroachdb
Message-ID: <CAPZw1G5FjA5J4-LsE+QC3npJm0Pia4K2FJgbkjsqsp5wL1WSBQ@mail.gmail.com>

Hi,

has anyone successfully managed to use cockroachdb with keycloak?

if so, what steps were taken?

thanks

Simon.

From csalazar at devsu.com  Thu Jan  4 09:51:19 2018
From: csalazar at devsu.com (Cesar Salazar)
Date: Thu, 4 Jan 2018 09:51:19 -0500
Subject: [keycloak-user] GET users endpoint is making lots of requests
 to the database (its really slow!)
In-Reply-To: <6148174c-f714-b56d-03a6-4dc5d4309cb6@redhat.com>
References: <CAJzRJ5K+fJXpJ2u28yWVh5NCwJ310qb7M4es0fpgH3LW54h+pw@mail.gmail.com>
	<6148174c-f714-b56d-03a6-4dc5d4309cb6@redhat.com>
Message-ID: <CAJzRJ5JhuhRVTDup8tvH4+rUA6+LOwE5AbJwr+YhTNiPbdYNDQ@mail.gmail.com>

Hi Marek, thanks for your answer. I just created a ticket in JIRA:
https://issues.jboss.org/browse/KEYCLOAK-6134

I was able to reduce the time to around 2.5 - 3 seconds by installing
Keycloak and mysql dockerized on bare metal (on a powerful server), but
still it should be considered slow, taking into account that we plan to
have not less than a few thousand users... and also considering that it's
not affordable to have such environment just for the authentication service.

If 150 users require 901 queries, and it takes around 3 seconds to respond,
with 3000 users, we would have 18001 requests, which would mean around 60
seconds for querying the users. (calculated using simple rule of three)

I tried the solution of using LDAP No-Import mode, but that doesn't solve
my use case, since I do need the /realm/users endpoint to return all the
users (not only allow them to login).

Anyways, for now we will stop scaling and I will ask one of my developers
to take a look at the code to see if we can find a fix and send a PR or
otherwise we will implement our own endpoint to get all the users (which is
something we need for our app).

Thanks!


2018-01-04 5:39 GMT-05:00 Marek Posolda <mposolda at redhat.com>:

> On 03/01/18 23:59, Cesar Salazar wrote:
>
>> Hi,
>>
>> First of all, thanks for the great work on keycloak!
>>
>> We are using keycloak for an application, and it was working great (until
>> we launched to production)
>>
>> We have 150 users which are connected to an Active Directory using the
>> Federation functionality.
>>
>> It works, but the endpoint GET /{realm}/users takes about 23 seconds to
>> respond (Keycloak running on a container in GKE backed by a mysql server
>> on
>> Google Cloud SQL).
>>
>> I enabled mysql logging and the problem seems to be that just for
>> responding this endpoint, the server makes 901 queries to the database!
>>
>> These are the queries:
>>
>> First query, to get the users:
>>
>> select userentity0_.ID as ID1_71_, userentity0_.CREATED_TIMESTAMP as
>> CREATED_2_71_, userentity0_.EMAIL as EMAIL3_71_,
>> userentity0_.EMAIL_CONSTRAINT as EMAIL_CO4_71_,
>> userentity0_.EMAIL_VERIFIED
>> as EMAIL_VE5_71_, userentity0_.ENABLED as ENABLED6_71_,
>> userentity0_.FEDERATION_LINK as FEDERATI7_71_, userentity0_.FIRST_NAME as
>> FIRST_NA8_71_, userentity0_.LAST_NAME as LAST_NAM9_71_,
>> userentity0_.NOT_BEFORE as NOT_BEF10_71_, userentity0_.REALM_ID as
>> REALM_I11_71_, userentity0_.SERVICE_ACCOUNT_CLIENT_LINK as SERVICE12_71_,
>> userentity0_.USERNAME as USERNAM13_71_ from USER_ENTITY userentity0_ where
>> userentity0_.REALM_ID='my-realm' and
>> (userentity0_.SERVICE_ACCOUNT_CLIENT_LINK is null) order by
>> userentity0_.USERNAME
>>
>>
>> Then,* for each user *a query like this, (getting user attributes I guess)
>>
>> select attributes0_.USER_ID as USER_ID4_67_0_, attributes0_.ID as
>> ID1_67_0_, attributes0_.ID as ID1_67_1_, attributes0_.NAME as NAME2_67_1_,
>> attributes0_.USER_ID as USER_ID4_67_1_, attributes0_.VALUE as VALUE3_67_1_
>> from USER_ATTRIBUTE attributes0_ where
>> attributes0_.USER_ID='b920df7c-a419-4150-86bd-9f81c7ea0b70'
>>
>>
>> Then,* for each user* 4 queries similar to this, (getting credentials I
>> guess)
>>
>> select credential0_.ID as ID1_18_, credential0_.ALGORITHM as
>> ALGORITH2_18_,
>> credential0_.COUNTER as COUNTER3_18_, credential0_.CREATED_DATE as
>> CREATED_4_18_, credential0_.DEVICE as DEVICE5_18_, credential0_.DIGITS as
>> DIGITS6_18_, credential0_.HASH_ITERATIONS as HASH_ITE7_18_,
>> credential0_.PERIOD as PERIOD8_18_, credential0_.SALT as SALT9_18_,
>> credential0_.TYPE as TYPE10_18_, credential0_.USER_ID as USER_ID12_18_,
>> credential0_.VALUE as VALUE11_18_ from CREDENTIAL credential0_ where
>> credential0_.USER_ID='94525793-297b-4895-ab2b-7cf8b580e9fa' and
>> credential0_.TYPE='totp'
>>
>>
>> A query with type *totp* is queried 2 times, the other 2 times are queried
>> with type *hotp* and *password*
>>
>> and finally one more query* for each user* (getting required actions I
>> guess)
>>
>> select requiredac0_.USER_ID as USER_ID2_77_0_,
>> requiredac0_.REQUIRED_ACTION
>> as REQUIRED1_77_0_, requiredac0_.REQUIRED_ACTION as REQUIRED1_77_1_,
>> requiredac0_.USER_ID as USER_ID2_77_1_ from USER_REQUIRED_ACTION
>> requiredac0_ where
>> requiredac0_.USER_ID='94525793-297b-4895-ab2b-7cf8b580e9fa'
>>
>>
>> So, in total, for 150 users, Keycloak is making 901 requests to the
>> database! If I increase the number to 500 users, will it be 30001
>> requests???
>>
>> How can this be improved? Is there something wrong I'm doing in the
>> configuration? Does this happens only with Federated users?
>>
> I don't think it is specific only for federated users. IMO the same will
> happen for 150 non-federated users too.
>
> You can create JIRA, but not sure if we are able to fix it on our side, we
> are using JPA/Hibernate under the covers and I think it doesn't easily
> allow something like "batch" query to retrieve attributes, requiredActions,
> credentials in single SQL query for current page of users...
>
> Maybe the options for you to improve this are:
> - Improve DB connection and make sure that there is no big network latency
> between DB and Keycloak (It seems this is the big issue in your env).
> - Use LDAP No-Import mode
>
> Marek
>
>>
>> Thanks!
>>
>>
>


-- 
*Cesar Salazar*
Development Manager
DEVSU | www.devsu.com
skype: cesarsalazar007
P: (213)-291-0752
M: +593 9 2917 160 (Ecuador)

From raphoa at worteks.com  Thu Jan  4 09:59:00 2018
From: raphoa at worteks.com (=?UTF-8?Q?Rapha=c3=abl_HOAREAU?=)
Date: Thu, 4 Jan 2018 15:59:00 +0100
Subject: [keycloak-user] OpenID Connect IdP and nonce parameter
Message-ID: <49fc1c6b-a2a4-282b-6d69-ac458734923f@worteks.com>

Hi,

I'm facing an issue where I use an external oidc IdP (FranceConnect) for 
my users to log in.

When trying to login with this provider, i have this error :

{"status":"fail","message":"The following fields are missing or empty : nonce"}

If i put, manually, &nonce=someRandomInt, in the URL, the process continues.

Am i missing something in my Identity Provider configuration ? Is there 
a way to add a parameter when requesting the external provider ?


Regards,

Rapha?l HOAREAU.



From csalazar at devsu.com  Thu Jan  4 10:00:12 2018
From: csalazar at devsu.com (Cesar Salazar)
Date: Thu, 4 Jan 2018 10:00:12 -0500
Subject: [keycloak-user] GET users endpoint is making lots of requests
 to the database (its really slow!)
In-Reply-To: <1F7FCB77-0DF9-4BDF-8CCA-060859FBC6D3@gmail.com>
References: <CAJzRJ5K+fJXpJ2u28yWVh5NCwJ310qb7M4es0fpgH3LW54h+pw@mail.gmail.com>
	<1F7FCB77-0DF9-4BDF-8CCA-060859FBC6D3@gmail.com>
Message-ID: <CAJzRJ5LCTYsG-7yX4azJ+TM1O_j007GBbuStkYVY2h_JO2rdtg@mail.gmail.com>

Hi Rob, caching was set to "DEFAULT". I just tested with "NO CACHING", but
I found no noticeable improvement. Querying the users endpoint still takes
around 22 seconds.

2018-01-04 6:42 GMT-05:00 Rob Shepherd <rgshepherd at gmail.com>:

> Cesar,
>
> Do you have Caching enabled?
>
> Realm > User Federation > Cache Settings > Cache Policy
>
>
> I posted to the list a few week ago to point out that with Caching
> *enabled*, the Keycloak was actually making More requests to a custom
> federated user backend.
>
> http://lists.jboss.org/pipermail/keycloak-user/2017-November/012230.html
>
>
> I appreciate that you use a different form of user federation, but it is
> the same unexpected scenario.
>
> Rob
>
>
>
>
> On 3 Jan 2018, at 22:59, Cesar Salazar <csalazar at devsu.com> wrote:
>
> Hi,
>
> First of all, thanks for the great work on keycloak!
>
> We are using keycloak for an application, and it was working great (until
> we launched to production)
>
> We have 150 users which are connected to an Active Directory using the
> Federation functionality.
>
> It works, but the endpoint GET /{realm}/users takes about 23 seconds to
> respond (Keycloak running on a container in GKE backed by a mysql server on
> Google Cloud SQL).
>
> I enabled mysql logging and the problem seems to be that just for
> responding this endpoint, the server makes 901 queries to the database!
>
> These are the queries:
>
> First query, to get the users:
>
> select userentity0_.ID as ID1_71_, userentity0_.CREATED_TIMESTAMP as
> CREATED_2_71_, userentity0_.EMAIL as EMAIL3_71_,
> userentity0_.EMAIL_CONSTRAINT as EMAIL_CO4_71_, userentity0_.EMAIL_VERIFIED
> as EMAIL_VE5_71_, userentity0_.ENABLED as ENABLED6_71_,
> userentity0_.FEDERATION_LINK as FEDERATI7_71_, userentity0_.FIRST_NAME as
> FIRST_NA8_71_, userentity0_.LAST_NAME as LAST_NAM9_71_,
> userentity0_.NOT_BEFORE as NOT_BEF10_71_, userentity0_.REALM_ID as
> REALM_I11_71_, userentity0_.SERVICE_ACCOUNT_CLIENT_LINK as SERVICE12_71_,
> userentity0_.USERNAME as USERNAM13_71_ from USER_ENTITY userentity0_ where
> userentity0_.REALM_ID='my-realm' and
> (userentity0_.SERVICE_ACCOUNT_CLIENT_LINK is null) order by
> userentity0_.USERNAME
>
>
> Then,* for each user *a query like this, (getting user attributes I guess)
>
> select attributes0_.USER_ID as USER_ID4_67_0_, attributes0_.ID as
> ID1_67_0_, attributes0_.ID as ID1_67_1_, attributes0_.NAME as NAME2_67_1_,
> attributes0_.USER_ID as USER_ID4_67_1_, attributes0_.VALUE as VALUE3_67_1_
> from USER_ATTRIBUTE attributes0_ where
> attributes0_.USER_ID='b920df7c-a419-4150-86bd-9f81c7ea0b70'
>
>
> Then,* for each user* 4 queries similar to this, (getting credentials I
> guess)
>
> select credential0_.ID as ID1_18_, credential0_.ALGORITHM as ALGORITH2_18_,
> credential0_.COUNTER as COUNTER3_18_, credential0_.CREATED_DATE as
> CREATED_4_18_, credential0_.DEVICE as DEVICE5_18_, credential0_.DIGITS as
> DIGITS6_18_, credential0_.HASH_ITERATIONS as HASH_ITE7_18_,
> credential0_.PERIOD as PERIOD8_18_, credential0_.SALT as SALT9_18_,
> credential0_.TYPE as TYPE10_18_, credential0_.USER_ID as USER_ID12_18_,
> credential0_.VALUE as VALUE11_18_ from CREDENTIAL credential0_ where
> credential0_.USER_ID='94525793-297b-4895-ab2b-7cf8b580e9fa' and
> credential0_.TYPE='totp'
>
>
> A query with type *totp* is queried 2 times, the other 2 times are queried
> with type *hotp* and *password*
>
> and finally one more query* for each user* (getting required actions I
> guess)
>
> select requiredac0_.USER_ID as USER_ID2_77_0_, requiredac0_.REQUIRED_ACTION
> as REQUIRED1_77_0_, requiredac0_.REQUIRED_ACTION as REQUIRED1_77_1_,
> requiredac0_.USER_ID as USER_ID2_77_1_ from USER_REQUIRED_ACTION
> requiredac0_ where
> requiredac0_.USER_ID='94525793-297b-4895-ab2b-7cf8b580e9fa'
>
>
> So, in total, for 150 users, Keycloak is making 901 requests to the
> database! If I increase the number to 500 users, will it be 30001
> requests???
>
> How can this be improved? Is there something wrong I'm doing in the
> configuration? Does this happens only with Federated users?
>
> Thanks!
>
> --
> *Cesar Salazar*
> Development Manager
> DEVSU | www.devsu.com
> skype: cesarsalazar007
> P: (213)-291-0752 <(213)%20291-0752>
> M: +593 9 2917 160 (Ecuador)
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
>
>


-- 
*Cesar Salazar*
Development Manager
DEVSU | www.devsu.com
skype: cesarsalazar007
P: (213)-291-0752
M: +593 9 2917 160 (Ecuador)

From jens.schliesser at gmail.com  Thu Jan  4 10:27:57 2018
From: jens.schliesser at gmail.com (Jens Schliesser)
Date: Thu, 4 Jan 2018 16:27:57 +0100
Subject: [keycloak-user] Keycloak JS + Cordova Adapter + iOS
Message-ID: <CALjQhGJ8aNYgHARHNWXj-DZaX9kyYYTxULZDLD=_iJnz8e1ARg@mail.gmail.com>

Hello,

we have a Angular4 web application running with keycloak.js that works
great.

We are now trying to put this application into a cordova container running
on iOS, but in the login function of the keycloak cordova adapter

var loginUrl = kc.createLoginUrl(options);
var ref = window.open(loginUrl, '_blank', o);

ref is always null, so adding the event listener fails ?!?


We are bootstrapping (main.ts) our angular application like this:

function bootstrapKeyCloak() {
    KeycloakService.init({
        'url': environment.keycloakConfig.url,
        'realm': environment.keycloakConfig.realm,
        'clientId': environment.keycloakConfig.clientId,
    }, {
        onLoad: 'login-required',
        flow: 'standard'
    }).then(() => {
        platformBrowserDynamic().bootstrapModule(AppModule);
    }).catch((e: any) => {
        alert(e);
    });
}

if (typeof window['cordova'] !== 'undefined') {
    if(document) {
        document.addEventListener('deviceready', () => {
            bootstrapKeyCloak();
        }, false);
    }
} else {
    bootstrapKeyCloak();
}


Any ideas why window.open fails and how to fix this?

-- 

Kind Regards,

Jens Schliesser

From s.hoffman at xsb.com  Thu Jan  4 15:23:35 2018
From: s.hoffman at xsb.com (Steve Hoffman)
Date: Thu, 4 Jan 2018 14:23:35 -0600 (CST)
Subject: [keycloak-user] Add required action "Update Password" to all
 users after Password Policy change
In-Reply-To: <c0835273-7916-9891-15d9-e4439d54b30d@redhat.com>
References: <1095562809.16778079.1514997574414.JavaMail.zimbra@xsb.com>
	<c0835273-7916-9891-15d9-e4439d54b30d@redhat.com>
Message-ID: <580807947.17116970.1515097415839.JavaMail.zimbra@xsb.com>

I was looking for a shortcut rather than invoking the REST API for each individual user, which is what I ended up doing in a quick utility.

The documentation seems to indicate a new feature would be added soon and/or in the future.  Guess I was hoping it already existed and hadn't made it into the docs yet.

Thanks,
-Stephen Hoffman

----- Original Message -----
From: "Marek Posolda" <mposolda at redhat.com>
To: "Steve Hoffman" <s.hoffman at xsb.com>, "keycloak-user" <keycloak-user at lists.jboss.org>
Sent: Thursday, January 4, 2018 5:44:13 AM
Subject: Re: [keycloak-user] Add required action "Update Password" to all users after Password Policy change

I guess you can go to tab "Required actions" in the admin console and 
switch the checkbox for "Update Password" required action to "default" . 
Then all new users should automatically be added to this action AFAIK.

If it's not sufficient, the easiest is likely really to update each user 
and manually add requiredAction to him. I would do it with admin REST API.

Marek

On 03/01/18 17:39, Steve Hoffman wrote:
> Currently updating the Password Policy for a realm, and I was looking for an easier (safer) way of forcing users to update password on login once we've set our new preferences.
>
> I'm aware that I can iterate through the users in the admin console (time/cost prohibitive) or POST/Update to the Admin REST API for each individual user after a GET for the user list.
>
> Is there another simpler built-in mechanism that I'm overlooking?
>
> Thanks,
> Stephen Hoffman
>
-- 
XSB, Inc

Office (631) 371-8100 Ext. 8128
Mobile (631) 579-9857
Fax (631) 382-8228

http://www.xsb.com/ 

DISCLAIMER:
This e-mail is intended for the use of the addressee(s) only and may contain privileged, confidential, or proprietary information that is exempt from disclosure under law. If you are not the intended recipient, please do not read, copy, use or disclose the contents of this communication to others.

Please notify the sender that you have received this e-mail in error by replying to the e-mail. Please then delete the e-mail and destroy any copies of it. Thank you.

From mposolda at redhat.com  Thu Jan  4 16:06:40 2018
From: mposolda at redhat.com (Marek Posolda)
Date: Thu, 4 Jan 2018 22:06:40 +0100
Subject: [keycloak-user] OpenID Connect IdP and nonce parameter
In-Reply-To: <49fc1c6b-a2a4-282b-6d69-ac458734923f@worteks.com>
References: <49fc1c6b-a2a4-282b-6d69-ac458734923f@worteks.com>
Message-ID: <9c40afc7-bddd-3951-4d30-9f2bdfa1bc1d@redhat.com>

Yes, Keycloak doesn't add "nonce" to the requests to identity providers. 
But IMO that's not the Keycloak's fault that your scenario doesn't work 
because "nonce" is not required, but just "optional" per OIDC 
specification in Authorization Code flow. See [1] .

Is FranceConnect using Authorization Code Flow or some other OIDC/OAuth2 
flow? If it's using some other flow (EG. Implicit flow), is it possible 
to switch it to use Authorization Code flow instead? If it already uses 
Authorization Code flow, then it's mistake on their side as "nonce" is 
optional parameter per specs, so they shouldn't require it though.

Still, you can maybe create JIRA in Keycloak for adding nonce. There 
shouldn't be any significant issue with adding it (besides the URL to 
identityProviders will be a bit longer).

[1] http://openid.net/specs/openid-connect-core-1_0.html#AuthRequest

Marek


On 04/01/18 15:59, Rapha?l HOAREAU wrote:
> Hi,
>
> I'm facing an issue where I use an external oidc IdP (FranceConnect) for
> my users to log in.
>
> When trying to login with this provider, i have this error :
>
> {"status":"fail","message":"The following fields are missing or empty : nonce"}
>
> If i put, manually, &nonce=someRandomInt, in the URL, the process continues.
>
> Am i missing something in my Identity Provider configuration ? Is there
> a way to add a parameter when requesting the external provider ?
>
>
> Regards,
>
> Rapha?l HOAREAU.
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user



From mposolda at redhat.com  Thu Jan  4 16:17:01 2018
From: mposolda at redhat.com (Marek Posolda)
Date: Thu, 4 Jan 2018 22:17:01 +0100
Subject: [keycloak-user] [Feature request] Adding scheduled tasks /
 change order of required actions / searchable user attributes
In-Reply-To: <CALgk1PLsVKjDaxcqDoKu3S8Ci-V1p96UTByoKL5E8P5SvQFk3g@mail.gmail.com>
References: <CALgk1PLsVKjDaxcqDoKu3S8Ci-V1p96UTByoKL5E8P5SvQFk3g@mail.gmail.com>
Message-ID: <11173036-2963-92f7-4834-3a8e63c84027@redhat.com>

On 04/01/18 15:12, Tom?s Garc?a wrote:
> Hi,
>
>     I'm trying to fulfill the needs of the GDPR of my company in Keycloak
> and I noticed these things:
>
> - I cannot add a scheduled task. I don't know where to put code like you
> have in KeycloakApplication like:
>              TimerProvider timer = session.getProvider(TimerProvider.class);
>              timer.schedule(new
> ClusterAwareScheduledTaskRunner(sessionFactory, new ClearExpiredEvents(),
> interval), interval, "ClearExpiredEvents");
>
> , so I can add a recurrent task starting from the startup of Keycloak. My
> use case is that I want to remove users that didn't verify their email or
> accepted terms & conditions after a week of first registration. So I was
> thinking to add a task to be run daily to do that.
There are ways to do that indirectly. For example, you can create custom 
provider of any type and add this to the "postInit" method here. But 
rather listen to the PostMigrationEven to ensure that tasks are 
triggered after
the DB migration is finished. See for example 
InfinispanAuthenticationSessionProviderFactory.postInit for inspiration.
>
> - The order of required actions execution is in alphabetical order, so if I
> wanted a custom required action to be run after the "Verify email" action I
> need to be sure that the name of my custom required action starts with "W"
> at least. An UI interface like what we already have in the Authenticators
> part would be nice.
+1 that it would be nice. On the other hand, is it a big issue to create 
the action starting with "W" ?

Feel free to create JIRA for add priority to requiredActions, just not 
sure when it will be done (unless you send PR by yourself :)
>
> - There are no facilities inside Keycloak to search users with a specific
> attribute key or value. It would be nice too to have long integers as
> attibute values, in case we want to search for users with greater / less
> than a specific timestamp attribute like the one you use in the terms &
> conditions required action. For example, for the removal task, I'd like to
> search for users without a custom attribute, then I'll remove those. I
> guess I'll just extend the data model if needed to workaround this issue.
There is model method for search by attribute - 
UserProvider.searchForUserByUserAttribute . There is no REST endpoint, 
but you can create your own custom REST endpoint for this though if you 
need it. But if you need to use this from your requiredAction, it should 
work fine.
>
> - If someone declines the terms & conditions, the user is redirected to a
> blank page with an "error" in the screen. I don't care about this since I'm
> going to make my custom required action if I can find an alternative for
> the things I'm saying above.
>
> If I'm wrong about something, please let me know.
>
> Thanks,
> Tom?s
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user



From sthorger at redhat.com  Fri Jan  5 03:02:53 2018
From: sthorger at redhat.com (Stian Thorgersen)
Date: Fri, 5 Jan 2018 09:02:53 +0100
Subject: [keycloak-user] CORS in Keycloak 3.4
In-Reply-To: <CAP1gnsJk-KxFprmT9a3wnmRyAee_2POqV-NPRY7L1AZwqQ6MUQ@mail.gmail.com>
References: <CAP1gnsJk-KxFprmT9a3wnmRyAee_2POqV-NPRY7L1AZwqQ6MUQ@mail.gmail.com>
Message-ID: <CAJgngAei4b_EocqFaOjTXC2=+S_+kpJha9gdWqFoGfza1Zta+w@mail.gmail.com>

https://github.com/keycloak/keycloak/tree/master/examples/cors

On 4 January 2018 at 08:55, Jonas Sch?nenberger <
jonas.schoenenberger at gmail.com> wrote:

> Hey there
>
> I?ve been trying to figure out how to enable CORS in the later versions of
> KeyCloak. I can?t seem to find a valid way to achieve this besides
> hardcoding response headers in the standalone.xml. I?m using a standalone
> deployment.
> I know the functionality to handle preflight and other CORS scenarios is
> there, so there must be surely a way to activate it?
>
> Could somebody enlighten me please?
>
> Thanks a lot
> Jonas
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

From tomas at intrahouse.com  Fri Jan  5 03:08:18 2018
From: tomas at intrahouse.com (=?UTF-8?B?VG9tw6FzIEdhcmPDrWE=?=)
Date: Fri, 05 Jan 2018 08:08:18 +0000
Subject: [keycloak-user] [Feature request] Adding scheduled tasks /
 change order of required actions / searchable user attributes
In-Reply-To: <11173036-2963-92f7-4834-3a8e63c84027@redhat.com>
References: <CALgk1PLsVKjDaxcqDoKu3S8Ci-V1p96UTByoKL5E8P5SvQFk3g@mail.gmail.com>
	<11173036-2963-92f7-4834-3a8e63c84027@redhat.com>
Message-ID: <CALgk1PJv5a5dA=Euw4RcJ1YZK40Ssi0p+Omb07ZLUzn8aduCfg@mail.gmail.com>

On Thu, Jan 4, 2018 at 9:17 PM Marek Posolda <mposolda at redhat.com> wrote:

> On 04/01/18 15:12, Tom?s Garc?a wrote:
> > Hi,
> >
> >     I'm trying to fulfill the needs of the GDPR of my company in Keycloak
> > and I noticed these things:
> >
> > - I cannot add a scheduled task. I don't know where to put code like you
> > have in KeycloakApplication like:
> >              TimerProvider timer =
> session.getProvider(TimerProvider.class);
> >              timer.schedule(new
> > ClusterAwareScheduledTaskRunner(sessionFactory, new ClearExpiredEvents(),
> > interval), interval, "ClearExpiredEvents");
> >
> > , so I can add a recurrent task starting from the startup of Keycloak. My
> > use case is that I want to remove users that didn't verify their email or
> > accepted terms & conditions after a week of first registration. So I was
> > thinking to add a task to be run daily to do that.
> There are ways to do that indirectly. For example, you can create custom
> provider of any type and add this to the "postInit" method here. But
> rather listen to the PostMigrationEven to ensure that tasks are
> triggered after
> the DB migration is finished. See for example
> InfinispanAuthenticationSessionProviderFactory.postInit for inspiration.
> >
>

Thanks!

> - The order of required actions execution is in alphabetical order, so if
> I
> > wanted a custom required action to be run after the "Verify email"
> action I
> > need to be sure that the name of my custom required action starts with
> "W"
> > at least. An UI interface like what we already have in the Authenticators
> > part would be nice.
> +1 that it would be nice. On the other hand, is it a big issue to create
> the action starting with "W" ?
>
> Feel free to create JIRA for add priority to requiredActions, just not
> sure when it will be done (unless you send PR by yourself :)
> >
>

Absolutely not :D I'll do that in the mean time. I'll create the JIRA issue
too.

> - There are no facilities inside Keycloak to search users with a specific
> > attribute key or value. It would be nice too to have long integers as
> > attibute values, in case we want to search for users with greater / less
> > than a specific timestamp attribute like the one you use in the terms &
> > conditions required action. For example, for the removal task, I'd like
> to
> > search for users without a custom attribute, then I'll remove those. I
> > guess I'll just extend the data model if needed to workaround this issue.
> There is model method for search by attribute -
> UserProvider.searchForUserByUserAttribute . There is no REST endpoint,
> but you can create your own custom REST endpoint for this though if you
> need it. But if you need to use this from your requiredAction, it should
> work fine.
> >
>

I missed that! Thanks.

> - If someone declines the terms & conditions, the user is redirected to a
> > blank page with an "error" in the screen. I don't care about this since
> I'm
> > going to make my custom required action if I can find an alternative for
> > the things I'm saying above.
> >
> > If I'm wrong about something, please let me know.
> >
>

I forgot to say I'll open a JIRA for this too anyway.

> Thanks,
> > Tom?s
> > _______________________________________________
> > keycloak-user mailing list
> > keycloak-user at lists.jboss.org
> > https://lists.jboss.org/mailman/listinfo/keycloak-user
>
>
>

From moritz.keppler at daimler.com  Fri Jan  5 05:08:23 2018
From: moritz.keppler at daimler.com (moritz.keppler at daimler.com)
Date: Fri, 05 Jan 2018 10:08:23 +0000
Subject: [keycloak-user] cockroachdb
In-Reply-To: <CAPZw1G5FjA5J4-LsE+QC3npJm0Pia4K2FJgbkjsqsp5wL1WSBQ@mail.gmail.com>
References: <CAPZw1G5FjA5J4-LsE+QC3npJm0Pia4K2FJgbkjsqsp5wL1WSBQ@mail.gmail.com>
Message-ID: <8bba78d6b9e6477d95113c7adb090337@DE35S004EXC1H.wp.corpintra.net>

Hi Simon,

we got that running - not in a production environment but as a demo.

We had to:
(1) update the liquibase version used. The one keycloak uses generates some SQL statements cockroachdb 1.0 does not support.
(2) patch the DefaultLiquibaseConnectionProvider in a way that no "SELECT FOR UPDATE" is generated. This breaks the lock functionality, definitely not recommended in an productive environment!
(see https://github.com/cockroachdb/cockroach/issues/6583)
(3) generate liquibase scripts cockroach is able to understand. The most important thing is that a primary key has to be defined during table creation.
To do so we applied all scripts to a postgres instance, generated a changeset from this db via liquibase, rewrote it to be cockroach compatible, applied it to a cockroach instance and filled the liquibase changelog tables so that keycloak believes all changes are already applied.
An alternative approach is described here https://github.com/cloudtrust/keycloak-cockroach

Would be great if one day cockroachdb was supported out of the box.

Moritz Keppler

Daimler TSS GmbH
Wilhelm-Runge-Stra?e 11
89081 Ulm/Germany
mailto:moritz.keppler at daimler.com

http://www.daimler-tss.com

Daimler TSS GmbH
Sitz und Registergericht/Domicile and Register Court: Ulm, HRB-Nr./Commercial Register No.: 3844 Gesch?ftsf?hrung/Management: Christoph R?ger (Vorsitzender/Chairperson), Steffen B?uerle

-----Original Message-----
From: keycloak-user-bounces at lists.jboss.org [mailto:keycloak-user-bounces at lists.jboss.org] On Behalf Of Simon Payne
Sent: Thursday, January 04, 2018 3:21 PM
To: keycloak-user <keycloak-user at lists.jboss.org>
Subject: [keycloak-user] cockroachdb

Hi,

has anyone successfully managed to use cockroachdb with keycloak?

if so, what steps were taken?

thanks

Simon.
_______________________________________________
keycloak-user mailing list
keycloak-user at lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user

If you are not the addressee, please inform us immediately that you have received this e-mail by mistake, and delete it. We thank you for your support.



From raphoa at worteks.com  Fri Jan  5 05:34:49 2018
From: raphoa at worteks.com (=?UTF-8?Q?Rapha=c3=abl_HOAREAU?=)
Date: Fri, 5 Jan 2018 11:34:49 +0100
Subject: [keycloak-user] OpenID Connect IdP and nonce parameter
In-Reply-To: <9c40afc7-bddd-3951-4d30-9f2bdfa1bc1d@redhat.com>
References: <49fc1c6b-a2a4-282b-6d69-ac458734923f@worteks.com>
	<9c40afc7-bddd-3951-4d30-9f2bdfa1bc1d@redhat.com>
Message-ID: <ab2a20f4-9b87-1b46-9652-05b3489eef2b@worteks.com>

Marek,

Thank you for the explanations.

FranceConnect already seems to use Authorization Code flow, but defines 
"nonce" as a mandatory field :

https://partenaires.franceconnect.gouv.fr/fournisseur-service

FR : "NONCE Champ obligatoire, g?n?r? al?atoirement par le FS que FC 
renvoie tel quel dans la r?ponse ? l'appel ? /token, pour ?tre ensuite 
v?rifi? par le FS. Il est utilis? pour emp?cher les attaques par rejeu"

EN : "NONCE Mandatory field, ramdonly generated by FS (client) that FC 
(FranceConnect) resend as-is in the request to /token, to be verified by 
the FS. It is used to prevent replay attacks"

I'll create a JIRA in Keycloak.

Rapha?l.

Le 04/01/2018 ? 22:06, Marek Posolda a ?crit?:
> Yes, Keycloak doesn't add "nonce" to the requests to identity 
> providers. But IMO that's not the Keycloak's fault that your scenario 
> doesn't work because "nonce" is not required, but just "optional" per 
> OIDC specification in Authorization Code flow. See [1] .
>
> Is FranceConnect using Authorization Code Flow or some other 
> OIDC/OAuth2 flow? If it's using some other flow (EG. Implicit flow), 
> is it possible to switch it to use Authorization Code flow instead? If 
> it already uses Authorization Code flow, then it's mistake on their 
> side as "nonce" is optional parameter per specs, so they shouldn't 
> require it though.
>
> Still, you can maybe create JIRA in Keycloak for adding nonce. There 
> shouldn't be any significant issue with adding it (besides the URL to 
> identityProviders will be a bit longer).
>
> [1] http://openid.net/specs/openid-connect-core-1_0.html#AuthRequest
>
> Marek
>
>
> On 04/01/18 15:59, Rapha?l HOAREAU wrote:
>> Hi,
>>
>> I'm facing an issue where I use an external oidc IdP (FranceConnect) for
>> my users to log in.
>>
>> When trying to login with this provider, i have this error :
>>
>> {"status":"fail","message":"The following fields are missing or empty 
>> : nonce"}
>>
>> If i put, manually, &nonce=someRandomInt, in the URL, the process 
>> continues.
>>
>> Am i missing something in my Identity Provider configuration ? Is there
>> a way to add a parameter when requesting the external provider ?
>>
>>
>> Regards,
>>
>> Rapha?l HOAREAU.
>>
>>
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
>


From simonpayne58 at gmail.com  Fri Jan  5 06:26:17 2018
From: simonpayne58 at gmail.com (Simon Payne)
Date: Fri, 5 Jan 2018 11:26:17 +0000
Subject: [keycloak-user] cockroachdb
In-Reply-To: <8bba78d6b9e6477d95113c7adb090337@DE35S004EXC1H.wp.corpintra.net>
References: <CAPZw1G5FjA5J4-LsE+QC3npJm0Pia4K2FJgbkjsqsp5wL1WSBQ@mail.gmail.com>
	<8bba78d6b9e6477d95113c7adb090337@DE35S004EXC1H.wp.corpintra.net>
Message-ID: <CAPZw1G4o9U=mPr6GZh1ciyO-eqs2N7XeYpAv1SvWm3vw235odQ@mail.gmail.com>

thanks for the information,

i've already identified the issues you mention in step 3 and have been
overcoming in a similar manner, however, i wasn't aware that to 'fix' the
select for update also meant breaking the locking functionality.  do we
know whether keycloak execute SELECT FOR UPDATE as part of use case
invocation or only during the liquibase schema alterations?


Simon




On Fri, Jan 5, 2018 at 10:08 AM, <moritz.keppler at daimler.com> wrote:

> Hi Simon,
>
> we got that running - not in a production environment but as a demo.
>
> We had to:
> (1) update the liquibase version used. The one keycloak uses generates
> some SQL statements cockroachdb 1.0 does not support.
> (2) patch the DefaultLiquibaseConnectionProvider in a way that no "SELECT
> FOR UPDATE" is generated. This breaks the lock functionality, definitely
> not recommended in an productive environment!
> (see https://github.com/cockroachdb/cockroach/issues/6583)
> (3) generate liquibase scripts cockroach is able to understand. The most
> important thing is that a primary key has to be defined during table
> creation.
> To do so we applied all scripts to a postgres instance, generated a
> changeset from this db via liquibase, rewrote it to be cockroach
> compatible, applied it to a cockroach instance and filled the liquibase
> changelog tables so that keycloak believes all changes are already applied.
> An alternative approach is described here https://github.com/cloudtrust/
> keycloak-cockroach
>
> Would be great if one day cockroachdb was supported out of the box.
>
> Moritz Keppler
>
> Daimler TSS GmbH
> Wilhelm-Runge-Stra?e 11
> 89081 Ulm/Germany
> mailto:moritz.keppler at daimler.com
>
> http://www.daimler-tss.com
>
> Daimler TSS GmbH
> Sitz und Registergericht/Domicile and Register Court: Ulm,
> HRB-Nr./Commercial Register No.: 3844 Gesch?ftsf?hrung/Management:
> Christoph R?ger (Vorsitzender/Chairperson), Steffen B?uerle
>
> -----Original Message-----
> From: keycloak-user-bounces at lists.jboss.org [mailto:keycloak-user-bounces@
> lists.jboss.org] On Behalf Of Simon Payne
> Sent: Thursday, January 04, 2018 3:21 PM
> To: keycloak-user <keycloak-user at lists.jboss.org>
> Subject: [keycloak-user] cockroachdb
>
> Hi,
>
> has anyone successfully managed to use cockroachdb with keycloak?
>
> if so, what steps were taken?
>
> thanks
>
> Simon.
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
> If you are not the addressee, please inform us immediately that you have
> received this e-mail by mistake, and delete it. We thank you for your
> support.
>
>

From aletundo at wikitolearn.org  Fri Jan  5 06:48:38 2018
From: aletundo at wikitolearn.org (Alessandro Tundo)
Date: Fri, 5 Jan 2018 12:48:38 +0100
Subject: [keycloak-user] Unable to register provider implementation: not
	a subtype exception
Message-ID: <CABuZfFo1dsQ9Zvf26Dv9eamu1+vOoojwviu1Sqydaf36Dq5dSg@mail.gmail.com>

Hi folks!

Someone could help me out with this?

Best regards,

Alessandro

2017-12-20 16:52 GMT+01:00 Alessandro Tundo <aletundo at wikitolearn.org>:

> Hi folks!
>
> I followed the documentation for implementing and registering a SPI but
> I'm not able to deploy it correctly.
>
> The raised exception is:
>
> *java.util.ServiceConfigurationError:
> org.keycloak.credential.hash.PasswordHashProviderFactory: Provider
> org.wikitolearn.keycloak.provider.MediaWikiBTypePasswordHashProviderFactory
> not a subtype*
>
> I tried both registration ways but the outcome is the same. The .jar I'm
> trying to deployt has the following structure:
>
>
>    - META-INF/services/org.keycloak.credential.hash.
>    PasswordHashProviderFactory
>    - org/wikitolearn/keycloak/provider/MediaWikiBTypePasswor
>    dHashProviderFactory.class
>    - org/wikitolearn/keycloak/provider/MediaWikiBTypePasswor
>    dHashProvider.class
>
> The factory and the provider implements respectively PasswordHashProviderFactory
> and PasswordHashProvider.
>
> I would like also to point out that the SPI works correctly in my Keycloak
> fork. But as you can imagine, a fork is not a good option. Especially when
> are available more elegant ways to extend the software programatically
> without a fork.
>
> I'm looking forward to receiving your reply asap.
>
> Thank you!
>
> Alessandro
>

From mposolda at redhat.com  Fri Jan  5 07:54:05 2018
From: mposolda at redhat.com (Marek Posolda)
Date: Fri, 5 Jan 2018 13:54:05 +0100
Subject: [keycloak-user] OpenID Connect IdP and nonce parameter
In-Reply-To: <ab2a20f4-9b87-1b46-9652-05b3489eef2b@worteks.com>
References: <49fc1c6b-a2a4-282b-6d69-ac458734923f@worteks.com>
	<9c40afc7-bddd-3951-4d30-9f2bdfa1bc1d@redhat.com>
	<ab2a20f4-9b87-1b46-9652-05b3489eef2b@worteks.com>
Message-ID: <dc529ac3-9255-c994-233e-2b2cf513e44b@redhat.com>

Yes, so as I mentioned, it means that there is bug on their side as they 
claim the "nonce" field as mandatory even if it's not per specs. So I 
suggest to create JIRA on their side too.

For our side, feel free to create JIRA to add "nonce", but it's not a 
bug, rather feature request. As we don't break specs anyhow.

Marek

On 05/01/18 11:34, Rapha?l HOAREAU wrote:
> Marek,
>
> Thank you for the explanations.
>
> FranceConnect already seems to use Authorization Code flow, but 
> defines "nonce" as a mandatory field :
>
> https://partenaires.franceconnect.gouv.fr/fournisseur-service
>
> FR : "NONCE Champ obligatoire, g?n?r? al?atoirement par le FS que FC 
> renvoie tel quel dans la r?ponse ? l'appel ? /token, pour ?tre ensuite 
> v?rifi? par le FS. Il est utilis? pour emp?cher les attaques par rejeu"
>
> EN : "NONCE Mandatory field, ramdonly generated by FS (client) that FC 
> (FranceConnect) resend as-is in the request to /token, to be verified 
> by the FS. It is used to prevent replay attacks"
>
> I'll create a JIRA in Keycloak.
>
> Rapha?l.
>
> Le 04/01/2018 ? 22:06, Marek Posolda a ?crit :
>> Yes, Keycloak doesn't add "nonce" to the requests to identity 
>> providers. But IMO that's not the Keycloak's fault that your scenario 
>> doesn't work because "nonce" is not required, but just "optional" per 
>> OIDC specification in Authorization Code flow. See [1] .
>>
>> Is FranceConnect using Authorization Code Flow or some other 
>> OIDC/OAuth2 flow? If it's using some other flow (EG. Implicit flow), 
>> is it possible to switch it to use Authorization Code flow instead? 
>> If it already uses Authorization Code flow, then it's mistake on 
>> their side as "nonce" is optional parameter per specs, so they 
>> shouldn't require it though.
>>
>> Still, you can maybe create JIRA in Keycloak for adding nonce. There 
>> shouldn't be any significant issue with adding it (besides the URL to 
>> identityProviders will be a bit longer).
>>
>> [1] http://openid.net/specs/openid-connect-core-1_0.html#AuthRequest
>>
>> Marek
>>
>>
>> On 04/01/18 15:59, Rapha?l HOAREAU wrote:
>>> Hi,
>>>
>>> I'm facing an issue where I use an external oidc IdP (FranceConnect) 
>>> for
>>> my users to log in.
>>>
>>> When trying to login with this provider, i have this error :
>>>
>>> {"status":"fail","message":"The following fields are missing or 
>>> empty : nonce"}
>>>
>>> If i put, manually, &nonce=someRandomInt, in the URL, the process 
>>> continues.
>>>
>>> Am i missing something in my Identity Provider configuration ? Is there
>>> a way to add a parameter when requesting the external provider ?
>>>
>>>
>>> Regards,
>>>
>>> Rapha?l HOAREAU.
>>>
>>>
>>> _______________________________________________
>>> keycloak-user mailing list
>>> keycloak-user at lists.jboss.org
>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>
>>
>


From juandiego83 at gmail.com  Fri Jan  5 11:28:53 2018
From: juandiego83 at gmail.com (Juan Diego)
Date: Fri, 5 Jan 2018 11:28:53 -0500
Subject: [keycloak-user] changing password not working with api
Message-ID: <CAJGEj6f5iBTr0tCC0jXMeT8JAsVRT+cJOC6vOs0uzBaX7dXH+g@mail.gmail.com>

Hi,

I did some tests months ago, and I was pretty sure the following code
worked.  Now when I am trying to implement a password change it doesnt
work. I am using basically the same  way to change the last name of the
users, and it works. I can see the last name change in the keycloak
server.  But when i try to login to the user that i just changed the
password I have to use and the old password.

Anyway this is my code:


UserResource ur = kc.realm(realm).users().get(id);
        UserRepresentation user = ur.toRepresentation();

CredentialRepresentation credential = new CredentialRepresentation();
credential.setType(CredentialRepresentation.PASSWORD);
credential.setValue(password);
credential.setTemporary(false);
user.setCredentials(asList(credential));

ur.update(user);

From juandiego83 at gmail.com  Fri Jan  5 11:47:24 2018
From: juandiego83 at gmail.com (Juan Diego)
Date: Fri, 5 Jan 2018 11:47:24 -0500
Subject: [keycloak-user] changing password not working with api
In-Reply-To: <CAJGEj6f5iBTr0tCC0jXMeT8JAsVRT+cJOC6vOs0uzBaX7dXH+g@mail.gmail.com>
References: <CAJGEj6f5iBTr0tCC0jXMeT8JAsVRT+cJOC6vOs0uzBaX7dXH+g@mail.gmail.com>
Message-ID: <CAJGEj6eXhBcp2Rp3OH=9Q6-QjvXmmPa3yDs8-5TYdm9zqUpE6g@mail.gmail.com>

Nevermind, I am an idiot.

I am using this now
ur.resetPassword(credential);

On Fri, Jan 5, 2018 at 11:28 AM, Juan Diego <juandiego83 at gmail.com> wrote:

> Hi,
>
> I did some tests months ago, and I was pretty sure the following code
> worked.  Now when I am trying to implement a password change it doesnt
> work. I am using basically the same  way to change the last name of the
> users, and it works. I can see the last name change in the keycloak
> server.  But when i try to login to the user that i just changed the
> password I have to use and the old password.
>
> Anyway this is my code:
>
>
> UserResource ur = kc.realm(realm).users().get(id);
>         UserRepresentation user = ur.toRepresentation();
>
> CredentialRepresentation credential = new CredentialRepresentation();
> credential.setType(CredentialRepresentation.PASSWORD);
> credential.setValue(password);
> credential.setTemporary(false);
> user.setCredentials(asList(credential));
>
> ur.update(user);
>

From jonas.schoenenberger at gmail.com  Fri Jan  5 13:30:42 2018
From: jonas.schoenenberger at gmail.com (=?UTF-8?Q?Jonas_Sch=C3=B6nenberger?=)
Date: Fri, 5 Jan 2018 19:30:42 +0100
Subject: [keycloak-user] CORS in Keycloak 3.4
In-Reply-To: <CAJgngAei4b_EocqFaOjTXC2=+S_+kpJha9gdWqFoGfza1Zta+w@mail.gmail.com>
References: <CAP1gnsJk-KxFprmT9a3wnmRyAee_2POqV-NPRY7L1AZwqQ6MUQ@mail.gmail.com>
	<CAJgngAei4b_EocqFaOjTXC2=+S_+kpJha9gdWqFoGfza1Zta+w@mail.gmail.com>
Message-ID: <CAP1gnsLdGmnJ187ZGL1J8sX8wneHtMO-fFJfxaDikyi3Vh5AQw@mail.gmail.com>

Hi Stian

Thank you for your reply.

Are you referring to the Web Origins in the realm config? They are only
relevant for the client's Handling of CORS Requests and not keycloaks own
responses/request handling - right?
I don't have a problem on the clients but rather on keycloak itself -
keycloak shall send/add CORS Headers on requests most likely like Miro
mentioned in his blog article but it doesn't work for me:
https://mirocupak.com/securing-web-applications-with-keycloak-and-cli/
(enable-cors).

Any pointers as to how to activate that in a standalone instance for a
realm or the whole instance?

Thanks again
Jonas

On Fri, Jan 5, 2018 at 9:02 AM, Stian Thorgersen <sthorger at redhat.com>
wrote:

> https://github.com/keycloak/keycloak/tree/master/examples/cors
>
> On 4 January 2018 at 08:55, Jonas Sch?nenberger <
> jonas.schoenenberger at gmail.com> wrote:
>
>> Hey there
>>
>> I?ve been trying to figure out how to enable CORS in the later versions of
>> KeyCloak. I can?t seem to find a valid way to achieve this besides
>> hardcoding response headers in the standalone.xml. I?m using a standalone
>> deployment.
>> I know the functionality to handle preflight and other CORS scenarios is
>> there, so there must be surely a way to activate it?
>>
>> Could somebody enlighten me please?
>>
>> Thanks a lot
>> Jonas
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
>
>

From ogusakov at cisco.com  Fri Jan  5 14:42:23 2018
From: ogusakov at cisco.com (Oleg Gusakov (ogusakov))
Date: Fri, 5 Jan 2018 19:42:23 +0000
Subject: [keycloak-user] login-status-iframe.html returning 403 with init
	parameters
Message-ID: <89d03390ca4e4c06ae6188d1a46ca9d1@XCH-RCD-005.cisco.com>

I am trying to use the keycloak js adapter to manage the OIDC session. I am able to load the login-status-iframe.html page by itself when not using any init parameters.
However, when the init parameters are added: login-status-iframe.html/init?client_id=someclient&origin=https%3A%2F%2Flocalhost%3A8443, the iframe receives a 403 response.

From diederen at nlcom.nl  Mon Jan  8 06:03:53 2018
From: diederen at nlcom.nl (Robin Diederen)
Date: Mon, 8 Jan 2018 11:03:53 +0000
Subject: [keycloak-user] KeyCloak and Azure Active Directory / response_type
Message-ID: <E355863A-D523-425B-B72C-09B44DBB73F7@contoso.com>

Hello all,

I?m trying to make KeyCloak (3.4.0 Final) work with Microsoft Azure AD using the OpenID Connect protocol (OIDC). My goal is for KeyCloak to be an identity broker between a number of in-house clients and Azure AD as identity backend.

After configuring the appropriate endpoints for OIDC / oAuth v2.0 and some clients, upon hitting my client with my browser, KeyCloak redirects me to the Microsoft login page. Logging in works fine and my client / app is correctly recognized by Microsoft. However, when redirected back to KeyCloak, I?m presented with an error.

Upon further investigation I?ve noticed that KeyCloak reports this error in its logs: ?Failed to make identity provider oauth callback: org.keycloak.broker.provider.IdentityBrokerException: No access_token from server.?. This seems to be related to the response_type attribute, which is to be set from KeyCloak upon calling the Microsoft login page. Up till now, I did not find any way to make KeyCloak include this parameter with the preffered value, being ?response_type=token_id?. KeyCloak however does include ?response_type=code?, yet Microsoft doesn?t seem to like this.

So here?s my question: how can I instruct KeyCloak to include this parameter to make it work with AzureAD? I?ve tried a number of settings in the client page, such as implicit and standard flow enabed / disabled, however, to no avail.

Any help is greatly appreciated.
Best, Robin

From thomas.darimont at googlemail.com  Mon Jan  8 06:20:13 2018
From: thomas.darimont at googlemail.com (Thomas Darimont)
Date: Mon, 8 Jan 2018 12:20:13 +0100
Subject: [keycloak-user] Forward Keycloak Events to Kafka
Message-ID: <CAK-7U1hgaAYOzMJy4bMjVGDdJsSRa_sJy5s+YD0rSLOUEqTgSQ@mail.gmail.com>

Hello,

just wanted to know if someone on this mailinglist has already built a
keycloak extension that forwards Keycloak user / admin events to Kafka?

Cheers,
Thomas

From benjamin.garcia at protonmail.com  Mon Jan  8 08:21:13 2018
From: benjamin.garcia at protonmail.com (Benjamin garcia)
Date: Mon, 08 Jan 2018 08:21:13 -0500
Subject: [keycloak-user] security question
Message-ID: <uh4eUiWOFgBmtO7LYRJNVCu02BXVTkU0-7K1aQzPObl05zIYSy7ahDqXyYJ3hFcGOvFDH4jG3k0BsNpKCEHug_UhjC9YST3R9sgj0hdLP50=@protonmail.com>

Hello,

I would like to use keycloack on my architechture, but I have (maybe) an issue in my design :
I have 3 applications :
- angularjs apps for the frontend
- a scalatra API to reponse to frontend throw http and which ask springboot app some datas,
- a springboot app for crud request on databases.

I would like to transfert bearer authentication from the front to springboot app throw scalatra API to ensure that request send on DB is from the right user. I don't really sure that's the right use case. Because, in my mind, If I use keycloack, it's to not modify some part of my code base with security knowledge. But in this use case, I'm mandatory to give jwt token on all my stak (which is not really cool).

Does somebody kown if I can do that or if it exist a better way?

Regards

Benjamin Garcia

From kevprice at redhat.com  Mon Jan  8 08:54:41 2018
From: kevprice at redhat.com (Kevin Price)
Date: Mon, 8 Jan 2018 14:54:41 +0100
Subject: [keycloak-user] CORS support
Message-ID: <90B7A30E-74A0-4054-8D21-852B43069503@redhat.com>

Hi everyone,

I?m on the support team with the 3scale product and I?m currently writing a JS client for our Developer Portal to be used with RH SSO & our interactive documentation tool. So I have a question around supporting CORS on the keycloak server.

I?m currently just running my key cloak instance as a native Java app server, is there any way to configure CORS either on the server level or realm level? Typically users would log into the portal to test their own application (client) credentials via the Swagger specification, however, this means every individual application stored in the Keycloak server needs to have the Web Origins field configured to allow requests from the developer portal domain. I would prefer to avoid this additional configuration. 

Apologies in advance if this is already covered in your documentation but I did take a look and I couldn?t find anything relevant.

Appreciate any help on this.

Regards,

Kevin Price

From pkboucher801 at gmail.com  Mon Jan  8 10:25:32 2018
From: pkboucher801 at gmail.com (Peter K. Boucher)
Date: Mon, 8 Jan 2018 10:25:32 -0500
Subject: [keycloak-user] Does Keycloak support a "Minimum password age"?
Message-ID: <003101d38894$ecaaa4e0$c5ffeea0$@gmail.com>

We have a customer requirement that users not be able to change their
passwords more frequently than once per day.

 

We are currently using Keycloak 3.1.  Does any later version of Keycloak
support (or plan to support) a "Minimum password age"?

 

Thanks!


From tahonen at redhat.com  Mon Jan  8 12:43:10 2018
From: tahonen at redhat.com (Tero Ahonen)
Date: Mon, 8 Jan 2018 19:43:10 +0200
Subject: [keycloak-user] CORS support
In-Reply-To: <90B7A30E-74A0-4054-8D21-852B43069503@redhat.com>
References: <90B7A30E-74A0-4054-8D21-852B43069503@redhat.com>
Message-ID: <12490D40-FB79-4032-A63A-43DB945928DE@redhat.com>

If you?re running keycloak on Wildfly, you can use undertow subsystem filter to write CORS headers to all request. Something like in this post

https://forum.camunda.org/t/enable-cors-on-wildfly/673


.t

> On 8 Jan 2018, at 15.54, Kevin Price <kevprice at redhat.com> wrote:
> 
> Hi everyone,
> 
> I?m on the support team with the 3scale product and I?m currently writing a JS client for our Developer Portal to be used with RH SSO & our interactive documentation tool. So I have a question around supporting CORS on the keycloak server.
> 
> I?m currently just running my key cloak instance as a native Java app server, is there any way to configure CORS either on the server level or realm level? Typically users would log into the portal to test their own application (client) credentials via the Swagger specification, however, this means every individual application stored in the Keycloak server needs to have the Web Origins field configured to allow requests from the developer portal domain. I would prefer to avoid this additional configuration. 
> 
> Apologies in advance if this is already covered in your documentation but I did take a look and I couldn?t find anything relevant.
> 
> Appreciate any help on this.
> 
> Regards,
> 
> Kevin Price
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user


From carreraariel at gmail.com  Mon Jan  8 14:26:55 2018
From: carreraariel at gmail.com (Ariel Carrera)
Date: Mon, 8 Jan 2018 16:26:55 -0300
Subject: [keycloak-user] [keycloak-dev] Trojan in Keycloak Javascript
	Adapter?
In-Reply-To: <CAHYJo18jrXAHDRWBiAbbGkNrGVxyCxNkuW9tJL--7RPdM3okeA@mail.gmail.com>
References: <CAFzO_6eDDb+uG67_uPFAZTSq6YRfmfhmmJ0VE5AjdvO37UprVA@mail.gmail.com>
	<CAHYJo18jrXAHDRWBiAbbGkNrGVxyCxNkuW9tJL--7RPdM3okeA@mail.gmail.com>
Message-ID: <CAFzO_6cNfJxsi_OKQwryUpgFh4XzVfVbpcOgd=7VbKMSj6pgVg@mail.gmail.com>

Checked with other computer (windows 10 + windows defender).

keycloak-min.js is detected as virus from  version 3.4.2 to 3.4.3


2018-01-03 17:44 GMT-03:00 Ramunas <ramunask at gmail.com>:

> * just downloaded keycloak-js-adapter-dist-3.4.2.Final.zip file
> * extracted and scanned "keycloak-js-adapter-dist-3.4.2.Final" folder
> with Windows Defender on Windows 10 - no issues found
> * checked for Windows updates. New update "Definition Update for Windows
> Defender Antivirus - KB2267602 (Definition 1.259.1141.0)" was found and
> installed.
> * scanned again. No issues found.
>
> Ram?nas
>



-- 
Ariel Carrera

From carreraariel at gmail.com  Mon Jan  8 14:56:18 2018
From: carreraariel at gmail.com (Ariel Carrera)
Date: Mon, 8 Jan 2018 16:56:18 -0300
Subject: [keycloak-user] [keycloak-dev] Trojan in Keycloak Javascript
	Adapter?
In-Reply-To: <CAFzO_6cNfJxsi_OKQwryUpgFh4XzVfVbpcOgd=7VbKMSj6pgVg@mail.gmail.com>
References: <CAFzO_6eDDb+uG67_uPFAZTSq6YRfmfhmmJ0VE5AjdvO37UprVA@mail.gmail.com>
	<CAHYJo18jrXAHDRWBiAbbGkNrGVxyCxNkuW9tJL--7RPdM3okeA@mail.gmail.com>
	<CAFzO_6cNfJxsi_OKQwryUpgFh4XzVfVbpcOgd=7VbKMSj6pgVg@mail.gmail.com>
Message-ID: <CAFzO_6e0BK6a=wzoJaM=6vW0sx=zMn-OyjPdDw3G9nm-u7BE7w@mail.gmail.com>

Hi Stian, I checked differences in keycloak.min.js comparing version 3.4.1
to 3.4.2.
I can't see a problem at first sight... but It's still a problem to see
your antivirus alerting for a threat when your browser access to a page
that uses "keycloak.min.js" or when your somebody get's a keycloak's
distribution to be installed.

Maybe this issue must to be in Jira.

Last changes in javascript file can be the problem.

Maybe function "processInit()" needs some changes.

Regards,

2018-01-08 16:26 GMT-03:00 Ariel Carrera <carreraariel at gmail.com>:

> Checked with other computer (windows 10 + windows defender).
>
> keycloak-min.js is detected as virus from  version 3.4.2 to 3.4.3
>
>
> 2018-01-03 17:44 GMT-03:00 Ramunas <ramunask at gmail.com>:
>
>> * just downloaded keycloak-js-adapter-dist-3.4.2.Final.zip file
>> * extracted and scanned "keycloak-js-adapter-dist-3.4.2.Final" folder
>> with Windows Defender on Windows 10 - no issues found
>> * checked for Windows updates. New update "Definition Update for Windows
>> Defender Antivirus - KB2267602 (Definition 1.259.1141.0)" was found and
>> installed.
>> * scanned again. No issues found.
>>
>> Ram?nas
>>
>
>
>
> --
> Ariel Carrera
>



-- 
Ariel Carrera

From carreraariel at gmail.com  Mon Jan  8 15:18:29 2018
From: carreraariel at gmail.com (Ariel Carrera)
Date: Mon, 8 Jan 2018 17:18:29 -0300
Subject: [keycloak-user] [keycloak-dev] Trojan in Keycloak Javascript
	Adapter?
In-Reply-To: <CAFzO_6e0BK6a=wzoJaM=6vW0sx=zMn-OyjPdDw3G9nm-u7BE7w@mail.gmail.com>
References: <CAFzO_6eDDb+uG67_uPFAZTSq6YRfmfhmmJ0VE5AjdvO37UprVA@mail.gmail.com>
	<CAHYJo18jrXAHDRWBiAbbGkNrGVxyCxNkuW9tJL--7RPdM3okeA@mail.gmail.com>
	<CAFzO_6cNfJxsi_OKQwryUpgFh4XzVfVbpcOgd=7VbKMSj6pgVg@mail.gmail.com>
	<CAFzO_6e0BK6a=wzoJaM=6vW0sx=zMn-OyjPdDw3G9nm-u7BE7w@mail.gmail.com>
Message-ID: <CAFzO_6frz9+1+uQ-fju-TBH0+KjbHeN7ShQmuV8DLPfb9ibGtQ@mail.gmail.com>

"when your somebody get's a keycloak's distribution to be installed"  read
like: "when someone gets Keycloak to be installed" xD

2018-01-08 16:56 GMT-03:00 Ariel Carrera <carreraariel at gmail.com>:

> Hi Stian, I checked differences in keycloak.min.js comparing version 3.4.1
> to 3.4.2.
> I can't see a problem at first sight... but It's still a problem to see
> your antivirus alerting for a threat when your browser access to a page
> that uses "keycloak.min.js" or when your somebody get's a keycloak's
> distribution to be installed.
>
> Maybe this issue must to be in Jira.
>
> Last changes in javascript file can be the problem.
>
> Maybe function "processInit()" needs some changes.
>
> Regards,
>
> 2018-01-08 16:26 GMT-03:00 Ariel Carrera <carreraariel at gmail.com>:
>
>> Checked with other computer (windows 10 + windows defender).
>>
>> keycloak-min.js is detected as virus from  version 3.4.2 to 3.4.3
>>
>>
>> 2018-01-03 17:44 GMT-03:00 Ramunas <ramunask at gmail.com>:
>>
>>> * just downloaded keycloak-js-adapter-dist-3.4.2.Final.zip file
>>> * extracted and scanned "keycloak-js-adapter-dist-3.4.2.Final" folder
>>> with Windows Defender on Windows 10 - no issues found
>>> * checked for Windows updates. New update "Definition Update for Windows
>>> Defender Antivirus - KB2267602 (Definition 1.259.1141.0)" was found and
>>> installed.
>>> * scanned again. No issues found.
>>>
>>> Ram?nas
>>>
>>
>>
>>
>> --
>> Ariel Carrera
>>
>
>
>
> --
> Ariel Carrera
>



-- 
Ariel Carrera

From alessandro.meyer at gmail.com  Mon Jan  8 16:50:07 2018
From: alessandro.meyer at gmail.com (Alessandro Meyer)
Date: Mon, 8 Jan 2018 22:50:07 +0100
Subject: [keycloak-user] CORS support
In-Reply-To: <12490D40-FB79-4032-A63A-43DB945928DE@redhat.com>
References: <90B7A30E-74A0-4054-8D21-852B43069503@redhat.com>
	<12490D40-FB79-4032-A63A-43DB945928DE@redhat.com>
Message-ID: <CAK6_SMzO88ev_eQ0FT0-nTkwV7kXr33EijjbAh6MFY3iYqpMoQ@mail.gmail.com>

That's a very naive approach - and is not capable of preflight handling and
neither flexible origin header-setting, just like the last comment says on
the link.

On Mon, Jan 8, 2018 at 6:43 PM, Tero Ahonen <tahonen at redhat.com> wrote:

> If you?re running keycloak on Wildfly, you can use undertow subsystem
> filter to write CORS headers to all request. Something like in this post
>
> https://forum.camunda.org/t/enable-cors-on-wildfly/673
>
>
> .t
>
> > On 8 Jan 2018, at 15.54, Kevin Price <kevprice at redhat.com> wrote:
> >
> > Hi everyone,
> >
> > I?m on the support team with the 3scale product and I?m currently
> writing a JS client for our Developer Portal to be used with RH SSO & our
> interactive documentation tool. So I have a question around supporting CORS
> on the keycloak server.
> >
> > I?m currently just running my key cloak instance as a native Java app
> server, is there any way to configure CORS either on the server level or
> realm level? Typically users would log into the portal to test their own
> application (client) credentials via the Swagger specification, however,
> this means every individual application stored in the Keycloak server needs
> to have the Web Origins field configured to allow requests from the
> developer portal domain. I would prefer to avoid this additional
> configuration.
> >
> > Apologies in advance if this is already covered in your documentation
> but I did take a look and I couldn?t find anything relevant.
> >
> > Appreciate any help on this.
> >
> > Regards,
> >
> > Kevin Price
> > _______________________________________________
> > keycloak-user mailing list
> > keycloak-user at lists.jboss.org
> > https://lists.jboss.org/mailman/listinfo/keycloak-user
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>

From tahonen at redhat.com  Tue Jan  9 01:00:07 2018
From: tahonen at redhat.com (Tero Ahonen)
Date: Tue, 09 Jan 2018 06:00:07 +0000
Subject: [keycloak-user] CORS support
In-Reply-To: <CAK6_SMzO88ev_eQ0FT0-nTkwV7kXr33EijjbAh6MFY3iYqpMoQ@mail.gmail.com>
References: <90B7A30E-74A0-4054-8D21-852B43069503@redhat.com>
	<12490D40-FB79-4032-A63A-43DB945928DE@redhat.com>
	<CAK6_SMzO88ev_eQ0FT0-nTkwV7kXr33EijjbAh6MFY3iYqpMoQ@mail.gmail.com>
Message-ID: <CAJSjHQDU0zWdUCH6zVbwhfK_Kkva=fGqx4O0==ZkyUHXtP=yeg@mail.gmail.com>

Totally true, yet easy to get working.

.t

On Mon, 8 Jan 2018 at 23.50, Alessandro Meyer <alessandro.meyer at gmail.com>
wrote:

> That's a very naive approach - and is not capable of preflight handling
> and neither flexible origin header-setting, just like the last comment says
> on the link.
>
> On Mon, Jan 8, 2018 at 6:43 PM, Tero Ahonen <tahonen at redhat.com> wrote:
>
>> If you?re running keycloak on Wildfly, you can use undertow subsystem
>> filter to write CORS headers to all request. Something like in this post
>>
>> https://forum.camunda.org/t/enable-cors-on-wildfly/673
>>
>>
>> .t
>>
>> > On 8 Jan 2018, at 15.54, Kevin Price <kevprice at redhat.com> wrote:
>> >
>> > Hi everyone,
>> >
>> > I?m on the support team with the 3scale product and I?m currently
>> writing a JS client for our Developer Portal to be used with RH SSO & our
>> interactive documentation tool. So I have a question around supporting CORS
>> on the keycloak server.
>> >
>> > I?m currently just running my key cloak instance as a native Java app
>> server, is there any way to configure CORS either on the server level or
>> realm level? Typically users would log into the portal to test their own
>> application (client) credentials via the Swagger specification, however,
>> this means every individual application stored in the Keycloak server needs
>> to have the Web Origins field configured to allow requests from the
>> developer portal domain. I would prefer to avoid this additional
>> configuration.
>> >
>> > Apologies in advance if this is already covered in your documentation
>> but I did take a look and I couldn?t find anything relevant.
>> >
>> > Appreciate any help on this.
>> >
>> > Regards,
>> >
>> > Kevin Price
>> > _______________________________________________
>> > keycloak-user mailing list
>> > keycloak-user at lists.jboss.org
>> > https://lists.jboss.org/mailman/listinfo/keycloak-user
>>
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>
>
>

From alessandro.meyer at gmail.com  Tue Jan  9 01:11:31 2018
From: alessandro.meyer at gmail.com (Alessandro Meyer)
Date: Tue, 9 Jan 2018 07:11:31 +0100
Subject: [keycloak-user] CORS support
In-Reply-To: <CAJSjHQDU0zWdUCH6zVbwhfK_Kkva=fGqx4O0==ZkyUHXtP=yeg@mail.gmail.com>
References: <90B7A30E-74A0-4054-8D21-852B43069503@redhat.com>
	<12490D40-FB79-4032-A63A-43DB945928DE@redhat.com>
	<CAK6_SMzO88ev_eQ0FT0-nTkwV7kXr33EijjbAh6MFY3iYqpMoQ@mail.gmail.com>
	<CAJSjHQDU0zWdUCH6zVbwhfK_Kkva=fGqx4O0==ZkyUHXtP=yeg@mail.gmail.com>
Message-ID: <CAK6_SMx9jOWVUX+OHFH0MEO0nqGd0Qewj+ipbMmGPKbKTFRdpA@mail.gmail.com>

Maybe a little to easy - it doesn't work for my cases at least. Especially
considering Keycloak is capable on its own to do it, but very few seem to
know how? http://lists.jboss.org/pipermail/keycloak-user/2018-
January/012680.html

On Tue, Jan 9, 2018 at 7:00 AM, Tero Ahonen <tahonen at redhat.com> wrote:

> Totally true, yet easy to get working.
>
> .t
>
> On Mon, 8 Jan 2018 at 23.50, Alessandro Meyer <alessandro.meyer at gmail.com>
> wrote:
>
>> That's a very naive approach - and is not capable of preflight handling
>> and neither flexible origin header-setting, just like the last comment says
>> on the link.
>>
>> On Mon, Jan 8, 2018 at 6:43 PM, Tero Ahonen <tahonen at redhat.com> wrote:
>>
>>> If you?re running keycloak on Wildfly, you can use undertow subsystem
>>> filter to write CORS headers to all request. Something like in this post
>>>
>>> https://forum.camunda.org/t/enable-cors-on-wildfly/673
>>>
>>>
>>> .t
>>>
>>> > On 8 Jan 2018, at 15.54, Kevin Price <kevprice at redhat.com> wrote:
>>> >
>>> > Hi everyone,
>>> >
>>> > I?m on the support team with the 3scale product and I?m currently
>>> writing a JS client for our Developer Portal to be used with RH SSO & our
>>> interactive documentation tool. So I have a question around supporting CORS
>>> on the keycloak server.
>>> >
>>> > I?m currently just running my key cloak instance as a native Java app
>>> server, is there any way to configure CORS either on the server level or
>>> realm level? Typically users would log into the portal to test their own
>>> application (client) credentials via the Swagger specification, however,
>>> this means every individual application stored in the Keycloak server needs
>>> to have the Web Origins field configured to allow requests from the
>>> developer portal domain. I would prefer to avoid this additional
>>> configuration.
>>> >
>>> > Apologies in advance if this is already covered in your documentation
>>> but I did take a look and I couldn?t find anything relevant.
>>> >
>>> > Appreciate any help on this.
>>> >
>>> > Regards,
>>> >
>>> > Kevin Price
>>> > _______________________________________________
>>> > keycloak-user mailing list
>>> > keycloak-user at lists.jboss.org
>>> > https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>
>>> _______________________________________________
>>> keycloak-user mailing list
>>> keycloak-user at lists.jboss.org
>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>
>>
>>

From sthorger at redhat.com  Tue Jan  9 02:14:22 2018
From: sthorger at redhat.com (Stian Thorgersen)
Date: Tue, 9 Jan 2018 08:14:22 +0100
Subject: [keycloak-user] Does Keycloak support a "Minimum password age"?
In-Reply-To: <003101d38894$ecaaa4e0$c5ffeea0$@gmail.com>
References: <003101d38894$ecaaa4e0$c5ffeea0$@gmail.com>
Message-ID: <CAJgngAd7EkrqVNFOa-MN-gzOoZSW+Exfx=PLdRN5bUd8D9rtmQ@mail.gmail.com>

No, but you can implement your own custom policy

On 8 Jan 2018 8:16 pm, "Peter K. Boucher" <pkboucher801 at gmail.com> wrote:

> We have a customer requirement that users not be able to change their
> passwords more frequently than once per day.
>
>
>
> We are currently using Keycloak 3.1.  Does any later version of Keycloak
> support (or plan to support) a "Minimum password age"?
>
>
>
> Thanks!
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>

From keycloak at frotscher.com  Tue Jan  9 05:01:28 2018
From: keycloak at frotscher.com (Thilo Frotscher)
Date: Tue, 9 Jan 2018 11:01:28 +0100
Subject: [keycloak-user] REGISTER event: firstName & lastName always NULL
Message-ID: <3594b91b-a5dd-79fa-0bc5-212a9d8113f8@frotscher.com>


Hi all,

In our project there is a requirement to execute some actions after successful
user registrations. I implemented an EventListenerProvider that listens to events
of type REGISTER. The details of this event type only contain the "username" of
the user that just registered, but first name and last name are missing.

So I thought I could retrieve this information from the user storage. But no
matter how I try to read the user information from the user storage, firstName
and lastName are always null.

Is this a bug or a feature? When manually logging on to the Admin Console,
I can see that firstName and lastName have been correctly saved. But how
can I programmatically retrieve the first name and last name of the user
that just registered in my event listener?

Sample code:

    public void onEvent(Event event) {

        if (!EventType.REGISTER.equals(event.getType())) {
            LOGGER.info("Ignoring event of type " + event.getType());
            return;
        }

        String realmId = event.getRealmId();
        RealmModel realm = session.realms().getRealm(realmId);

        String userId = event.getUserId();

        Map<String, String> details = event.getDetails();
        String username = details.get("username");

        printUser(session.users().getUserByUsername(username, realm));
        printUser(session.userLocalStorage().getUserByUsername(username, realm));
        printUser(session.userCache().getUserByUsername(username, realm));
        printUser(session.userStorageManager().getUserByUsername(username, realm));

    }

    private void printUser(UserModel user) {
        if (user==null) {
            LOGGER.info("User is null");
        } else {
            LOGGER.info(user.getFirstName()); // always null
            LOGGER.info(user.getLastName()); // always null
            LOGGER.info(user.getId());
            LOGGER.info(user.getEmail());
            LOGGER.info(user.getUsername());
        }
    }

Actually, I believe firstName and lastName should be part of the event details
in the first place...

Thanks for your help!

Cheers,
Thilo

From Tony.Harris at oneadvanced.com  Tue Jan  9 05:01:16 2018
From: Tony.Harris at oneadvanced.com (Tony Harris)
Date: Tue, 9 Jan 2018 10:01:16 +0000
Subject: [keycloak-user] Issue in Chrome and FF
Message-ID: <843ed8be0aa24dab836f5604bbf0e845@SL1ACSEXCMB01.acsresource.com>

After logging in to the admin Console in either Chrome or FF we are presented with a blank white screen and the following error in the browser console

app.js:31 XHR failed loading: GET "https://xxxxxxxx.com/auth/admin/master/console/whoami".                                   whoAmI @ app.js:31
app.js:31 GET https://xxxxxxxx.com/auth/admin/master/console/whoami net::ERR_CONNECTION_CLOSED
app.js:76 Uncaught TypeError: error is not a function
    at app.js:76
    at XMLHttpRequest.req.onreadystatechange (app.js:26)


It ends up in the error handler section because the attempt to connect to the keycloak whoami end point fails with a 500 response, there is nothing in the JBoss logs.  It looks very similar to the following Jira issue, but we do not end up in a redirect loop and we are not seeing the 401 Unauthorised.

https://issues.jboss.org/browse/KEYCLOAK-4735

Interestingly, IE 11 gets a 200 response from the whoami end point.

If we delete a recently created Realm then Chrome goes back to working, however the same realm created on another instance, it's created by a script so we know it's the same in both,  of Keycloak has no issues.  Other realms in this same Keycloak instance created via the script do not cause any issues.  Has anyone seen this before>


Server Info

Server Version

3.1.0.Final

Server Profile

Community

Server Time

Tue Jan 09 09:56:53 UTC 2018

Server Uptime

11 days, 1 hour, 22 minutes, 39 seconds

Memory
Total Memory

455 MB

Free Memory

251 MB (55%)

Used Memory

204 MB

System
Current Working Directory

/opt/jboss

Java Version

1.8.0_121

Java Vendor

Oracle Corporation

Java Runtime

OpenJDK Runtime Environment

Java VM

OpenJDK 64-Bit Server VM

Java VM Version

25.121-b13

Java Home

/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.121-0.b13.el7_3.x86_64/jre

User Name

jboss

User Timezone

UTC

User Locale

us_EN

System Encoding

ANSI_X3.4-1968

Operating System

Linux 4.9.62-21.56.amzn1.x86_64

OS Architecture

amd64



[cid:image012.png at 01D17AF7.D972DF70]<http://www.advancedtogether.com/>
Tony Harris
Java Developer
> A Sunday Times Top Track 250 Company 2016
> Proud to be a Patron of The Prince's Trust

________________________

Advanced Computer Software Group
Ditton Park, Riding Court Road, Datchet, Berkshire, SL3 9LL
t:08451 606 162

www.oneadvanced.com<http://www.advancedtogether.com/>
[cid:image018.png at 01D17AF7.D972DF70] <http://www.linkedin.com/company/2426258> [cid:image019.png at 01D17AF7.D972DF70] <https://twitter.com/adv_group>
> A Sunday Times Top Track 250 Company 2015
> Ranked in UK's 50 fastest growing technology companies 2014


***** Email confidentiality *****

This message is private and confidential. If you have received this message in error, please notify us and remove it from your system. The dissemination, copying or distribution of this message, or related files, by anyone other than the intended recipient is strictly prohibited.



Any views or opinions expressed are solely those of the author and do not necessarily represent those of Advanced Computer Software Group Limited.



***** Email monitoring *****

Advanced Computer Software Group Limited may monitor email traffic data and also the content of email for the purposes of security and staff training.



***** Email security *****

In keeping with good computing practice, the recipient of this email should ensure that it is virus-free. Advanced Computer Software Group Limited does not accept responsibility for any virus that may be transferred by way of this email.



Email may be susceptible to data corruption, interception and/or unauthorised amendment. Advanced Computer Software Group Limited does not accept liability for any such corruption, interception or amendment or any consequences thereof.



This email has been scanned for viruses by the Symantec Email Security.cloud service.



Advanced Computer Software Group Limited

Registered office: Ditton Park, Riding Court Road, Datchet, Berkshire, SL3 9LL, UK

Registered in England under number 5965280

________________________________

Please consider the environment: Think before you print!


This message has been scanned for malware by Websense. www.websense.com
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image001.png
Type: image/png
Size: 10312 bytes
Desc: image001.png
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20180109/007195bb/attachment-0003.png 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image002.png
Type: image/png
Size: 1482 bytes
Desc: image002.png
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20180109/007195bb/attachment-0004.png 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image003.png
Type: image/png
Size: 1610 bytes
Desc: image003.png
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20180109/007195bb/attachment-0005.png 

From sthorger at redhat.com  Tue Jan  9 07:42:53 2018
From: sthorger at redhat.com (Stian Thorgersen)
Date: Tue, 9 Jan 2018 13:42:53 +0100
Subject: [keycloak-user] [keycloak-dev] Trojan in Keycloak Javascript
	Adapter?
In-Reply-To: <CAFzO_6frz9+1+uQ-fju-TBH0+KjbHeN7ShQmuV8DLPfb9ibGtQ@mail.gmail.com>
References: <CAFzO_6eDDb+uG67_uPFAZTSq6YRfmfhmmJ0VE5AjdvO37UprVA@mail.gmail.com>
	<CAHYJo18jrXAHDRWBiAbbGkNrGVxyCxNkuW9tJL--7RPdM3okeA@mail.gmail.com>
	<CAFzO_6cNfJxsi_OKQwryUpgFh4XzVfVbpcOgd=7VbKMSj6pgVg@mail.gmail.com>
	<CAFzO_6e0BK6a=wzoJaM=6vW0sx=zMn-OyjPdDw3G9nm-u7BE7w@mail.gmail.com>
	<CAFzO_6frz9+1+uQ-fju-TBH0+KjbHeN7ShQmuV8DLPfb9ibGtQ@mail.gmail.com>
Message-ID: <CAJgngAepgq8NuWDwPcU4r9LN_9ixKrBqhUDska6YEofpUPXNmA@mail.gmail.com>

Please create an issue with the details. We'll need to figure out how to
reproduce the issue though. Seemed like Ramunas had tried, but that
Defender wasn't reporting anything for him.

On 8 January 2018 at 21:18, Ariel Carrera <carreraariel at gmail.com> wrote:

> "when your somebody get's a keycloak's distribution to be installed"  read
> like: "when someone gets Keycloak to be installed" xD
>
> 2018-01-08 16:56 GMT-03:00 Ariel Carrera <carreraariel at gmail.com>:
>
>> Hi Stian, I checked differences in keycloak.min.js comparing version
>> 3.4.1 to 3.4.2.
>> I can't see a problem at first sight... but It's still a problem to see
>> your antivirus alerting for a threat when your browser access to a page
>> that uses "keycloak.min.js" or when your somebody get's a keycloak's
>> distribution to be installed.
>>
>> Maybe this issue must to be in Jira.
>>
>> Last changes in javascript file can be the problem.
>>
>> Maybe function "processInit()" needs some changes.
>>
>> Regards,
>>
>> 2018-01-08 16:26 GMT-03:00 Ariel Carrera <carreraariel at gmail.com>:
>>
>>> Checked with other computer (windows 10 + windows defender).
>>>
>>> keycloak-min.js is detected as virus from  version 3.4.2 to 3.4.3
>>>
>>>
>>> 2018-01-03 17:44 GMT-03:00 Ramunas <ramunask at gmail.com>:
>>>
>>>> * just downloaded keycloak-js-adapter-dist-3.4.2.Final.zip file
>>>> * extracted and scanned "keycloak-js-adapter-dist-3.4.2.Final" folder
>>>> with Windows Defender on Windows 10 - no issues found
>>>> * checked for Windows updates. New update "Definition Update for
>>>> Windows Defender Antivirus - KB2267602 (Definition 1.259.1141.0)" was found
>>>> and installed.
>>>> * scanned again. No issues found.
>>>>
>>>> Ram?nas
>>>>
>>>
>>>
>>>
>>> --
>>> Ariel Carrera
>>>
>>
>>
>>
>> --
>> Ariel Carrera
>>
>
>
>
> --
> Ariel Carrera
>

From bruno at abstractj.org  Tue Jan  9 08:28:36 2018
From: bruno at abstractj.org (Bruno Oliveira)
Date: Tue, 09 Jan 2018 13:28:36 +0000
Subject: [keycloak-user] [keycloak-dev] Trojan in Keycloak Javascript
	Adapter?
In-Reply-To: <CAJgngAepgq8NuWDwPcU4r9LN_9ixKrBqhUDska6YEofpUPXNmA@mail.gmail.com>
References: <CAFzO_6eDDb+uG67_uPFAZTSq6YRfmfhmmJ0VE5AjdvO37UprVA@mail.gmail.com>
	<CAHYJo18jrXAHDRWBiAbbGkNrGVxyCxNkuW9tJL--7RPdM3okeA@mail.gmail.com>
	<CAFzO_6cNfJxsi_OKQwryUpgFh4XzVfVbpcOgd=7VbKMSj6pgVg@mail.gmail.com>
	<CAFzO_6e0BK6a=wzoJaM=6vW0sx=zMn-OyjPdDw3G9nm-u7BE7w@mail.gmail.com>
	<CAFzO_6frz9+1+uQ-fju-TBH0+KjbHeN7ShQmuV8DLPfb9ibGtQ@mail.gmail.com>
	<CAJgngAepgq8NuWDwPcU4r9LN_9ixKrBqhUDska6YEofpUPXNmA@mail.gmail.com>
Message-ID: <CAM5SUC5SMkA_Bbe6pvKtTP2_hQdo3EkUiud1HH93NvscV7rPNg@mail.gmail.com>

So I don't have Windows 10, but I managed to run the VM from
https://developer.microsoft.com/en-us/microsoft-edge/tools/vms/.

After that I cloned the whole Keycloak repository
https://github.com/keycloak/keycloak-js-bower. Nothing was found, please
see the screenshot attached.[image: Screenshot from 2018-01-09 11-25-57.png]

On Tue, Jan 9, 2018 at 10:46 AM Stian Thorgersen <sthorger at redhat.com>
wrote:

> Please create an issue with the details. We'll need to figure out how to
> reproduce the issue though. Seemed like Ramunas had tried, but that
> Defender wasn't reporting anything for him.
>
> On 8 January 2018 at 21:18, Ariel Carrera <carreraariel at gmail.com> wrote:
>
> > "when your somebody get's a keycloak's distribution to be installed"
> read
> > like: "when someone gets Keycloak to be installed" xD
> >
> > 2018-01-08 16:56 GMT-03:00 Ariel Carrera <carreraariel at gmail.com>:
> >
> >> Hi Stian, I checked differences in keycloak.min.js comparing version
> >> 3.4.1 to 3.4.2.
> >> I can't see a problem at first sight... but It's still a problem to see
> >> your antivirus alerting for a threat when your browser access to a page
> >> that uses "keycloak.min.js" or when your somebody get's a keycloak's
> >> distribution to be installed.
> >>
> >> Maybe this issue must to be in Jira.
> >>
> >> Last changes in javascript file can be the problem.
> >>
> >> Maybe function "processInit()" needs some changes.
> >>
> >> Regards,
> >>
> >> 2018-01-08 16:26 GMT-03:00 Ariel Carrera <carreraariel at gmail.com>:
> >>
> >>> Checked with other computer (windows 10 + windows defender).
> >>>
> >>> keycloak-min.js is detected as virus from  version 3.4.2 to 3.4.3
> >>>
> >>>
> >>> 2018-01-03 17:44 GMT-03:00 Ramunas <ramunask at gmail.com>:
> >>>
> >>>> * just downloaded keycloak-js-adapter-dist-3.4.2.Final.zip file
> >>>> * extracted and scanned "keycloak-js-adapter-dist-3.4.2.Final" folder
> >>>> with Windows Defender on Windows 10 - no issues found
> >>>> * checked for Windows updates. New update "Definition Update for
> >>>> Windows Defender Antivirus - KB2267602 (Definition 1.259.1141.0)" was
> found
> >>>> and installed.
> >>>> * scanned again. No issues found.
> >>>>
> >>>> Ram?nas
> >>>>
> >>>
> >>>
> >>>
> >>> --
> >>> Ariel Carrera
> >>>
> >>
> >>
> >>
> >> --
> >> Ariel Carrera
> >>
> >
> >
> >
> > --
> > Ariel Carrera
> >
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
-------------- next part --------------
A non-text attachment was scrubbed...
Name: Screenshot from 2018-01-09 11-25-57.png
Type: image/png
Size: 61682 bytes
Desc: not available
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20180109/cd1f76c9/attachment-0001.png 

From Pankaj.Mahajan at harbingergroup.com  Tue Jan  9 08:50:57 2018
From: Pankaj.Mahajan at harbingergroup.com (Pankaj Mahajan)
Date: Tue, 9 Jan 2018 13:50:57 +0000
Subject: [keycloak-user] Inter realm authentication
Message-ID: <PN1PR0101MB19838904BCE89B32D3ACF014F5100@PN1PR0101MB1983.INDPRD01.PROD.OUTLOOK.COM>

Hi Team,

Is it possible to authenticate client from one realm with the IDP of other realm?

Like, we have a case where, we have Client-A in Realm-A and we have to authenticate it with IDP-I which is configured in Realm-B.

Is it possible in Keycloak or we need to change our approach to achieve this?

Thanks & regards,
Pankaj Mahajan

Sent from Mail<https://go.microsoft.com/fwlink/?LinkId=550986> for Windows 10


From kevin.berendsen at pharmapartners.nl  Tue Jan  9 09:22:16 2018
From: kevin.berendsen at pharmapartners.nl (Kevin Berendsen)
Date: Tue, 9 Jan 2018 14:22:16 +0000
Subject: [keycloak-user] Inter realm authentication
In-Reply-To: <PN1PR0101MB19838904BCE89B32D3ACF014F5100@PN1PR0101MB1983.INDPRD01.PROD.OUTLOOK.COM>
References: <PN1PR0101MB19838904BCE89B32D3ACF014F5100@PN1PR0101MB1983.INDPRD01.PROD.OUTLOOK.COM>
Message-ID: <897d75e1afab43c4ad38fc2ad9049adb@PHINEAS.ppg.lan>

Hi Pankaj,

The realms are meant to be absolutely isolated. It's not possible to authenticate a user with an authenticator from another realm. Both realms should have the same authenticators configured then to accomplish what you wish.

>> -----Original Message-----
>> From: keycloak-user-bounces at lists.jboss.org [mailto:keycloak-user-bounces at lists.jboss.org] On Behalf Of Pankaj Mahajan
>> Sent: Tuesday, January 9, 2018 2:51 PM
>> To: keycloak-user at lists.jboss.org
>> Subject: [keycloak-user] Inter realm authentication
>>
>> Hi Team,
>>
>> Is it possible to authenticate client from one realm with the IDP of other realm?
>>
>> Like, we have a case where, we have Client-A in Realm-A and we have to authenticate it with IDP-I which is configured in Realm-B.
>>
>> Is it possible in Keycloak or we need to change our approach to achieve this?
>>
>> Thanks & regards,
>> Pankaj Mahajan
>>
>> Sent from Mail<https://go.microsoft.com/fwlink/?LinkId=550986> for Windows 10
>>
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user


From jcain at redhat.com  Tue Jan  9 09:28:30 2018
From: jcain at redhat.com (Josh Cain)
Date: Tue, 9 Jan 2018 08:28:30 -0600
Subject: [keycloak-user] Inter realm authentication
In-Reply-To: <PN1PR0101MB19838904BCE89B32D3ACF014F5100@PN1PR0101MB1983.INDPRD01.PROD.OUTLOOK.COM>
References: <PN1PR0101MB19838904BCE89B32D3ACF014F5100@PN1PR0101MB1983.INDPRD01.PROD.OUTLOOK.COM>
Message-ID: <42ed9b39-69cb-8edc-6d52-ffebfaabb796@redhat.com>

The only ways I know of to do so are through brokering.  Once a brokered
relationship is set up, you can either:

 - Have a button for "authenticate via Realm A" (or whatever text you
need).  Would require users to be smart enough to know they have a
session/account established in the other realm.
 - Use the "try Realm A first" authentication option.

Keycloak team might have more suggestions though.

Josh Cain
Senior Software Applications Engineer, RHCE
Red Hat North America
jcain at redhat.com IRC: jcain

On 01/09/2018 07:50 AM, Pankaj Mahajan wrote:
> Hi Team,
> 
> Is it possible to authenticate client from one realm with the IDP of other realm?
> 
> Like, we have a case where, we have Client-A in Realm-A and we have to authenticate it with IDP-I which is configured in Realm-B.
> 
> Is it possible in Keycloak or we need to change our approach to achieve this?
> 
> Thanks & regards,
> Pankaj Mahajan
> 
> Sent from Mail<https://go.microsoft.com/fwlink/?LinkId=550986> for Windows 10
> 
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
> 

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20180109/7413f286/attachment.bin 

From bruno at abstractj.org  Tue Jan  9 09:50:26 2018
From: bruno at abstractj.org (Bruno Oliveira)
Date: Tue, 09 Jan 2018 14:50:26 +0000
Subject: [keycloak-user] [keycloak-dev] Trojan in Keycloak Javascript
	Adapter?
In-Reply-To: <CAJgngAepgq8NuWDwPcU4r9LN_9ixKrBqhUDska6YEofpUPXNmA@mail.gmail.com>
References: <CAFzO_6eDDb+uG67_uPFAZTSq6YRfmfhmmJ0VE5AjdvO37UprVA@mail.gmail.com>
	<CAHYJo18jrXAHDRWBiAbbGkNrGVxyCxNkuW9tJL--7RPdM3okeA@mail.gmail.com>
	<CAFzO_6cNfJxsi_OKQwryUpgFh4XzVfVbpcOgd=7VbKMSj6pgVg@mail.gmail.com>
	<CAFzO_6e0BK6a=wzoJaM=6vW0sx=zMn-OyjPdDw3G9nm-u7BE7w@mail.gmail.com>
	<CAFzO_6frz9+1+uQ-fju-TBH0+KjbHeN7ShQmuV8DLPfb9ibGtQ@mail.gmail.com>
	<CAJgngAepgq8NuWDwPcU4r9LN_9ixKrBqhUDska6YEofpUPXNmA@mail.gmail.com>
Message-ID: <CAM5SUC7vvp62sq8LT7sDvVb8MGgDvbU1P2K155FhCWpBVypwYQ@mail.gmail.com>

So I don't have Windows 10, but I managed to run a VM from
https://developer.microsoft.com/en-us/microsoft-edge/tools/vms/.

After that I cloned the whole Keycloak repository
https://github.com/keycloak/keycloak-js-bower. Nothing was found, please
see the screenshot: https://i.imgur.com/1NbFGrn.png.

On Tue, Jan 9, 2018 at 10:46 AM Stian Thorgersen <sthorger at redhat.com>
wrote:

> Please create an issue with the details. We'll need to figure out how to
> reproduce the issue though. Seemed like Ramunas had tried, but that
> Defender wasn't reporting anything for him.
>
> On 8 January 2018 at 21:18, Ariel Carrera <carreraariel at gmail.com> wrote:
>
> > "when your somebody get's a keycloak's distribution to be installed"
> read
> > like: "when someone gets Keycloak to be installed" xD
> >
> > 2018-01-08 16:56 GMT-03:00 Ariel Carrera <carreraariel at gmail.com>:
> >
> >> Hi Stian, I checked differences in keycloak.min.js comparing version
> >> 3.4.1 to 3.4.2.
> >> I can't see a problem at first sight... but It's still a problem to see
> >> your antivirus alerting for a threat when your browser access to a page
> >> that uses "keycloak.min.js" or when your somebody get's a keycloak's
> >> distribution to be installed.
> >>
> >> Maybe this issue must to be in Jira.
> >>
> >> Last changes in javascript file can be the problem.
> >>
> >> Maybe function "processInit()" needs some changes.
> >>
> >> Regards,
> >>
> >> 2018-01-08 16:26 GMT-03:00 Ariel Carrera <carreraariel at gmail.com>:
> >>
> >>> Checked with other computer (windows 10 + windows defender).
> >>>
> >>> keycloak-min.js is detected as virus from  version 3.4.2 to 3.4.3
> >>>
> >>>
> >>> 2018-01-03 17:44 GMT-03:00 Ramunas <ramunask at gmail.com>:
> >>>
> >>>> * just downloaded keycloak-js-adapter-dist-3.4.2.Final.zip file
> >>>> * extracted and scanned "keycloak-js-adapter-dist-3.4.2.Final" folder
> >>>> with Windows Defender on Windows 10 - no issues found
> >>>> * checked for Windows updates. New update "Definition Update for
> >>>> Windows Defender Antivirus - KB2267602 (Definition 1.259.1141.0)" was
> found
> >>>> and installed.
> >>>> * scanned again. No issues found.
> >>>>
> >>>> Ram?nas
> >>>>
> >>>
> >>>
> >>>
> >>> --
> >>> Ariel Carrera
> >>>
> >>
> >>
> >>
> >> --
> >> Ariel Carrera
> >>
> >
> >
> >
> > --
> > Ariel Carrera
> >
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

From carreraariel at gmail.com  Tue Jan  9 10:47:35 2018
From: carreraariel at gmail.com (Ariel Carrera)
Date: Tue, 9 Jan 2018 12:47:35 -0300
Subject: [keycloak-user] [keycloak-dev] Trojan in Keycloak Javascript
	Adapter?
In-Reply-To: <CAM5SUC7vvp62sq8LT7sDvVb8MGgDvbU1P2K155FhCWpBVypwYQ@mail.gmail.com>
References: <CAFzO_6eDDb+uG67_uPFAZTSq6YRfmfhmmJ0VE5AjdvO37UprVA@mail.gmail.com>
	<CAHYJo18jrXAHDRWBiAbbGkNrGVxyCxNkuW9tJL--7RPdM3okeA@mail.gmail.com>
	<CAFzO_6cNfJxsi_OKQwryUpgFh4XzVfVbpcOgd=7VbKMSj6pgVg@mail.gmail.com>
	<CAFzO_6e0BK6a=wzoJaM=6vW0sx=zMn-OyjPdDw3G9nm-u7BE7w@mail.gmail.com>
	<CAFzO_6frz9+1+uQ-fju-TBH0+KjbHeN7ShQmuV8DLPfb9ibGtQ@mail.gmail.com>
	<CAJgngAepgq8NuWDwPcU4r9LN_9ixKrBqhUDska6YEofpUPXNmA@mail.gmail.com>
	<CAM5SUC7vvp62sq8LT7sDvVb8MGgDvbU1P2K155FhCWpBVypwYQ@mail.gmail.com>
Message-ID: <CAFzO_6c2U8v_WjeFPqYgNRdzNU7UgnVNf50noCGn5S7YNfyLcA@mail.gmail.com>

I don't know why we have differents Windows Defender results... but it's
Microsoft...

Bruno, Is your Windows (inside VM) updated? What version is? Do you updated
virus definitions too?

I updated definitions but problem persists... Here is another screenshot:
[image: Im?genes integradas 1]


[image: Im?genes integradas 2]


You can check my windows version in second screenshot. It is version
10.0.16299.192 (and it was tested in another machine with version (
10.0.16299.125)).

Recently, It was tested again with a third machine (at home) in another
network / location / and installation. Same problem, virus detected.

Maybe Microsoft has differents versions by location... I don't know...
after update to last version, Windows Defender asked me to send the file to
improve detection (I had not asked for this before).



2018-01-09 11:50 GMT-03:00 Bruno Oliveira <bruno at abstractj.org>:

> So I don't have Windows 10, but I managed to run a VM from
> https://developer.microsoft.com/en-us/microsoft-edge/tools/vms/.
>
> After that I cloned the whole Keycloak repository https://github.com/
> keycloak/keycloak-js-bower. Nothing was found, please see the screenshot:
> https://i.imgur.com/1NbFGrn.png.
>
> On Tue, Jan 9, 2018 at 10:46 AM Stian Thorgersen <sthorger at redhat.com>
> wrote:
>
>> Please create an issue with the details. We'll need to figure out how to
>> reproduce the issue though. Seemed like Ramunas had tried, but that
>> Defender wasn't reporting anything for him.
>>
>> On 8 January 2018 at 21:18, Ariel Carrera <carreraariel at gmail.com> wrote:
>>
>> > "when your somebody get's a keycloak's distribution to be installed"
>> read
>> > like: "when someone gets Keycloak to be installed" xD
>> >
>> > 2018-01-08 16:56 GMT-03:00 Ariel Carrera <carreraariel at gmail.com>:
>> >
>> >> Hi Stian, I checked differences in keycloak.min.js comparing version
>> >> 3.4.1 to 3.4.2.
>> >> I can't see a problem at first sight... but It's still a problem to see
>> >> your antivirus alerting for a threat when your browser access to a page
>> >> that uses "keycloak.min.js" or when your somebody get's a keycloak's
>> >> distribution to be installed.
>> >>
>> >> Maybe this issue must to be in Jira.
>> >>
>> >> Last changes in javascript file can be the problem.
>> >>
>> >> Maybe function "processInit()" needs some changes.
>> >>
>> >> Regards,
>> >>
>> >> 2018-01-08 16:26 GMT-03:00 Ariel Carrera <carreraariel at gmail.com>:
>> >>
>> >>> Checked with other computer (windows 10 + windows defender).
>> >>>
>> >>> keycloak-min.js is detected as virus from  version 3.4.2 to 3.4.3
>> >>>
>> >>>
>> >>> 2018-01-03 17:44 GMT-03:00 Ramunas <ramunask at gmail.com>:
>> >>>
>> >>>> * just downloaded keycloak-js-adapter-dist-3.4.2.Final.zip file
>> >>>> * extracted and scanned "keycloak-js-adapter-dist-3.4.2.Final"
>> folder
>> >>>> with Windows Defender on Windows 10 - no issues found
>> >>>> * checked for Windows updates. New update "Definition Update for
>> >>>> Windows Defender Antivirus - KB2267602 (Definition 1.259.1141.0)"
>> was found
>> >>>> and installed.
>> >>>> * scanned again. No issues found.
>> >>>>
>> >>>> Ram?nas
>> >>>>
>> >>>
>> >>>
>> >>>
>> >>> --
>> >>> Ariel Carrera
>> >>>
>> >>
>> >>
>> >>
>> >> --
>> >> Ariel Carrera
>> >>
>> >
>> >
>> >
>> > --
>> > Ariel Carrera
>> >
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
>


-- 
Ariel Carrera
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image.png
Type: image/png
Size: 112492 bytes
Desc: not available
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20180109/c877f125/attachment-0002.png 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image.png
Type: image/png
Size: 39616 bytes
Desc: not available
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20180109/c877f125/attachment-0003.png 

From carreraariel at gmail.com  Tue Jan  9 11:16:28 2018
From: carreraariel at gmail.com (Ariel Carrera)
Date: Tue, 9 Jan 2018 13:16:28 -0300
Subject: [keycloak-user] [keycloak-dev] Trojan in Keycloak Javascript
	Adapter?
In-Reply-To: <CAFzO_6c2U8v_WjeFPqYgNRdzNU7UgnVNf50noCGn5S7YNfyLcA@mail.gmail.com>
References: <CAFzO_6eDDb+uG67_uPFAZTSq6YRfmfhmmJ0VE5AjdvO37UprVA@mail.gmail.com>
	<CAHYJo18jrXAHDRWBiAbbGkNrGVxyCxNkuW9tJL--7RPdM3okeA@mail.gmail.com>
	<CAFzO_6cNfJxsi_OKQwryUpgFh4XzVfVbpcOgd=7VbKMSj6pgVg@mail.gmail.com>
	<CAFzO_6e0BK6a=wzoJaM=6vW0sx=zMn-OyjPdDw3G9nm-u7BE7w@mail.gmail.com>
	<CAFzO_6frz9+1+uQ-fju-TBH0+KjbHeN7ShQmuV8DLPfb9ibGtQ@mail.gmail.com>
	<CAJgngAepgq8NuWDwPcU4r9LN_9ixKrBqhUDska6YEofpUPXNmA@mail.gmail.com>
	<CAM5SUC7vvp62sq8LT7sDvVb8MGgDvbU1P2K155FhCWpBVypwYQ@mail.gmail.com>
	<CAFzO_6c2U8v_WjeFPqYgNRdzNU7UgnVNf50noCGn5S7YNfyLcA@mail.gmail.com>
Message-ID: <CAFzO_6cveF6o=PS0CNswp3BeH1rj6DqnC4j6y3iO5Bok=0BqLw@mail.gmail.com>

I created a Jira to track this problem:

https://issues.jboss.org/browse/KEYCLOAK-6157

I tried with older 3.4.x versions and only happens with 3.4.2 and 3.4.3

I compared the minified files between version 3.4.1 and 3.4.2 and they have
little differences between them but I can't see a threat in the code so I
suspect that it is a false alarm but it still is a problem for users.

I think that doing a rewrite of the function "processInit()" can helps to
get off alerts when the file gets minified.


2018-01-09 12:47 GMT-03:00 Ariel Carrera <carreraariel at gmail.com>:

> I don't know why we have differents Windows Defender results... but it's
> Microsoft...
>
> Bruno, Is your Windows (inside VM) updated? What version is? Do you
> updated virus definitions too?
>
> I updated definitions but problem persists... Here is another screenshot:
> [image: Im?genes integradas 1]
>
>
> [image: Im?genes integradas 2]
>
>
> You can check my windows version in second screenshot. It is version
> 10.0.16299.192 (and it was tested in another machine with version (
> 10.0.16299.125)).
>
> Recently, It was tested again with a third machine (at home) in another
> network / location / and installation. Same problem, virus detected.
>
> Maybe Microsoft has differents versions by location... I don't know...
> after update to last version, Windows Defender asked me to send the file to
> improve detection (I had not asked for this before).
>
>
>
> 2018-01-09 11:50 GMT-03:00 Bruno Oliveira <bruno at abstractj.org>:
>
>> So I don't have Windows 10, but I managed to run a VM from
>> https://developer.microsoft.com/en-us/microsoft-edge/tools/vms/.
>>
>> After that I cloned the whole Keycloak repository https://github.com/
>> keycloak/keycloak-js-bower. Nothing was found, please see the
>> screenshot: https://i.imgur.com/1NbFGrn.png.
>>
>> On Tue, Jan 9, 2018 at 10:46 AM Stian Thorgersen <sthorger at redhat.com>
>> wrote:
>>
>>> Please create an issue with the details. We'll need to figure out how to
>>> reproduce the issue though. Seemed like Ramunas had tried, but that
>>> Defender wasn't reporting anything for him.
>>>
>>> On 8 January 2018 at 21:18, Ariel Carrera <carreraariel at gmail.com>
>>> wrote:
>>>
>>> > "when your somebody get's a keycloak's distribution to be installed"
>>> read
>>> > like: "when someone gets Keycloak to be installed" xD
>>> >
>>> > 2018-01-08 16:56 GMT-03:00 Ariel Carrera <carreraariel at gmail.com>:
>>> >
>>> >> Hi Stian, I checked differences in keycloak.min.js comparing version
>>> >> 3.4.1 to 3.4.2.
>>> >> I can't see a problem at first sight... but It's still a problem to
>>> see
>>> >> your antivirus alerting for a threat when your browser access to a
>>> page
>>> >> that uses "keycloak.min.js" or when your somebody get's a keycloak's
>>> >> distribution to be installed.
>>> >>
>>> >> Maybe this issue must to be in Jira.
>>> >>
>>> >> Last changes in javascript file can be the problem.
>>> >>
>>> >> Maybe function "processInit()" needs some changes.
>>> >>
>>> >> Regards,
>>> >>
>>> >> 2018-01-08 16:26 GMT-03:00 Ariel Carrera <carreraariel at gmail.com>:
>>> >>
>>> >>> Checked with other computer (windows 10 + windows defender).
>>> >>>
>>> >>> keycloak-min.js is detected as virus from  version 3.4.2 to 3.4.3
>>> >>>
>>> >>>
>>> >>> 2018-01-03 17:44 GMT-03:00 Ramunas <ramunask at gmail.com>:
>>> >>>
>>> >>>> * just downloaded keycloak-js-adapter-dist-3.4.2.Final.zip file
>>> >>>> * extracted and scanned "keycloak-js-adapter-dist-3.4.2.Final"
>>> folder
>>> >>>> with Windows Defender on Windows 10 - no issues found
>>> >>>> * checked for Windows updates. New update "Definition Update for
>>> >>>> Windows Defender Antivirus - KB2267602 (Definition 1.259.1141.0)"
>>> was found
>>> >>>> and installed.
>>> >>>> * scanned again. No issues found.
>>> >>>>
>>> >>>> Ram?nas
>>> >>>>
>>> >>>
>>> >>>
>>> >>>
>>> >>> --
>>> >>> Ariel Carrera
>>> >>>
>>> >>
>>> >>
>>> >>
>>> >> --
>>> >> Ariel Carrera
>>> >>
>>> >
>>> >
>>> >
>>> > --
>>> > Ariel Carrera
>>> >
>>> _______________________________________________
>>> keycloak-user mailing list
>>> keycloak-user at lists.jboss.org
>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>
>>
>
>
> --
> Ariel Carrera
>



-- 
Ariel Carrera
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image.png
Type: image/png
Size: 39616 bytes
Desc: not available
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20180109/3068e7b6/attachment-0002.png 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image.png
Type: image/png
Size: 112492 bytes
Desc: not available
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20180109/3068e7b6/attachment-0003.png 

From sthorger at redhat.com  Tue Jan  9 13:55:34 2018
From: sthorger at redhat.com (Stian Thorgersen)
Date: Tue, 9 Jan 2018 19:55:34 +0100
Subject: [keycloak-user] [keycloak-dev] Trojan in Keycloak Javascript
	Adapter?
In-Reply-To: <CAFzO_6cveF6o=PS0CNswp3BeH1rj6DqnC4j6y3iO5Bok=0BqLw@mail.gmail.com>
References: <CAFzO_6eDDb+uG67_uPFAZTSq6YRfmfhmmJ0VE5AjdvO37UprVA@mail.gmail.com>
	<CAHYJo18jrXAHDRWBiAbbGkNrGVxyCxNkuW9tJL--7RPdM3okeA@mail.gmail.com>
	<CAFzO_6cNfJxsi_OKQwryUpgFh4XzVfVbpcOgd=7VbKMSj6pgVg@mail.gmail.com>
	<CAFzO_6e0BK6a=wzoJaM=6vW0sx=zMn-OyjPdDw3G9nm-u7BE7w@mail.gmail.com>
	<CAFzO_6frz9+1+uQ-fju-TBH0+KjbHeN7ShQmuV8DLPfb9ibGtQ@mail.gmail.com>
	<CAJgngAepgq8NuWDwPcU4r9LN_9ixKrBqhUDska6YEofpUPXNmA@mail.gmail.com>
	<CAM5SUC7vvp62sq8LT7sDvVb8MGgDvbU1P2K155FhCWpBVypwYQ@mail.gmail.com>
	<CAFzO_6c2U8v_WjeFPqYgNRdzNU7UgnVNf50noCGn5S7YNfyLcA@mail.gmail.com>
	<CAFzO_6cveF6o=PS0CNswp3BeH1rj6DqnC4j6y3iO5Bok=0BqLw@mail.gmail.com>
Message-ID: <CAJgngAfqAxw+Bq0E18Q65zUanwQ7QwGyjG=4oi4p1F81bOv+vQ@mail.gmail.com>

We're not going to do anything unless someone else can confirm this. This
is probably also something that you can report to Microsoft as they are
reporting a false positive here, assuming you're not actually affected by a
virus yourself.

I've also tried Defender now, that makes 3 people that has tried to confirm
this with no luck.

On 9 January 2018 at 17:16, Ariel Carrera <carreraariel at gmail.com> wrote:

> I created a Jira to track this problem:
>
> https://issues.jboss.org/browse/KEYCLOAK-6157
>
> I tried with older 3.4.x versions and only happens with 3.4.2 and 3.4.3
>
> I compared the minified files between version 3.4.1 and 3.4.2 and they
> have little differences between them but I can't see a threat in the code
> so I suspect that it is a false alarm but it still is a problem for users.
>
> I think that doing a rewrite of the function "processInit()" can helps to
> get off alerts when the file gets minified.
>
>
> 2018-01-09 12:47 GMT-03:00 Ariel Carrera <carreraariel at gmail.com>:
>
>> I don't know why we have differents Windows Defender results... but it's
>> Microsoft...
>>
>> Bruno, Is your Windows (inside VM) updated? What version is? Do you
>> updated virus definitions too?
>>
>> I updated definitions but problem persists... Here is another screenshot:
>> [image: Im?genes integradas 1]
>>
>>
>> [image: Im?genes integradas 2]
>>
>>
>> You can check my windows version in second screenshot. It is version
>> 10.0.16299.192 (and it was tested in another machine with version (
>> 10.0.16299.125)).
>>
>> Recently, It was tested again with a third machine (at home) in another
>> network / location / and installation. Same problem, virus detected.
>>
>> Maybe Microsoft has differents versions by location... I don't know...
>> after update to last version, Windows Defender asked me to send the file to
>> improve detection (I had not asked for this before).
>>
>>
>>
>> 2018-01-09 11:50 GMT-03:00 Bruno Oliveira <bruno at abstractj.org>:
>>
>>> So I don't have Windows 10, but I managed to run a VM from
>>> https://developer.microsoft.com/en-us/microsoft-edge/tools/vms/.
>>>
>>> After that I cloned the whole Keycloak repository https://github.com/
>>> keycloak/keycloak-js-bower. Nothing was found, please see the
>>> screenshot: https://i.imgur.com/1NbFGrn.png.
>>>
>>> On Tue, Jan 9, 2018 at 10:46 AM Stian Thorgersen <sthorger at redhat.com>
>>> wrote:
>>>
>>>> Please create an issue with the details. We'll need to figure out how to
>>>> reproduce the issue though. Seemed like Ramunas had tried, but that
>>>> Defender wasn't reporting anything for him.
>>>>
>>>> On 8 January 2018 at 21:18, Ariel Carrera <carreraariel at gmail.com>
>>>> wrote:
>>>>
>>>> > "when your somebody get's a keycloak's distribution to be installed"
>>>> read
>>>> > like: "when someone gets Keycloak to be installed" xD
>>>> >
>>>> > 2018-01-08 16:56 GMT-03:00 Ariel Carrera <carreraariel at gmail.com>:
>>>> >
>>>> >> Hi Stian, I checked differences in keycloak.min.js comparing version
>>>> >> 3.4.1 to 3.4.2.
>>>> >> I can't see a problem at first sight... but It's still a problem to
>>>> see
>>>> >> your antivirus alerting for a threat when your browser access to a
>>>> page
>>>> >> that uses "keycloak.min.js" or when your somebody get's a keycloak's
>>>> >> distribution to be installed.
>>>> >>
>>>> >> Maybe this issue must to be in Jira.
>>>> >>
>>>> >> Last changes in javascript file can be the problem.
>>>> >>
>>>> >> Maybe function "processInit()" needs some changes.
>>>> >>
>>>> >> Regards,
>>>> >>
>>>> >> 2018-01-08 16:26 GMT-03:00 Ariel Carrera <carreraariel at gmail.com>:
>>>> >>
>>>> >>> Checked with other computer (windows 10 + windows defender).
>>>> >>>
>>>> >>> keycloak-min.js is detected as virus from  version 3.4.2 to 3.4.3
>>>> >>>
>>>> >>>
>>>> >>> 2018-01-03 17:44 GMT-03:00 Ramunas <ramunask at gmail.com>:
>>>> >>>
>>>> >>>> * just downloaded keycloak-js-adapter-dist-3.4.2.Final.zip file
>>>> >>>> * extracted and scanned "keycloak-js-adapter-dist-3.4.2.Final"
>>>> folder
>>>> >>>> with Windows Defender on Windows 10 - no issues found
>>>> >>>> * checked for Windows updates. New update "Definition Update for
>>>> >>>> Windows Defender Antivirus - KB2267602 (Definition 1.259.1141.0)"
>>>> was found
>>>> >>>> and installed.
>>>> >>>> * scanned again. No issues found.
>>>> >>>>
>>>> >>>> Ram?nas
>>>> >>>>
>>>> >>>
>>>> >>>
>>>> >>>
>>>> >>> --
>>>> >>> Ariel Carrera
>>>> >>>
>>>> >>
>>>> >>
>>>> >>
>>>> >> --
>>>> >> Ariel Carrera
>>>> >>
>>>> >
>>>> >
>>>> >
>>>> > --
>>>> > Ariel Carrera
>>>> >
>>>> _______________________________________________
>>>> keycloak-user mailing list
>>>> keycloak-user at lists.jboss.org
>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>
>>>
>>
>>
>> --
>> Ariel Carrera
>>
>
>
>
> --
> Ariel Carrera
>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image.png
Type: image/png
Size: 112492 bytes
Desc: not available
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20180109/f1e8886c/attachment-0002.png 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image.png
Type: image/png
Size: 39616 bytes
Desc: not available
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20180109/f1e8886c/attachment-0003.png 

From sthorger at redhat.com  Tue Jan  9 13:58:06 2018
From: sthorger at redhat.com (Stian Thorgersen)
Date: Tue, 9 Jan 2018 19:58:06 +0100
Subject: [keycloak-user] [keycloak-dev] Trojan in Keycloak Javascript
	Adapter?
In-Reply-To: <CAJgngAfqAxw+Bq0E18Q65zUanwQ7QwGyjG=4oi4p1F81bOv+vQ@mail.gmail.com>
References: <CAFzO_6eDDb+uG67_uPFAZTSq6YRfmfhmmJ0VE5AjdvO37UprVA@mail.gmail.com>
	<CAHYJo18jrXAHDRWBiAbbGkNrGVxyCxNkuW9tJL--7RPdM3okeA@mail.gmail.com>
	<CAFzO_6cNfJxsi_OKQwryUpgFh4XzVfVbpcOgd=7VbKMSj6pgVg@mail.gmail.com>
	<CAFzO_6e0BK6a=wzoJaM=6vW0sx=zMn-OyjPdDw3G9nm-u7BE7w@mail.gmail.com>
	<CAFzO_6frz9+1+uQ-fju-TBH0+KjbHeN7ShQmuV8DLPfb9ibGtQ@mail.gmail.com>
	<CAJgngAepgq8NuWDwPcU4r9LN_9ixKrBqhUDska6YEofpUPXNmA@mail.gmail.com>
	<CAM5SUC7vvp62sq8LT7sDvVb8MGgDvbU1P2K155FhCWpBVypwYQ@mail.gmail.com>
	<CAFzO_6c2U8v_WjeFPqYgNRdzNU7UgnVNf50noCGn5S7YNfyLcA@mail.gmail.com>
	<CAFzO_6cveF6o=PS0CNswp3BeH1rj6DqnC4j6y3iO5Bok=0BqLw@mail.gmail.com>
	<CAJgngAfqAxw+Bq0E18Q65zUanwQ7QwGyjG=4oi4p1F81bOv+vQ@mail.gmail.com>
Message-ID: <CAJgngAewGffhnDqTPXML31MgKN+A9Ho+X4zH1LiuHzONJJg3=Q@mail.gmail.com>

Please report the files here
https://www.microsoft.com/en-us/wdsi/filesubmission.

On 9 January 2018 at 19:55, Stian Thorgersen <sthorger at redhat.com> wrote:

> We're not going to do anything unless someone else can confirm this. This
> is probably also something that you can report to Microsoft as they are
> reporting a false positive here, assuming you're not actually affected by a
> virus yourself.
>
> I've also tried Defender now, that makes 3 people that has tried to
> confirm this with no luck.
>
> On 9 January 2018 at 17:16, Ariel Carrera <carreraariel at gmail.com> wrote:
>
>> I created a Jira to track this problem:
>>
>> https://issues.jboss.org/browse/KEYCLOAK-6157
>>
>> I tried with older 3.4.x versions and only happens with 3.4.2 and 3.4.3
>>
>> I compared the minified files between version 3.4.1 and 3.4.2 and they
>> have little differences between them but I can't see a threat in the code
>> so I suspect that it is a false alarm but it still is a problem for users.
>>
>> I think that doing a rewrite of the function "processInit()" can helps to
>> get off alerts when the file gets minified.
>>
>>
>> 2018-01-09 12:47 GMT-03:00 Ariel Carrera <carreraariel at gmail.com>:
>>
>>> I don't know why we have differents Windows Defender results... but it's
>>> Microsoft...
>>>
>>> Bruno, Is your Windows (inside VM) updated? What version is? Do you
>>> updated virus definitions too?
>>>
>>> I updated definitions but problem persists... Here is another screenshot:
>>> [image: Im?genes integradas 1]
>>>
>>>
>>> [image: Im?genes integradas 2]
>>>
>>>
>>> You can check my windows version in second screenshot. It is version
>>> 10.0.16299.192 (and it was tested in another machine with version (
>>> 10.0.16299.125)).
>>>
>>> Recently, It was tested again with a third machine (at home) in another
>>> network / location / and installation. Same problem, virus detected.
>>>
>>> Maybe Microsoft has differents versions by location... I don't know...
>>> after update to last version, Windows Defender asked me to send the file to
>>> improve detection (I had not asked for this before).
>>>
>>>
>>>
>>> 2018-01-09 11:50 GMT-03:00 Bruno Oliveira <bruno at abstractj.org>:
>>>
>>>> So I don't have Windows 10, but I managed to run a VM from
>>>> https://developer.microsoft.com/en-us/microsoft-edge/tools/vms/.
>>>>
>>>> After that I cloned the whole Keycloak repository https://github.com/
>>>> keycloak/keycloak-js-bower. Nothing was found, please see the
>>>> screenshot: https://i.imgur.com/1NbFGrn.png.
>>>>
>>>> On Tue, Jan 9, 2018 at 10:46 AM Stian Thorgersen <sthorger at redhat.com>
>>>> wrote:
>>>>
>>>>> Please create an issue with the details. We'll need to figure out how
>>>>> to
>>>>> reproduce the issue though. Seemed like Ramunas had tried, but that
>>>>> Defender wasn't reporting anything for him.
>>>>>
>>>>> On 8 January 2018 at 21:18, Ariel Carrera <carreraariel at gmail.com>
>>>>> wrote:
>>>>>
>>>>> > "when your somebody get's a keycloak's distribution to be
>>>>> installed"  read
>>>>> > like: "when someone gets Keycloak to be installed" xD
>>>>> >
>>>>> > 2018-01-08 16:56 GMT-03:00 Ariel Carrera <carreraariel at gmail.com>:
>>>>> >
>>>>> >> Hi Stian, I checked differences in keycloak.min.js comparing version
>>>>> >> 3.4.1 to 3.4.2.
>>>>> >> I can't see a problem at first sight... but It's still a problem to
>>>>> see
>>>>> >> your antivirus alerting for a threat when your browser access to a
>>>>> page
>>>>> >> that uses "keycloak.min.js" or when your somebody get's a keycloak's
>>>>> >> distribution to be installed.
>>>>> >>
>>>>> >> Maybe this issue must to be in Jira.
>>>>> >>
>>>>> >> Last changes in javascript file can be the problem.
>>>>> >>
>>>>> >> Maybe function "processInit()" needs some changes.
>>>>> >>
>>>>> >> Regards,
>>>>> >>
>>>>> >> 2018-01-08 16:26 GMT-03:00 Ariel Carrera <carreraariel at gmail.com>:
>>>>> >>
>>>>> >>> Checked with other computer (windows 10 + windows defender).
>>>>> >>>
>>>>> >>> keycloak-min.js is detected as virus from  version 3.4.2 to 3.4.3
>>>>> >>>
>>>>> >>>
>>>>> >>> 2018-01-03 17:44 GMT-03:00 Ramunas <ramunask at gmail.com>:
>>>>> >>>
>>>>> >>>> * just downloaded keycloak-js-adapter-dist-3.4.2.Final.zip file
>>>>> >>>> * extracted and scanned "keycloak-js-adapter-dist-3.4.2.Final"
>>>>> folder
>>>>> >>>> with Windows Defender on Windows 10 - no issues found
>>>>> >>>> * checked for Windows updates. New update "Definition Update for
>>>>> >>>> Windows Defender Antivirus - KB2267602 (Definition 1.259.1141.0)"
>>>>> was found
>>>>> >>>> and installed.
>>>>> >>>> * scanned again. No issues found.
>>>>> >>>>
>>>>> >>>> Ram?nas
>>>>> >>>>
>>>>> >>>
>>>>> >>>
>>>>> >>>
>>>>> >>> --
>>>>> >>> Ariel Carrera
>>>>> >>>
>>>>> >>
>>>>> >>
>>>>> >>
>>>>> >> --
>>>>> >> Ariel Carrera
>>>>> >>
>>>>> >
>>>>> >
>>>>> >
>>>>> > --
>>>>> > Ariel Carrera
>>>>> >
>>>>> _______________________________________________
>>>>> keycloak-user mailing list
>>>>> keycloak-user at lists.jboss.org
>>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>>
>>>>
>>>
>>>
>>> --
>>> Ariel Carrera
>>>
>>
>>
>>
>> --
>> Ariel Carrera
>>
>
>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image.png
Type: image/png
Size: 112492 bytes
Desc: not available
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20180109/78905c6a/attachment-0002.png 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image.png
Type: image/png
Size: 39616 bytes
Desc: not available
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20180109/78905c6a/attachment-0003.png 

From bruno at abstractj.org  Tue Jan  9 14:10:49 2018
From: bruno at abstractj.org (Bruno Oliveira)
Date: Tue, 09 Jan 2018 19:10:49 +0000
Subject: [keycloak-user] [keycloak-dev] Trojan in Keycloak Javascript
	Adapter?
In-Reply-To: <CAFzO_6c2U8v_WjeFPqYgNRdzNU7UgnVNf50noCGn5S7YNfyLcA@mail.gmail.com>
References: <CAFzO_6eDDb+uG67_uPFAZTSq6YRfmfhmmJ0VE5AjdvO37UprVA@mail.gmail.com>
	<CAHYJo18jrXAHDRWBiAbbGkNrGVxyCxNkuW9tJL--7RPdM3okeA@mail.gmail.com>
	<CAFzO_6cNfJxsi_OKQwryUpgFh4XzVfVbpcOgd=7VbKMSj6pgVg@mail.gmail.com>
	<CAFzO_6e0BK6a=wzoJaM=6vW0sx=zMn-OyjPdDw3G9nm-u7BE7w@mail.gmail.com>
	<CAFzO_6frz9+1+uQ-fju-TBH0+KjbHeN7ShQmuV8DLPfb9ibGtQ@mail.gmail.com>
	<CAJgngAepgq8NuWDwPcU4r9LN_9ixKrBqhUDska6YEofpUPXNmA@mail.gmail.com>
	<CAM5SUC7vvp62sq8LT7sDvVb8MGgDvbU1P2K155FhCWpBVypwYQ@mail.gmail.com>
	<CAFzO_6c2U8v_WjeFPqYgNRdzNU7UgnVNf50noCGn5S7YNfyLcA@mail.gmail.com>
Message-ID: <CAM5SUC5JK1AfBV=t2Y4gPpd=20hQGGmtQboMvHJ7Ff339fSuFA@mail.gmail.com>

Yes, everything is up to date. Like mentioned in my previous e-mail, I'm
running Windows 10 VM from
https://developer.microsoft.com/en-us/microsoft-edge/tools/vms/.

I strongly recommend you to do the same. It's always better to test things
in a clean environment.


On Tue, Jan 9, 2018 at 1:47 PM Ariel Carrera <carreraariel at gmail.com> wrote:

> I don't know why we have differents Windows Defender results... but it's
> Microsoft...
>
> Bruno, Is your Windows (inside VM) updated? What version is? Do you
> updated virus definitions too?
>
> I updated definitions but problem persists... Here is another screenshot:
> [image: image.png]
>
>
> [image: image.png]
>
>
> You can check my windows version in second screenshot. It is version
> 10.0.16299.192 (and it was tested in another machine with version (
> 10.0.16299.125)).
>
> Recently, It was tested again with a third machine (at home) in another
> network / location / and installation. Same problem, virus detected.
>
> Maybe Microsoft has differents versions by location... I don't know...
> after update to last version, Windows Defender asked me to send the file to
> improve detection (I had not asked for this before).
>
>
>
> 2018-01-09 11:50 GMT-03:00 Bruno Oliveira <bruno at abstractj.org>:
>
>> So I don't have Windows 10, but I managed to run a VM from
>> https://developer.microsoft.com/en-us/microsoft-edge/tools/vms/.
>>
>> After that I cloned the whole Keycloak repository
>> https://github.com/keycloak/keycloak-js-bower. Nothing was found, please
>> see the screenshot: https://i.imgur.com/1NbFGrn.png.
>>
>> On Tue, Jan 9, 2018 at 10:46 AM Stian Thorgersen <sthorger at redhat.com>
>> wrote:
>>
>>> Please create an issue with the details. We'll need to figure out how to
>>> reproduce the issue though. Seemed like Ramunas had tried, but that
>>> Defender wasn't reporting anything for him.
>>>
>>> On 8 January 2018 at 21:18, Ariel Carrera <carreraariel at gmail.com>
>>> wrote:
>>>
>>> > "when your somebody get's a keycloak's distribution to be installed"
>>> read
>>> > like: "when someone gets Keycloak to be installed" xD
>>> >
>>> > 2018-01-08 16:56 GMT-03:00 Ariel Carrera <carreraariel at gmail.com>:
>>> >
>>> >> Hi Stian, I checked differences in keycloak.min.js comparing version
>>> >> 3.4.1 to 3.4.2.
>>> >> I can't see a problem at first sight... but It's still a problem to
>>> see
>>> >> your antivirus alerting for a threat when your browser access to a
>>> page
>>> >> that uses "keycloak.min.js" or when your somebody get's a keycloak's
>>> >> distribution to be installed.
>>> >>
>>> >> Maybe this issue must to be in Jira.
>>> >>
>>> >> Last changes in javascript file can be the problem.
>>> >>
>>> >> Maybe function "processInit()" needs some changes.
>>> >>
>>> >> Regards,
>>> >>
>>> >> 2018-01-08 16:26 GMT-03:00 Ariel Carrera <carreraariel at gmail.com>:
>>> >>
>>> >>> Checked with other computer (windows 10 + windows defender).
>>> >>>
>>> >>> keycloak-min.js is detected as virus from  version 3.4.2 to 3.4.3
>>> >>>
>>> >>>
>>> >>> 2018-01-03 17:44 GMT-03:00 Ramunas <ramunask at gmail.com>:
>>> >>>
>>> >>>> * just downloaded keycloak-js-adapter-dist-3.4.2.Final.zip file
>>> >>>> * extracted and scanned "keycloak-js-adapter-dist-3.4.2.Final"
>>> folder
>>> >>>> with Windows Defender on Windows 10 - no issues found
>>> >>>> * checked for Windows updates. New update "Definition Update for
>>> >>>> Windows Defender Antivirus - KB2267602 (Definition 1.259.1141.0)"
>>> was found
>>> >>>> and installed.
>>> >>>> * scanned again. No issues found.
>>> >>>>
>>> >>>> Ram?nas
>>> >>>>
>>> >>>
>>> >>>
>>> >>>
>>> >>> --
>>> >>> Ariel Carrera
>>> >>>
>>> >>
>>> >>
>>> >>
>>> >> --
>>> >> Ariel Carrera
>>> >>
>>> >
>>> >
>>> >
>>> > --
>>> > Ariel Carrera
>>> >
>>> _______________________________________________
>>> keycloak-user mailing list
>>> keycloak-user at lists.jboss.org
>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>
>>
>
>
> --
> Ariel Carrera
>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image.png
Type: image/png
Size: 112492 bytes
Desc: not available
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20180109/6f7cae18/attachment-0002.png 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image.png
Type: image/png
Size: 39616 bytes
Desc: not available
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20180109/6f7cae18/attachment-0003.png 

From MMcShea at idtus.com  Tue Jan  9 14:48:05 2018
From: MMcShea at idtus.com (Matt McShea)
Date: Tue, 9 Jan 2018 14:48:05 -0500
Subject: [keycloak-user] Help Needed on X509 Certificate Authentication with
 keycloak behind Nginx reverse proxy
Message-ID: <97E0A24F0C2ECC4EACB65491D0CCDDB3348706C466@MX1.corp.idtus.com>

Hello,

I am running into the exact issue described in a previous thread, and was wondering if there have been any updates made in the recent releases that fix this issue.

http://lists.jboss.org/pipermail/keycloak-user/2017-September/011905.html

Like Thomas in that thread, everything works with the ngninx reverse proxy, but when I go through the proxy I'm unable to login.

If I use the following line in my proxy configuration" proxy_set_header X-SSL-CERT $ssl_client_raw_cert", I just get a blank page with no html codes or anything.

If I use $ssl_client_cert instead, I get redirected to the username/password login as if there wasn't a client certificate.

I am currently using 3.1.0, but upgraded to Wildfly 11.

Thanks,
Matt McShea


From mposolda at redhat.com  Tue Jan  9 15:40:42 2018
From: mposolda at redhat.com (Marek Posolda)
Date: Tue, 9 Jan 2018 21:40:42 +0100
Subject: [keycloak-user] Help Needed on X509 Certificate Authentication
 with keycloak behind Nginx reverse proxy
In-Reply-To: <97E0A24F0C2ECC4EACB65491D0CCDDB3348706C466@MX1.corp.idtus.com>
References: <97E0A24F0C2ECC4EACB65491D0CCDDB3348706C466@MX1.corp.idtus.com>
Message-ID: <f72ca33b-42a6-ba6b-4620-19961b6c4d73@redhat.com>

By coincidence, I've just send PR for the documentation support around 
this: https://github.com/keycloak/keycloak-documentation/pull/287

In shortcut, we have builtin support when Keycloak is behind Apache 
reverse proxy or HAProxy. We didn't yet tried to test with Keycloak 
behind NGinx, but it's possible that one of the providers like "apache" 
or "haproxy" will work with nginx too. If it doesn't, you can 
investigate the reason and possibly send PR.

Good luck,
Marek

On 09/01/18 20:48, Matt McShea wrote:
> Hello,
>
> I am running into the exact issue described in a previous thread, and was wondering if there have been any updates made in the recent releases that fix this issue.
>
> http://lists.jboss.org/pipermail/keycloak-user/2017-September/011905.html
>
> Like Thomas in that thread, everything works with the ngninx reverse proxy, but when I go through the proxy I'm unable to login.
>
> If I use the following line in my proxy configuration" proxy_set_header X-SSL-CERT $ssl_client_raw_cert", I just get a blank page with no html codes or anything.
>
> If I use $ssl_client_cert instead, I get redirected to the username/password login as if there wasn't a client certificate.
>
> I am currently using 3.1.0, but upgraded to Wildfly 11.
>
> Thanks,
> Matt McShea
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user



From mposolda at redhat.com  Tue Jan  9 15:47:14 2018
From: mposolda at redhat.com (Marek Posolda)
Date: Tue, 9 Jan 2018 21:47:14 +0100
Subject: [keycloak-user] REGISTER event: firstName & lastName always NULL
In-Reply-To: <3594b91b-a5dd-79fa-0bc5-212a9d8113f8@frotscher.com>
References: <3594b91b-a5dd-79fa-0bc5-212a9d8113f8@frotscher.com>
Message-ID: <d0d27673-48cf-7f04-e405-a09df2c8223a@redhat.com>

Not 100% sure, but I think that you're right and firstName and lastName 
are not available in the REGISTER event. That's because REGISTER event 
is triggered too early - at the stage when userModel doesn't yet have 
firstName and lastName properly set on it.

I think there are some workarounds - for example there is LOGIN event, 
which is send right after the REGISTER. You can track LOGIN events, 
which were sent right after the REGISTER events. I think that firstName, 
lastName should be available in those LOGIN events.

Marek

On 09/01/18 11:01, Thilo Frotscher wrote:
> Hi all,
>
> In our project there is a requirement to execute some actions after successful
> user registrations. I implemented an EventListenerProvider that listens to events
> of type REGISTER. The details of this event type only contain the "username" of
> the user that just registered, but first name and last name are missing.
>
> So I thought I could retrieve this information from the user storage. But no
> matter how I try to read the user information from the user storage, firstName
> and lastName are always null.
>
> Is this a bug or a feature? When manually logging on to the Admin Console,
> I can see that firstName and lastName have been correctly saved. But how
> can I programmatically retrieve the first name and last name of the user
> that just registered in my event listener?
>
> Sample code:
>
>      public void onEvent(Event event) {
>
>          if (!EventType.REGISTER.equals(event.getType())) {
>              LOGGER.info("Ignoring event of type " + event.getType());
>              return;
>          }
>
>          String realmId = event.getRealmId();
>          RealmModel realm = session.realms().getRealm(realmId);
>
>          String userId = event.getUserId();
>
>          Map<String, String> details = event.getDetails();
>          String username = details.get("username");
>
>          printUser(session.users().getUserByUsername(username, realm));
>          printUser(session.userLocalStorage().getUserByUsername(username, realm));
>          printUser(session.userCache().getUserByUsername(username, realm));
>          printUser(session.userStorageManager().getUserByUsername(username, realm));
>
>      }
>
>      private void printUser(UserModel user) {
>          if (user==null) {
>              LOGGER.info("User is null");
>          } else {
>              LOGGER.info(user.getFirstName()); // always null
>              LOGGER.info(user.getLastName()); // always null
>              LOGGER.info(user.getId());
>              LOGGER.info(user.getEmail());
>              LOGGER.info(user.getUsername());
>          }
>      }
>
> Actually, I believe firstName and lastName should be part of the event details
> in the first place...
>
> Thanks for your help!
>
> Cheers,
> Thilo
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user



From noircc at gmail.com  Wed Jan 10 07:29:52 2018
From: noircc at gmail.com (SW)
Date: Wed, 10 Jan 2018 05:29:52 -0700 (MST)
Subject: [keycloak-user] Backward-Compatibility of
	keycloak-admin-client-x.x.x.jar?
Message-ID: <1515587392284-0.post@n6.nabble.com>

First question:

1) Who is keeping the keycloak-admin-client-x.x.x.jar uptodate?

2) If a new version of keycloak is arriving will there ever be a new version
of keycloak-admin-client.jar?

3) Can the newest keycloak-admin-client communicate with older versions of
keycloak?

regards && tia 
   Sebastian



--
Sent from: http://keycloak-user.88327.x6.nabble.com/

From noircc at gmail.com  Wed Jan 10 07:30:12 2018
From: noircc at gmail.com (SW)
Date: Wed, 10 Jan 2018 05:30:12 -0700 (MST)
Subject: [keycloak-user] Backward-Compatibility of
	keycloak-admin-client-x.x.x.jar?
Message-ID: <1515587412588-0.post@n6.nabble.com>

First question:

1) Who is keeping the keycloak-admin-client-x.x.x.jar uptodate?

2) If a new version of keycloak is arriving will there ever be a new version
of keycloak-admin-client.jar?

3) Can the newest keycloak-admin-client communicate with older versions of
keycloak?

regards && tia 
   Sebastian



--
Sent from: http://keycloak-user.88327.x6.nabble.com/

From mstrukel at redhat.com  Wed Jan 10 10:12:25 2018
From: mstrukel at redhat.com (Marko Strukelj)
Date: Wed, 10 Jan 2018 16:12:25 +0100
Subject: [keycloak-user] Backward-Compatibility of
	keycloak-admin-client-x.x.x.jar?
In-Reply-To: <1515587412588-0.post@n6.nabble.com>
References: <1515587412588-0.post@n6.nabble.com>
Message-ID: <CA+1OW+jQ13LGbur5V1pi1ED_eMNJtYETA+z1EEmReE6FxsLFhQ@mail.gmail.com>

On Wed, Jan 10, 2018 at 1:30 PM, SW <noircc at gmail.com> wrote:

> First question:
>
> 1) Who is keeping the keycloak-admin-client-x.x.x.jar uptodate?
>
Keycloak admin client is a part of Keycloak code base so it's maintained by
Keycloak project developers.


> 2) If a new version of keycloak is arriving will there ever be a new
> version
> of keycloak-admin-client.jar?
>
 With every new release of Keycloak the keycloak-admin-client is
incremented to the new version. It is constantly maintained.

3) Can the newest keycloak-admin-client communicate with older versions of
> keycloak?
>
In principle it should work with the same major version of the server - so
minor version releases should not break it (in principle). But I think
there have been cases where we made changes that broke that, and I don't
think we have the tests to make sure that it works. Thus it's best to test
your clients with new version against older server before upgrading.

From noircc at gmail.com  Wed Jan 10 10:15:21 2018
From: noircc at gmail.com (Sebastian Wilhelm)
Date: Wed, 10 Jan 2018 16:15:21 +0100
Subject: [keycloak-user] Backward-Compatibility of
	keycloak-admin-client-x.x.x.jar?
In-Reply-To: <CA+1OW+jQ13LGbur5V1pi1ED_eMNJtYETA+z1EEmReE6FxsLFhQ@mail.gmail.com>
References: <1515587412588-0.post@n6.nabble.com>
	<CA+1OW+jQ13LGbur5V1pi1ED_eMNJtYETA+z1EEmReE6FxsLFhQ@mail.gmail.com>
Message-ID: <CACr-HWHSQ6CU0rd7CUepP32vPMmCpu-5MTAXLdcWRjYpCbCehw@mail.gmail.com>

Ok, thanks for the info.

Am 10.01.2018 4:12 Nachm. schrieb "Marko Strukelj" <mstrukel at redhat.com>:

>
> On Wed, Jan 10, 2018 at 1:30 PM, SW <noircc at gmail.com> wrote:
>
>> First question:
>>
>> 1) Who is keeping the keycloak-admin-client-x.x.x.jar uptodate?
>>
> Keycloak admin client is a part of Keycloak code base so it's maintained
> by Keycloak project developers.
>
>
>> 2) If a new version of keycloak is arriving will there ever be a new
>> version
>> of keycloak-admin-client.jar?
>>
>  With every new release of Keycloak the keycloak-admin-client is
> incremented to the new version. It is constantly maintained.
>
> 3) Can the newest keycloak-admin-client communicate with older versions of
>> keycloak?
>>
> In principle it should work with the same major version of the server - so
> minor version releases should not break it (in principle). But I think
> there have been cases where we made changes that broke that, and I don't
> think we have the tests to make sure that it works. Thus it's best to test
> your clients with new version against older server before upgrading.
>
>

From jcain at redhat.com  Wed Jan 10 13:13:35 2018
From: jcain at redhat.com (Josh Cain)
Date: Wed, 10 Jan 2018 12:13:35 -0600
Subject: [keycloak-user] offlineSessions data in cache vs db
In-Reply-To: <bae6fa59-6711-eeda-d196-f4529a167873@autonomic.ai>
References: <bae6fa59-6711-eeda-d196-f4529a167873@autonomic.ai>
Message-ID: <a045fed1-7e7f-b5f0-5c84-08bd87fb9e8c@redhat.com>

Looking to do some work with offline tokens and I had similar questions.
 Was there ever a response to this?

Josh Cain
Senior Software Applications Engineer, RHCE
Red Hat North America
jcain at redhat.com IRC: jcain

On 11/21/2017 05:12 PM, Tonnis Wildeboer wrote:
> Hello Keycloak Users,
> 
> Ultimately, what we want to do is have three nodes in one Kubernetes 
> namespace that define a cluster. Then be able to add three more nodes to 
> the cluster in a new namespace that shares the same subnet and database, 
> then kill off the original three nodes, effectively migrating the 
> cluster to the new namespace and do all this without anyone being logged 
> out. The namespace distinction is invisible to Keycloak, as far as I can 
> tell.
> 
> What we have tried:
> * Start with 3 standalone-ha mode instances clustered with 
> JGroups/JDBC_PING.
> * Set the number of cache owners for sessions to 6.
> * Start the three new instances in the new Kubernetes namespace, 
> configured exactly the same as the first three - that is, same db, same 
> number of cache owners.
> * Kill the original three
> 
> But it seems this caused offlineSession tokens to be expired immediately.
> 
> I found this in the online documentation 
> (http://www.keycloak.org/docs/latest/server_installation/index.html#server-cache-configuration):
> 
>  > The second type of cache handles managing user sessions, offline 
> tokens, and keeping track of login failures... The data held in these 
> caches is temporary, in memory only, but is possibly replicated across 
> the cluster.
> 
>  > The sessions, authenticationSessions, offlineSessions and 
> loginFailures caches are the only caches that may perform replication. 
> Entries are not replicated to every single node, but instead one or more 
> nodes is chosen as an owner of that data. If a node is not the owner of 
> a specific cache entry it queries the cluster to obtain it. What this 
> means for failover is that if all the nodes that own a piece of data go 
> down, that data is lost forever. By default, Keycloak only specifies one 
> owner for data. So if that one node goes down that data is lost. This 
> usually means that users will be logged out and will have to login again.
> 
> It appears, based on these documentation comments and our experience, 
> that the "source of truth" regarding offlineSessions is the data in the 
> "owner" caches, is NOT the database, as I would have expected. It also 
> seems to be the case that if a node joins the cluster (as defined by 
> JGroups/JDBC_PING), it will NOT be able to populate its offlineSessions 
> cache from the database, but must rely on replication from one of the 
> owner nodes.
> 
> Questions:
> 1. Is the above understanding regarding the db vs cache correct?
> 2. If so, please explain the design/reasoning behind this behavior. 
> Otherwise, please correct my understanding.
> 3. Is there a way to perform this simple migration without losing any 
> sessions?
> 
> Thanks,
> 
> --Tonnis
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
> 

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20180110/9cbedffe/attachment-0001.bin 

From mposolda at redhat.com  Wed Jan 10 16:13:53 2018
From: mposolda at redhat.com (Marek Posolda)
Date: Wed, 10 Jan 2018 22:13:53 +0100
Subject: [keycloak-user] offlineSessions data in cache vs db
In-Reply-To: <a045fed1-7e7f-b5f0-5c84-08bd87fb9e8c@redhat.com>
References: <bae6fa59-6711-eeda-d196-f4529a167873@autonomic.ai>
	<a045fed1-7e7f-b5f0-5c84-08bd87fb9e8c@redhat.com>
Message-ID: <c58ff56e-2c18-3387-d052-f05d9a0a2409@redhat.com>

Yes, I've replied. It seems this thread was send to both "keycloak-dev" 
and "keycloak-user" and I've replied to "keycloak-dev" . Answer is here: 
http://lists.jboss.org/pipermail/keycloak-dev/2017-December/010249.html .

Marek

On 10/01/18 19:13, Josh Cain wrote:
> Looking to do some work with offline tokens and I had similar questions.
>   Was there ever a response to this?
>
> Josh Cain
> Senior Software Applications Engineer, RHCE
> Red Hat North America
> jcain at redhat.com IRC: jcain
>
> On 11/21/2017 05:12 PM, Tonnis Wildeboer wrote:
>> Hello Keycloak Users,
>>
>> Ultimately, what we want to do is have three nodes in one Kubernetes
>> namespace that define a cluster. Then be able to add three more nodes to
>> the cluster in a new namespace that shares the same subnet and database,
>> then kill off the original three nodes, effectively migrating the
>> cluster to the new namespace and do all this without anyone being logged
>> out. The namespace distinction is invisible to Keycloak, as far as I can
>> tell.
>>
>> What we have tried:
>> * Start with 3 standalone-ha mode instances clustered with
>> JGroups/JDBC_PING.
>> * Set the number of cache owners for sessions to 6.
>> * Start the three new instances in the new Kubernetes namespace,
>> configured exactly the same as the first three - that is, same db, same
>> number of cache owners.
>> * Kill the original three
>>
>> But it seems this caused offlineSession tokens to be expired immediately.
>>
>> I found this in the online documentation
>> (http://www.keycloak.org/docs/latest/server_installation/index.html#server-cache-configuration):
>>
>>   > The second type of cache handles managing user sessions, offline
>> tokens, and keeping track of login failures... The data held in these
>> caches is temporary, in memory only, but is possibly replicated across
>> the cluster.
>>
>>   > The sessions, authenticationSessions, offlineSessions and
>> loginFailures caches are the only caches that may perform replication.
>> Entries are not replicated to every single node, but instead one or more
>> nodes is chosen as an owner of that data. If a node is not the owner of
>> a specific cache entry it queries the cluster to obtain it. What this
>> means for failover is that if all the nodes that own a piece of data go
>> down, that data is lost forever. By default, Keycloak only specifies one
>> owner for data. So if that one node goes down that data is lost. This
>> usually means that users will be logged out and will have to login again.
>>
>> It appears, based on these documentation comments and our experience,
>> that the "source of truth" regarding offlineSessions is the data in the
>> "owner" caches, is NOT the database, as I would have expected. It also
>> seems to be the case that if a node joins the cluster (as defined by
>> JGroups/JDBC_PING), it will NOT be able to populate its offlineSessions
>> cache from the database, but must rely on replication from one of the
>> owner nodes.
>>
>> Questions:
>> 1. Is the above understanding regarding the db vs cache correct?
>> 2. If so, please explain the design/reasoning behind this behavior.
>> Otherwise, please correct my understanding.
>> 3. Is there a way to perform this simple migration without losing any
>> sessions?
>>
>> Thanks,
>>
>> --Tonnis
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user



From jcain at redhat.com  Wed Jan 10 16:31:38 2018
From: jcain at redhat.com (Josh Cain)
Date: Wed, 10 Jan 2018 15:31:38 -0600
Subject: [keycloak-user] offlineSessions data in cache vs db
In-Reply-To: <c58ff56e-2c18-3387-d052-f05d9a0a2409@redhat.com>
References: <bae6fa59-6711-eeda-d196-f4529a167873@autonomic.ai>
	<a045fed1-7e7f-b5f0-5c84-08bd87fb9e8c@redhat.com>
	<c58ff56e-2c18-3387-d052-f05d9a0a2409@redhat.com>
Message-ID: <3a16a6e1-6a61-ae1c-4941-a85ade1d323f@redhat.com>

Thanks for the response!  Seem to have missed the reply.  A follow-up
question:

You mentioned that the choice to store in the Infinispan cache was made
for performance purposes.  I understand that this will lead to faster
retrieval speeds, however storing *every* offline session in the
Infinispan cache could lead to a massive memory footprint if these
sessions are used widely enough, right?

Am I understanding this correctly, or are the client sessions so light
the impact is negligible?

Josh Cain
Senior Software Applications Engineer, RHCE
Red Hat North America
jcain at redhat.com IRC: jcain

On 01/10/2018 03:13 PM, Marek Posolda wrote:
> Yes, I've replied. It seems this thread was send to both "keycloak-dev"
> and "keycloak-user" and I've replied to "keycloak-dev" . Answer is here:
> http://lists.jboss.org/pipermail/keycloak-dev/2017-December/010249.html .
> 
> Marek
> 
> On 10/01/18 19:13, Josh Cain wrote:
>> Looking to do some work with offline tokens and I had similar questions.
>> ? Was there ever a response to this?
>>
>> Josh Cain
>> Senior Software Applications Engineer, RHCE
>> Red Hat North America
>> jcain at redhat.com IRC: jcain
>>
>> On 11/21/2017 05:12 PM, Tonnis Wildeboer wrote:
>>> Hello Keycloak Users,
>>>
>>> Ultimately, what we want to do is have three nodes in one Kubernetes
>>> namespace that define a cluster. Then be able to add three more nodes to
>>> the cluster in a new namespace that shares the same subnet and database,
>>> then kill off the original three nodes, effectively migrating the
>>> cluster to the new namespace and do all this without anyone being logged
>>> out. The namespace distinction is invisible to Keycloak, as far as I can
>>> tell.
>>>
>>> What we have tried:
>>> * Start with 3 standalone-ha mode instances clustered with
>>> JGroups/JDBC_PING.
>>> * Set the number of cache owners for sessions to 6.
>>> * Start the three new instances in the new Kubernetes namespace,
>>> configured exactly the same as the first three - that is, same db, same
>>> number of cache owners.
>>> * Kill the original three
>>>
>>> But it seems this caused offlineSession tokens to be expired
>>> immediately.
>>>
>>> I found this in the online documentation
>>> (http://www.keycloak.org/docs/latest/server_installation/index.html#server-cache-configuration):
>>>
>>>
>>> ? > The second type of cache handles managing user sessions, offline
>>> tokens, and keeping track of login failures... The data held in these
>>> caches is temporary, in memory only, but is possibly replicated across
>>> the cluster.
>>>
>>> ? > The sessions, authenticationSessions, offlineSessions and
>>> loginFailures caches are the only caches that may perform replication.
>>> Entries are not replicated to every single node, but instead one or more
>>> nodes is chosen as an owner of that data. If a node is not the owner of
>>> a specific cache entry it queries the cluster to obtain it. What this
>>> means for failover is that if all the nodes that own a piece of data go
>>> down, that data is lost forever. By default, Keycloak only specifies one
>>> owner for data. So if that one node goes down that data is lost. This
>>> usually means that users will be logged out and will have to login
>>> again.
>>>
>>> It appears, based on these documentation comments and our experience,
>>> that the "source of truth" regarding offlineSessions is the data in the
>>> "owner" caches, is NOT the database, as I would have expected. It also
>>> seems to be the case that if a node joins the cluster (as defined by
>>> JGroups/JDBC_PING), it will NOT be able to populate its offlineSessions
>>> cache from the database, but must rely on replication from one of the
>>> owner nodes.
>>>
>>> Questions:
>>> 1. Is the above understanding regarding the db vs cache correct?
>>> 2. If so, please explain the design/reasoning behind this behavior.
>>> Otherwise, please correct my understanding.
>>> 3. Is there a way to perform this simple migration without losing any
>>> sessions?
>>>
>>> Thanks,
>>>
>>> --Tonnis
>>> _______________________________________________
>>> keycloak-user mailing list
>>> keycloak-user at lists.jboss.org
>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>
>>
>>
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
> 
> 
> 

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20180110/b83f26d0/attachment.bin 

From Pankaj.Mahajan at harbingergroup.com  Thu Jan 11 08:42:33 2018
From: Pankaj.Mahajan at harbingergroup.com (Pankaj Mahajan)
Date: Thu, 11 Jan 2018 13:42:33 +0000
Subject: [keycloak-user] How to pass custom parameter to Keycloak SAML
 authenticationn endpoint
Message-ID: <PN1PR0101MB1983F08EAC6156FE9A1C29EDF5160@PN1PR0101MB1983.INDPRD01.PROD.OUTLOOK.COM>

Hi Team,

I have multiple clients(OIDC and SAML both) in a single realm with multiple Identity providers in the same realm. I need to pass custom parameter in authentication request based on which within Keycloak I will be able to determine to which IDP this request need to be forwarded instead of displaying Keycloak login page.

For OIDC applications the kc_idp_hint query parameter can be used, but I would like to achieve this behavior for SAML applications.

Please let me know, if there is already a provision in Keycloak to achieve the above behavior. If not then please share your thoughts/pointers if any. Thank you in advance.

Thanks & regards,
Pankaj Mahajan

Sent from Mail<https://go.microsoft.com/fwlink/?LinkId=550986> for Windows 10


From the_fredo at yahoo.com  Thu Jan 11 09:29:10 2018
From: the_fredo at yahoo.com (The Fredo)
Date: Thu, 11 Jan 2018 14:29:10 +0000 (UTC)
Subject: [keycloak-user] overriding built-in verify-email RequiredAction
References: <1290297806.1120835.1515680950641.ref@mail.yahoo.com>
Message-ID: <1290297806.1120835.1515680950641@mail.yahoo.com>

Hello all,
I need to extend a bit the built-in VerifyEmail RequiredAction (i.e. adding a specific attribute in the LoginFormsProvider, so that the login-verify-email.ftl template displays accordingly).What would be the right way to do this ?
I tried to build a new RequiredAction based on the existing VerifyEmail RequiredAction, but it happened to be far too complex for me.
(The only way I made it work was modifying the existing code (of VerifyEmail.java), it allowed to test that my data are available for the freemarker template).
Thanks in advance !
regards
Keycloak 3.2.1

From mposolda at redhat.com  Thu Jan 11 12:07:13 2018
From: mposolda at redhat.com (Marek Posolda)
Date: Thu, 11 Jan 2018 18:07:13 +0100
Subject: [keycloak-user] offlineSessions data in cache vs db
In-Reply-To: <3a16a6e1-6a61-ae1c-4941-a85ade1d323f@redhat.com>
References: <bae6fa59-6711-eeda-d196-f4529a167873@autonomic.ai>
	<a045fed1-7e7f-b5f0-5c84-08bd87fb9e8c@redhat.com>
	<c58ff56e-2c18-3387-d052-f05d9a0a2409@redhat.com>
	<3a16a6e1-6a61-ae1c-4941-a85ade1d323f@redhat.com>
Message-ID: <8ef486e4-fbfc-a9d7-5d56-c2f266a26eaf@redhat.com>

On 10/01/18 22:31, Josh Cain wrote:
> Thanks for the response!  Seem to have missed the reply.  A follow-up
> question:
>
> You mentioned that the choice to store in the Infinispan cache was made
> for performance purposes.  I understand that this will lead to faster
> retrieval speeds, however storing *every* offline session in the
> Infinispan cache could lead to a massive memory footprint if these
> sessions are used widely enough, right?
Just tried some very basic testing. I've tried to create 100K 
userSessions where every of them has 1 clientSession - so 100K 
userSessions + 100K clientSessions.

With 0 offlineSessions, I saw server consumes 100 MBytes in memory. With 
100K sessions (100K userSessions + 100K clientSessions) it was 230 
MBytes. With 200K sessions (200K userSessions + 200K clientSessions), it 
was 350 MBytes.

So every userSession+clientSession pair took around 1-2 KBytes in my 
test. In reality, it may be more as it depends on the amount of things 
in the sessions (roles, protocolMappers, notes etc). We have an existing 
JIRA to remove some stuff from sessions and save it on tokens itself, 
which should improve memory consumption [1] .

In cluster environment, the memory consumption will be smaller as every 
cluster node will have just those sessions, which he is owner (default 
setup of infinispan caches "offlineSessions" and "offlineClientSessions" 
is to use distributed cache with 1 owner).

If some more flexibility is needed, we may add support for 
offlineSessions to use infinispan cacheStores/cacheLoaders. This is 
pretty flexible SPI in infinispan 8 (which is the version we currently 
use). With this, customer may be able to choose if sessions should be 
preloaded on startup or lazy loaded. Also there may be some additional 
options around passivation etc, which may be good if customer prefers to 
save memory rather than CPU. Feel free to create another JIRA if you 
need this. Just not sure when it's done...

[1] https://issues.jboss.org/browse/KEYCLOAK-5006

Marek
>
> Am I understanding this correctly, or are the client sessions so light
> the impact is negligible?
>
> Josh Cain
> Senior Software Applications Engineer, RHCE
> Red Hat North America
> jcain at redhat.com IRC: jcain
>
> On 01/10/2018 03:13 PM, Marek Posolda wrote:
>> Yes, I've replied. It seems this thread was send to both "keycloak-dev"
>> and "keycloak-user" and I've replied to "keycloak-dev" . Answer is here:
>> http://lists.jboss.org/pipermail/keycloak-dev/2017-December/010249.html .
>>
>> Marek
>>
>> On 10/01/18 19:13, Josh Cain wrote:
>>> Looking to do some work with offline tokens and I had similar questions.
>>>    Was there ever a response to this?
>>>
>>> Josh Cain
>>> Senior Software Applications Engineer, RHCE
>>> Red Hat North America
>>> jcain at redhat.com IRC: jcain
>>>
>>> On 11/21/2017 05:12 PM, Tonnis Wildeboer wrote:
>>>> Hello Keycloak Users,
>>>>
>>>> Ultimately, what we want to do is have three nodes in one Kubernetes
>>>> namespace that define a cluster. Then be able to add three more nodes to
>>>> the cluster in a new namespace that shares the same subnet and database,
>>>> then kill off the original three nodes, effectively migrating the
>>>> cluster to the new namespace and do all this without anyone being logged
>>>> out. The namespace distinction is invisible to Keycloak, as far as I can
>>>> tell.
>>>>
>>>> What we have tried:
>>>> * Start with 3 standalone-ha mode instances clustered with
>>>> JGroups/JDBC_PING.
>>>> * Set the number of cache owners for sessions to 6.
>>>> * Start the three new instances in the new Kubernetes namespace,
>>>> configured exactly the same as the first three - that is, same db, same
>>>> number of cache owners.
>>>> * Kill the original three
>>>>
>>>> But it seems this caused offlineSession tokens to be expired
>>>> immediately.
>>>>
>>>> I found this in the online documentation
>>>> (http://www.keycloak.org/docs/latest/server_installation/index.html#server-cache-configuration):
>>>>
>>>>
>>>>    > The second type of cache handles managing user sessions, offline
>>>> tokens, and keeping track of login failures... The data held in these
>>>> caches is temporary, in memory only, but is possibly replicated across
>>>> the cluster.
>>>>
>>>>    > The sessions, authenticationSessions, offlineSessions and
>>>> loginFailures caches are the only caches that may perform replication.
>>>> Entries are not replicated to every single node, but instead one or more
>>>> nodes is chosen as an owner of that data. If a node is not the owner of
>>>> a specific cache entry it queries the cluster to obtain it. What this
>>>> means for failover is that if all the nodes that own a piece of data go
>>>> down, that data is lost forever. By default, Keycloak only specifies one
>>>> owner for data. So if that one node goes down that data is lost. This
>>>> usually means that users will be logged out and will have to login
>>>> again.
>>>>
>>>> It appears, based on these documentation comments and our experience,
>>>> that the "source of truth" regarding offlineSessions is the data in the
>>>> "owner" caches, is NOT the database, as I would have expected. It also
>>>> seems to be the case that if a node joins the cluster (as defined by
>>>> JGroups/JDBC_PING), it will NOT be able to populate its offlineSessions
>>>> cache from the database, but must rely on replication from one of the
>>>> owner nodes.
>>>>
>>>> Questions:
>>>> 1. Is the above understanding regarding the db vs cache correct?
>>>> 2. If so, please explain the design/reasoning behind this behavior.
>>>> Otherwise, please correct my understanding.
>>>> 3. Is there a way to perform this simple migration without losing any
>>>> sessions?
>>>>
>>>> Thanks,
>>>>
>>>> --Tonnis
>>>> _______________________________________________
>>>> keycloak-user mailing list
>>>> keycloak-user at lists.jboss.org
>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>>
>>>
>>> _______________________________________________
>>> keycloak-user mailing list
>>> keycloak-user at lists.jboss.org
>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>
>>


From keycloak at frotscher.com  Fri Jan 12 10:18:42 2018
From: keycloak at frotscher.com (Thilo Frotscher)
Date: Fri, 12 Jan 2018 16:18:42 +0100
Subject: [keycloak-user] REGISTER event: firstName & lastName always NULL
In-Reply-To: <d0d27673-48cf-7f04-e405-a09df2c8223a@redhat.com>
References: <3594b91b-a5dd-79fa-0bc5-212a9d8113f8@frotscher.com>
	<d0d27673-48cf-7f04-e405-a09df2c8223a@redhat.com>
Message-ID: <713f2373-2d81-e7bc-5bf6-cc9bea4d42bf@frotscher.com>


Thanks for your reply. Listening to LOGIN events was not an option for us. There are simply
too many of those LOGIN events, not just the ones following a REGISTER event. It would have
been too complex to find the right LOGIN event among all the others. Also, we would have had
to maintain some kind of state in the listener.

At the end we solved the issue by notifying our application about the REGISTER event and
including dummy values for firstName and lastName. These dummy values are stored in our
application temporarily until the newly registered user logs in to our application for the
first time. Upon logging in an access token will be passed to the application that contains
the correctly populated firstName and lastName. So we just compare the user details contained
in the access token with the user details in our application's database, and update the
database if there is any difference.

An obvious concern with this solution is that we do this check for every request we receive.
But it does not actually cause any significant additional load, not even an additional database
query, as we access for database for every incoming request anyway.

Thilo



Am 09.01.2018 um 21:47 schrieb Marek Posolda:
> Not 100% sure, but I think that you're right and firstName and lastName are not available in the REGISTER event. That's
> because REGISTER event is triggered too early - at the stage when userModel doesn't yet have firstName and lastName
> properly set on it.
> 
> I think there are some workarounds - for example there is LOGIN event, which is send right after the REGISTER. You can
> track LOGIN events, which were sent right after the REGISTER events. I think that firstName, lastName should be
> available in those LOGIN events.
> 
> Marek
> 
> On 09/01/18 11:01, Thilo Frotscher wrote:
>> Hi all,
>>
>> In our project there is a requirement to execute some actions after successful
>> user registrations. I implemented an EventListenerProvider that listens to events
>> of type REGISTER. The details of this event type only contain the "username" of
>> the user that just registered, but first name and last name are missing.
>>
>> So I thought I could retrieve this information from the user storage. But no
>> matter how I try to read the user information from the user storage, firstName
>> and lastName are always null.
>>
>> Is this a bug or a feature? When manually logging on to the Admin Console,
>> I can see that firstName and lastName have been correctly saved. But how
>> can I programmatically retrieve the first name and last name of the user
>> that just registered in my event listener?
>>
>> Sample code:
>>
>> ???? public void onEvent(Event event) {
>>
>> ???????? if (!EventType.REGISTER.equals(event.getType())) {
>> ???????????? LOGGER.info("Ignoring event of type " + event.getType());
>> ???????????? return;
>> ???????? }
>>
>> ???????? String realmId = event.getRealmId();
>> ???????? RealmModel realm = session.realms().getRealm(realmId);
>>
>> ???????? String userId = event.getUserId();
>>
>> ???????? Map<String, String> details = event.getDetails();
>> ???????? String username = details.get("username");
>>
>> ???????? printUser(session.users().getUserByUsername(username, realm));
>> ???????? printUser(session.userLocalStorage().getUserByUsername(username, realm));
>> ???????? printUser(session.userCache().getUserByUsername(username, realm));
>> ???????? printUser(session.userStorageManager().getUserByUsername(username, realm));
>>
>> ???? }
>>
>> ???? private void printUser(UserModel user) {
>> ???????? if (user==null) {
>> ???????????? LOGGER.info("User is null");
>> ???????? } else {
>> ???????????? LOGGER.info(user.getFirstName()); // always null
>> ???????????? LOGGER.info(user.getLastName()); // always null
>> ???????????? LOGGER.info(user.getId());
>> ???????????? LOGGER.info(user.getEmail());
>> ???????????? LOGGER.info(user.getUsername());
>> ???????? }
>> ???? }
>>
>> Actually, I believe firstName and lastName should be part of the event details
>> in the first place...
>>
>> Thanks for your help!
>>
>> Cheers,
>> Thilo
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
> 
> 
> 

From to_sud at yahoo.com  Fri Jan 12 15:25:43 2018
From: to_sud at yahoo.com (Sud Ramasamy)
Date: Fri, 12 Jan 2018 15:25:43 -0500
Subject: [keycloak-user] implicitly pick the IdP for brokering
Message-ID: <etPan.5a5919c7.76a7bad4.2393@yahoo.com>


As I understand it currently keycloak expects a kc_idp_hint URL attribute if we want to redirect to a brokering IdP from a set of configured IdPs in the realm. Is it possible to accomplish the same behavior without having the specify the kc_id_hint attribute.

We don?t want the user to have to specify the kc_idp_hint URL attribute when accessing our SaaS application. But we also don?t want to add any URL rewrites in front of the application or in front of Keycloak where the kc_idp_hint param gets set if we can avoid it. We could add a Servlet Filter in the application that sets the kc_idp_hint parameter before passing the request to the Keycloak Java Adapter filter that we use in the application.?

Outside of the custom filter option we were wondering if we were to do this entirely in Keycloak was that even possible and what would that look like.

Thanks
-sud

From rsoares at redhat.com  Fri Jan 12 16:07:00 2018
From: rsoares at redhat.com (Rafael T. C. Soares)
Date: Fri, 12 Jan 2018 18:07:00 -0300
Subject: [keycloak-user] connect and revoke third party apps on Keycloak
Message-ID: <9690c55d-7d4a-aae5-bedf-f0c18fa67518@redhat.com>

Hi!

Sorry if this question sound kinda dummy. But I can not recognize this 
feature on Keycloak. Maybe it uses another terminology for this.

Anyway, how can we implement something like Third Party Application 
Connection (eg: like google [1] and twitter [2] does) on keycloak. And 
how a user (not admin) can by itself revoke authorized /third party 
apps/ connected to it's account on keycloak?

[1] https://support.google.com/accounts/answer/3466521?hl=en

[2] 
https://help.twitter.com/pt/managing-your-account/connect-or-revoke-access-to-third-party-apps

-- 
Rafael T. C. Soares


From csalazar at devsu.com  Fri Jan 12 16:40:00 2018
From: csalazar at devsu.com (Cesar Salazar)
Date: Fri, 12 Jan 2018 16:40:00 -0500
Subject: [keycloak-user] GET users endpoint is making lots of requests
 to the database (its really slow!)
In-Reply-To: <CAJzRJ5JhuhRVTDup8tvH4+rUA6+LOwE5AbJwr+YhTNiPbdYNDQ@mail.gmail.com>
References: <CAJzRJ5K+fJXpJ2u28yWVh5NCwJ310qb7M4es0fpgH3LW54h+pw@mail.gmail.com>
	<6148174c-f714-b56d-03a6-4dc5d4309cb6@redhat.com>
	<CAJzRJ5JhuhRVTDup8tvH4+rUA6+LOwE5AbJwr+YhTNiPbdYNDQ@mail.gmail.com>
Message-ID: <CAJzRJ5+gc403BL1o7QCWhkAVGmM148Yj8J2be_V==aQmfq-0NQ@mail.gmail.com>

Just wanted to update my findings on this issue: it is related to federated
users. My previous tests were invalid because latency for connecting to
Active Directory was different from the cloud that from my server.

I could reduce the time from 25 to 12 seconds by moving Active Directory to
Azure. It's better but still slow. Finally I ended up implementing a custom
endpoint, because we didn't have enough knowledge / time to provide a good
PR.

I will delete the issue I created in JIRA, but I don't know if I should
create another one to report this slowness issue. Also, the endpoint
doesn't respond if Active Directory is down.

Also, something really weird I found is that I use a token for the admin
user it's a few seconds faster than when making the request using a token
of a regular user. (It really doesn't make sense, but for real, using a
token of an admin user, the request always takes about 4 seconds less).


2018-01-04 9:51 GMT-05:00 Cesar Salazar <csalazar at devsu.com>:

> Hi Marek, thanks for your answer. I just created a ticket in JIRA:
> https://issues.jboss.org/browse/KEYCLOAK-6134
>
> I was able to reduce the time to around 2.5 - 3 seconds by installing
> Keycloak and mysql dockerized on bare metal (on a powerful server), but
> still it should be considered slow, taking into account that we plan to
> have not less than a few thousand users... and also considering that it's
> not affordable to have such environment just for the authentication service.
>
> If 150 users require 901 queries, and it takes around 3 seconds to
> respond, with 3000 users, we would have 18001 requests, which would mean
> around 60 seconds for querying the users. (calculated using simple rule of
> three)
>
> I tried the solution of using LDAP No-Import mode, but that doesn't solve
> my use case, since I do need the /realm/users endpoint to return all the
> users (not only allow them to login).
>
> Anyways, for now we will stop scaling and I will ask one of my developers
> to take a look at the code to see if we can find a fix and send a PR or
> otherwise we will implement our own endpoint to get all the users (which is
> something we need for our app).
>
> Thanks!
>
>
> 2018-01-04 5:39 GMT-05:00 Marek Posolda <mposolda at redhat.com>:
>
>> On 03/01/18 23:59, Cesar Salazar wrote:
>>
>>> Hi,
>>>
>>> First of all, thanks for the great work on keycloak!
>>>
>>> We are using keycloak for an application, and it was working great (until
>>> we launched to production)
>>>
>>> We have 150 users which are connected to an Active Directory using the
>>> Federation functionality.
>>>
>>> It works, but the endpoint GET /{realm}/users takes about 23 seconds to
>>> respond (Keycloak running on a container in GKE backed by a mysql server
>>> on
>>> Google Cloud SQL).
>>>
>>> I enabled mysql logging and the problem seems to be that just for
>>> responding this endpoint, the server makes 901 queries to the database!
>>>
>>> These are the queries:
>>>
>>> First query, to get the users:
>>>
>>> select userentity0_.ID as ID1_71_, userentity0_.CREATED_TIMESTAMP as
>>> CREATED_2_71_, userentity0_.EMAIL as EMAIL3_71_,
>>> userentity0_.EMAIL_CONSTRAINT as EMAIL_CO4_71_,
>>> userentity0_.EMAIL_VERIFIED
>>> as EMAIL_VE5_71_, userentity0_.ENABLED as ENABLED6_71_,
>>> userentity0_.FEDERATION_LINK as FEDERATI7_71_, userentity0_.FIRST_NAME as
>>> FIRST_NA8_71_, userentity0_.LAST_NAME as LAST_NAM9_71_,
>>> userentity0_.NOT_BEFORE as NOT_BEF10_71_, userentity0_.REALM_ID as
>>> REALM_I11_71_, userentity0_.SERVICE_ACCOUNT_CLIENT_LINK as
>>> SERVICE12_71_,
>>> userentity0_.USERNAME as USERNAM13_71_ from USER_ENTITY userentity0_
>>> where
>>> userentity0_.REALM_ID='my-realm' and
>>> (userentity0_.SERVICE_ACCOUNT_CLIENT_LINK is null) order by
>>> userentity0_.USERNAME
>>>
>>>
>>> Then,* for each user *a query like this, (getting user attributes I
>>> guess)
>>>
>>> select attributes0_.USER_ID as USER_ID4_67_0_, attributes0_.ID as
>>> ID1_67_0_, attributes0_.ID as ID1_67_1_, attributes0_.NAME as
>>> NAME2_67_1_,
>>> attributes0_.USER_ID as USER_ID4_67_1_, attributes0_.VALUE as
>>> VALUE3_67_1_
>>> from USER_ATTRIBUTE attributes0_ where
>>> attributes0_.USER_ID='b920df7c-a419-4150-86bd-9f81c7ea0b70'
>>>
>>>
>>> Then,* for each user* 4 queries similar to this, (getting credentials I
>>> guess)
>>>
>>> select credential0_.ID as ID1_18_, credential0_.ALGORITHM as
>>> ALGORITH2_18_,
>>> credential0_.COUNTER as COUNTER3_18_, credential0_.CREATED_DATE as
>>> CREATED_4_18_, credential0_.DEVICE as DEVICE5_18_, credential0_.DIGITS as
>>> DIGITS6_18_, credential0_.HASH_ITERATIONS as HASH_ITE7_18_,
>>> credential0_.PERIOD as PERIOD8_18_, credential0_.SALT as SALT9_18_,
>>> credential0_.TYPE as TYPE10_18_, credential0_.USER_ID as USER_ID12_18_,
>>> credential0_.VALUE as VALUE11_18_ from CREDENTIAL credential0_ where
>>> credential0_.USER_ID='94525793-297b-4895-ab2b-7cf8b580e9fa' and
>>> credential0_.TYPE='totp'
>>>
>>>
>>> A query with type *totp* is queried 2 times, the other 2 times are
>>> queried
>>> with type *hotp* and *password*
>>>
>>> and finally one more query* for each user* (getting required actions I
>>> guess)
>>>
>>> select requiredac0_.USER_ID as USER_ID2_77_0_,
>>> requiredac0_.REQUIRED_ACTION
>>> as REQUIRED1_77_0_, requiredac0_.REQUIRED_ACTION as REQUIRED1_77_1_,
>>> requiredac0_.USER_ID as USER_ID2_77_1_ from USER_REQUIRED_ACTION
>>> requiredac0_ where
>>> requiredac0_.USER_ID='94525793-297b-4895-ab2b-7cf8b580e9fa'
>>>
>>>
>>> So, in total, for 150 users, Keycloak is making 901 requests to the
>>> database! If I increase the number to 500 users, will it be 30001
>>> requests???
>>>
>>> How can this be improved? Is there something wrong I'm doing in the
>>> configuration? Does this happens only with Federated users?
>>>
>> I don't think it is specific only for federated users. IMO the same will
>> happen for 150 non-federated users too.
>>
>> You can create JIRA, but not sure if we are able to fix it on our side,
>> we are using JPA/Hibernate under the covers and I think it doesn't easily
>> allow something like "batch" query to retrieve attributes, requiredActions,
>> credentials in single SQL query for current page of users...
>>
>> Maybe the options for you to improve this are:
>> - Improve DB connection and make sure that there is no big network
>> latency between DB and Keycloak (It seems this is the big issue in your
>> env).
>> - Use LDAP No-Import mode
>>
>> Marek
>>
>>>
>>> Thanks!
>>>
>>>
>>
>
>
> --
> *Cesar Salazar*
> Development Manager
> DEVSU | www.devsu.com
> skype: cesarsalazar007
> P: (213)-291-0752 <(213)%20291-0752>
> M: +593 9 2917 160 (Ecuador)
>



-- 
*Cesar Salazar*
Development Manager
DEVSU | www.devsu.com
skype: cesarsalazar007
P: (213)-291-0752
M: +593 9 2917 160 (Ecuador)

From chris.savory at edlogics.com  Fri Jan 12 16:48:08 2018
From: chris.savory at edlogics.com (Chris Savory)
Date: Fri, 12 Jan 2018 21:48:08 +0000
Subject: [keycloak-user] GET users endpoint is making lots of requests
 to the database (its really slow!)
In-Reply-To: <CAJzRJ5+gc403BL1o7QCWhkAVGmM148Yj8J2be_V==aQmfq-0NQ@mail.gmail.com>
References: <CAJzRJ5K+fJXpJ2u28yWVh5NCwJ310qb7M4es0fpgH3LW54h+pw@mail.gmail.com>
	<6148174c-f714-b56d-03a6-4dc5d4309cb6@redhat.com>
	<CAJzRJ5JhuhRVTDup8tvH4+rUA6+LOwE5AbJwr+YhTNiPbdYNDQ@mail.gmail.com>
	<CAJzRJ5+gc403BL1o7QCWhkAVGmM148Yj8J2be_V==aQmfq-0NQ@mail.gmail.com>
Message-ID: <12CAD1B9-7133-4D44-842D-5C3503E123C8@edlogics.com>

We noticed the call to /users became considerably slower when we recently upgraded from 1.9.8 to 3.3.  We are not using federated users on this realm either.  On a keycloak realm with about 2k users, the call went from ~1 second to 30+ seconds.   The only way we were to get sub 10second times was make repeated calls while only grabbing 100 users at a time.  

--
Christopher Savory

On 1/12/18, 3:40 PM, "keycloak-user-bounces at lists.jboss.org on behalf of Cesar Salazar" <keycloak-user-bounces at lists.jboss.org on behalf of csalazar at devsu.com> wrote:

    Just wanted to update my findings on this issue: it is related to federated
    users. My previous tests were invalid because latency for connecting to
    Active Directory was different from the cloud that from my server.
    
    I could reduce the time from 25 to 12 seconds by moving Active Directory to
    Azure. It's better but still slow. Finally I ended up implementing a custom
    endpoint, because we didn't have enough knowledge / time to provide a good
    PR.
    
    I will delete the issue I created in JIRA, but I don't know if I should
    create another one to report this slowness issue. Also, the endpoint
    doesn't respond if Active Directory is down.
    
    Also, something really weird I found is that I use a token for the admin
    user it's a few seconds faster than when making the request using a token
    of a regular user. (It really doesn't make sense, but for real, using a
    token of an admin user, the request always takes about 4 seconds less).
    
    
    2018-01-04 9:51 GMT-05:00 Cesar Salazar <csalazar at devsu.com>:
    
    > Hi Marek, thanks for your answer. I just created a ticket in JIRA:
    > https://issues.jboss.org/browse/KEYCLOAK-6134
    >
    > I was able to reduce the time to around 2.5 - 3 seconds by installing
    > Keycloak and mysql dockerized on bare metal (on a powerful server), but
    > still it should be considered slow, taking into account that we plan to
    > have not less than a few thousand users... and also considering that it's
    > not affordable to have such environment just for the authentication service.
    >
    > If 150 users require 901 queries, and it takes around 3 seconds to
    > respond, with 3000 users, we would have 18001 requests, which would mean
    > around 60 seconds for querying the users. (calculated using simple rule of
    > three)
    >
    > I tried the solution of using LDAP No-Import mode, but that doesn't solve
    > my use case, since I do need the /realm/users endpoint to return all the
    > users (not only allow them to login).
    >
    > Anyways, for now we will stop scaling and I will ask one of my developers
    > to take a look at the code to see if we can find a fix and send a PR or
    > otherwise we will implement our own endpoint to get all the users (which is
    > something we need for our app).
    >
    > Thanks!
    >
    >
    > 2018-01-04 5:39 GMT-05:00 Marek Posolda <mposolda at redhat.com>:
    >
    >> On 03/01/18 23:59, Cesar Salazar wrote:
    >>
    >>> Hi,
    >>>
    >>> First of all, thanks for the great work on keycloak!
    >>>
    >>> We are using keycloak for an application, and it was working great (until
    >>> we launched to production)
    >>>
    >>> We have 150 users which are connected to an Active Directory using the
    >>> Federation functionality.
    >>>
    >>> It works, but the endpoint GET /{realm}/users takes about 23 seconds to
    >>> respond (Keycloak running on a container in GKE backed by a mysql server
    >>> on
    >>> Google Cloud SQL).
    >>>
    >>> I enabled mysql logging and the problem seems to be that just for
    >>> responding this endpoint, the server makes 901 queries to the database!
    >>>
    >>> These are the queries:
    >>>
    >>> First query, to get the users:
    >>>
    >>> select userentity0_.ID as ID1_71_, userentity0_.CREATED_TIMESTAMP as
    >>> CREATED_2_71_, userentity0_.EMAIL as EMAIL3_71_,
    >>> userentity0_.EMAIL_CONSTRAINT as EMAIL_CO4_71_,
    >>> userentity0_.EMAIL_VERIFIED
    >>> as EMAIL_VE5_71_, userentity0_.ENABLED as ENABLED6_71_,
    >>> userentity0_.FEDERATION_LINK as FEDERATI7_71_, userentity0_.FIRST_NAME as
    >>> FIRST_NA8_71_, userentity0_.LAST_NAME as LAST_NAM9_71_,
    >>> userentity0_.NOT_BEFORE as NOT_BEF10_71_, userentity0_.REALM_ID as
    >>> REALM_I11_71_, userentity0_.SERVICE_ACCOUNT_CLIENT_LINK as
    >>> SERVICE12_71_,
    >>> userentity0_.USERNAME as USERNAM13_71_ from USER_ENTITY userentity0_
    >>> where
    >>> userentity0_.REALM_ID='my-realm' and
    >>> (userentity0_.SERVICE_ACCOUNT_CLIENT_LINK is null) order by
    >>> userentity0_.USERNAME
    >>>
    >>>
    >>> Then,* for each user *a query like this, (getting user attributes I
    >>> guess)
    >>>
    >>> select attributes0_.USER_ID as USER_ID4_67_0_, attributes0_.ID as
    >>> ID1_67_0_, attributes0_.ID as ID1_67_1_, attributes0_.NAME as
    >>> NAME2_67_1_,
    >>> attributes0_.USER_ID as USER_ID4_67_1_, attributes0_.VALUE as
    >>> VALUE3_67_1_
    >>> from USER_ATTRIBUTE attributes0_ where
    >>> attributes0_.USER_ID='b920df7c-a419-4150-86bd-9f81c7ea0b70'
    >>>
    >>>
    >>> Then,* for each user* 4 queries similar to this, (getting credentials I
    >>> guess)
    >>>
    >>> select credential0_.ID as ID1_18_, credential0_.ALGORITHM as
    >>> ALGORITH2_18_,
    >>> credential0_.COUNTER as COUNTER3_18_, credential0_.CREATED_DATE as
    >>> CREATED_4_18_, credential0_.DEVICE as DEVICE5_18_, credential0_.DIGITS as
    >>> DIGITS6_18_, credential0_.HASH_ITERATIONS as HASH_ITE7_18_,
    >>> credential0_.PERIOD as PERIOD8_18_, credential0_.SALT as SALT9_18_,
    >>> credential0_.TYPE as TYPE10_18_, credential0_.USER_ID as USER_ID12_18_,
    >>> credential0_.VALUE as VALUE11_18_ from CREDENTIAL credential0_ where
    >>> credential0_.USER_ID='94525793-297b-4895-ab2b-7cf8b580e9fa' and
    >>> credential0_.TYPE='totp'
    >>>
    >>>
    >>> A query with type *totp* is queried 2 times, the other 2 times are
    >>> queried
    >>> with type *hotp* and *password*
    >>>
    >>> and finally one more query* for each user* (getting required actions I
    >>> guess)
    >>>
    >>> select requiredac0_.USER_ID as USER_ID2_77_0_,
    >>> requiredac0_.REQUIRED_ACTION
    >>> as REQUIRED1_77_0_, requiredac0_.REQUIRED_ACTION as REQUIRED1_77_1_,
    >>> requiredac0_.USER_ID as USER_ID2_77_1_ from USER_REQUIRED_ACTION
    >>> requiredac0_ where
    >>> requiredac0_.USER_ID='94525793-297b-4895-ab2b-7cf8b580e9fa'
    >>>
    >>>
    >>> So, in total, for 150 users, Keycloak is making 901 requests to the
    >>> database! If I increase the number to 500 users, will it be 30001
    >>> requests???
    >>>
    >>> How can this be improved? Is there something wrong I'm doing in the
    >>> configuration? Does this happens only with Federated users?
    >>>
    >> I don't think it is specific only for federated users. IMO the same will
    >> happen for 150 non-federated users too.
    >>
    >> You can create JIRA, but not sure if we are able to fix it on our side,
    >> we are using JPA/Hibernate under the covers and I think it doesn't easily
    >> allow something like "batch" query to retrieve attributes, requiredActions,
    >> credentials in single SQL query for current page of users...
    >>
    >> Maybe the options for you to improve this are:
    >> - Improve DB connection and make sure that there is no big network
    >> latency between DB and Keycloak (It seems this is the big issue in your
    >> env).
    >> - Use LDAP No-Import mode
    >>
    >> Marek
    >>
    >>>
    >>> Thanks!
    >>>
    >>>
    >>
    >
    >
    > --
    > *Cesar Salazar*
    > Development Manager
    > DEVSU | www.devsu.com
    > skype: cesarsalazar007
    > P: (213)-291-0752 <(213)%20291-0752>
    > M: +593 9 2917 160 (Ecuador)
    >
    
    
    
    -- 
    *Cesar Salazar*
    Development Manager
    DEVSU | www.devsu.com
    skype: cesarsalazar007
    P: (213)-291-0752
    M: +593 9 2917 160 (Ecuador)
    _______________________________________________
    keycloak-user mailing list
    keycloak-user at lists.jboss.org
    https://lists.jboss.org/mailman/listinfo/keycloak-user
    



From mkanis at redhat.com  Mon Jan 15 02:27:50 2018
From: mkanis at redhat.com (Martin Kanis)
Date: Mon, 15 Jan 2018 08:27:50 +0100
Subject: [keycloak-user] connect and revoke third party apps on Keycloak
In-Reply-To: <9690c55d-7d4a-aae5-bedf-f0c18fa67518@redhat.com>
References: <9690c55d-7d4a-aae5-bedf-f0c18fa67518@redhat.com>
Message-ID: <CAAskycR3ncPo7wb9zixALsLKbW7z1J-UMALWvO0t-wFxEzR_5g@mail.gmail.com>

Hello,

I think, you are referring to
http://www.keycloak.org/docs/latest/server_admin/index.html#social-identity-providers
.

Martin

On Fri, Jan 12, 2018 at 10:07 PM, Rafael T. C. Soares <rsoares at redhat.com>
wrote:

> Hi!
>
> Sorry if this question sound kinda dummy. But I can not recognize this
> feature on Keycloak. Maybe it uses another terminology for this.
>
> Anyway, how can we implement something like Third Party Application
> Connection (eg: like google [1] and twitter [2] does) on keycloak. And
> how a user (not admin) can by itself revoke authorized /third party
> apps/ connected to it's account on keycloak?
>
> [1] https://support.google.com/accounts/answer/3466521?hl=en
>
> [2]
> https://help.twitter.com/pt/managing-your-account/connect-
> or-revoke-access-to-third-party-apps
>
> --
> Rafael T. C. Soares
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>

From hylton.peimer at datos-health.com  Mon Jan 15 05:05:26 2018
From: hylton.peimer at datos-health.com (Hylton Peimer)
Date: Mon, 15 Jan 2018 10:05:26 +0000
Subject: [keycloak-user] Accessing redirect url
Message-ID: <CACGrZevZUTFM==_XYQjSE7gu3ZkzPkSeGvZTGsMd1BZ_UEQV+A@mail.gmail.com>

Inside a custom Authenticator I am trying to access the original URL
entered at the user's browser.

How can I access this URL in the method:
authenticate(AuthenticationFlowContext) of interface Authenticator?

From noircc at gmail.com  Mon Jan 15 07:00:25 2018
From: noircc at gmail.com (Sebastian Wilhelm)
Date: Mon, 15 Jan 2018 13:00:25 +0100
Subject: [keycloak-user] Change root of activation URL
Message-ID: <CACr-HWHZ7sbFXR47zx_cVanxjDVytSY2GGDdPAUonuanR7gYfQ@mail.gmail.com>

I have two services, one is my rest-service the other one is the keycloak
service.

When I am using the keycloak-admin-client for triggering features in
keycloak like sending a verification email, I get an Email with the
activation URL like: localhost:xyz
auth/realms/wienenergie/login-actions/action-token?

I am calling the rest-api of keycloak internally per localhost:xyz. What I
wish to do is changing this internal local URL to my external URL in the
admin-console.

Is this possible?

From eric.kapitza at web.de  Mon Jan 15 07:10:11 2018
From: eric.kapitza at web.de (eric.kapitza at web.de)
Date: Mon, 15 Jan 2018 13:10:11 +0100
Subject: [keycloak-user]  Different theme for each client
Message-ID: <trinity-08954434-d99a-48a0-8de6-7e83da7f493a-1516018211633@3c-app-webde-bap55>


From kristoffer.skaret at gmail.com  Mon Jan 15 08:17:38 2018
From: kristoffer.skaret at gmail.com (Kristoffer Skaret)
Date: Mon, 15 Jan 2018 14:17:38 +0100
Subject: [keycloak-user] Keycloak, iframe, Safari and cookies
Message-ID: <CAAgV0+nMRjaN7BTwbh042jS3FMs9SgBX00m+irFPGF5ZizPryQ@mail.gmail.com>

Our organization is implementing an OIDC platform based on Keycloak, and so
far we are over all happy with the result. But we are left with one major
issue regarding cookies and iframes.


Background:

   - Our OIDC platform will be exposed through public domain on the
   Internet, and will be used as an authentication service in a long range of
   different web sites
   - As a result, the clients to our service will run on different domains
   - Many of the client applications will prefer to present the OIDC user
   interface in an iFrame


The problem came up when we tried running with this setup using the Safari
browser. As it seems, Safari treats cookies presented in an iframe as 3rd
party cookies. So the browser will refuse to save these, unless a similar
cookie has already been presented.

   - Has anybody else experience with this issue?
   - Any suggested solutions?


As we have learned, Keycloak is very dependent upon cookies regarding many
different aspects of the functionality. However, we are considering the
option to try and make a fork of Keycloak without the need for cookies.
Many aspects, such as cookie-based SSO are not relevant In our solution.


Thanks,

Kristoffer

From jcain at redhat.com  Mon Jan 15 12:24:35 2018
From: jcain at redhat.com (Josh Cain)
Date: Mon, 15 Jan 2018 11:24:35 -0600
Subject: [keycloak-user] offlineSessions data in cache vs db
In-Reply-To: <8ef486e4-fbfc-a9d7-5d56-c2f266a26eaf@redhat.com>
References: <bae6fa59-6711-eeda-d196-f4529a167873@autonomic.ai>
	<a045fed1-7e7f-b5f0-5c84-08bd87fb9e8c@redhat.com>
	<c58ff56e-2c18-3387-d052-f05d9a0a2409@redhat.com>
	<3a16a6e1-6a61-ae1c-4941-a85ade1d323f@redhat.com>
	<8ef486e4-fbfc-a9d7-5d56-c2f266a26eaf@redhat.com>
Message-ID: <42c1f336-80ba-67d6-542f-301443a7f26f@redhat.com>

Thanks for taking a look at that Marek.  Really helpful.

I might open something.  Our use case has very infrequent offline token
usage (once every week to once every month), and it just doesn't make
sense to have tokens used so infrequently sit in memory.  Any chance of
having a DB option?

Last question on this (for now anyway) - Are offline sessions part of
the RH-SSO 7.2 + JDG cross-datacenter replication support?  If the cache
only loads those on server startup, that obviously presents a problem
when doing something like failing over to a secondary datacenter on hot
standby.

Josh Cain
Senior Software Applications Engineer, RHCE
Red Hat North America
jcain at redhat.com IRC: jcain

On 01/11/2018 11:07 AM, Marek Posolda wrote:
> On 10/01/18 22:31, Josh Cain wrote:
>> Thanks for the response!? Seem to have missed the reply.? A follow-up
>> question:
>>
>> You mentioned that the choice to store in the Infinispan cache was made
>> for performance purposes.? I understand that this will lead to faster
>> retrieval speeds, however storing *every* offline session in the
>> Infinispan cache could lead to a massive memory footprint if these
>> sessions are used widely enough, right?
> Just tried some very basic testing. I've tried to create 100K
> userSessions where every of them has 1 clientSession - so 100K
> userSessions + 100K clientSessions.
> 
> With 0 offlineSessions, I saw server consumes 100 MBytes in memory. With
> 100K sessions (100K userSessions + 100K clientSessions) it was 230
> MBytes. With 200K sessions (200K userSessions + 200K clientSessions), it
> was 350 MBytes.
> 
> So every userSession+clientSession pair took around 1-2 KBytes in my
> test. In reality, it may be more as it depends on the amount of things
> in the sessions (roles, protocolMappers, notes etc). We have an existing
> JIRA to remove some stuff from sessions and save it on tokens itself,
> which should improve memory consumption [1] .
> 
> In cluster environment, the memory consumption will be smaller as every
> cluster node will have just those sessions, which he is owner (default
> setup of infinispan caches "offlineSessions" and "offlineClientSessions"
> is to use distributed cache with 1 owner).
> 
> If some more flexibility is needed, we may add support for
> offlineSessions to use infinispan cacheStores/cacheLoaders. This is
> pretty flexible SPI in infinispan 8 (which is the version we currently
> use). With this, customer may be able to choose if sessions should be
> preloaded on startup or lazy loaded. Also there may be some additional
> options around passivation etc, which may be good if customer prefers to
> save memory rather than CPU. Feel free to create another JIRA if you
> need this. Just not sure when it's done...
> 
> [1] https://issues.jboss.org/browse/KEYCLOAK-5006
> 
> Marek
>>
>> Am I understanding this correctly, or are the client sessions so light
>> the impact is negligible?
>>
>> Josh Cain
>> Senior Software Applications Engineer, RHCE
>> Red Hat North America
>> jcain at redhat.com IRC: jcain
>>
>> On 01/10/2018 03:13 PM, Marek Posolda wrote:
>>> Yes, I've replied. It seems this thread was send to both "keycloak-dev"
>>> and "keycloak-user" and I've replied to "keycloak-dev" . Answer is here:
>>> http://lists.jboss.org/pipermail/keycloak-dev/2017-December/010249.html
>>> .
>>>
>>> Marek
>>>
>>> On 10/01/18 19:13, Josh Cain wrote:
>>>> Looking to do some work with offline tokens and I had similar
>>>> questions.
>>>> ?? Was there ever a response to this?
>>>>
>>>> Josh Cain
>>>> Senior Software Applications Engineer, RHCE
>>>> Red Hat North America
>>>> jcain at redhat.com IRC: jcain
>>>>
>>>> On 11/21/2017 05:12 PM, Tonnis Wildeboer wrote:
>>>>> Hello Keycloak Users,
>>>>>
>>>>> Ultimately, what we want to do is have three nodes in one Kubernetes
>>>>> namespace that define a cluster. Then be able to add three more
>>>>> nodes to
>>>>> the cluster in a new namespace that shares the same subnet and
>>>>> database,
>>>>> then kill off the original three nodes, effectively migrating the
>>>>> cluster to the new namespace and do all this without anyone being
>>>>> logged
>>>>> out. The namespace distinction is invisible to Keycloak, as far as
>>>>> I can
>>>>> tell.
>>>>>
>>>>> What we have tried:
>>>>> * Start with 3 standalone-ha mode instances clustered with
>>>>> JGroups/JDBC_PING.
>>>>> * Set the number of cache owners for sessions to 6.
>>>>> * Start the three new instances in the new Kubernetes namespace,
>>>>> configured exactly the same as the first three - that is, same db,
>>>>> same
>>>>> number of cache owners.
>>>>> * Kill the original three
>>>>>
>>>>> But it seems this caused offlineSession tokens to be expired
>>>>> immediately.
>>>>>
>>>>> I found this in the online documentation
>>>>> (http://www.keycloak.org/docs/latest/server_installation/index.html#server-cache-configuration):
>>>>>
>>>>>
>>>>>
>>>>> ?? > The second type of cache handles managing user sessions, offline
>>>>> tokens, and keeping track of login failures... The data held in these
>>>>> caches is temporary, in memory only, but is possibly replicated across
>>>>> the cluster.
>>>>>
>>>>> ?? > The sessions, authenticationSessions, offlineSessions and
>>>>> loginFailures caches are the only caches that may perform replication.
>>>>> Entries are not replicated to every single node, but instead one or
>>>>> more
>>>>> nodes is chosen as an owner of that data. If a node is not the
>>>>> owner of
>>>>> a specific cache entry it queries the cluster to obtain it. What this
>>>>> means for failover is that if all the nodes that own a piece of
>>>>> data go
>>>>> down, that data is lost forever. By default, Keycloak only
>>>>> specifies one
>>>>> owner for data. So if that one node goes down that data is lost. This
>>>>> usually means that users will be logged out and will have to login
>>>>> again.
>>>>>
>>>>> It appears, based on these documentation comments and our experience,
>>>>> that the "source of truth" regarding offlineSessions is the data in
>>>>> the
>>>>> "owner" caches, is NOT the database, as I would have expected. It also
>>>>> seems to be the case that if a node joins the cluster (as defined by
>>>>> JGroups/JDBC_PING), it will NOT be able to populate its
>>>>> offlineSessions
>>>>> cache from the database, but must rely on replication from one of the
>>>>> owner nodes.
>>>>>
>>>>> Questions:
>>>>> 1. Is the above understanding regarding the db vs cache correct?
>>>>> 2. If so, please explain the design/reasoning behind this behavior.
>>>>> Otherwise, please correct my understanding.
>>>>> 3. Is there a way to perform this simple migration without losing any
>>>>> sessions?
>>>>>
>>>>> Thanks,
>>>>>
>>>>> --Tonnis
>>>>> _______________________________________________
>>>>> keycloak-user mailing list
>>>>> keycloak-user at lists.jboss.org
>>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>>>
>>>>
>>>> _______________________________________________
>>>> keycloak-user mailing list
>>>> keycloak-user at lists.jboss.org
>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>
>>>
> 

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20180115/e821b33b/attachment.bin 

From jcain at redhat.com  Mon Jan 15 12:26:33 2018
From: jcain at redhat.com (Josh Cain)
Date: Mon, 15 Jan 2018 11:26:33 -0600
Subject: [keycloak-user] Different theme for each client
In-Reply-To: <trinity-08954434-d99a-48a0-8de6-7e83da7f493a-1516018211633@3c-app-webde-bap55>
References: <trinity-08954434-d99a-48a0-8de6-7e83da7f493a-1516018211633@3c-app-webde-bap55>
Message-ID: <0c00b809-1e5f-75eb-40b2-08d36587cda1@redhat.com>

Was originally discussed here:
http://lists.jboss.org/pipermail/keycloak-user/2016-January/004288.html

And I asked the same question again here:
http://lists.jboss.org/pipermail/keycloak-user/2016-July/007052.html

But feel free to keep bumping.  It's a feature I'd like to see anyway ;-)

Josh Cain
Senior Software Applications Engineer, RHCE
Red Hat North America
jcain at redhat.com IRC: jcain

On 01/15/2018 06:10 AM, eric.kapitza at web.de wrote:
> 
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
> 

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20180115/cb98fa8d/attachment-0001.bin 

From christer.vaskinn at bouvet.no  Mon Jan 15 13:56:38 2018
From: christer.vaskinn at bouvet.no (Christer Vaskinn)
Date: Mon, 15 Jan 2018 18:56:38 +0000
Subject: [keycloak-user] Re-authenticate user and populate login form with
	session data
In-Reply-To: <HE1PR0102MB31457F7D2124C5536DB6752D82EB0@HE1PR0102MB3145.eurprd01.prod.exchangelabs.com>
References: <HE1PR0102MB31457F7D2124C5536DB6752D82EB0@HE1PR0102MB3145.eurprd01.prod.exchangelabs.com>
Message-ID: <HE1PR0102MB314500AAA938C11D2544C49682EB0@HE1PR0102MB3145.eurprd01.prod.exchangelabs.com>

Hi.

We're trying to implement re-authentication for privileged functions using OIDC and prompt=login. As such, we'd like to populate the username field in login.ftl with the username of the currently logged in user. Is that possible?

Best regards
Christer Vaskinn


From knitesh at smartdestinations.com  Mon Jan 15 14:14:41 2018
From: knitesh at smartdestinations.com (Kumar Nitesh)
Date: Mon, 15 Jan 2018 14:14:41 -0500
Subject: [keycloak-user] Login or BacktoApplication Link Missing
In-Reply-To: <HE1PR0102MB314500AAA938C11D2544C49682EB0@HE1PR0102MB3145.eurprd01.prod.exchangelabs.com>
References: <HE1PR0102MB31457F7D2124C5536DB6752D82EB0@HE1PR0102MB3145.eurprd01.prod.exchangelabs.com>
	<HE1PR0102MB314500AAA938C11D2544C49682EB0@HE1PR0102MB3145.eurprd01.prod.exchangelabs.com>
Message-ID: <5F2C103F-479D-4B6E-8162-A4A5C39BE744@smartdestinations.com>


Hi,

How to add "back to application" link on password updated successfully page? Right now it doesn?t have any link and url also losses the client Id value.

Thanks
Kumar

From betalb at gmail.com  Mon Jan 15 14:47:07 2018
From: betalb at gmail.com (=?UTF-8?B?0JLQuNGC0LDQu9C40Lkg0JjRidC10L3QutC+?=)
Date: Mon, 15 Jan 2018 19:47:07 +0000
Subject: [keycloak-user] Keycloak, iframe, Safari and cookies
In-Reply-To: <CAAgV0+nMRjaN7BTwbh042jS3FMs9SgBX00m+irFPGF5ZizPryQ@mail.gmail.com>
References: <CAAgV0+nMRjaN7BTwbh042jS3FMs9SgBX00m+irFPGF5ZizPryQ@mail.gmail.com>
Message-ID: <CANYoZJmgzBFKP_WN=uLNodiM40gs+2W--qONodhp0pYOnDZB=A@mail.gmail.com>

Hiding login address from end user is really bad idea. User must see
keycloack dns name and be able to verify ssl certificate

If you really want to create your own login experience, there is an option
of using direct grant flow. But this way is also not recommended on public
apps, as users will be asked to enter their credentials on 3rd party site
that may be not trusted or compromised
??, 15 ???. 2018 ?. ? 16:25, Kristoffer Skaret <kristoffer.skaret at gmail.com
>:

> Our organization is implementing an OIDC platform based on Keycloak, and so
> far we are over all happy with the result. But we are left with one major
> issue regarding cookies and iframes.
>
>
> Background:
>
>    - Our OIDC platform will be exposed through public domain on the
>    Internet, and will be used as an authentication service in a long range
> of
>    different web sites
>    - As a result, the clients to our service will run on different domains
>    - Many of the client applications will prefer to present the OIDC user
>    interface in an iFrame
>
>
> The problem came up when we tried running with this setup using the Safari
> browser. As it seems, Safari treats cookies presented in an iframe as 3rd
> party cookies. So the browser will refuse to save these, unless a similar
> cookie has already been presented.
>
>    - Has anybody else experience with this issue?
>    - Any suggested solutions?
>
>
> As we have learned, Keycloak is very dependent upon cookies regarding many
> different aspects of the functionality. However, we are considering the
> option to try and make a fork of Keycloak without the need for cookies.
> Many aspects, such as cookie-based SSO are not relevant In our solution.
>
>
> Thanks,
>
> Kristoffer
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>

From mposolda at redhat.com  Mon Jan 15 15:19:26 2018
From: mposolda at redhat.com (Marek Posolda)
Date: Mon, 15 Jan 2018 21:19:26 +0100
Subject: [keycloak-user] offlineSessions data in cache vs db
In-Reply-To: <42c1f336-80ba-67d6-542f-301443a7f26f@redhat.com>
References: <bae6fa59-6711-eeda-d196-f4529a167873@autonomic.ai>
	<a045fed1-7e7f-b5f0-5c84-08bd87fb9e8c@redhat.com>
	<c58ff56e-2c18-3387-d052-f05d9a0a2409@redhat.com>
	<3a16a6e1-6a61-ae1c-4941-a85ade1d323f@redhat.com>
	<8ef486e4-fbfc-a9d7-5d56-c2f266a26eaf@redhat.com>
	<42c1f336-80ba-67d6-542f-301443a7f26f@redhat.com>
Message-ID: <0835614e-da3c-d196-d79d-3477a8e708db@redhat.com>

Hi Josh,

On 15/01/18 18:24, Josh Cain wrote:
> Thanks for taking a look at that Marek.  Really helpful.
>
> I might open something.  Our use case has very infrequent offline token
> usage (once every week to once every month), and it just doesn't make
> sense to have tokens used so infrequently sit in memory.  Any chance of
> having a DB option?
Yes, there is any chance, but everything depends on the priorities though :)

But actually, you use cross-DC setup if I know correctly? If yes, the 
infinispan caches will be configured with the remoteStore. It's possible 
that if you enable eviction + passivation on offlineSession caches, the 
infrequently used session data will be "passivated" and hence removed 
from the infinispan cache on Keycloak servers side, they will just 
remain in the caches on JDG side and will be loaded by Keycloak servers 
just when needed. But we didn't yet try to test with eviction and 
passivation enabled on infinispan caches with remoteStore on Keycloak 
server side.

Another question is, how much offline sessions you plan to have? Will be 
there million of sessions or 100K or just few thousands? If it's few 
thousands, then the memory might be acceptable? Even for 100K sessions 
(considering that one session = pair of 1 userSession + 1 clientSession) 
the memory is not more than 500 MB - and even less with more cluster 
nodes as then the sessions are distributed among all cluster nodes.
> Last question on this (for now anyway) - Are offline sessions part of
> the RH-SSO 7.2 + JDG cross-datacenter replication support?  If the cache
> only loads those on server startup, that obviously presents a problem
> when doing something like failing over to a secondary datacenter on hot
> standby.
Yes, offline sessions are part of RHSSO 7.2 + cross-datacenter 
replication support. Docs is available already in community [1] .

I think that usecase with hot standby will work.

Actually the example flow may work this way:
- You have 2 datacenters and JDG servers are started in both datacenters.
- First Keycloak server is starting in first datacenter. This server 
will start preloading sessions from DB .
- Offline sessions are preloaded in Keycloak caches in JDG caches in 
first datacenter and also on JDG in second datacenter (due the JDG in 
first DC is automatically doing backup to the JDG in second DC)
- When Keycloak server in second DC is starting, the sessions are 
preloaded from the JDG server in second DC, not from DB.
- At this point, offline sessions are available on both DCs.
- When any datacenter is going to offline mode, the Keycloak servers on 
the second DC will always be available to read the content from the caches
- When the datacenter is started again, it will preload again the 
sessions from the JDG servers in already started DC.

The offline sessions are preloaded from DB really just during start of 
first Keycloak in first DC (we saw much worse performance then 
preloading from remoteStore). But sessions should be always available.

If you have an opportunity to read the docs, try things and provide 
feedback, it will be cool.

[1] 
http://www.keycloak.org/docs/latest/server_installation/index.html#crossdc-mode

Marek
> Josh Cain
> Senior Software Applications Engineer, RHCE
> Red Hat North America
> jcain at redhat.com IRC: jcain
>
> On 01/11/2018 11:07 AM, Marek Posolda wrote:
>> On 10/01/18 22:31, Josh Cain wrote:
>>> Thanks for the response!  Seem to have missed the reply.  A follow-up
>>> question:
>>>
>>> You mentioned that the choice to store in the Infinispan cache was made
>>> for performance purposes.  I understand that this will lead to faster
>>> retrieval speeds, however storing *every* offline session in the
>>> Infinispan cache could lead to a massive memory footprint if these
>>> sessions are used widely enough, right?
>> Just tried some very basic testing. I've tried to create 100K
>> userSessions where every of them has 1 clientSession - so 100K
>> userSessions + 100K clientSessions.
>>
>> With 0 offlineSessions, I saw server consumes 100 MBytes in memory. With
>> 100K sessions (100K userSessions + 100K clientSessions) it was 230
>> MBytes. With 200K sessions (200K userSessions + 200K clientSessions), it
>> was 350 MBytes.
>>
>> So every userSession+clientSession pair took around 1-2 KBytes in my
>> test. In reality, it may be more as it depends on the amount of things
>> in the sessions (roles, protocolMappers, notes etc). We have an existing
>> JIRA to remove some stuff from sessions and save it on tokens itself,
>> which should improve memory consumption [1] .
>>
>> In cluster environment, the memory consumption will be smaller as every
>> cluster node will have just those sessions, which he is owner (default
>> setup of infinispan caches "offlineSessions" and "offlineClientSessions"
>> is to use distributed cache with 1 owner).
>>
>> If some more flexibility is needed, we may add support for
>> offlineSessions to use infinispan cacheStores/cacheLoaders. This is
>> pretty flexible SPI in infinispan 8 (which is the version we currently
>> use). With this, customer may be able to choose if sessions should be
>> preloaded on startup or lazy loaded. Also there may be some additional
>> options around passivation etc, which may be good if customer prefers to
>> save memory rather than CPU. Feel free to create another JIRA if you
>> need this. Just not sure when it's done...
>>
>> [1] https://issues.jboss.org/browse/KEYCLOAK-5006
>>
>> Marek
>>> Am I understanding this correctly, or are the client sessions so light
>>> the impact is negligible?
>>>
>>> Josh Cain
>>> Senior Software Applications Engineer, RHCE
>>> Red Hat North America
>>> jcain at redhat.com IRC: jcain
>>>
>>> On 01/10/2018 03:13 PM, Marek Posolda wrote:
>>>> Yes, I've replied. It seems this thread was send to both "keycloak-dev"
>>>> and "keycloak-user" and I've replied to "keycloak-dev" . Answer is here:
>>>> http://lists.jboss.org/pipermail/keycloak-dev/2017-December/010249.html
>>>> .
>>>>
>>>> Marek
>>>>
>>>> On 10/01/18 19:13, Josh Cain wrote:
>>>>> Looking to do some work with offline tokens and I had similar
>>>>> questions.
>>>>>     Was there ever a response to this?
>>>>>
>>>>> Josh Cain
>>>>> Senior Software Applications Engineer, RHCE
>>>>> Red Hat North America
>>>>> jcain at redhat.com IRC: jcain
>>>>>
>>>>> On 11/21/2017 05:12 PM, Tonnis Wildeboer wrote:
>>>>>> Hello Keycloak Users,
>>>>>>
>>>>>> Ultimately, what we want to do is have three nodes in one Kubernetes
>>>>>> namespace that define a cluster. Then be able to add three more
>>>>>> nodes to
>>>>>> the cluster in a new namespace that shares the same subnet and
>>>>>> database,
>>>>>> then kill off the original three nodes, effectively migrating the
>>>>>> cluster to the new namespace and do all this without anyone being
>>>>>> logged
>>>>>> out. The namespace distinction is invisible to Keycloak, as far as
>>>>>> I can
>>>>>> tell.
>>>>>>
>>>>>> What we have tried:
>>>>>> * Start with 3 standalone-ha mode instances clustered with
>>>>>> JGroups/JDBC_PING.
>>>>>> * Set the number of cache owners for sessions to 6.
>>>>>> * Start the three new instances in the new Kubernetes namespace,
>>>>>> configured exactly the same as the first three - that is, same db,
>>>>>> same
>>>>>> number of cache owners.
>>>>>> * Kill the original three
>>>>>>
>>>>>> But it seems this caused offlineSession tokens to be expired
>>>>>> immediately.
>>>>>>
>>>>>> I found this in the online documentation
>>>>>> (http://www.keycloak.org/docs/latest/server_installation/index.html#server-cache-configuration):
>>>>>>
>>>>>>
>>>>>>
>>>>>>     > The second type of cache handles managing user sessions, offline
>>>>>> tokens, and keeping track of login failures... The data held in these
>>>>>> caches is temporary, in memory only, but is possibly replicated across
>>>>>> the cluster.
>>>>>>
>>>>>>     > The sessions, authenticationSessions, offlineSessions and
>>>>>> loginFailures caches are the only caches that may perform replication.
>>>>>> Entries are not replicated to every single node, but instead one or
>>>>>> more
>>>>>> nodes is chosen as an owner of that data. If a node is not the
>>>>>> owner of
>>>>>> a specific cache entry it queries the cluster to obtain it. What this
>>>>>> means for failover is that if all the nodes that own a piece of
>>>>>> data go
>>>>>> down, that data is lost forever. By default, Keycloak only
>>>>>> specifies one
>>>>>> owner for data. So if that one node goes down that data is lost. This
>>>>>> usually means that users will be logged out and will have to login
>>>>>> again.
>>>>>>
>>>>>> It appears, based on these documentation comments and our experience,
>>>>>> that the "source of truth" regarding offlineSessions is the data in
>>>>>> the
>>>>>> "owner" caches, is NOT the database, as I would have expected. It also
>>>>>> seems to be the case that if a node joins the cluster (as defined by
>>>>>> JGroups/JDBC_PING), it will NOT be able to populate its
>>>>>> offlineSessions
>>>>>> cache from the database, but must rely on replication from one of the
>>>>>> owner nodes.
>>>>>>
>>>>>> Questions:
>>>>>> 1. Is the above understanding regarding the db vs cache correct?
>>>>>> 2. If so, please explain the design/reasoning behind this behavior.
>>>>>> Otherwise, please correct my understanding.
>>>>>> 3. Is there a way to perform this simple migration without losing any
>>>>>> sessions?
>>>>>>
>>>>>> Thanks,
>>>>>>
>>>>>> --Tonnis
>>>>>> _______________________________________________
>>>>>> keycloak-user mailing list
>>>>>> keycloak-user at lists.jboss.org
>>>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>>>>
>>>>> _______________________________________________
>>>>> keycloak-user mailing list
>>>>> keycloak-user at lists.jboss.org
>>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>>


From mposolda at redhat.com  Mon Jan 15 15:22:01 2018
From: mposolda at redhat.com (Marek Posolda)
Date: Mon, 15 Jan 2018 21:22:01 +0100
Subject: [keycloak-user] Different theme for each client
In-Reply-To: <0c00b809-1e5f-75eb-40b2-08d36587cda1@redhat.com>
References: <trinity-08954434-d99a-48a0-8de6-7e83da7f493a-1516018211633@3c-app-webde-bap55>
	<0c00b809-1e5f-75eb-40b2-08d36587cda1@redhat.com>
Message-ID: <53c1f766-587e-2822-5002-f9d81085e72e@redhat.com>

I think that Freemarker theme (at least login theme) has access to 
ClientBean through the "client" expression . So it's likely already 
possible to do some hacking in the template itself and provide different 
CSS according to the client used. Not very nice, but likely should be 
somehow possible.

Marek

On 15/01/18 18:26, Josh Cain wrote:
> Was originally discussed here:
> http://lists.jboss.org/pipermail/keycloak-user/2016-January/004288.html
>
> And I asked the same question again here:
> http://lists.jboss.org/pipermail/keycloak-user/2016-July/007052.html
>
> But feel free to keep bumping.  It's a feature I'd like to see anyway ;-)
>
> Josh Cain
> Senior Software Applications Engineer, RHCE
> Red Hat North America
> jcain at redhat.com IRC: jcain
>
> On 01/15/2018 06:10 AM, eric.kapitza at web.de wrote:
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user



From mposolda at redhat.com  Mon Jan 15 15:25:46 2018
From: mposolda at redhat.com (Marek Posolda)
Date: Mon, 15 Jan 2018 21:25:46 +0100
Subject: [keycloak-user] Login or BacktoApplication Link Missing
In-Reply-To: <5F2C103F-479D-4B6E-8162-A4A5C39BE744@smartdestinations.com>
References: <HE1PR0102MB31457F7D2124C5536DB6752D82EB0@HE1PR0102MB3145.eurprd01.prod.exchangelabs.com>
	<HE1PR0102MB314500AAA938C11D2544C49682EB0@HE1PR0102MB3145.eurprd01.prod.exchangelabs.com>
	<5F2C103F-479D-4B6E-8162-A4A5C39BE744@smartdestinations.com>
Message-ID: <e760a2e4-4909-74a9-82ac-398c9980ef02@redhat.com>

Does your client has baseUrl configured? If yes, could you try with 
latest Keycloak 3.4.3 and check if the issue still happen and you still 
can't see the link? If still not, feel free to create JIRA and provide 
the detailed steps to reproduce - especially include if the link from 
email was opened in same or different browser (assuming you use the flow 
for password reset link sent to the user by email)

Thanks,
Marek

On 15/01/18 20:14, Kumar Nitesh wrote:
> Hi,
>
> How to add "back to application" link on password updated successfully page? Right now it doesn?t have any link and url also losses the client Id value.
>
> Thanks
> Kumar
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user



From knitesh at smartdestinations.com  Mon Jan 15 15:34:48 2018
From: knitesh at smartdestinations.com (Kumar Nitesh)
Date: Mon, 15 Jan 2018 15:34:48 -0500
Subject: [keycloak-user] Login or BacktoApplication Link Missing
In-Reply-To: <e760a2e4-4909-74a9-82ac-398c9980ef02@redhat.com>
References: <HE1PR0102MB31457F7D2124C5536DB6752D82EB0@HE1PR0102MB3145.eurprd01.prod.exchangelabs.com>
	<HE1PR0102MB314500AAA938C11D2544C49682EB0@HE1PR0102MB3145.eurprd01.prod.exchangelabs.com>
	<5F2C103F-479D-4B6E-8162-A4A5C39BE744@smartdestinations.com>
	<e760a2e4-4909-74a9-82ac-398c9980ef02@redhat.com>
Message-ID: <DC8C886C-1C14-4FAE-B600-19A1A9D680BE@smartdestinations.com>

Hi,

Yes, my client has baseUrl configure and I am using 3.4.1. Let me know where you feel the error is in ftl template or java code. I will try to update to latest Keycloak.

Thanks
Kumar

> On Jan 15, 2018, at 3:25 PM, Marek Posolda <mposolda at redhat.com> wrote:
> 
> Does your client has baseUrl configured? If yes, could you try with latest Keycloak 3.4.3 and check if the issue still happen and you still can't see the link? If still not, feel free to create JIRA and provide the detailed steps to reproduce - especially include if the link from email was opened in same or different browser (assuming you use the flow for password reset link sent to the user by email)
> 
> Thanks,
> Marek
> 
> On 15/01/18 20:14, Kumar Nitesh wrote:
>> Hi,
>> 
>> How to add "back to application" link on password updated successfully page? Right now it doesn?t have any link and url also losses the client Id value.
>> 
>> Thanks
>> Kumar
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
> 
> 



From Ori.Doolman at amdocs.com  Mon Jan 15 16:59:57 2018
From: Ori.Doolman at amdocs.com (Ori Doolman)
Date: Mon, 15 Jan 2018 21:59:57 +0000
Subject: [keycloak-user] adding realm level configuration parameter
Message-ID: <F12603E320A90546946D142FB805B94601734E8A88@ILRAADAGBE1.corp.amdocs.com>

Hi,
I want to perform some customization to Keycloak using existing SPIs.
For that, I need to store a configuration parameter (may be different value per realm).
What is the way to achieve that? Is there an SPI to extend the realm properties?
The only solution I can think of now is setting a custom attribute in the users group of the realm.


Thanks,

Ori Doolman
Lead Software Architect
Amdocs Optima

+972 9 778 6914 (office)
+972 50 9111442 (mobile)

[cid:image001.png at 01D2C8DE.BFF33E10]

This message and the information contained herein is proprietary and confidential and subject to the Amdocs policy statement,

you may review at https://www.amdocs.com/about/email-disclaimer <https://www.amdocs.com/about/email-disclaimer>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image001.png
Type: image/png
Size: 3506 bytes
Desc: image001.png
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20180115/af4c25a2/attachment.png 

From bburke at redhat.com  Mon Jan 15 18:09:16 2018
From: bburke at redhat.com (Bill Burke)
Date: Mon, 15 Jan 2018 18:09:16 -0500
Subject: [keycloak-user] Different theme for each client
In-Reply-To: <53c1f766-587e-2822-5002-f9d81085e72e@redhat.com>
References: <trinity-08954434-d99a-48a0-8de6-7e83da7f493a-1516018211633@3c-app-webde-bap55>
	<0c00b809-1e5f-75eb-40b2-08d36587cda1@redhat.com>
	<53c1f766-587e-2822-5002-f9d81085e72e@redhat.com>
Message-ID: <CABRXCmyGoUvkcV6gRAaAmkey_26+yHqV-ECGV_q1Ui_e-+8_nw@mail.gmail.com>

I wonder how hard it would be to implement?

On Mon, Jan 15, 2018 at 3:22 PM, Marek Posolda <mposolda at redhat.com> wrote:
> I think that Freemarker theme (at least login theme) has access to
> ClientBean through the "client" expression . So it's likely already
> possible to do some hacking in the template itself and provide different
> CSS according to the client used. Not very nice, but likely should be
> somehow possible.
>
> Marek
>
> On 15/01/18 18:26, Josh Cain wrote:
>> Was originally discussed here:
>> http://lists.jboss.org/pipermail/keycloak-user/2016-January/004288.html
>>
>> And I asked the same question again here:
>> http://lists.jboss.org/pipermail/keycloak-user/2016-July/007052.html
>>
>> But feel free to keep bumping.  It's a feature I'd like to see anyway ;-)
>>
>> Josh Cain
>> Senior Software Applications Engineer, RHCE
>> Red Hat North America
>> jcain at redhat.com IRC: jcain
>>
>> On 01/15/2018 06:10 AM, eric.kapitza at web.de wrote:
>>> _______________________________________________
>>> keycloak-user mailing list
>>> keycloak-user at lists.jboss.org
>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>
>>
>>
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user



-- 
Bill Burke
Red Hat

From hmlnarik at redhat.com  Tue Jan 16 03:12:09 2018
From: hmlnarik at redhat.com (Hynek Mlnarik)
Date: Tue, 16 Jan 2018 09:12:09 +0100
Subject: [keycloak-user] Blog post about cross-datacenter replication in
 Keycloak 3.3.CR1
In-Reply-To: <3ad96320-2bb8-9f52-e068-aec0517e6f6b@redhat.com>
References: <CAK-7U1jLAVeqMtH9cFHu-Jv6ucw0FZZECBibSZJuJ-spB=ByTA@mail.gmail.com>
	<3ad96320-2bb8-9f52-e068-aec0517e6f6b@redhat.com>
Message-ID: <CAMvXD=GwCZca9mM4bXPWhg+XLyUpixwFw6dd6QR37opJEp-Yww@mail.gmail.com>

There is a new blog available on cross-DC setup: How to set up cross DC in
Amazon AWS environment. Available at:

http://blog.keycloak.org/2018/01/keycloak-cross-data-center-setup-in-aws.html

On Mon, Sep 11, 2017 at 10:41 AM, Marek Posolda <mposolda at redhat.com> wrote:

> Yes maybe for a bit more important blog posts it makes sense to write an
> email too. Sorry for not doing it. Will try to be better next time :)
>
> Marek
>
> On 08/09/17 14:48, Thomas Darimont wrote:
> > Hello,
> >
> > in case you missed it (as I did...), there is an interesting blog post
> about
> > cross-datacenter replication in Keycloak 3.3.CR1
> > http://blog.keycloak.org/2017/09/cross-datacenter-support-
> in-keycloak.html
> >
> > @keycloak-Team
> > Would be great if you could drop a mail to the mailing list for articles
> > like this :)
> >
> > Cheers,
> > Thomas
> > _______________________________________________
> > keycloak-user mailing list
> > keycloak-user at lists.jboss.org
> > https://lists.jboss.org/mailman/listinfo/keycloak-user
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>



-- 

--Hynek

From Michael.Knurr at adesso.ch  Tue Jan 16 04:30:04 2018
From: Michael.Knurr at adesso.ch (Knurr, Michael)
Date: Tue, 16 Jan 2018 09:30:04 +0000
Subject: [keycloak-user] Running two Keycloak instances in parallel
Message-ID: <256903ed7bc740b4a36dc2a969449c12@EX2013-DB02.adesso.local>

Hi all

When trying to upgrade Keycloak to the latest version I ran into problems. Unfortunately It turned out that we ran into different upgrade behaviors on different machines. With the latest version, the upgrade is running locally, on test and on stage. As a last step I now tried to test the upgrade procedure on the production machine with a keycloak instance running on a different port.

When running the upgrade on a server with an already running keycloak instance, the new server runs into a timeout because of concurrency.

10:16:24,926 INFO  [org.keycloak.connections.jpa.updater.liquibase.LiquibaseJpaUpdaterProvider] (ServerService Thread Pool -- 58) Updating database. Using changelog META-INF/jpa-changelog-master.xml
10:21:22,322 ERROR [org.jboss.as.controller.management-operation] (Controller Boot Thread) WFLYCTL0348: Timeout after [300] seconds waiting for service container stability. Operation will roll back. Step that first updated the service container was 'add' at address '[
    ("core-service" => "management"),
    ("management-interface" => "http-interface")
]'
10:21:23,397 WARN  [com.arjuna.ats.arjuna] (Transaction Reaper) ARJUNA012117: TransactionReaper::check timeout for TX 0:ffff7f000101:73d290d3:5a5dc2e6:d in state  RUN
10:21:23,402 WARN  [com.arjuna.ats.arjuna] (Transaction Reaper Worker 0) ARJUNA012121: TransactionReaper::doCancellations worker Thread[Transaction Reaper Worker 0,5,main] successfully canceled TX 0:ffff7f000101:73d290d3:5a5dc2e6:d
10:21:23,668 WARN  [com.arjuna.ats.arjuna] (Transaction Reaper) ARJUNA012117: TransactionReaper::check timeout for TX 0:ffff7f000101:73d290d3:5a5dc2e6:10 in state  RUN
10:21:23,669 WARN  [com.arjuna.ats.arjuna] (Transaction Reaper Worker 0) ARJUNA012121: TransactionReaper::doCancellations worker Thread[Transaction Reaper Worker 0,5,main] successfully canceled TX 0:ffff7f000101:73d290d3:5a5dc2e6:10
10:21:27,328 ERROR [org.jboss.as.controller.management-operation] (Controller Boot Thread) WFLYCTL0190: Step handler org.jboss.as.server.DeployerChainAddHandler$FinalRuntimeStepHandler at 20b4c4cb for operation add-deployer-chains at address [] failed handling operation rollback -- java.util.concurrent.TimeoutException: java.util.concurrent.TimeoutException
        at org.jboss.as.controller.OperationContextImpl.waitForRemovals(OperationContextImpl.java:522)
...

What might be the reason for this? Shouldn't it possible to run two keycloak servers (with a different port offset) on a single machine? How can I test the keycloak upgrade on the production machine without stopping the running server instance?


Best regards
Michael

From corentin.dupont at gmail.com  Tue Jan 16 05:09:32 2018
From: corentin.dupont at gmail.com (Corentin Dupont)
Date: Tue, 16 Jan 2018 11:09:32 +0100
Subject: [keycloak-user] Failed to initialize in KC 3.4
In-Reply-To: <CAEyhvmqnB_nsaGxkkBQ_vP2DkkSY0fU7Dy_=jhnPvRDkWZw_-Q@mail.gmail.com>
References: <CAEyhvmqnB_nsaGxkkBQ_vP2DkkSY0fU7Dy_=jhnPvRDkWZw_-Q@mail.gmail.com>
Message-ID: <CAEyhvmoLP_=atBZ5EPPKV4FLVVOjgM=-kAyyR4B8CGrSQuokYg@mail.gmail.com>

Hi guys,
I finally solved this problem.
Posting here for memory :)
I use this simple code in my NodeJS application:

import Keycloak from 'keycloak-js';

var keycloak = Keycloak();
keycloak.init({ onLoad: 'login-required'}).success(authenticated => {
  if (authenticated) {
    console.log("Authenticated");
  }
}).error(function (error) {
    console.log("Authentication error");
  });
}

In Keycloak 3.3 and above, I kept getting the message "Authentication
error".
Keycloak 3.2 and below works.

I finally understood that the problem is the Web Origins of my client.
It was set to "*", but apparently this is not supported anymore in KC>=3.3.
By putting something more precise it worked (e.g. http://localhost:3000).

The debugging of this one was very tricky...
The problem happens at the "code to token exchange" step.
In KC 3.3, the response headers "Access-Control-Allow-Origin" is set to "*".
This doesn't seem to work with keycloak.js adapter, at this line:
https://github.com/keycloak/keycloak/blob/master/adapters/oidc/js/src/main/resources/keycloak.js#L341

The req.status is 0. It seems that XMLHttpRequest doesn't like this
Access-Control-Allow-Origin="*".

If I change the Web Origins to http://localhost:3000, it works.
Likewise, in KC=3.2, the Web Origins = *  seems to be translated
automatically to Access-Control-Allow-Origin hea=





In KC 3.2, with Web Origin "*", the  is transformed as "
http://localhost:3000"



https://github.com/keycloak/keycloak/blob/master/adapters/oidc/js/src/main/resources/keycloak.js#L337




On Tue, Dec 12, 2017 at 10:45 AM, Corentin Dupont <corentin.dupont at gmail.com
> wrote:

> Hi guys,
>
> I use this code in my javascript application:
>
> var keycloak = Keycloak();
>         keycloak.init().success(function(authenticated) {
>             alert(authenticated ? 'authenticated' : 'not authenticated');
>         }).error(function() {
>             alert('failed to initialize');
>         });
>
> Since I updated Keycloak I get the message 'failed to initialize'.
> It was working well with the previous version of KC 3.2.
>
> What could it be? How can I get a better error message?
>
>
> Thanks!
>

From hmlnarik at redhat.com  Tue Jan 16 05:30:32 2018
From: hmlnarik at redhat.com (Hynek Mlnarik)
Date: Tue, 16 Jan 2018 11:30:32 +0100
Subject: [keycloak-user] Running two Keycloak instances in parallel
In-Reply-To: <256903ed7bc740b4a36dc2a969449c12@EX2013-DB02.adesso.local>
References: <256903ed7bc740b4a36dc2a969449c12@EX2013-DB02.adesso.local>
Message-ID: <CAMvXD=HPKDFPROFtV_qaYEG6OOhGSJAZ4KjSptAvRvM4Ekkc0w@mail.gmail.com>

It could be for many reasons. Just guessing - since it is terminating after
300 seconds (5 minutes) while the last log entry is about updating
database, maybe the database connection/operation is too slow. Hence you
can try increasing the startup period value to e.g. 900 seconds by passing
-Djboss.as.management.blocking.timeout=900 parameter to standalone.sh. Also
make sure that the database of the new Keycloak instance is distinct from
the original one.

On Tue, Jan 16, 2018 at 10:30 AM, Knurr, Michael <Michael.Knurr at adesso.ch>
wrote:

> Hi all
>
> When trying to upgrade Keycloak to the latest version I ran into problems.
> Unfortunately It turned out that we ran into different upgrade behaviors on
> different machines. With the latest version, the upgrade is running
> locally, on test and on stage. As a last step I now tried to test the
> upgrade procedure on the production machine with a keycloak instance
> running on a different port.
>
> When running the upgrade on a server with an already running keycloak
> instance, the new server runs into a timeout because of concurrency.
>
> 10:16:24,926 INFO  [org.keycloak.connections.jpa.updater.liquibase.LiquibaseJpaUpdaterProvider]
> (ServerService Thread Pool -- 58) Updating database. Using changelog
> META-INF/jpa-changelog-master.xml
> 10:21:22,322 ERROR [org.jboss.as.controller.management-operation]
> (Controller Boot Thread) WFLYCTL0348: Timeout after [300] seconds waiting
> for service container stability. Operation will roll back. Step that first
> updated the service container was 'add' at address '[
>     ("core-service" => "management"),
>     ("management-interface" => "http-interface")
> ]'
> 10:21:23,397 WARN  [com.arjuna.ats.arjuna] (Transaction Reaper)
> ARJUNA012117: TransactionReaper::check timeout for TX
> 0:ffff7f000101:73d290d3:5a5dc2e6:d in state  RUN
> 10:21:23,402 WARN  [com.arjuna.ats.arjuna] (Transaction Reaper Worker 0)
> ARJUNA012121: TransactionReaper::doCancellations worker
> Thread[Transaction Reaper Worker 0,5,main] successfully canceled TX
> 0:ffff7f000101:73d290d3:5a5dc2e6:d
> 10:21:23,668 WARN  [com.arjuna.ats.arjuna] (Transaction Reaper)
> ARJUNA012117: TransactionReaper::check timeout for TX
> 0:ffff7f000101:73d290d3:5a5dc2e6:10 in state  RUN
> 10:21:23,669 WARN  [com.arjuna.ats.arjuna] (Transaction Reaper Worker 0)
> ARJUNA012121: TransactionReaper::doCancellations worker
> Thread[Transaction Reaper Worker 0,5,main] successfully canceled TX
> 0:ffff7f000101:73d290d3:5a5dc2e6:10
> 10:21:27,328 ERROR [org.jboss.as.controller.management-operation]
> (Controller Boot Thread) WFLYCTL0190: Step handler org.jboss.as.server.
> DeployerChainAddHandler$FinalRuntimeStepHandler at 20b4c4cb for operation
> add-deployer-chains at address [] failed handling operation rollback --
> java.util.concurrent.TimeoutException: java.util.concurrent.
> TimeoutException
>         at org.jboss.as.controller.OperationContextImpl.waitForRemovals(
> OperationContextImpl.java:522)
> ...
>
> What might be the reason for this? Shouldn't it possible to run two
> keycloak servers (with a different port offset) on a single machine? How
> can I test the keycloak upgrade on the production machine without stopping
> the running server instance?
>
>
> Best regards
> Michael
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>



-- 

--Hynek

From betalb at gmail.com  Tue Jan 16 06:46:13 2018
From: betalb at gmail.com (=?UTF-8?B?0JLQuNGC0LDQu9C40Lkg0JjRidC10L3QutC+?=)
Date: Tue, 16 Jan 2018 11:46:13 +0000
Subject: [keycloak-user] Failed to initialize in KC 3.4
In-Reply-To: <CAEyhvmoLP_=atBZ5EPPKV4FLVVOjgM=-kAyyR4B8CGrSQuokYg@mail.gmail.com>
References: <CAEyhvmqnB_nsaGxkkBQ_vP2DkkSY0fU7Dy_=jhnPvRDkWZw_-Q@mail.gmail.com>
	<CAEyhvmoLP_=atBZ5EPPKV4FLVVOjgM=-kAyyR4B8CGrSQuokYg@mail.gmail.com>
Message-ID: <CANYoZJkLB36-7ehTDwRbbwA5aEyx4LbCiczp6YaUize=YPpb7Q@mail.gmail.com>

Hi

Asterisk should be pretty valid, maybe at some point in time KC stopped
expanding it and just started to pass in reply as-is, but
Access-Control-Allow-Origin:
*

Is valid header value [1]. And status = 0 means that preflight request
check failed on the browser side and JS code can't even access any info
from KC.

Do you have request and response headers dump, an asterisk was quoted or
not?

[1]
https://developer.mozilla.org/ru/docs/Web/HTTP/Headers/Access-Control-Allow-Origin

On Tue, Jan 16, 2018 at 1:10 PM Corentin Dupont <corentin.dupont at gmail.com>
wrote:

> Hi guys,
> I finally solved this problem.
> Posting here for memory :)
> I use this simple code in my NodeJS application:
>
> import Keycloak from 'keycloak-js';
>
> var keycloak = Keycloak();
> keycloak.init({ onLoad: 'login-required'}).success(authenticated => {
>   if (authenticated) {
>     console.log("Authenticated");
>   }
> }).error(function (error) {
>     console.log("Authentication error");
>   });
> }
>
> In Keycloak 3.3 and above, I kept getting the message "Authentication
> error".
> Keycloak 3.2 and below works.
>
> I finally understood that the problem is the Web Origins of my client.
> It was set to "*", but apparently this is not supported anymore in KC>=3.3.
> By putting something more precise it worked (e.g. http://localhost:3000).
>
> The debugging of this one was very tricky...
> The problem happens at the "code to token exchange" step.
> In KC 3.3, the response headers "Access-Control-Allow-Origin" is set to
> "*".
> This doesn't seem to work with keycloak.js adapter, at this line:
>
> https://github.com/keycloak/keycloak/blob/master/adapters/oidc/js/src/main/resources/keycloak.js#L341
>
> The req.status is 0. It seems that XMLHttpRequest doesn't like this
> Access-Control-Allow-Origin="*".
>
> If I change the Web Origins to http://localhost:3000, it works.
> Likewise, in KC=3.2, the Web Origins = *  seems to be translated
> automatically to Access-Control-Allow-Origin hea=
>
>
>
>
>
> In KC 3.2, with Web Origin "*", the  is transformed as "
> http://localhost:3000"
>
>
>
>
> https://github.com/keycloak/keycloak/blob/master/adapters/oidc/js/src/main/resources/keycloak.js#L337
>
>
>
>
> On Tue, Dec 12, 2017 at 10:45 AM, Corentin Dupont <
> corentin.dupont at gmail.com
> > wrote:
>
> > Hi guys,
> >
> > I use this code in my javascript application:
> >
> > var keycloak = Keycloak();
> >         keycloak.init().success(function(authenticated) {
> >             alert(authenticated ? 'authenticated' : 'not authenticated');
> >         }).error(function() {
> >             alert('failed to initialize');
> >         });
> >
> > Since I updated Keycloak I get the message 'failed to initialize'.
> > It was working well with the previous version of KC 3.2.
> >
> > What could it be? How can I get a better error message?
> >
> >
> > Thanks!
> >
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>

From betalb at gmail.com  Tue Jan 16 06:47:06 2018
From: betalb at gmail.com (=?UTF-8?B?0JLQuNGC0LDQu9C40Lkg0JjRidC10L3QutC+?=)
Date: Tue, 16 Jan 2018 11:47:06 +0000
Subject: [keycloak-user] Failed to initialize in KC 3.4
In-Reply-To: <CANYoZJkLB36-7ehTDwRbbwA5aEyx4LbCiczp6YaUize=YPpb7Q@mail.gmail.com>
References: <CAEyhvmqnB_nsaGxkkBQ_vP2DkkSY0fU7Dy_=jhnPvRDkWZw_-Q@mail.gmail.com>
	<CAEyhvmoLP_=atBZ5EPPKV4FLVVOjgM=-kAyyR4B8CGrSQuokYg@mail.gmail.com>
	<CANYoZJkLB36-7ehTDwRbbwA5aEyx4LbCiczp6YaUize=YPpb7Q@mail.gmail.com>
Message-ID: <CANYoZJmys3-B4nOCynX+CWuxcXVM5+fKbkukLbCTCroq-Pq76g@mail.gmail.com>

Also, you can set Origins to "+" plus sign, and KC will expand origins
automatically for you

On Tue, Jan 16, 2018 at 2:46 PM ??????? ?????? <betalb at gmail.com> wrote:

> Hi
>
> Asterisk should be pretty valid, maybe at some point in time KC stopped
> expanding it and just started to pass in reply as-is, but Access-Control-Allow-Origin:
> *
>
> Is valid header value [1]. And status = 0 means that preflight request
> check failed on the browser side and JS code can't even access any info
> from KC.
>
> Do you have request and response headers dump, an asterisk was quoted or
> not?
>
> [1]
> https://developer.mozilla.org/ru/docs/Web/HTTP/Headers/Access-Control-Allow-Origin
>
> On Tue, Jan 16, 2018 at 1:10 PM Corentin Dupont <corentin.dupont at gmail.com>
> wrote:
>
>> Hi guys,
>> I finally solved this problem.
>> Posting here for memory :)
>> I use this simple code in my NodeJS application:
>>
>> import Keycloak from 'keycloak-js';
>>
>> var keycloak = Keycloak();
>> keycloak.init({ onLoad: 'login-required'}).success(authenticated => {
>>   if (authenticated) {
>>     console.log("Authenticated");
>>   }
>> }).error(function (error) {
>>     console.log("Authentication error");
>>   });
>> }
>>
>> In Keycloak 3.3 and above, I kept getting the message "Authentication
>> error".
>> Keycloak 3.2 and below works.
>>
>> I finally understood that the problem is the Web Origins of my client.
>> It was set to "*", but apparently this is not supported anymore in
>> KC>=3.3.
>> By putting something more precise it worked (e.g. http://localhost:3000).
>>
>> The debugging of this one was very tricky...
>> The problem happens at the "code to token exchange" step.
>> In KC 3.3, the response headers "Access-Control-Allow-Origin" is set to
>> "*".
>> This doesn't seem to work with keycloak.js adapter, at this line:
>>
>> https://github.com/keycloak/keycloak/blob/master/adapters/oidc/js/src/main/resources/keycloak.js#L341
>>
>> The req.status is 0. It seems that XMLHttpRequest doesn't like this
>> Access-Control-Allow-Origin="*".
>>
>> If I change the Web Origins to http://localhost:3000, it works.
>> Likewise, in KC=3.2, the Web Origins = *  seems to be translated
>> automatically to Access-Control-Allow-Origin hea=
>>
>>
>>
>>
>>
>> In KC 3.2, with Web Origin "*", the  is transformed as "
>> http://localhost:3000"
>>
>>
>>
>>
>> https://github.com/keycloak/keycloak/blob/master/adapters/oidc/js/src/main/resources/keycloak.js#L337
>>
>>
>>
>>
>> On Tue, Dec 12, 2017 at 10:45 AM, Corentin Dupont <
>> corentin.dupont at gmail.com
>> > wrote:
>>
>> > Hi guys,
>> >
>> > I use this code in my javascript application:
>> >
>> > var keycloak = Keycloak();
>> >         keycloak.init().success(function(authenticated) {
>> >             alert(authenticated ? 'authenticated' : 'not
>> authenticated');
>> >         }).error(function() {
>> >             alert('failed to initialize');
>> >         });
>> >
>> > Since I updated Keycloak I get the message 'failed to initialize'.
>> > It was working well with the previous version of KC 3.2.
>> >
>> > What could it be? How can I get a better error message?
>> >
>> >
>> > Thanks!
>> >
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>
>

From corentin.dupont at gmail.com  Tue Jan 16 07:15:08 2018
From: corentin.dupont at gmail.com (Corentin Dupont)
Date: Tue, 16 Jan 2018 13:15:08 +0100
Subject: [keycloak-user] Failed to initialize in KC 3.4
In-Reply-To: <CANYoZJkLB36-7ehTDwRbbwA5aEyx4LbCiczp6YaUize=YPpb7Q@mail.gmail.com>
References: <CAEyhvmqnB_nsaGxkkBQ_vP2DkkSY0fU7Dy_=jhnPvRDkWZw_-Q@mail.gmail.com>
	<CAEyhvmoLP_=atBZ5EPPKV4FLVVOjgM=-kAyyR4B8CGrSQuokYg@mail.gmail.com>
	<CANYoZJkLB36-7ehTDwRbbwA5aEyx4LbCiczp6YaUize=YPpb7Q@mail.gmail.com>
Message-ID: <CAEyhvmqHCiEd41ZBMSwPSPf1x8d57+5vf9t16DWPAAnNYMqmyw@mail.gmail.com>

Hello ,
what do you mean by headers dump?
I included two screenshots in the previous post, is this what you mean?
Thanks

On Tue, Jan 16, 2018 at 12:46 PM, ??????? ?????? <betalb at gmail.com> wrote:

> Hi
>
> Asterisk should be pretty valid, maybe at some point in time KC stopped
> expanding it and just started to pass in reply as-is, but
> Access-Control-Allow-Origin: *
>
> Is valid header value [1]. And status = 0 means that preflight request
> check failed on the browser side and JS code can't even access any info
> from KC.
>
> Do you have request and response headers dump, an asterisk was quoted or
> not?
>
> [1] https://developer.mozilla.org/ru/docs/Web/HTTP/Headers/
> Access-Control-Allow-Origin
>
> On Tue, Jan 16, 2018 at 1:10 PM Corentin Dupont <corentin.dupont at gmail.com>
> wrote:
>
>> Hi guys,
>> I finally solved this problem.
>> Posting here for memory :)
>> I use this simple code in my NodeJS application:
>>
>> import Keycloak from 'keycloak-js';
>>
>> var keycloak = Keycloak();
>> keycloak.init({ onLoad: 'login-required'}).success(authenticated => {
>>   if (authenticated) {
>>     console.log("Authenticated");
>>   }
>> }).error(function (error) {
>>     console.log("Authentication error");
>>   });
>> }
>>
>> In Keycloak 3.3 and above, I kept getting the message "Authentication
>> error".
>> Keycloak 3.2 and below works.
>>
>> I finally understood that the problem is the Web Origins of my client.
>> It was set to "*", but apparently this is not supported anymore in
>> KC>=3.3.
>> By putting something more precise it worked (e.g. http://localhost:3000).
>>
>> The debugging of this one was very tricky...
>> The problem happens at the "code to token exchange" step.
>> In KC 3.3, the response headers "Access-Control-Allow-Origin" is set to
>> "*".
>> This doesn't seem to work with keycloak.js adapter, at this line:
>> https://github.com/keycloak/keycloak/blob/master/adapters/
>> oidc/js/src/main/resources/keycloak.js#L341
>>
>> The req.status is 0. It seems that XMLHttpRequest doesn't like this
>> Access-Control-Allow-Origin="*".
>>
>> If I change the Web Origins to http://localhost:3000, it works.
>> Likewise, in KC=3.2, the Web Origins = *  seems to be translated
>> automatically to Access-Control-Allow-Origin hea=
>>
>>
>>
>>
>>
>> In KC 3.2, with Web Origin "*", the  is transformed as "
>> http://localhost:3000"
>>
>>
>>
>> https://github.com/keycloak/keycloak/blob/master/adapters/
>> oidc/js/src/main/resources/keycloak.js#L337
>>
>>
>>
>>
>> On Tue, Dec 12, 2017 at 10:45 AM, Corentin Dupont <
>> corentin.dupont at gmail.com
>> > wrote:
>>
>> > Hi guys,
>> >
>> > I use this code in my javascript application:
>> >
>> > var keycloak = Keycloak();
>> >         keycloak.init().success(function(authenticated) {
>> >             alert(authenticated ? 'authenticated' : 'not
>> authenticated');
>> >         }).error(function() {
>> >             alert('failed to initialize');
>> >         });
>> >
>> > Since I updated Keycloak I get the message 'failed to initialize'.
>> > It was working well with the previous version of KC 3.2.
>> >
>> > What could it be? How can I get a better error message?
>> >
>> >
>> > Thanks!
>> >
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>
>

From betalb at gmail.com  Tue Jan 16 07:25:04 2018
From: betalb at gmail.com (=?UTF-8?B?0JLQuNGC0LDQu9C40Lkg0JjRidC10L3QutC+?=)
Date: Tue, 16 Jan 2018 12:25:04 +0000
Subject: [keycloak-user] Failed to initialize in KC 3.4
In-Reply-To: <CAEyhvmqHCiEd41ZBMSwPSPf1x8d57+5vf9t16DWPAAnNYMqmyw@mail.gmail.com>
References: <CAEyhvmqnB_nsaGxkkBQ_vP2DkkSY0fU7Dy_=jhnPvRDkWZw_-Q@mail.gmail.com>
	<CAEyhvmoLP_=atBZ5EPPKV4FLVVOjgM=-kAyyR4B8CGrSQuokYg@mail.gmail.com>
	<CANYoZJkLB36-7ehTDwRbbwA5aEyx4LbCiczp6YaUize=YPpb7Q@mail.gmail.com>
	<CAEyhvmqHCiEd41ZBMSwPSPf1x8d57+5vf9t16DWPAAnNYMqmyw@mail.gmail.com>
Message-ID: <CANYoZJmUB5+1pfbNXZSR1Y0W=EbuQMJLwfMDVFfX_mT7vnNdSA@mail.gmail.com>

I think mailing list is not allowing attachments, you need to host images
somewhere else and post link here

On Tue, Jan 16, 2018 at 3:15 PM Corentin Dupont <corentin.dupont at gmail.com>
wrote:

> Hello ,
> what do you mean by headers dump?
> I included two screenshots in the previous post, is this what you mean?
> Thanks
>
> On Tue, Jan 16, 2018 at 12:46 PM, ??????? ?????? <betalb at gmail.com> wrote:
>
>> Hi
>>
>> Asterisk should be pretty valid, maybe at some point in time KC stopped
>> expanding it and just started to pass in reply as-is, but Access-Control-Allow-Origin:
>> *
>>
>> Is valid header value [1]. And status = 0 means that preflight request
>> check failed on the browser side and JS code can't even access any info
>> from KC.
>>
>> Do you have request and response headers dump, an asterisk was quoted or
>> not?
>>
>> [1]
>> https://developer.mozilla.org/ru/docs/Web/HTTP/Headers/Access-Control-Allow-Origin
>>
>> On Tue, Jan 16, 2018 at 1:10 PM Corentin Dupont <
>> corentin.dupont at gmail.com> wrote:
>>
>>> Hi guys,
>>> I finally solved this problem.
>>> Posting here for memory :)
>>> I use this simple code in my NodeJS application:
>>>
>>> import Keycloak from 'keycloak-js';
>>>
>>> var keycloak = Keycloak();
>>> keycloak.init({ onLoad: 'login-required'}).success(authenticated => {
>>>   if (authenticated) {
>>>     console.log("Authenticated");
>>>   }
>>> }).error(function (error) {
>>>     console.log("Authentication error");
>>>   });
>>> }
>>>
>>> In Keycloak 3.3 and above, I kept getting the message "Authentication
>>> error".
>>> Keycloak 3.2 and below works.
>>>
>>> I finally understood that the problem is the Web Origins of my client.
>>> It was set to "*", but apparently this is not supported anymore in
>>> KC>=3.3.
>>> By putting something more precise it worked (e.g. http://localhost:3000
>>> ).
>>>
>>> The debugging of this one was very tricky...
>>> The problem happens at the "code to token exchange" step.
>>> In KC 3.3, the response headers "Access-Control-Allow-Origin" is set to
>>> "*".
>>> This doesn't seem to work with keycloak.js adapter, at this line:
>>>
>>> https://github.com/keycloak/keycloak/blob/master/adapters/oidc/js/src/main/resources/keycloak.js#L341
>>>
>>> The req.status is 0. It seems that XMLHttpRequest doesn't like this
>>> Access-Control-Allow-Origin="*".
>>>
>>> If I change the Web Origins to http://localhost:3000, it works.
>>> Likewise, in KC=3.2, the Web Origins = *  seems to be translated
>>> automatically to Access-Control-Allow-Origin hea=
>>>
>>>
>>>
>>>
>>>
>>> In KC 3.2, with Web Origin "*", the  is transformed as "
>>> http://localhost:3000"
>>>
>>>
>>>
>>>
>>> https://github.com/keycloak/keycloak/blob/master/adapters/oidc/js/src/main/resources/keycloak.js#L337
>>>
>>>
>>>
>>>
>>> On Tue, Dec 12, 2017 at 10:45 AM, Corentin Dupont <
>>> corentin.dupont at gmail.com
>>> > wrote:
>>>
>>> > Hi guys,
>>> >
>>> > I use this code in my javascript application:
>>> >
>>> > var keycloak = Keycloak();
>>> >         keycloak.init().success(function(authenticated) {
>>> >             alert(authenticated ? 'authenticated' : 'not
>>> authenticated');
>>> >         }).error(function() {
>>> >             alert('failed to initialize');
>>> >         });
>>> >
>>> > Since I updated Keycloak I get the message 'failed to initialize'.
>>> > It was working well with the previous version of KC 3.2.
>>> >
>>> > What could it be? How can I get a better error message?
>>> >
>>> >
>>> > Thanks!
>>> >
>>> _______________________________________________
>>> keycloak-user mailing list
>>> keycloak-user at lists.jboss.org
>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>
>>
>

From corentin.dupont at gmail.com  Tue Jan 16 07:32:21 2018
From: corentin.dupont at gmail.com (Corentin Dupont)
Date: Tue, 16 Jan 2018 13:32:21 +0100
Subject: [keycloak-user] Failed to initialize in KC 3.4
In-Reply-To: <CANYoZJmUB5+1pfbNXZSR1Y0W=EbuQMJLwfMDVFfX_mT7vnNdSA@mail.gmail.com>
References: <CAEyhvmqnB_nsaGxkkBQ_vP2DkkSY0fU7Dy_=jhnPvRDkWZw_-Q@mail.gmail.com>
	<CAEyhvmoLP_=atBZ5EPPKV4FLVVOjgM=-kAyyR4B8CGrSQuokYg@mail.gmail.com>
	<CANYoZJkLB36-7ehTDwRbbwA5aEyx4LbCiczp6YaUize=YPpb7Q@mail.gmail.com>
	<CAEyhvmqHCiEd41ZBMSwPSPf1x8d57+5vf9t16DWPAAnNYMqmyw@mail.gmail.com>
	<CANYoZJmUB5+1pfbNXZSR1Y0W=EbuQMJLwfMDVFfX_mT7vnNdSA@mail.gmail.com>
Message-ID: <CAEyhvmq4XYUOptEnkgmZxj9JaNi9H+-AmArJ73V4aN7kcKS4bA@mail.gmail.com>

Let's try with Drive:?
 Keycloak 3.2 headers.png
<https://drive.google.com/file/d/1gNKw3coRAJ1UTLKMYcpfVDEFXx4Xc3sO/view?usp=drive_web>
??
 Keycloak 3.3 headers.png
<https://drive.google.com/file/d/1pf8YcJD-wtPHpV553l0pqKzdSTbU_96_/view?usp=drive_web>
?

On Tue, Jan 16, 2018 at 1:25 PM, ??????? ?????? <betalb at gmail.com> wrote:

> I think mailing list is not allowing attachments, you need to host images
> somewhere else and post link here
>
> On Tue, Jan 16, 2018 at 3:15 PM Corentin Dupont <corentin.dupont at gmail.com>
> wrote:
>
>> Hello ,
>> what do you mean by headers dump?
>> I included two screenshots in the previous post, is this what you mean?
>> Thanks
>>
>> On Tue, Jan 16, 2018 at 12:46 PM, ??????? ?????? <betalb at gmail.com>
>> wrote:
>>
>>> Hi
>>>
>>> Asterisk should be pretty valid, maybe at some point in time KC stopped
>>> expanding it and just started to pass in reply as-is, but
>>> Access-Control-Allow-Origin: *
>>>
>>> Is valid header value [1]. And status = 0 means that preflight request
>>> check failed on the browser side and JS code can't even access any info
>>> from KC.
>>>
>>> Do you have request and response headers dump, an asterisk was quoted or
>>> not?
>>>
>>> [1] https://developer.mozilla.org/ru/docs/Web/HTTP/Headers/
>>> Access-Control-Allow-Origin
>>>
>>> On Tue, Jan 16, 2018 at 1:10 PM Corentin Dupont <
>>> corentin.dupont at gmail.com> wrote:
>>>
>>>> Hi guys,
>>>> I finally solved this problem.
>>>> Posting here for memory :)
>>>> I use this simple code in my NodeJS application:
>>>>
>>>> import Keycloak from 'keycloak-js';
>>>>
>>>> var keycloak = Keycloak();
>>>> keycloak.init({ onLoad: 'login-required'}).success(authenticated => {
>>>>   if (authenticated) {
>>>>     console.log("Authenticated");
>>>>   }
>>>> }).error(function (error) {
>>>>     console.log("Authentication error");
>>>>   });
>>>> }
>>>>
>>>> In Keycloak 3.3 and above, I kept getting the message "Authentication
>>>> error".
>>>> Keycloak 3.2 and below works.
>>>>
>>>> I finally understood that the problem is the Web Origins of my client.
>>>> It was set to "*", but apparently this is not supported anymore in
>>>> KC>=3.3.
>>>> By putting something more precise it worked (e.g. http://localhost:3000
>>>> ).
>>>>
>>>> The debugging of this one was very tricky...
>>>> The problem happens at the "code to token exchange" step.
>>>> In KC 3.3, the response headers "Access-Control-Allow-Origin" is set to
>>>> "*".
>>>> This doesn't seem to work with keycloak.js adapter, at this line:
>>>> https://github.com/keycloak/keycloak/blob/master/adapters/
>>>> oidc/js/src/main/resources/keycloak.js#L341
>>>>
>>>> The req.status is 0. It seems that XMLHttpRequest doesn't like this
>>>> Access-Control-Allow-Origin="*".
>>>>
>>>> If I change the Web Origins to http://localhost:3000, it works.
>>>> Likewise, in KC=3.2, the Web Origins = *  seems to be translated
>>>> automatically to Access-Control-Allow-Origin hea=
>>>>
>>>>
>>>>
>>>>
>>>>
>>>> In KC 3.2, with Web Origin "*", the  is transformed as "
>>>> http://localhost:3000"
>>>>
>>>>
>>>>
>>>> https://github.com/keycloak/keycloak/blob/master/adapters/
>>>> oidc/js/src/main/resources/keycloak.js#L337
>>>>
>>>>
>>>>
>>>>
>>>> On Tue, Dec 12, 2017 at 10:45 AM, Corentin Dupont <
>>>> corentin.dupont at gmail.com
>>>> > wrote:
>>>>
>>>> > Hi guys,
>>>> >
>>>> > I use this code in my javascript application:
>>>> >
>>>> > var keycloak = Keycloak();
>>>> >         keycloak.init().success(function(authenticated) {
>>>> >             alert(authenticated ? 'authenticated' : 'not
>>>> authenticated');
>>>> >         }).error(function() {
>>>> >             alert('failed to initialize');
>>>> >         });
>>>> >
>>>> > Since I updated Keycloak I get the message 'failed to initialize'.
>>>> > It was working well with the previous version of KC 3.2.
>>>> >
>>>> > What could it be? How can I get a better error message?
>>>> >
>>>> >
>>>> > Thanks!
>>>> >
>>>> _______________________________________________
>>>> keycloak-user mailing list
>>>> keycloak-user at lists.jboss.org
>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>>
>>>
>>

From mposolda at redhat.com  Tue Jan 16 07:57:06 2018
From: mposolda at redhat.com (Marek Posolda)
Date: Tue, 16 Jan 2018 13:57:06 +0100
Subject: [keycloak-user] Login or BacktoApplication Link Missing
In-Reply-To: <DC8C886C-1C14-4FAE-B600-19A1A9D680BE@smartdestinations.com>
References: <HE1PR0102MB31457F7D2124C5536DB6752D82EB0@HE1PR0102MB3145.eurprd01.prod.exchangelabs.com>
	<HE1PR0102MB314500AAA938C11D2544C49682EB0@HE1PR0102MB3145.eurprd01.prod.exchangelabs.com>
	<5F2C103F-479D-4B6E-8162-A4A5C39BE744@smartdestinations.com>
	<e760a2e4-4909-74a9-82ac-398c9980ef02@redhat.com>
	<DC8C886C-1C14-4FAE-B600-19A1A9D680BE@smartdestinations.com>
Message-ID: <aad6a386-5ff7-8b0d-07ff-4da3a247c671@redhat.com>

Yes, I would try latest Keycloak 3.4.3 and see if it's still there. 
There were some fixes/changes in the meantime though.

Marek

On 15/01/18 21:34, Kumar Nitesh wrote:
> Hi,
>
> Yes, my client has baseUrl configure and I am using 3.4.1. Let me know where you feel the error is in ftl template or java code. I will try to update to latest Keycloak.
>
> Thanks
> Kumar
>
>> On Jan 15, 2018, at 3:25 PM, Marek Posolda <mposolda at redhat.com> wrote:
>>
>> Does your client has baseUrl configured? If yes, could you try with latest Keycloak 3.4.3 and check if the issue still happen and you still can't see the link? If still not, feel free to create JIRA and provide the detailed steps to reproduce - especially include if the link from email was opened in same or different browser (assuming you use the flow for password reset link sent to the user by email)
>>
>> Thanks,
>> Marek
>>
>> On 15/01/18 20:14, Kumar Nitesh wrote:
>>> Hi,
>>>
>>> How to add "back to application" link on password updated successfully page? Right now it doesn?t have any link and url also losses the client Id value.
>>>
>>> Thanks
>>> Kumar
>>> _______________________________________________
>>> keycloak-user mailing list
>>> keycloak-user at lists.jboss.org
>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>


From mposolda at redhat.com  Tue Jan 16 08:09:59 2018
From: mposolda at redhat.com (Marek Posolda)
Date: Tue, 16 Jan 2018 14:09:59 +0100
Subject: [keycloak-user] Different theme for each client
In-Reply-To: <CABRXCmyGoUvkcV6gRAaAmkey_26+yHqV-ECGV_q1Ui_e-+8_nw@mail.gmail.com>
References: <trinity-08954434-d99a-48a0-8de6-7e83da7f493a-1516018211633@3c-app-webde-bap55>
	<0c00b809-1e5f-75eb-40b2-08d36587cda1@redhat.com>
	<53c1f766-587e-2822-5002-f9d81085e72e@redhat.com>
	<CABRXCmyGoUvkcV6gRAaAmkey_26+yHqV-ECGV_q1Ui_e-+8_nw@mail.gmail.com>
Message-ID: <2545189b-77cd-581e-d0e8-0d72f5964bcf@redhat.com>

We can probably do some builtin support for clients into the themes 
itself. Doing it properly may take few days. Depends if we want to 
support that. AFAIR Stian didn't like that, but to me it makes sense 
that some people want different look&feel based on client.

For example template file can be lookup from the directory with the 
clientId (EG. theme/my-theme/login/customer-portal/login.ftl ). If it 
doesn't exists, then fallback to the current location without "clientId" 
directory. Maybe something similar would be needed for the CSS files and 
other resources.

But for some very basic cases, people can probably already handle it by 
add some "if" into the freemarker template itself and use different CSS 
styles based on the client or something like this.

Marek


On 16/01/18 00:09, Bill Burke wrote:
> I wonder how hard it would be to implement?
>
> On Mon, Jan 15, 2018 at 3:22 PM, Marek Posolda <mposolda at redhat.com> wrote:
>> I think that Freemarker theme (at least login theme) has access to
>> ClientBean through the "client" expression . So it's likely already
>> possible to do some hacking in the template itself and provide different
>> CSS according to the client used. Not very nice, but likely should be
>> somehow possible.
>>
>> Marek
>>
>> On 15/01/18 18:26, Josh Cain wrote:
>>> Was originally discussed here:
>>> http://lists.jboss.org/pipermail/keycloak-user/2016-January/004288.html
>>>
>>> And I asked the same question again here:
>>> http://lists.jboss.org/pipermail/keycloak-user/2016-July/007052.html
>>>
>>> But feel free to keep bumping.  It's a feature I'd like to see anyway ;-)
>>>
>>> Josh Cain
>>> Senior Software Applications Engineer, RHCE
>>> Red Hat North America
>>> jcain at redhat.com IRC: jcain
>>>
>>> On 01/15/2018 06:10 AM, eric.kapitza at web.de wrote:
>>>> _______________________________________________
>>>> keycloak-user mailing list
>>>> keycloak-user at lists.jboss.org
>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>>
>>>
>>> _______________________________________________
>>> keycloak-user mailing list
>>> keycloak-user at lists.jboss.org
>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
>


From Michael.Knurr at adesso.ch  Tue Jan 16 08:14:28 2018
From: Michael.Knurr at adesso.ch (Knurr, Michael)
Date: Tue, 16 Jan 2018 13:14:28 +0000
Subject: [keycloak-user] Running two Keycloak instances in parallel
In-Reply-To: <CAMvXD=HPKDFPROFtV_qaYEG6OOhGSJAZ4KjSptAvRvM4Ekkc0w@mail.gmail.com>
References: <256903ed7bc740b4a36dc2a969449c12@EX2013-DB02.adesso.local>
	<CAMvXD=HPKDFPROFtV_qaYEG6OOhGSJAZ4KjSptAvRvM4Ekkc0w@mail.gmail.com>
Message-ID: <9f5f2d15acc647f6ab2ff298bd4e3ad5@EX2013-DB02.adesso.local>

Hi Hynek

When passing the parameter -Djboss.as.management.blocking.timeout=900 to standalone.sh, I still get an transaction timeout after 5 minutes. The JBoss deployment timeout follows 10 minutes later

13:48:58,480 INFO  [org.keycloak.connections.jpa.updater.liquibase.LiquibaseJpaUpdaterProvider] (ServerService Thread Pool -- 54) Updating database. Using changelog META-INF/jpa-changelog-master.xml
13:53:56,978 WARN  [com.arjuna.ats.arjuna] (Transaction Reaper) ARJUNA012117: TransactionReaper::check timeout for TX 0:ffff7f000101:3bafd8ef:5a5df4b7:d in state  RUN
13:53:56,986 WARN  [com.arjuna.ats.arjuna] (Transaction Reaper Worker 0) ARJUNA012121: TransactionReaper::doCancellations worker Thread[Transaction Reaper Worker 0,5,main] successfully canceled TX 0:ffff7f000101:3bafd8ef:5a5df4b7:d
13:53:57,240 WARN  [com.arjuna.ats.arjuna] (Transaction Reaper) ARJUNA012117: TransactionReaper::check timeout for TX 0:ffff7f000101:3bafd8ef:5a5df4b7:10 in state  RUN
13:53:57,241 WARN  [com.arjuna.ats.arjuna] (Transaction Reaper Worker 0) ARJUNA012121: TransactionReaper::doCancellations worker Thread[Transaction Reaper Worker 0,5,main] successfully canceled TX 0:ffff7f000101:3bafd8ef:5a5df4b7:10
14:03:55,819 ERROR [org.jboss.as.controller.management-operation] (Controller Boot Thread) WFLYCTL0348: Timeout after [900] seconds waiting for service container stability. Operation will roll back. Step that first updated the service container was 'add' at address '[
    ("core-service" => "management"),
    ("management-interface" => "http-interface")
]'
14:04:00,825 ERROR [org.jboss.as.controller.management-operation] (Controller Boot Thread) WFLYCTL0190: Step handler org.jboss.as.server.DeployerChainAddHandler$FinalRuntimeStepHandler at 3cf14117<mailto:org.jboss.as.server.DeployerChainAddHandler$FinalRuntimeStepHandler at 3cf14117> for operation add-deployer-chains at address [] failed handling operation rollback -- java.util.concurrent.TimeoutException: java.util.concurrent.TimeoutException
        at org.jboss.as.controller.OperationContextImpl.waitForRemovals(OperationContextImpl.java:522)
?

However, when the previous keycloak instance is stopped, the upgrade runs through within 55 seconds for about 25k users. As far as i could see, keycloak only uses the java:jboss/datasources/KeycloakDS which points to jdbc:h2:${jboss.server.data.dir}/keycloak;AUTO_SERVER=TRUE

For persistence I use the standard builtin H2 database connection so I just assumed that each wildfly installation would use its own h2 database and infinispan cache. Apparently this is not the case.

I already tried the upgrade using 900, 1200 and 1800 seconds for timeout, without any luck.

Do you have any other idea how I can debug this?

Brgds
Michael


Von: Hynek Mlnarik [mailto:hmlnarik at redhat.com]
Gesendet: Dienstag, 16. Januar 2018 11:31
An: Knurr, Michael <Michael.Knurr at adesso.ch>
Cc: keycloak-user <keycloak-user at lists.jboss.org>
Betreff: Re: [keycloak-user] Running two Keycloak instances in parallel

It could be for many reasons. Just guessing - since it is terminating after 300 seconds (5 minutes) while the last log entry is about updating database, maybe the database connection/operation is too slow. Hence you can try increasing the startup period value to e.g. 900 seconds by passing -Djboss.as.management.blocking.timeout=900 parameter to standalone.sh. Also make sure that the database of the new Keycloak instance is distinct from the original one.

On Tue, Jan 16, 2018 at 10:30 AM, Knurr, Michael <Michael.Knurr at adesso.ch<mailto:Michael.Knurr at adesso.ch>> wrote:
Hi all

When trying to upgrade Keycloak to the latest version I ran into problems. Unfortunately It turned out that we ran into different upgrade behaviors on different machines. With the latest version, the upgrade is running locally, on test and on stage. As a last step I now tried to test the upgrade procedure on the production machine with a keycloak instance running on a different port.

When running the upgrade on a server with an already running keycloak instance, the new server runs into a timeout because of concurrency.

10:16:24,926 INFO  [org.keycloak.connections.jpa.updater.liquibase.LiquibaseJpaUpdaterProvider] (ServerService Thread Pool -- 58) Updating database. Using changelog META-INF/jpa-changelog-master.xml
10:21:22,322 ERROR [org.jboss.as.controller.management-operation] (Controller Boot Thread) WFLYCTL0348: Timeout after [300] seconds waiting for service container stability. Operation will roll back. Step that first updated the service container was 'add' at address '[
    ("core-service" => "management"),
    ("management-interface" => "http-interface")
]'
10:21:23,397 WARN  [com.arjuna.ats.arjuna] (Transaction Reaper) ARJUNA012117: TransactionReaper::check timeout for TX 0:ffff7f000101:73d290d3:5a5dc2e6:d in state  RUN
10:21:23,402 WARN  [com.arjuna.ats.arjuna] (Transaction Reaper Worker 0) ARJUNA012121: TransactionReaper::doCancellations worker Thread[Transaction Reaper Worker 0,5,main] successfully canceled TX 0:ffff7f000101:73d290d3:5a5dc2e6:d
10:21:23,668 WARN  [com.arjuna.ats.arjuna] (Transaction Reaper) ARJUNA012117: TransactionReaper::check timeout for TX 0:ffff7f000101:73d290d3:5a5dc2e6:10 in state  RUN
10:21:23,669 WARN  [com.arjuna.ats.arjuna] (Transaction Reaper Worker 0) ARJUNA012121: TransactionReaper::doCancellations worker Thread[Transaction Reaper Worker 0,5,main] successfully canceled TX 0:ffff7f000101:73d290d3:5a5dc2e6:10
10:21:27,328 ERROR [org.jboss.as.controller.management-operation] (Controller Boot Thread) WFLYCTL0190: Step handler org.jboss.as.server.DeployerChainAddHandler$FinalRuntimeStepHandler at 20b4c4cb<mailto:org.jboss.as.server.DeployerChainAddHandler$FinalRuntimeStepHandler at 20b4c4cb> for operation add-deployer-chains at address [] failed handling operation rollback -- java.util.concurrent.TimeoutException: java.util.concurrent.TimeoutException
        at org.jboss.as.controller.OperationContextImpl.waitForRemovals(OperationContextImpl.java:522)
...

What might be the reason for this? Shouldn't it possible to run two keycloak servers (with a different port offset) on a single machine? How can I test the keycloak upgrade on the production machine without stopping the running server instance?


Best regards
Michael
_______________________________________________
keycloak-user mailing list
keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>
https://lists.jboss.org/mailman/listinfo/keycloak-user



--

--Hynek

From corentin.dupont at gmail.com  Tue Jan 16 08:31:37 2018
From: corentin.dupont at gmail.com (Corentin Dupont)
Date: Tue, 16 Jan 2018 14:31:37 +0100
Subject: [keycloak-user] Failed to initialize in KC 3.4
In-Reply-To: <CAEyhvmq4XYUOptEnkgmZxj9JaNi9H+-AmArJ73V4aN7kcKS4bA@mail.gmail.com>
References: <CAEyhvmqnB_nsaGxkkBQ_vP2DkkSY0fU7Dy_=jhnPvRDkWZw_-Q@mail.gmail.com>
	<CAEyhvmoLP_=atBZ5EPPKV4FLVVOjgM=-kAyyR4B8CGrSQuokYg@mail.gmail.com>
	<CANYoZJkLB36-7ehTDwRbbwA5aEyx4LbCiczp6YaUize=YPpb7Q@mail.gmail.com>
	<CAEyhvmqHCiEd41ZBMSwPSPf1x8d57+5vf9t16DWPAAnNYMqmyw@mail.gmail.com>
	<CANYoZJmUB5+1pfbNXZSR1Y0W=EbuQMJLwfMDVFfX_mT7vnNdSA@mail.gmail.com>
	<CAEyhvmq4XYUOptEnkgmZxj9JaNi9H+-AmArJ73V4aN7kcKS4bA@mail.gmail.com>
Message-ID: <CAEyhvmqtSM6q9EK362s9CGXge37Pxns55fBuOT4vh_+Zo_Wyiw@mail.gmail.com>

I tried with "+" as the web origins but it doesn't work as well (same
result: cors issues with res.status = 0 in the client code)

On Tue, Jan 16, 2018 at 1:32 PM, Corentin Dupont <corentin.dupont at gmail.com>
wrote:

> Let's try with Drive:?
>  Keycloak 3.2 headers.png
> <https://drive.google.com/file/d/1gNKw3coRAJ1UTLKMYcpfVDEFXx4Xc3sO/view?usp=drive_web>
> ??
>  Keycloak 3.3 headers.png
> <https://drive.google.com/file/d/1pf8YcJD-wtPHpV553l0pqKzdSTbU_96_/view?usp=drive_web>
> ?
>
> On Tue, Jan 16, 2018 at 1:25 PM, ??????? ?????? <betalb at gmail.com> wrote:
>
>> I think mailing list is not allowing attachments, you need to host images
>> somewhere else and post link here
>>
>> On Tue, Jan 16, 2018 at 3:15 PM Corentin Dupont <
>> corentin.dupont at gmail.com> wrote:
>>
>>> Hello ,
>>> what do you mean by headers dump?
>>> I included two screenshots in the previous post, is this what you mean?
>>> Thanks
>>>
>>> On Tue, Jan 16, 2018 at 12:46 PM, ??????? ?????? <betalb at gmail.com>
>>> wrote:
>>>
>>>> Hi
>>>>
>>>> Asterisk should be pretty valid, maybe at some point in time KC stopped
>>>> expanding it and just started to pass in reply as-is, but
>>>> Access-Control-Allow-Origin: *
>>>>
>>>> Is valid header value [1]. And status = 0 means that preflight request
>>>> check failed on the browser side and JS code can't even access any info
>>>> from KC.
>>>>
>>>> Do you have request and response headers dump, an asterisk was quoted
>>>> or not?
>>>>
>>>> [1] https://developer.mozilla.org/ru/docs/Web/HTTP/Headers/A
>>>> ccess-Control-Allow-Origin
>>>>
>>>> On Tue, Jan 16, 2018 at 1:10 PM Corentin Dupont <
>>>> corentin.dupont at gmail.com> wrote:
>>>>
>>>>> Hi guys,
>>>>> I finally solved this problem.
>>>>> Posting here for memory :)
>>>>> I use this simple code in my NodeJS application:
>>>>>
>>>>> import Keycloak from 'keycloak-js';
>>>>>
>>>>> var keycloak = Keycloak();
>>>>> keycloak.init({ onLoad: 'login-required'}).success(authenticated => {
>>>>>   if (authenticated) {
>>>>>     console.log("Authenticated");
>>>>>   }
>>>>> }).error(function (error) {
>>>>>     console.log("Authentication error");
>>>>>   });
>>>>> }
>>>>>
>>>>> In Keycloak 3.3 and above, I kept getting the message "Authentication
>>>>> error".
>>>>> Keycloak 3.2 and below works.
>>>>>
>>>>> I finally understood that the problem is the Web Origins of my client.
>>>>> It was set to "*", but apparently this is not supported anymore in
>>>>> KC>=3.3.
>>>>> By putting something more precise it worked (e.g.
>>>>> http://localhost:3000).
>>>>>
>>>>> The debugging of this one was very tricky...
>>>>> The problem happens at the "code to token exchange" step.
>>>>> In KC 3.3, the response headers "Access-Control-Allow-Origin" is set
>>>>> to "*".
>>>>> This doesn't seem to work with keycloak.js adapter, at this line:
>>>>> https://github.com/keycloak/keycloak/blob/master/adapters/oi
>>>>> dc/js/src/main/resources/keycloak.js#L341
>>>>>
>>>>> The req.status is 0. It seems that XMLHttpRequest doesn't like this
>>>>> Access-Control-Allow-Origin="*".
>>>>>
>>>>> If I change the Web Origins to http://localhost:3000, it works.
>>>>> Likewise, in KC=3.2, the Web Origins = *  seems to be translated
>>>>> automatically to Access-Control-Allow-Origin hea=
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>> In KC 3.2, with Web Origin "*", the  is transformed as "
>>>>> http://localhost:3000"
>>>>>
>>>>>
>>>>>
>>>>> https://github.com/keycloak/keycloak/blob/master/adapters/oi
>>>>> dc/js/src/main/resources/keycloak.js#L337
>>>>>
>>>>>
>>>>>
>>>>>
>>>>> On Tue, Dec 12, 2017 at 10:45 AM, Corentin Dupont <
>>>>> corentin.dupont at gmail.com
>>>>> > wrote:
>>>>>
>>>>> > Hi guys,
>>>>> >
>>>>> > I use this code in my javascript application:
>>>>> >
>>>>> > var keycloak = Keycloak();
>>>>> >         keycloak.init().success(function(authenticated) {
>>>>> >             alert(authenticated ? 'authenticated' : 'not
>>>>> authenticated');
>>>>> >         }).error(function() {
>>>>> >             alert('failed to initialize');
>>>>> >         });
>>>>> >
>>>>> > Since I updated Keycloak I get the message 'failed to initialize'.
>>>>> > It was working well with the previous version of KC 3.2.
>>>>> >
>>>>> > What could it be? How can I get a better error message?
>>>>> >
>>>>> >
>>>>> > Thanks!
>>>>> >
>>>>> _______________________________________________
>>>>> keycloak-user mailing list
>>>>> keycloak-user at lists.jboss.org
>>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>>>
>>>>
>>>
>

From sthorger at redhat.com  Tue Jan 16 09:54:19 2018
From: sthorger at redhat.com (Stian Thorgersen)
Date: Tue, 16 Jan 2018 15:54:19 +0100
Subject: [keycloak-user] Different theme for each client
In-Reply-To: <2545189b-77cd-581e-d0e8-0d72f5964bcf@redhat.com>
References: <trinity-08954434-d99a-48a0-8de6-7e83da7f493a-1516018211633@3c-app-webde-bap55>
	<0c00b809-1e5f-75eb-40b2-08d36587cda1@redhat.com>
	<53c1f766-587e-2822-5002-f9d81085e72e@redhat.com>
	<CABRXCmyGoUvkcV6gRAaAmkey_26+yHqV-ECGV_q1Ui_e-+8_nw@mail.gmail.com>
	<2545189b-77cd-581e-d0e8-0d72f5964bcf@redhat.com>
Message-ID: <CAJgngAdCZAsbcvLOPC6=UpWX_RM-r6=YUsdTr_MLKP1=WPETcA@mail.gmail.com>

It makes sense to add two options:

1. Expose client attributes to theme. That would allow setting an attribute
on a specific client or a client template to then have some conditions to
provide variants within a theme.
2. Allow overriding theme in client and client template. No need to add
something additional to themes as they can already be extended. We simply
need to allow users to specify a different theme. In this case we may also
want to add a ThemeSelectorSPI that would allow some custom logic to select
the theme (could be based on headers for instance in the case of a mobile
theme).

On 16 January 2018 at 14:09, Marek Posolda <mposolda at redhat.com> wrote:

> We can probably do some builtin support for clients into the themes
> itself. Doing it properly may take few days. Depends if we want to
> support that. AFAIR Stian didn't like that, but to me it makes sense
> that some people want different look&feel based on client.
>
> For example template file can be lookup from the directory with the
> clientId (EG. theme/my-theme/login/customer-portal/login.ftl ). If it
> doesn't exists, then fallback to the current location without "clientId"
> directory. Maybe something similar would be needed for the CSS files and
> other resources.
>
> But for some very basic cases, people can probably already handle it by
> add some "if" into the freemarker template itself and use different CSS
> styles based on the client or something like this.
>
> Marek
>
>
> On 16/01/18 00:09, Bill Burke wrote:
> > I wonder how hard it would be to implement?
> >
> > On Mon, Jan 15, 2018 at 3:22 PM, Marek Posolda <mposolda at redhat.com>
> wrote:
> >> I think that Freemarker theme (at least login theme) has access to
> >> ClientBean through the "client" expression . So it's likely already
> >> possible to do some hacking in the template itself and provide different
> >> CSS according to the client used. Not very nice, but likely should be
> >> somehow possible.
> >>
> >> Marek
> >>
> >> On 15/01/18 18:26, Josh Cain wrote:
> >>> Was originally discussed here:
> >>> http://lists.jboss.org/pipermail/keycloak-user/2016-
> January/004288.html
> >>>
> >>> And I asked the same question again here:
> >>> http://lists.jboss.org/pipermail/keycloak-user/2016-July/007052.html
> >>>
> >>> But feel free to keep bumping.  It's a feature I'd like to see anyway
> ;-)
> >>>
> >>> Josh Cain
> >>> Senior Software Applications Engineer, RHCE
> >>> Red Hat North America
> >>> jcain at redhat.com IRC: jcain
> >>>
> >>> On 01/15/2018 06:10 AM, eric.kapitza at web.de wrote:
> >>>> _______________________________________________
> >>>> keycloak-user mailing list
> >>>> keycloak-user at lists.jboss.org
> >>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
> >>>>
> >>>
> >>> _______________________________________________
> >>> keycloak-user mailing list
> >>> keycloak-user at lists.jboss.org
> >>> https://lists.jboss.org/mailman/listinfo/keycloak-user
> >>
> >> _______________________________________________
> >> keycloak-user mailing list
> >> keycloak-user at lists.jboss.org
> >> https://lists.jboss.org/mailman/listinfo/keycloak-user
> >
> >
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>

From jcain at redhat.com  Tue Jan 16 11:06:29 2018
From: jcain at redhat.com (Josh Cain)
Date: Tue, 16 Jan 2018 10:06:29 -0600
Subject: [keycloak-user] Different theme for each client
In-Reply-To: <CAJgngAdCZAsbcvLOPC6=UpWX_RM-r6=YUsdTr_MLKP1=WPETcA@mail.gmail.com>
References: <trinity-08954434-d99a-48a0-8de6-7e83da7f493a-1516018211633@3c-app-webde-bap55>
	<0c00b809-1e5f-75eb-40b2-08d36587cda1@redhat.com>
	<53c1f766-587e-2822-5002-f9d81085e72e@redhat.com>
	<CABRXCmyGoUvkcV6gRAaAmkey_26+yHqV-ECGV_q1Ui_e-+8_nw@mail.gmail.com>
	<2545189b-77cd-581e-d0e8-0d72f5964bcf@redhat.com>
	<CAJgngAdCZAsbcvLOPC6=UpWX_RM-r6=YUsdTr_MLKP1=WPETcA@mail.gmail.com>
Message-ID: <711ff92f-c66c-6aab-abba-068f6cdfe9f8@redhat.com>

+1 for that solution, would make some of what we're looking to do in the
near future *way* cleaner!

Josh Cain
Senior Software Applications Engineer, RHCE
Red Hat North America
jcain at redhat.com IRC: jcain

On 01/16/2018 08:54 AM, Stian Thorgersen wrote:
> It makes sense to add two options:
> 
> 1. Expose client attributes to theme. That would allow setting an attribute
> on a specific client or a client template to then have some conditions to
> provide variants within a theme.
> 2. Allow overriding theme in client and client template. No need to add
> something additional to themes as they can already be extended. We simply
> need to allow users to specify a different theme. In this case we may also
> want to add a ThemeSelectorSPI that would allow some custom logic to select
> the theme (could be based on headers for instance in the case of a mobile
> theme).
> 
> On 16 January 2018 at 14:09, Marek Posolda <mposolda at redhat.com> wrote:
> 
>> We can probably do some builtin support for clients into the themes
>> itself. Doing it properly may take few days. Depends if we want to
>> support that. AFAIR Stian didn't like that, but to me it makes sense
>> that some people want different look&feel based on client.
>>
>> For example template file can be lookup from the directory with the
>> clientId (EG. theme/my-theme/login/customer-portal/login.ftl ). If it
>> doesn't exists, then fallback to the current location without "clientId"
>> directory. Maybe something similar would be needed for the CSS files and
>> other resources.
>>
>> But for some very basic cases, people can probably already handle it by
>> add some "if" into the freemarker template itself and use different CSS
>> styles based on the client or something like this.
>>
>> Marek
>>
>>
>> On 16/01/18 00:09, Bill Burke wrote:
>>> I wonder how hard it would be to implement?
>>>
>>> On Mon, Jan 15, 2018 at 3:22 PM, Marek Posolda <mposolda at redhat.com>
>> wrote:
>>>> I think that Freemarker theme (at least login theme) has access to
>>>> ClientBean through the "client" expression . So it's likely already
>>>> possible to do some hacking in the template itself and provide different
>>>> CSS according to the client used. Not very nice, but likely should be
>>>> somehow possible.
>>>>
>>>> Marek
>>>>
>>>> On 15/01/18 18:26, Josh Cain wrote:
>>>>> Was originally discussed here:
>>>>> http://lists.jboss.org/pipermail/keycloak-user/2016-
>> January/004288.html
>>>>>
>>>>> And I asked the same question again here:
>>>>> http://lists.jboss.org/pipermail/keycloak-user/2016-July/007052.html
>>>>>
>>>>> But feel free to keep bumping.  It's a feature I'd like to see anyway
>> ;-)
>>>>>
>>>>> Josh Cain
>>>>> Senior Software Applications Engineer, RHCE
>>>>> Red Hat North America
>>>>> jcain at redhat.com IRC: jcain
>>>>>
>>>>> On 01/15/2018 06:10 AM, eric.kapitza at web.de wrote:
>>>>>> _______________________________________________
>>>>>> keycloak-user mailing list
>>>>>> keycloak-user at lists.jboss.org
>>>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>>>>
>>>>>
>>>>> _______________________________________________
>>>>> keycloak-user mailing list
>>>>> keycloak-user at lists.jboss.org
>>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>>
>>>> _______________________________________________
>>>> keycloak-user mailing list
>>>> keycloak-user at lists.jboss.org
>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>
>>>
>>
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
> 

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20180116/082cda45/attachment.bin 

From jcain at redhat.com  Tue Jan 16 11:12:38 2018
From: jcain at redhat.com (Josh Cain)
Date: Tue, 16 Jan 2018 10:12:38 -0600
Subject: [keycloak-user] offlineSessions data in cache vs db
In-Reply-To: <0835614e-da3c-d196-d79d-3477a8e708db@redhat.com>
References: <bae6fa59-6711-eeda-d196-f4529a167873@autonomic.ai>
	<a045fed1-7e7f-b5f0-5c84-08bd87fb9e8c@redhat.com>
	<c58ff56e-2c18-3387-d052-f05d9a0a2409@redhat.com>
	<3a16a6e1-6a61-ae1c-4941-a85ade1d323f@redhat.com>
	<8ef486e4-fbfc-a9d7-5d56-c2f266a26eaf@redhat.com>
	<42c1f336-80ba-67d6-542f-301443a7f26f@redhat.com>
	<0835614e-da3c-d196-d79d-3477a8e708db@redhat.com>
Message-ID: <bdf36006-d4d8-1949-16ac-ab3e9cf3287f@redhat.com>

Perfect.  That answers my question, thanks for the explanation Marek!

Josh Cain
Senior Software Applications Engineer, RHCE
Red Hat North America
jcain at redhat.com IRC: jcain

On 01/15/2018 02:19 PM, Marek Posolda wrote:
> Hi Josh,
> 
> On 15/01/18 18:24, Josh Cain wrote:
>> Thanks for taking a look at that Marek.? Really helpful.
>>
>> I might open something.? Our use case has very infrequent offline token
>> usage (once every week to once every month), and it just doesn't make
>> sense to have tokens used so infrequently sit in memory.? Any chance of
>> having a DB option?
> Yes, there is any chance, but everything depends on the priorities
> though :)
> 
> But actually, you use cross-DC setup if I know correctly? If yes, the
> infinispan caches will be configured with the remoteStore. It's possible
> that if you enable eviction + passivation on offlineSession caches, the
> infrequently used session data will be "passivated" and hence removed
> from the infinispan cache on Keycloak servers side, they will just
> remain in the caches on JDG side and will be loaded by Keycloak servers
> just when needed. But we didn't yet try to test with eviction and
> passivation enabled on infinispan caches with remoteStore on Keycloak
> server side.
> 
> Another question is, how much offline sessions you plan to have? Will be
> there million of sessions or 100K or just few thousands? If it's few
> thousands, then the memory might be acceptable? Even for 100K sessions
> (considering that one session = pair of 1 userSession + 1 clientSession)
> the memory is not more than 500 MB - and even less with more cluster
> nodes as then the sessions are distributed among all cluster nodes.
>> Last question on this (for now anyway) - Are offline sessions part of
>> the RH-SSO 7.2 + JDG cross-datacenter replication support?? If the cache
>> only loads those on server startup, that obviously presents a problem
>> when doing something like failing over to a secondary datacenter on hot
>> standby.
> Yes, offline sessions are part of RHSSO 7.2 + cross-datacenter
> replication support. Docs is available already in community [1] .
> 
> I think that usecase with hot standby will work.
> 
> Actually the example flow may work this way:
> - You have 2 datacenters and JDG servers are started in both datacenters.
> - First Keycloak server is starting in first datacenter. This server
> will start preloading sessions from DB .
> - Offline sessions are preloaded in Keycloak caches in JDG caches in
> first datacenter and also on JDG in second datacenter (due the JDG in
> first DC is automatically doing backup to the JDG in second DC)
> - When Keycloak server in second DC is starting, the sessions are
> preloaded from the JDG server in second DC, not from DB.
> - At this point, offline sessions are available on both DCs.
> - When any datacenter is going to offline mode, the Keycloak servers on
> the second DC will always be available to read the content from the caches
> - When the datacenter is started again, it will preload again the
> sessions from the JDG servers in already started DC.
> 
> The offline sessions are preloaded from DB really just during start of
> first Keycloak in first DC (we saw much worse performance then
> preloading from remoteStore). But sessions should be always available.
> 
> If you have an opportunity to read the docs, try things and provide
> feedback, it will be cool.
> 
> [1]
> http://www.keycloak.org/docs/latest/server_installation/index.html#crossdc-mode
> 
> 
> Marek
>> Josh Cain
>> Senior Software Applications Engineer, RHCE
>> Red Hat North America
>> jcain at redhat.com IRC: jcain
>>
>> On 01/11/2018 11:07 AM, Marek Posolda wrote:
>>> On 10/01/18 22:31, Josh Cain wrote:
>>>> Thanks for the response!? Seem to have missed the reply.? A follow-up
>>>> question:
>>>>
>>>> You mentioned that the choice to store in the Infinispan cache was made
>>>> for performance purposes.? I understand that this will lead to faster
>>>> retrieval speeds, however storing *every* offline session in the
>>>> Infinispan cache could lead to a massive memory footprint if these
>>>> sessions are used widely enough, right?
>>> Just tried some very basic testing. I've tried to create 100K
>>> userSessions where every of them has 1 clientSession - so 100K
>>> userSessions + 100K clientSessions.
>>>
>>> With 0 offlineSessions, I saw server consumes 100 MBytes in memory. With
>>> 100K sessions (100K userSessions + 100K clientSessions) it was 230
>>> MBytes. With 200K sessions (200K userSessions + 200K clientSessions), it
>>> was 350 MBytes.
>>>
>>> So every userSession+clientSession pair took around 1-2 KBytes in my
>>> test. In reality, it may be more as it depends on the amount of things
>>> in the sessions (roles, protocolMappers, notes etc). We have an existing
>>> JIRA to remove some stuff from sessions and save it on tokens itself,
>>> which should improve memory consumption [1] .
>>>
>>> In cluster environment, the memory consumption will be smaller as every
>>> cluster node will have just those sessions, which he is owner (default
>>> setup of infinispan caches "offlineSessions" and "offlineClientSessions"
>>> is to use distributed cache with 1 owner).
>>>
>>> If some more flexibility is needed, we may add support for
>>> offlineSessions to use infinispan cacheStores/cacheLoaders. This is
>>> pretty flexible SPI in infinispan 8 (which is the version we currently
>>> use). With this, customer may be able to choose if sessions should be
>>> preloaded on startup or lazy loaded. Also there may be some additional
>>> options around passivation etc, which may be good if customer prefers to
>>> save memory rather than CPU. Feel free to create another JIRA if you
>>> need this. Just not sure when it's done...
>>>
>>> [1] https://issues.jboss.org/browse/KEYCLOAK-5006
>>>
>>> Marek
>>>> Am I understanding this correctly, or are the client sessions so light
>>>> the impact is negligible?
>>>>
>>>> Josh Cain
>>>> Senior Software Applications Engineer, RHCE
>>>> Red Hat North America
>>>> jcain at redhat.com IRC: jcain
>>>>
>>>> On 01/10/2018 03:13 PM, Marek Posolda wrote:
>>>>> Yes, I've replied. It seems this thread was send to both
>>>>> "keycloak-dev"
>>>>> and "keycloak-user" and I've replied to "keycloak-dev" . Answer is
>>>>> here:
>>>>> http://lists.jboss.org/pipermail/keycloak-dev/2017-December/010249.html
>>>>>
>>>>> .
>>>>>
>>>>> Marek
>>>>>
>>>>> On 10/01/18 19:13, Josh Cain wrote:
>>>>>> Looking to do some work with offline tokens and I had similar
>>>>>> questions.
>>>>>> ??? Was there ever a response to this?
>>>>>>
>>>>>> Josh Cain
>>>>>> Senior Software Applications Engineer, RHCE
>>>>>> Red Hat North America
>>>>>> jcain at redhat.com IRC: jcain
>>>>>>
>>>>>> On 11/21/2017 05:12 PM, Tonnis Wildeboer wrote:
>>>>>>> Hello Keycloak Users,
>>>>>>>
>>>>>>> Ultimately, what we want to do is have three nodes in one Kubernetes
>>>>>>> namespace that define a cluster. Then be able to add three more
>>>>>>> nodes to
>>>>>>> the cluster in a new namespace that shares the same subnet and
>>>>>>> database,
>>>>>>> then kill off the original three nodes, effectively migrating the
>>>>>>> cluster to the new namespace and do all this without anyone being
>>>>>>> logged
>>>>>>> out. The namespace distinction is invisible to Keycloak, as far as
>>>>>>> I can
>>>>>>> tell.
>>>>>>>
>>>>>>> What we have tried:
>>>>>>> * Start with 3 standalone-ha mode instances clustered with
>>>>>>> JGroups/JDBC_PING.
>>>>>>> * Set the number of cache owners for sessions to 6.
>>>>>>> * Start the three new instances in the new Kubernetes namespace,
>>>>>>> configured exactly the same as the first three - that is, same db,
>>>>>>> same
>>>>>>> number of cache owners.
>>>>>>> * Kill the original three
>>>>>>>
>>>>>>> But it seems this caused offlineSession tokens to be expired
>>>>>>> immediately.
>>>>>>>
>>>>>>> I found this in the online documentation
>>>>>>> (http://www.keycloak.org/docs/latest/server_installation/index.html#server-cache-configuration):
>>>>>>>
>>>>>>>
>>>>>>>
>>>>>>>
>>>>>>> ??? > The second type of cache handles managing user sessions,
>>>>>>> offline
>>>>>>> tokens, and keeping track of login failures... The data held in
>>>>>>> these
>>>>>>> caches is temporary, in memory only, but is possibly replicated
>>>>>>> across
>>>>>>> the cluster.
>>>>>>>
>>>>>>> ??? > The sessions, authenticationSessions, offlineSessions and
>>>>>>> loginFailures caches are the only caches that may perform
>>>>>>> replication.
>>>>>>> Entries are not replicated to every single node, but instead one or
>>>>>>> more
>>>>>>> nodes is chosen as an owner of that data. If a node is not the
>>>>>>> owner of
>>>>>>> a specific cache entry it queries the cluster to obtain it. What
>>>>>>> this
>>>>>>> means for failover is that if all the nodes that own a piece of
>>>>>>> data go
>>>>>>> down, that data is lost forever. By default, Keycloak only
>>>>>>> specifies one
>>>>>>> owner for data. So if that one node goes down that data is lost.
>>>>>>> This
>>>>>>> usually means that users will be logged out and will have to login
>>>>>>> again.
>>>>>>>
>>>>>>> It appears, based on these documentation comments and our
>>>>>>> experience,
>>>>>>> that the "source of truth" regarding offlineSessions is the data in
>>>>>>> the
>>>>>>> "owner" caches, is NOT the database, as I would have expected. It
>>>>>>> also
>>>>>>> seems to be the case that if a node joins the cluster (as defined by
>>>>>>> JGroups/JDBC_PING), it will NOT be able to populate its
>>>>>>> offlineSessions
>>>>>>> cache from the database, but must rely on replication from one of
>>>>>>> the
>>>>>>> owner nodes.
>>>>>>>
>>>>>>> Questions:
>>>>>>> 1. Is the above understanding regarding the db vs cache correct?
>>>>>>> 2. If so, please explain the design/reasoning behind this behavior.
>>>>>>> Otherwise, please correct my understanding.
>>>>>>> 3. Is there a way to perform this simple migration without losing
>>>>>>> any
>>>>>>> sessions?
>>>>>>>
>>>>>>> Thanks,
>>>>>>>
>>>>>>> --Tonnis
>>>>>>> _______________________________________________
>>>>>>> keycloak-user mailing list
>>>>>>> keycloak-user at lists.jboss.org
>>>>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>>>>>
>>>>>> _______________________________________________
>>>>>> keycloak-user mailing list
>>>>>> keycloak-user at lists.jboss.org
>>>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>>>
> 

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20180116/2b7045f0/attachment-0001.bin 

From Thomas.FOUTREIN at imprimerienationale.fr  Tue Jan 16 11:42:11 2018
From: Thomas.FOUTREIN at imprimerienationale.fr (FOUTREIN Thomas)
Date: Tue, 16 Jan 2018 16:42:11 +0000
Subject: [keycloak-user] [HS256] Use HS256 rather than RS256 for Id Token
	Signature
Message-ID: <1516120930463.82477@imprimerienationale.fr>

Hello,


I m trying to connect our keycloak instance with France Connect (the french public openid connect platform)


But France Connect doesn't accept Id Token signed with RSA key , it only accept HS256 with a shared secret to verify the signature


I tried to desactivate in my Realm the RSA Provider , but this has no effect on the Token generated (always RS256)


Do you have a simple solution for that ?


thanks in advance


Thomas

From jochen at jochen.org  Wed Jan 17 00:16:45 2018
From: jochen at jochen.org (Jochen Hein)
Date: Wed, 17 Jan 2018 06:16:45 +0100
Subject: [keycloak-user] Authentication fails for OTP user with kerberos
Message-ID: <8360813w02.fsf@jochen.org>


I'm running FreeIPA and have users with and without OTP.  OTP users
authenticate with RADIUS (Privacyidea manages the tokens). My final goal
is that users with a kerberos ticket can authenticate without password
and users without ticket get asked for password+OTP (when configured).

In FreeIPA a user is defined with password and radius authentication:

$ ipa user-show jochen
  User login: jochen
...
  Kerberos principal: jochen at EXAMPLE.ORG
...
  User authentication types: password, radius

According to the FreeIPA docs LDAP bind works with password only, but
kerberos needs password+OTP. That works fine with sssd and other
applications.

I'm now running keycloak 3.4.2 and played with it.  I've added a User
Federation with LDAP to my FreeIPA server and enabled "Allow Kerberos
Authentication".  After that I can log in with my Kerberos ticket
without further authentication.  If I don't have a Kerberos ticket
keycloak asks me for username and password - authentication works with
LDAP bind as long as "Use Kerberos For Password Authentication" is
disabled.

For a regular (non-OTP) user I can authenticate with a Kerberos ticket.
If the user does not have a Kerberos ticket, he is asked for username
and password as expected, and authentication is successful.

Another user with OTP-authentication in FreeIPA can also authenticate
with his Kerberos ticket.

If the OTP-user does not have a Kerberos ticket, keycloak asks for
username and password (as expected).  If the user federation has "Use
Kerberos for Password Authentication" not selected, the user in
FreeIPA needs to have password+OTP (or password+RADIUS) allowed and
can authenticate against FreeIPA-LDAP with password only - that's not
what I want[1].

When I enable "Use Kerberos For Password Authentication" non-OTP users
can still authenticate, but OTP users can't. According to
https://www.freeipa.org/page/V4/OTP#How_to_Test 
"Kerberos FAST is required for OTP operations." - and that's true.

If I just use kinit I get "Generic preauthentication failure while
getting initial credentials".  The kerberos log has:

Aug 08 21:24:17 freeipa1.jochen.org krb5kdc[4442](info): AS_REQ (4 etypes {18 17 16 23}) x.x.x.x: NEEDED_PREAUTH: jochen at EXAMPLE.ORG for krbtgt/JOCHEN.ORG at EXAMPLE.ORG, Additional pre-authentication required
Aug 08 21:24:17 freeipa1.jochen.org krb5kdc[4442](info): preauth (encrypted_timestamp) verify failure: No matching key in entry
Aug 08 21:24:17 freeipa1.jochen.org krb5kdc[4442](info): AS_REQ (4 etypes {18 17 16 23}) x.x.x.127: PREAUTH_FAILED: jochen at EXAMPLE.ORG for krbtgt/JOCHEN.ORG at EXAMPLE.ORG, Preauthentication failed

debg log fom keycloak:

2017-08-08 21:24:17,473 INFO  [stdout] (default task-1) Debug is  true storeKey true useTicketCache false useKeyTab false doNotPrompt false ticketCache is null isInitiator true KeyTab is null refreshKrb5Config is false principal is null tryFirstPass is false useFirstPass is false storePass is false clearPass is false
2017-08-08 21:24:17,473 INFO  [stdout] (default task-1)                 [Krb5LoginModule] user entered username: jochen at EXAMPLE.ORG
2017-08-08 21:24:17,473 INFO  [stdout] (default task-1) 
2017-08-08 21:24:17,605 INFO  [stdout] (default task-1)                 [Krb5LoginModule] authentication failed 
2017-08-08 21:24:17,605 INFO  [stdout] (default task-1) Pre-authentication information was invalid (24) - PREAUTH_FAILED
2017-08-08 21:24:17,606 WARN  [org.keycloak.events] (default task-1) type=LOGIN_ERROR, realmId=jochen.org, clientId=account, userId=3ebc8518-a488-4dce-bd94-4a72c03a5ed9, ipAddress=192.168.yy.xx, error=invalid_user_credentials, auth_method=openid-connect, auth_type=code, redirect_uri=https://saml.jochen.org/auth/realms/jochen.org/account/login-redirect, code_id=eefbcc3e-f581-465c-bc28-7e37fc939ae6, username=jochen at example.org

That look's like there is no FAST implemented, but that or Anonymous PKINIT
seems to be needed for OTP authentication through Kerberos:

https://www.freeipa.org/page/V4/OTP
https://www.freeipa.org/page/V4/Kerberos_PKINIT

On my systems the OTP-user can't kinit directly, but needs to "kinit -n"
first:

$ kinit otpuser
kinit: Pre-authentication failed: invalid argument while getting initial credentials
$ kinit -n
$ klist
Ticket cache: KEYRING:persistent:1004:1004
Default principal: WELLKNOWN/ANONYMOUS at WELLKNOWN:ANONYMOUS

Valid starting       Expires              Service principal
04.11.2017 18:31:20  05.11.2017 18:31:20  krbtgt/EXAMPLE.ORG at EXAMPLE.ORG

$ kinit -T KEYRING:persistent:1004:1004 otpuser
Enter OTP Token Value: 
$ klist
Ticket cache: KEYRING:persistent:1004:krb_ccache_ZKhNrfE
Default principal: otpuser at EXAMPLE.ORG

Valid starting       Expires              Service principal
04.11.2017 18:31:48  05.11.2017 18:31:37  krbtgt/EXAMPLE.ORG at EXAMPLE.ORG

After some research I think that JDK doesn't implement FAST for now and
the tickets/messages I found looked like it will be some time until that
might be implemented (if ever).

Would it be possible to implement that in keycloak?
https://blog-ftweedal.rhcloud.com/2014/07/otp-authentication-in-freeipa/
has some python code that is implementing that for FreeIPA.
I've looked at
https://github.com/keycloak/keycloak/blob/master/federation/kerberos/src/main/java/org/keycloak/federation/kerberos/impl/KerberosUsernamePasswordAuthenticator.java#L120
but don't see how that might be implemented there...

I've already tried to add two providers to my user federation, LDAP and sssd.
sssd can authentication my otpuser with password+OTP fine. But I couldn't
get authentication with Kerberos ticket to work when I have both providers
active. Is that something that should work? 

Any ideas?

Thanks,
Jochen
[1] password allows authentication to LDAP (no OTP). RADIUS or OTP
authentications against Kerberos, which handles OTP and RADIUS
and needs password+OTP.




-- 
This space is intentionally left blank.


From sthorger at redhat.com  Wed Jan 17 02:19:02 2018
From: sthorger at redhat.com (Stian Thorgersen)
Date: Wed, 17 Jan 2018 08:19:02 +0100
Subject: [keycloak-user] Different theme for each client
In-Reply-To: <711ff92f-c66c-6aab-abba-068f6cdfe9f8@redhat.com>
References: <trinity-08954434-d99a-48a0-8de6-7e83da7f493a-1516018211633@3c-app-webde-bap55>
	<0c00b809-1e5f-75eb-40b2-08d36587cda1@redhat.com>
	<53c1f766-587e-2822-5002-f9d81085e72e@redhat.com>
	<CABRXCmyGoUvkcV6gRAaAmkey_26+yHqV-ECGV_q1Ui_e-+8_nw@mail.gmail.com>
	<2545189b-77cd-581e-d0e8-0d72f5964bcf@redhat.com>
	<CAJgngAdCZAsbcvLOPC6=UpWX_RM-r6=YUsdTr_MLKP1=WPETcA@mail.gmail.com>
	<711ff92f-c66c-6aab-abba-068f6cdfe9f8@redhat.com>
Message-ID: <CAJgngAdKekskGvrM8ZBkNhYx3AYQtG5WrdLO8dm0hbTurUbyjg@mail.gmail.com>

I've started work on this as I needed a simple dev task to wake up ;)

https://issues.jboss.org/browse/KEYCLOAK-3370

On 16 January 2018 at 17:06, Josh Cain <jcain at redhat.com> wrote:

> +1 for that solution, would make some of what we're looking to do in the
> near future *way* cleaner!
>
> Josh Cain
> Senior Software Applications Engineer, RHCE
> Red Hat North America
> jcain at redhat.com IRC: jcain
>
> On 01/16/2018 08:54 AM, Stian Thorgersen wrote:
> > It makes sense to add two options:
> >
> > 1. Expose client attributes to theme. That would allow setting an
> attribute
> > on a specific client or a client template to then have some conditions to
> > provide variants within a theme.
> > 2. Allow overriding theme in client and client template. No need to add
> > something additional to themes as they can already be extended. We simply
> > need to allow users to specify a different theme. In this case we may
> also
> > want to add a ThemeSelectorSPI that would allow some custom logic to
> select
> > the theme (could be based on headers for instance in the case of a mobile
> > theme).
> >
> > On 16 January 2018 at 14:09, Marek Posolda <mposolda at redhat.com> wrote:
> >
> >> We can probably do some builtin support for clients into the themes
> >> itself. Doing it properly may take few days. Depends if we want to
> >> support that. AFAIR Stian didn't like that, but to me it makes sense
> >> that some people want different look&feel based on client.
> >>
> >> For example template file can be lookup from the directory with the
> >> clientId (EG. theme/my-theme/login/customer-portal/login.ftl ). If it
> >> doesn't exists, then fallback to the current location without "clientId"
> >> directory. Maybe something similar would be needed for the CSS files and
> >> other resources.
> >>
> >> But for some very basic cases, people can probably already handle it by
> >> add some "if" into the freemarker template itself and use different CSS
> >> styles based on the client or something like this.
> >>
> >> Marek
> >>
> >>
> >> On 16/01/18 00:09, Bill Burke wrote:
> >>> I wonder how hard it would be to implement?
> >>>
> >>> On Mon, Jan 15, 2018 at 3:22 PM, Marek Posolda <mposolda at redhat.com>
> >> wrote:
> >>>> I think that Freemarker theme (at least login theme) has access to
> >>>> ClientBean through the "client" expression . So it's likely already
> >>>> possible to do some hacking in the template itself and provide
> different
> >>>> CSS according to the client used. Not very nice, but likely should be
> >>>> somehow possible.
> >>>>
> >>>> Marek
> >>>>
> >>>> On 15/01/18 18:26, Josh Cain wrote:
> >>>>> Was originally discussed here:
> >>>>> http://lists.jboss.org/pipermail/keycloak-user/2016-
> >> January/004288.html
> >>>>>
> >>>>> And I asked the same question again here:
> >>>>> http://lists.jboss.org/pipermail/keycloak-user/2016-July/007052.html
> >>>>>
> >>>>> But feel free to keep bumping.  It's a feature I'd like to see anyway
> >> ;-)
> >>>>>
> >>>>> Josh Cain
> >>>>> Senior Software Applications Engineer, RHCE
> >>>>> Red Hat North America
> >>>>> jcain at redhat.com IRC: jcain
> >>>>>
> >>>>> On 01/15/2018 06:10 AM, eric.kapitza at web.de wrote:
> >>>>>> _______________________________________________
> >>>>>> keycloak-user mailing list
> >>>>>> keycloak-user at lists.jboss.org
> >>>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
> >>>>>>
> >>>>>
> >>>>> _______________________________________________
> >>>>> keycloak-user mailing list
> >>>>> keycloak-user at lists.jboss.org
> >>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
> >>>>
> >>>> _______________________________________________
> >>>> keycloak-user mailing list
> >>>> keycloak-user at lists.jboss.org
> >>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
> >>>
> >>>
> >>
> >> _______________________________________________
> >> keycloak-user mailing list
> >> keycloak-user at lists.jboss.org
> >> https://lists.jboss.org/mailman/listinfo/keycloak-user
> >>
> > _______________________________________________
> > keycloak-user mailing list
> > keycloak-user at lists.jboss.org
> > https://lists.jboss.org/mailman/listinfo/keycloak-user
> >
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>

From mposolda at redhat.com  Wed Jan 17 02:54:46 2018
From: mposolda at redhat.com (Marek Posolda)
Date: Wed, 17 Jan 2018 08:54:46 +0100
Subject: [keycloak-user] Different theme for each client
In-Reply-To: <CAJgngAdKekskGvrM8ZBkNhYx3AYQtG5WrdLO8dm0hbTurUbyjg@mail.gmail.com>
References: <trinity-08954434-d99a-48a0-8de6-7e83da7f493a-1516018211633@3c-app-webde-bap55>
	<0c00b809-1e5f-75eb-40b2-08d36587cda1@redhat.com>
	<53c1f766-587e-2822-5002-f9d81085e72e@redhat.com>
	<CABRXCmyGoUvkcV6gRAaAmkey_26+yHqV-ECGV_q1Ui_e-+8_nw@mail.gmail.com>
	<2545189b-77cd-581e-d0e8-0d72f5964bcf@redhat.com>
	<CAJgngAdCZAsbcvLOPC6=UpWX_RM-r6=YUsdTr_MLKP1=WPETcA@mail.gmail.com>
	<711ff92f-c66c-6aab-abba-068f6cdfe9f8@redhat.com>
	<CAJgngAdKekskGvrM8ZBkNhYx3AYQtG5WrdLO8dm0hbTurUbyjg@mail.gmail.com>
Message-ID: <76c64dd5-669c-975e-d687-acdc6dd8604b@redhat.com>

+1 to handle on the client. Seems to be better than handle in the theme 
itself.

Marek

On 17/01/18 08:19, Stian Thorgersen wrote:
> I've started work on this as I needed a simple dev task to wake up ;)
>
> https://issues.jboss.org/browse/KEYCLOAK-3370
>
> On 16 January 2018 at 17:06, Josh Cain <jcain at redhat.com> wrote:
>
>> +1 for that solution, would make some of what we're looking to do in the
>> near future *way* cleaner!
>>
>> Josh Cain
>> Senior Software Applications Engineer, RHCE
>> Red Hat North America
>> jcain at redhat.com IRC: jcain
>>
>> On 01/16/2018 08:54 AM, Stian Thorgersen wrote:
>>> It makes sense to add two options:
>>>
>>> 1. Expose client attributes to theme. That would allow setting an
>> attribute
>>> on a specific client or a client template to then have some conditions to
>>> provide variants within a theme.
>>> 2. Allow overriding theme in client and client template. No need to add
>>> something additional to themes as they can already be extended. We simply
>>> need to allow users to specify a different theme. In this case we may
>> also
>>> want to add a ThemeSelectorSPI that would allow some custom logic to
>> select
>>> the theme (could be based on headers for instance in the case of a mobile
>>> theme).
>>>
>>> On 16 January 2018 at 14:09, Marek Posolda <mposolda at redhat.com> wrote:
>>>
>>>> We can probably do some builtin support for clients into the themes
>>>> itself. Doing it properly may take few days. Depends if we want to
>>>> support that. AFAIR Stian didn't like that, but to me it makes sense
>>>> that some people want different look&feel based on client.
>>>>
>>>> For example template file can be lookup from the directory with the
>>>> clientId (EG. theme/my-theme/login/customer-portal/login.ftl ). If it
>>>> doesn't exists, then fallback to the current location without "clientId"
>>>> directory. Maybe something similar would be needed for the CSS files and
>>>> other resources.
>>>>
>>>> But for some very basic cases, people can probably already handle it by
>>>> add some "if" into the freemarker template itself and use different CSS
>>>> styles based on the client or something like this.
>>>>
>>>> Marek
>>>>
>>>>
>>>> On 16/01/18 00:09, Bill Burke wrote:
>>>>> I wonder how hard it would be to implement?
>>>>>
>>>>> On Mon, Jan 15, 2018 at 3:22 PM, Marek Posolda <mposolda at redhat.com>
>>>> wrote:
>>>>>> I think that Freemarker theme (at least login theme) has access to
>>>>>> ClientBean through the "client" expression . So it's likely already
>>>>>> possible to do some hacking in the template itself and provide
>> different
>>>>>> CSS according to the client used. Not very nice, but likely should be
>>>>>> somehow possible.
>>>>>>
>>>>>> Marek
>>>>>>
>>>>>> On 15/01/18 18:26, Josh Cain wrote:
>>>>>>> Was originally discussed here:
>>>>>>> http://lists.jboss.org/pipermail/keycloak-user/2016-
>>>> January/004288.html
>>>>>>> And I asked the same question again here:
>>>>>>> http://lists.jboss.org/pipermail/keycloak-user/2016-July/007052.html
>>>>>>>
>>>>>>> But feel free to keep bumping.  It's a feature I'd like to see anyway
>>>> ;-)
>>>>>>> Josh Cain
>>>>>>> Senior Software Applications Engineer, RHCE
>>>>>>> Red Hat North America
>>>>>>> jcain at redhat.com IRC: jcain
>>>>>>>
>>>>>>> On 01/15/2018 06:10 AM, eric.kapitza at web.de wrote:
>>>>>>>> _______________________________________________
>>>>>>>> keycloak-user mailing list
>>>>>>>> keycloak-user at lists.jboss.org
>>>>>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>>>>>>
>>>>>>> _______________________________________________
>>>>>>> keycloak-user mailing list
>>>>>>> keycloak-user at lists.jboss.org
>>>>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>>>> _______________________________________________
>>>>>> keycloak-user mailing list
>>>>>> keycloak-user at lists.jboss.org
>>>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>>>
>>>> _______________________________________________
>>>> keycloak-user mailing list
>>>> keycloak-user at lists.jboss.org
>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>>
>>> _______________________________________________
>>> keycloak-user mailing list
>>> keycloak-user at lists.jboss.org
>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>
>>
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user



From sthorger at redhat.com  Wed Jan 17 03:03:29 2018
From: sthorger at redhat.com (Stian Thorgersen)
Date: Wed, 17 Jan 2018 09:03:29 +0100
Subject: [keycloak-user] Different theme for each client
In-Reply-To: <76c64dd5-669c-975e-d687-acdc6dd8604b@redhat.com>
References: <trinity-08954434-d99a-48a0-8de6-7e83da7f493a-1516018211633@3c-app-webde-bap55>
	<0c00b809-1e5f-75eb-40b2-08d36587cda1@redhat.com>
	<53c1f766-587e-2822-5002-f9d81085e72e@redhat.com>
	<CABRXCmyGoUvkcV6gRAaAmkey_26+yHqV-ECGV_q1Ui_e-+8_nw@mail.gmail.com>
	<2545189b-77cd-581e-d0e8-0d72f5964bcf@redhat.com>
	<CAJgngAdCZAsbcvLOPC6=UpWX_RM-r6=YUsdTr_MLKP1=WPETcA@mail.gmail.com>
	<711ff92f-c66c-6aab-abba-068f6cdfe9f8@redhat.com>
	<CAJgngAdKekskGvrM8ZBkNhYx3AYQtG5WrdLO8dm0hbTurUbyjg@mail.gmail.com>
	<76c64dd5-669c-975e-d687-acdc6dd8604b@redhat.com>
Message-ID: <CAJgngAcf-OLE+kKM7nHLq-sfUrgv2WgdN5BvyCx6vc030wafzw@mail.gmail.com>

Added a public ThemeSelectorSPI [1] that allows adding custom logic for
selecting what theme to use. The default implementation is very simple at
the moment [2]. It simply looks for the realm setting and fallbacks to the
default if not set.

Changing the selector is a global thing and there is no mechanism to
configure a separate selector for a realm. That's something we could
consider adding later if needed.

The question is should we provide the ability to set the theme per-client
or is that actually quite cumbersome to use? There could be hundreds of
clients.

[1] https://github.com/stianst/keycloak/tree/KEYCLOAK-6289
[2]
https://github.com/stianst/keycloak/blob/KEYCLOAK-6289/services/src/main/java/org/keycloak/theme/DefaultThemeSelectorProvider.java#L17

On 17 January 2018 at 08:54, Marek Posolda <mposolda at redhat.com> wrote:

> +1 to handle on the client. Seems to be better than handle in the theme
> itself.
>
> Marek
>
>
> On 17/01/18 08:19, Stian Thorgersen wrote:
>
>> I've started work on this as I needed a simple dev task to wake up ;)
>>
>> https://issues.jboss.org/browse/KEYCLOAK-3370
>>
>> On 16 January 2018 at 17:06, Josh Cain <jcain at redhat.com> wrote:
>>
>> +1 for that solution, would make some of what we're looking to do in the
>>> near future *way* cleaner!
>>>
>>> Josh Cain
>>> Senior Software Applications Engineer, RHCE
>>> Red Hat North America
>>> jcain at redhat.com IRC: jcain
>>>
>>> On 01/16/2018 08:54 AM, Stian Thorgersen wrote:
>>>
>>>> It makes sense to add two options:
>>>>
>>>> 1. Expose client attributes to theme. That would allow setting an
>>>>
>>> attribute
>>>
>>>> on a specific client or a client template to then have some conditions
>>>> to
>>>> provide variants within a theme.
>>>> 2. Allow overriding theme in client and client template. No need to add
>>>> something additional to themes as they can already be extended. We
>>>> simply
>>>> need to allow users to specify a different theme. In this case we may
>>>>
>>> also
>>>
>>>> want to add a ThemeSelectorSPI that would allow some custom logic to
>>>>
>>> select
>>>
>>>> the theme (could be based on headers for instance in the case of a
>>>> mobile
>>>> theme).
>>>>
>>>> On 16 January 2018 at 14:09, Marek Posolda <mposolda at redhat.com> wrote:
>>>>
>>>> We can probably do some builtin support for clients into the themes
>>>>> itself. Doing it properly may take few days. Depends if we want to
>>>>> support that. AFAIR Stian didn't like that, but to me it makes sense
>>>>> that some people want different look&feel based on client.
>>>>>
>>>>> For example template file can be lookup from the directory with the
>>>>> clientId (EG. theme/my-theme/login/customer-portal/login.ftl ). If it
>>>>> doesn't exists, then fallback to the current location without
>>>>> "clientId"
>>>>> directory. Maybe something similar would be needed for the CSS files
>>>>> and
>>>>> other resources.
>>>>>
>>>>> But for some very basic cases, people can probably already handle it by
>>>>> add some "if" into the freemarker template itself and use different CSS
>>>>> styles based on the client or something like this.
>>>>>
>>>>> Marek
>>>>>
>>>>>
>>>>> On 16/01/18 00:09, Bill Burke wrote:
>>>>>
>>>>>> I wonder how hard it would be to implement?
>>>>>>
>>>>>> On Mon, Jan 15, 2018 at 3:22 PM, Marek Posolda <mposolda at redhat.com>
>>>>>>
>>>>> wrote:
>>>>>
>>>>>> I think that Freemarker theme (at least login theme) has access to
>>>>>>> ClientBean through the "client" expression . So it's likely already
>>>>>>> possible to do some hacking in the template itself and provide
>>>>>>>
>>>>>> different
>>>
>>>> CSS according to the client used. Not very nice, but likely should be
>>>>>>> somehow possible.
>>>>>>>
>>>>>>> Marek
>>>>>>>
>>>>>>> On 15/01/18 18:26, Josh Cain wrote:
>>>>>>>
>>>>>>>> Was originally discussed here:
>>>>>>>> http://lists.jboss.org/pipermail/keycloak-user/2016-
>>>>>>>>
>>>>>>> January/004288.html
>>>>>
>>>>>> And I asked the same question again here:
>>>>>>>> http://lists.jboss.org/pipermail/keycloak-user/2016-July/
>>>>>>>> 007052.html
>>>>>>>>
>>>>>>>> But feel free to keep bumping.  It's a feature I'd like to see
>>>>>>>> anyway
>>>>>>>>
>>>>>>> ;-)
>>>>>
>>>>>> Josh Cain
>>>>>>>> Senior Software Applications Engineer, RHCE
>>>>>>>> Red Hat North America
>>>>>>>> jcain at redhat.com IRC: jcain
>>>>>>>>
>>>>>>>> On 01/15/2018 06:10 AM, eric.kapitza at web.de wrote:
>>>>>>>>
>>>>>>>>> _______________________________________________
>>>>>>>>> keycloak-user mailing list
>>>>>>>>> keycloak-user at lists.jboss.org
>>>>>>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>>>>>>>
>>>>>>>>> _______________________________________________
>>>>>>>> keycloak-user mailing list
>>>>>>>> keycloak-user at lists.jboss.org
>>>>>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>>>>>>
>>>>>>> _______________________________________________
>>>>>>> keycloak-user mailing list
>>>>>>> keycloak-user at lists.jboss.org
>>>>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>>>>>
>>>>>>
>>>>>> _______________________________________________
>>>>> keycloak-user mailing list
>>>>> keycloak-user at lists.jboss.org
>>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>>>
>>>>> _______________________________________________
>>>> keycloak-user mailing list
>>>> keycloak-user at lists.jboss.org
>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>>
>>>>
>>> _______________________________________________
>>> keycloak-user mailing list
>>> keycloak-user at lists.jboss.org
>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>
>>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>
>
>
>

From mposolda at redhat.com  Wed Jan 17 03:27:05 2018
From: mposolda at redhat.com (Marek Posolda)
Date: Wed, 17 Jan 2018 09:27:05 +0100
Subject: [keycloak-user] Authentication fails for OTP user with kerberos
In-Reply-To: <8360813w02.fsf@jochen.org>
References: <8360813w02.fsf@jochen.org>
Message-ID: <9d73f599-c9da-203f-af77-b4711657567f@redhat.com>

The integration with FreeIPA is suppose to use SSSD userStorage 
provider. Have few questions to clarify:

1. If you have SSSD provider and your user doesn't have kerberos ticket, 
is Keycloak authentication work for both password-only and password+otp 
users?

2. If you have SSSD provider and your user has kerberos ticket, are you 
able to authenticate with Kerberos+SPNEGO?

Thanks,
Marek

On 17/01/18 06:16, Jochen Hein wrote:
> I'm running FreeIPA and have users with and without OTP.  OTP users
> authenticate with RADIUS (Privacyidea manages the tokens). My final goal
> is that users with a kerberos ticket can authenticate without password
> and users without ticket get asked for password+OTP (when configured).
>
> In FreeIPA a user is defined with password and radius authentication:
>
> $ ipa user-show jochen
>    User login: jochen
> ...
>    Kerberos principal: jochen at EXAMPLE.ORG
> ...
>    User authentication types: password, radius
>
> According to the FreeIPA docs LDAP bind works with password only, but
> kerberos needs password+OTP. That works fine with sssd and other
> applications.
>
> I'm now running keycloak 3.4.2 and played with it.  I've added a User
> Federation with LDAP to my FreeIPA server and enabled "Allow Kerberos
> Authentication".  After that I can log in with my Kerberos ticket
> without further authentication.  If I don't have a Kerberos ticket
> keycloak asks me for username and password - authentication works with
> LDAP bind as long as "Use Kerberos For Password Authentication" is
> disabled.
>
> For a regular (non-OTP) user I can authenticate with a Kerberos ticket.
> If the user does not have a Kerberos ticket, he is asked for username
> and password as expected, and authentication is successful.
>
> Another user with OTP-authentication in FreeIPA can also authenticate
> with his Kerberos ticket.
>
> If the OTP-user does not have a Kerberos ticket, keycloak asks for
> username and password (as expected).  If the user federation has "Use
> Kerberos for Password Authentication" not selected, the user in
> FreeIPA needs to have password+OTP (or password+RADIUS) allowed and
> can authenticate against FreeIPA-LDAP with password only - that's not
> what I want[1].
>
> When I enable "Use Kerberos For Password Authentication" non-OTP users
> can still authenticate, but OTP users can't. According to
> https://www.freeipa.org/page/V4/OTP#How_to_Test
> "Kerberos FAST is required for OTP operations." - and that's true.
>
> If I just use kinit I get "Generic preauthentication failure while
> getting initial credentials".  The kerberos log has:
>
> Aug 08 21:24:17 freeipa1.jochen.org krb5kdc[4442](info): AS_REQ (4 etypes {18 17 16 23}) x.x.x.x: NEEDED_PREAUTH: jochen at EXAMPLE.ORG for krbtgt/JOCHEN.ORG at EXAMPLE.ORG, Additional pre-authentication required
> Aug 08 21:24:17 freeipa1.jochen.org krb5kdc[4442](info): preauth (encrypted_timestamp) verify failure: No matching key in entry
> Aug 08 21:24:17 freeipa1.jochen.org krb5kdc[4442](info): AS_REQ (4 etypes {18 17 16 23}) x.x.x.127: PREAUTH_FAILED: jochen at EXAMPLE.ORG for krbtgt/JOCHEN.ORG at EXAMPLE.ORG, Preauthentication failed
>
> debg log fom keycloak:
>
> 2017-08-08 21:24:17,473 INFO  [stdout] (default task-1) Debug is  true storeKey true useTicketCache false useKeyTab false doNotPrompt false ticketCache is null isInitiator true KeyTab is null refreshKrb5Config is false principal is null tryFirstPass is false useFirstPass is false storePass is false clearPass is false
> 2017-08-08 21:24:17,473 INFO  [stdout] (default task-1)                 [Krb5LoginModule] user entered username: jochen at EXAMPLE.ORG
> 2017-08-08 21:24:17,473 INFO  [stdout] (default task-1)
> 2017-08-08 21:24:17,605 INFO  [stdout] (default task-1)                 [Krb5LoginModule] authentication failed
> 2017-08-08 21:24:17,605 INFO  [stdout] (default task-1) Pre-authentication information was invalid (24) - PREAUTH_FAILED
> 2017-08-08 21:24:17,606 WARN  [org.keycloak.events] (default task-1) type=LOGIN_ERROR, realmId=jochen.org, clientId=account, userId=3ebc8518-a488-4dce-bd94-4a72c03a5ed9, ipAddress=192.168.yy.xx, error=invalid_user_credentials, auth_method=openid-connect, auth_type=code, redirect_uri=https://saml.jochen.org/auth/realms/jochen.org/account/login-redirect, code_id=eefbcc3e-f581-465c-bc28-7e37fc939ae6, username=jochen at example.org
>
> That look's like there is no FAST implemented, but that or Anonymous PKINIT
> seems to be needed for OTP authentication through Kerberos:
>
> https://www.freeipa.org/page/V4/OTP
> https://www.freeipa.org/page/V4/Kerberos_PKINIT
>
> On my systems the OTP-user can't kinit directly, but needs to "kinit -n"
> first:
>
> $ kinit otpuser
> kinit: Pre-authentication failed: invalid argument while getting initial credentials
> $ kinit -n
> $ klist
> Ticket cache: KEYRING:persistent:1004:1004
> Default principal: WELLKNOWN/ANONYMOUS at WELLKNOWN:ANONYMOUS
>
> Valid starting       Expires              Service principal
> 04.11.2017 18:31:20  05.11.2017 18:31:20  krbtgt/EXAMPLE.ORG at EXAMPLE.ORG
>
> $ kinit -T KEYRING:persistent:1004:1004 otpuser
> Enter OTP Token Value:
> $ klist
> Ticket cache: KEYRING:persistent:1004:krb_ccache_ZKhNrfE
> Default principal: otpuser at EXAMPLE.ORG
>
> Valid starting       Expires              Service principal
> 04.11.2017 18:31:48  05.11.2017 18:31:37  krbtgt/EXAMPLE.ORG at EXAMPLE.ORG
>
> After some research I think that JDK doesn't implement FAST for now and
> the tickets/messages I found looked like it will be some time until that
> might be implemented (if ever).
>
> Would it be possible to implement that in keycloak?
> https://blog-ftweedal.rhcloud.com/2014/07/otp-authentication-in-freeipa/
> has some python code that is implementing that for FreeIPA.
> I've looked at
> https://github.com/keycloak/keycloak/blob/master/federation/kerberos/src/main/java/org/keycloak/federation/kerberos/impl/KerberosUsernamePasswordAuthenticator.java#L120
> but don't see how that might be implemented there...
>
> I've already tried to add two providers to my user federation, LDAP and sssd.
> sssd can authentication my otpuser with password+OTP fine. But I couldn't
> get authentication with Kerberos ticket to work when I have both providers
> active. Is that something that should work?
>
> Any ideas?
>
> Thanks,
> Jochen
> [1] password allows authentication to LDAP (no OTP). RADIUS or OTP
> authentications against Kerberos, which handles OTP and RADIUS
> and needs password+OTP.
>
>
>
>


From mposolda at redhat.com  Wed Jan 17 03:35:09 2018
From: mposolda at redhat.com (Marek Posolda)
Date: Wed, 17 Jan 2018 09:35:09 +0100
Subject: [keycloak-user] Different theme for each client
In-Reply-To: <CAJgngAcf-OLE+kKM7nHLq-sfUrgv2WgdN5BvyCx6vc030wafzw@mail.gmail.com>
References: <trinity-08954434-d99a-48a0-8de6-7e83da7f493a-1516018211633@3c-app-webde-bap55>
	<0c00b809-1e5f-75eb-40b2-08d36587cda1@redhat.com>
	<53c1f766-587e-2822-5002-f9d81085e72e@redhat.com>
	<CABRXCmyGoUvkcV6gRAaAmkey_26+yHqV-ECGV_q1Ui_e-+8_nw@mail.gmail.com>
	<2545189b-77cd-581e-d0e8-0d72f5964bcf@redhat.com>
	<CAJgngAdCZAsbcvLOPC6=UpWX_RM-r6=YUsdTr_MLKP1=WPETcA@mail.gmail.com>
	<711ff92f-c66c-6aab-abba-068f6cdfe9f8@redhat.com>
	<CAJgngAdKekskGvrM8ZBkNhYx3AYQtG5WrdLO8dm0hbTurUbyjg@mail.gmail.com>
	<76c64dd5-669c-975e-d687-acdc6dd8604b@redhat.com>
	<CAJgngAcf-OLE+kKM7nHLq-sfUrgv2WgdN5BvyCx6vc030wafzw@mail.gmail.com>
Message-ID: <c1395fa3-73b9-c7b5-3189-72d5caceb090@redhat.com>

On 17/01/18 09:03, Stian Thorgersen wrote:
> Added a public ThemeSelectorSPI [1] that allows adding custom logic 
> for selecting what theme to use. The default implementation is very 
> simple at the moment [2]. It simply looks for the realm setting and 
> fallbacks to the default if not set.
>
> Changing the selector is a global thing and there is no mechanism to 
> configure a separate selector for a realm. That's something we could 
> consider adding later if needed.
>
> The question is should we provide the ability to set the theme 
> per-client or is that actually quite cumbersome to use? There could be 
> hundreds of clients.
I think that yes. It can be cumbersome, but this applies for many 
client-specific settings. For example you may have some custom 
protocolMapper, which you want to use for more clients and then you also 
need to edit protocolMappers in all clients to add this custom 
protocolMapper.

We can also support theme per clientTemplate, so if client doesn't have 
theme set, it can try the theme from clientTemplate and fallback to 
realm and finally to default if nothing is set.

Marek
>
> [1] https://github.com/stianst/keycloak/tree/KEYCLOAK-6289
> [2] 
> https://github.com/stianst/keycloak/blob/KEYCLOAK-6289/services/src/main/java/org/keycloak/theme/DefaultThemeSelectorProvider.java#L17
>
> On 17 January 2018 at 08:54, Marek Posolda <mposolda at redhat.com 
> <mailto:mposolda at redhat.com>> wrote:
>
>     +1 to handle on the client. Seems to be better than handle in the
>     theme itself.
>
>     Marek
>
>
>     On 17/01/18 08:19, Stian Thorgersen wrote:
>
>         I've started work on this as I needed a simple dev task to
>         wake up ;)
>
>         https://issues.jboss.org/browse/KEYCLOAK-3370
>         <https://issues.jboss.org/browse/KEYCLOAK-3370>
>
>         On 16 January 2018 at 17:06, Josh Cain <jcain at redhat.com
>         <mailto:jcain at redhat.com>> wrote:
>
>             +1 for that solution, would make some of what we're
>             looking to do in the
>             near future *way* cleaner!
>
>             Josh Cain
>             Senior Software Applications Engineer, RHCE
>             Red Hat North America
>             jcain at redhat.com <mailto:jcain at redhat.com> IRC: jcain
>
>             On 01/16/2018 08:54 AM, Stian Thorgersen wrote:
>
>                 It makes sense to add two options:
>
>                 1. Expose client attributes to theme. That would allow
>                 setting an
>
>             attribute
>
>                 on a specific client or a client template to then have
>                 some conditions to
>                 provide variants within a theme.
>                 2. Allow overriding theme in client and client
>                 template. No need to add
>                 something additional to themes as they can already be
>                 extended. We simply
>                 need to allow users to specify a different theme. In
>                 this case we may
>
>             also
>
>                 want to add a ThemeSelectorSPI that would allow some
>                 custom logic to
>
>             select
>
>                 the theme (could be based on headers for instance in
>                 the case of a mobile
>                 theme).
>
>                 On 16 January 2018 at 14:09, Marek Posolda
>                 <mposolda at redhat.com <mailto:mposolda at redhat.com>> wrote:
>
>                     We can probably do some builtin support for
>                     clients into the themes
>                     itself. Doing it properly may take few days.
>                     Depends if we want to
>                     support that. AFAIR Stian didn't like that, but to
>                     me it makes sense
>                     that some people want different look&feel based on
>                     client.
>
>                     For example template file can be lookup from the
>                     directory with the
>                     clientId (EG.
>                     theme/my-theme/login/customer-portal/login.ftl ).
>                     If it
>                     doesn't exists, then fallback to the current
>                     location without "clientId"
>                     directory. Maybe something similar would be needed
>                     for the CSS files and
>                     other resources.
>
>                     But for some very basic cases, people can probably
>                     already handle it by
>                     add some "if" into the freemarker template itself
>                     and use different CSS
>                     styles based on the client or something like this.
>
>                     Marek
>
>
>                     On 16/01/18 00:09, Bill Burke wrote:
>
>                         I wonder how hard it would be to implement?
>
>                         On Mon, Jan 15, 2018 at 3:22 PM, Marek Posolda
>                         <mposolda at redhat.com <mailto:mposolda at redhat.com>>
>
>                     wrote:
>
>                             I think that Freemarker theme (at least
>                             login theme) has access to
>                             ClientBean through the "client" expression
>                             . So it's likely already
>                             possible to do some hacking in the
>                             template itself and provide
>
>             different
>
>                             CSS according to the client used. Not very
>                             nice, but likely should be
>                             somehow possible.
>
>                             Marek
>
>                             On 15/01/18 18:26, Josh Cain wrote:
>
>                                 Was originally discussed here:
>                                 http://lists.jboss.org/pipermail/keycloak-user/2016-
>                                 <http://lists.jboss.org/pipermail/keycloak-user/2016->
>
>                     January/004288.html
>
>                                 And I asked the same question again here:
>                                 http://lists.jboss.org/pipermail/keycloak-user/2016-July/007052.html
>                                 <http://lists.jboss.org/pipermail/keycloak-user/2016-July/007052.html>
>
>                                 But feel free to keep bumping.  It's a
>                                 feature I'd like to see anyway
>
>                     ;-)
>
>                                 Josh Cain
>                                 Senior Software Applications Engineer,
>                                 RHCE
>                                 Red Hat North America
>                                 jcain at redhat.com
>                                 <mailto:jcain at redhat.com> IRC: jcain
>
>                                 On 01/15/2018 06:10 AM,
>                                 eric.kapitza at web.de
>                                 <mailto:eric.kapitza at web.de> wrote:
>
>                                     _______________________________________________
>                                     keycloak-user mailing list
>                                     keycloak-user at lists.jboss.org
>                                     <mailto:keycloak-user at lists.jboss.org>
>                                     https://lists.jboss.org/mailman/listinfo/keycloak-user
>                                     <https://lists.jboss.org/mailman/listinfo/keycloak-user>
>
>                                 _______________________________________________
>                                 keycloak-user mailing list
>                                 keycloak-user at lists.jboss.org
>                                 <mailto:keycloak-user at lists.jboss.org>
>                                 https://lists.jboss.org/mailman/listinfo/keycloak-user
>                                 <https://lists.jboss.org/mailman/listinfo/keycloak-user>
>
>                             _______________________________________________
>                             keycloak-user mailing list
>                             keycloak-user at lists.jboss.org
>                             <mailto:keycloak-user at lists.jboss.org>
>                             https://lists.jboss.org/mailman/listinfo/keycloak-user
>                             <https://lists.jboss.org/mailman/listinfo/keycloak-user>
>
>
>                     _______________________________________________
>                     keycloak-user mailing list
>                     keycloak-user at lists.jboss.org
>                     <mailto:keycloak-user at lists.jboss.org>
>                     https://lists.jboss.org/mailman/listinfo/keycloak-user
>                     <https://lists.jboss.org/mailman/listinfo/keycloak-user>
>
>                 _______________________________________________
>                 keycloak-user mailing list
>                 keycloak-user at lists.jboss.org
>                 <mailto:keycloak-user at lists.jboss.org>
>                 https://lists.jboss.org/mailman/listinfo/keycloak-user
>                 <https://lists.jboss.org/mailman/listinfo/keycloak-user>
>
>
>             _______________________________________________
>             keycloak-user mailing list
>             keycloak-user at lists.jboss.org
>             <mailto:keycloak-user at lists.jboss.org>
>             https://lists.jboss.org/mailman/listinfo/keycloak-user
>             <https://lists.jboss.org/mailman/listinfo/keycloak-user>
>
>         _______________________________________________
>         keycloak-user mailing list
>         keycloak-user at lists.jboss.org
>         <mailto:keycloak-user at lists.jboss.org>
>         https://lists.jboss.org/mailman/listinfo/keycloak-user
>         <https://lists.jboss.org/mailman/listinfo/keycloak-user>
>
>
>
>


From sthorger at redhat.com  Wed Jan 17 03:38:58 2018
From: sthorger at redhat.com (Stian Thorgersen)
Date: Wed, 17 Jan 2018 09:38:58 +0100
Subject: [keycloak-user] Different theme for each client
In-Reply-To: <c1395fa3-73b9-c7b5-3189-72d5caceb090@redhat.com>
References: <trinity-08954434-d99a-48a0-8de6-7e83da7f493a-1516018211633@3c-app-webde-bap55>
	<0c00b809-1e5f-75eb-40b2-08d36587cda1@redhat.com>
	<53c1f766-587e-2822-5002-f9d81085e72e@redhat.com>
	<CABRXCmyGoUvkcV6gRAaAmkey_26+yHqV-ECGV_q1Ui_e-+8_nw@mail.gmail.com>
	<2545189b-77cd-581e-d0e8-0d72f5964bcf@redhat.com>
	<CAJgngAdCZAsbcvLOPC6=UpWX_RM-r6=YUsdTr_MLKP1=WPETcA@mail.gmail.com>
	<711ff92f-c66c-6aab-abba-068f6cdfe9f8@redhat.com>
	<CAJgngAdKekskGvrM8ZBkNhYx3AYQtG5WrdLO8dm0hbTurUbyjg@mail.gmail.com>
	<76c64dd5-669c-975e-d687-acdc6dd8604b@redhat.com>
	<CAJgngAcf-OLE+kKM7nHLq-sfUrgv2WgdN5BvyCx6vc030wafzw@mail.gmail.com>
	<c1395fa3-73b9-c7b5-3189-72d5caceb090@redhat.com>
Message-ID: <CAJgngAfx8scUOvjAR6dUg7JjE899uESADmtb7B5SgL9Ujwcasw@mail.gmail.com>

On 17 January 2018 at 09:35, Marek Posolda <mposolda at redhat.com> wrote:

> On 17/01/18 09:03, Stian Thorgersen wrote:
>
> Added a public ThemeSelectorSPI [1] that allows adding custom logic for
> selecting what theme to use. The default implementation is very simple at
> the moment [2]. It simply looks for the realm setting and fallbacks to the
> default if not set.
>
> Changing the selector is a global thing and there is no mechanism to
> configure a separate selector for a realm. That's something we could
> consider adding later if needed.
>
> The question is should we provide the ability to set the theme per-client
> or is that actually quite cumbersome to use? There could be hundreds of
> clients.
>
> I think that yes. It can be cumbersome, but this applies for many
> client-specific settings. For example you may have some custom
> protocolMapper, which you want to use for more clients and then you also
> need to edit protocolMappers in all clients to add this custom
> protocolMapper.
>
> We can also support theme per clientTemplate, so if client doesn't have
> theme set, it can try the theme from clientTemplate and fallback to realm
> and finally to default if nothing is set.
>

OK. I guess implementation should be pretty straightforward as both clients
and client templates have attributes.


>
>
> Marek
>
>
> [1] https://github.com/stianst/keycloak/tree/KEYCLOAK-6289
> [2] https://github.com/stianst/keycloak/blob/KEYCLOAK-6289/services/src/
> main/java/org/keycloak/theme/DefaultThemeSelectorProvider.java#L17
>
> On 17 January 2018 at 08:54, Marek Posolda <mposolda at redhat.com> wrote:
>
>> +1 to handle on the client. Seems to be better than handle in the theme
>> itself.
>>
>> Marek
>>
>>
>> On 17/01/18 08:19, Stian Thorgersen wrote:
>>
>>> I've started work on this as I needed a simple dev task to wake up ;)
>>>
>>> https://issues.jboss.org/browse/KEYCLOAK-3370
>>>
>>> On 16 January 2018 at 17:06, Josh Cain <jcain at redhat.com> wrote:
>>>
>>> +1 for that solution, would make some of what we're looking to do in the
>>>> near future *way* cleaner!
>>>>
>>>> Josh Cain
>>>> Senior Software Applications Engineer, RHCE
>>>> Red Hat North America
>>>> jcain at redhat.com IRC: jcain
>>>>
>>>> On 01/16/2018 08:54 AM, Stian Thorgersen wrote:
>>>>
>>>>> It makes sense to add two options:
>>>>>
>>>>> 1. Expose client attributes to theme. That would allow setting an
>>>>>
>>>> attribute
>>>>
>>>>> on a specific client or a client template to then have some conditions
>>>>> to
>>>>> provide variants within a theme.
>>>>> 2. Allow overriding theme in client and client template. No need to add
>>>>> something additional to themes as they can already be extended. We
>>>>> simply
>>>>> need to allow users to specify a different theme. In this case we may
>>>>>
>>>> also
>>>>
>>>>> want to add a ThemeSelectorSPI that would allow some custom logic to
>>>>>
>>>> select
>>>>
>>>>> the theme (could be based on headers for instance in the case of a
>>>>> mobile
>>>>> theme).
>>>>>
>>>>> On 16 January 2018 at 14:09, Marek Posolda <mposolda at redhat.com>
>>>>> wrote:
>>>>>
>>>>> We can probably do some builtin support for clients into the themes
>>>>>> itself. Doing it properly may take few days. Depends if we want to
>>>>>> support that. AFAIR Stian didn't like that, but to me it makes sense
>>>>>> that some people want different look&feel based on client.
>>>>>>
>>>>>> For example template file can be lookup from the directory with the
>>>>>> clientId (EG. theme/my-theme/login/customer-portal/login.ftl ). If it
>>>>>> doesn't exists, then fallback to the current location without
>>>>>> "clientId"
>>>>>> directory. Maybe something similar would be needed for the CSS files
>>>>>> and
>>>>>> other resources.
>>>>>>
>>>>>> But for some very basic cases, people can probably already handle it
>>>>>> by
>>>>>> add some "if" into the freemarker template itself and use different
>>>>>> CSS
>>>>>> styles based on the client or something like this.
>>>>>>
>>>>>> Marek
>>>>>>
>>>>>>
>>>>>> On 16/01/18 00:09, Bill Burke wrote:
>>>>>>
>>>>>>> I wonder how hard it would be to implement?
>>>>>>>
>>>>>>> On Mon, Jan 15, 2018 at 3:22 PM, Marek Posolda <mposolda at redhat.com>
>>>>>>>
>>>>>> wrote:
>>>>>>
>>>>>>> I think that Freemarker theme (at least login theme) has access to
>>>>>>>> ClientBean through the "client" expression . So it's likely already
>>>>>>>> possible to do some hacking in the template itself and provide
>>>>>>>>
>>>>>>> different
>>>>
>>>>> CSS according to the client used. Not very nice, but likely should be
>>>>>>>> somehow possible.
>>>>>>>>
>>>>>>>> Marek
>>>>>>>>
>>>>>>>> On 15/01/18 18:26, Josh Cain wrote:
>>>>>>>>
>>>>>>>>> Was originally discussed here:
>>>>>>>>> http://lists.jboss.org/pipermail/keycloak-user/2016-
>>>>>>>>>
>>>>>>>> January/004288.html
>>>>>>
>>>>>>> And I asked the same question again here:
>>>>>>>>> http://lists.jboss.org/pipermail/keycloak-user/2016-July/007
>>>>>>>>> 052.html
>>>>>>>>>
>>>>>>>>> But feel free to keep bumping.  It's a feature I'd like to see
>>>>>>>>> anyway
>>>>>>>>>
>>>>>>>> ;-)
>>>>>>
>>>>>>> Josh Cain
>>>>>>>>> Senior Software Applications Engineer, RHCE
>>>>>>>>> Red Hat North America
>>>>>>>>> jcain at redhat.com IRC: jcain
>>>>>>>>>
>>>>>>>>> On 01/15/2018 06:10 AM, eric.kapitza at web.de wrote:
>>>>>>>>>
>>>>>>>>>> _______________________________________________
>>>>>>>>>> keycloak-user mailing list
>>>>>>>>>> keycloak-user at lists.jboss.org
>>>>>>>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>>>>>>>>
>>>>>>>>>> _______________________________________________
>>>>>>>>> keycloak-user mailing list
>>>>>>>>> keycloak-user at lists.jboss.org
>>>>>>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>>>>>>>
>>>>>>>> _______________________________________________
>>>>>>>> keycloak-user mailing list
>>>>>>>> keycloak-user at lists.jboss.org
>>>>>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>>>>>>
>>>>>>>
>>>>>>> _______________________________________________
>>>>>> keycloak-user mailing list
>>>>>> keycloak-user at lists.jboss.org
>>>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>>>>
>>>>>> _______________________________________________
>>>>> keycloak-user mailing list
>>>>> keycloak-user at lists.jboss.org
>>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>>>
>>>>>
>>>> _______________________________________________
>>>> keycloak-user mailing list
>>>> keycloak-user at lists.jboss.org
>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>>
>>>> _______________________________________________
>>> keycloak-user mailing list
>>> keycloak-user at lists.jboss.org
>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>
>>
>>
>>
>
>

From Michael.Knurr at adesso.ch  Wed Jan 17 05:00:40 2018
From: Michael.Knurr at adesso.ch (Knurr, Michael)
Date: Wed, 17 Jan 2018 10:00:40 +0000
Subject: [keycloak-user] Timeout during import
Message-ID: <bc906fb4acb3433c85bec8d1ccab7fd6@EX2013-DB02.adesso.local>

When importing realm data from json, the import with default settings will run into a timeout after exactly 5 minutes.

Following the guide on https://mirocupak.com/enabling-long-deployments-on-wildfly/, I set the jboss.as.management.blocking.timeout and deployment-scanner deployment-timeout to 900 seconds. Now the process does not run into a timeout any longer. However after 5 minutes the process shows a huge number of warnings like these

10:47:24,804 WARN  [com.arjuna.ats.arjuna] (Transaction Reaper) ARJUNA012117: TransactionReaper::check timeout for TX 0:ffff7f000101:148e7def:5a5f1a7f:e in state  RUN
10:47:24,805 WARN  [org.hibernate.resource.transaction.backend.jta.internal.synchronization.SynchronizationCallbackCoordinatorTrackingImpl] (Transaction Reaper Worker 0) HHH000451: Transaction afterCompletion called by a background thread; delaying afterCompletion processing until the original thread can handle it. [status=4]
10:47:24,805 WARN  [org.hibernate.resource.transaction.backend.jta.internal.synchronization.SynchronizationCallbackCoordinatorTrackingImpl] (Transaction Reaper Worker 0) HHH000451: Transaction afterCompletion called by a background thread; delaying afterCompletion processing until the original thread can handle it. [status=4]
10:47:24,805 WARN  [org.hibernate.resource.transaction.backend.jta.internal.synchronization.SynchronizationCallbackCoordinatorTrackingImpl] (Transaction Reaper Worker 0) HHH000451: Transaction afterCompletion called by a background thread; delaying afterCompletion processing until the original thread can handle it. [status=4]


The import seems to go through but the server startup finally fails with an error:


10:49:25,924 INFO  [org.keycloak.services] (ServerService Thread Pool -- 58) KC-SERVICES0032: Import finished successfully
10:49:25,942 WARN  [com.arjuna.ats.arjuna] (ServerService Thread Pool -- 58) ARJUNA012077: Abort called on already aborted atomic action 0:ffff7f000101:148e7def:5a5f1a7f:e
10:49:25,945 INFO  [org.jboss.as.server] (Thread-2) WFLYSRV0220: Server shutdown has been requested via an OS signal
10:49:25,949 ERROR [org.jboss.msc.service.fail] (ServerService Thread Pool -- 58) MSC000001: Failed to start service jboss.undertow.deployment.default-server.default-host./auth: org.jboss.msc.service.StartException in service jboss.undertow.deployment.default-server.default-host./auth: java.lang.RuntimeException: RESTEASY003325: Failed to construct public org.keycloak.services.resources.KeycloakApplication(javax.servlet.ServletContext,org.jboss.resteasy.core.Dispatcher)
        at org.wildfly.extension.undertow.deployment.UndertowDeploymentService$1.run(UndertowDeploymentService.java:84)
        at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
        at java.util.concurrent.FutureTask.run(FutureTask.java:266)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
        at java.lang.Thread.run(Thread.java:745)
        at org.jboss.threads.JBossThread.run(JBossThread.java:320)
Caused by: java.lang.RuntimeException: RESTEASY003325: Failed to construct public org.keycloak.services.resources.KeycloakApplication(javax.servlet.ServletContext,org.jboss.resteasy.core.Dispatcher)
        at org.jboss.resteasy.core.ConstructorInjectorImpl.construct(ConstructorInjectorImpl.java:162)
        at org.jboss.resteasy.spi.ResteasyProviderFactory.createProviderInstance(ResteasyProviderFactory.java:2298)
        at org.jboss.resteasy.spi.ResteasyDeployment.createApplication(ResteasyDeployment.java:340)
        at org.jboss.resteasy.spi.ResteasyDeployment.start(ResteasyDeployment.java:253)
        at org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.init(ServletContainerDispatcher.java:120)
        at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.init(HttpServletDispatcher.java:36)
        at io.undertow.servlet.core.LifecyleInterceptorInvocation.proceed(LifecyleInterceptorInvocation.java:117)
        at org.wildfly.extension.undertow.security.RunAsLifecycleInterceptor.init(RunAsLifecycleInterceptor.java:78)
        at io.undertow.servlet.core.LifecyleInterceptorInvocation.proceed(LifecyleInterceptorInvocation.java:103)
        at io.undertow.servlet.core.ManagedServlet$DefaultInstanceStrategy.start(ManagedServlet.java:250)
        at io.undertow.servlet.core.ManagedServlet.createServlet(ManagedServlet.java:133)
        at io.undertow.servlet.core.DeploymentManagerImpl$2.call(DeploymentManagerImpl.java:565)
        at io.undertow.servlet.core.DeploymentManagerImpl$2.call(DeploymentManagerImpl.java:536)
        at io.undertow.servlet.core.ServletRequestContextThreadSetupAction$1.call(ServletRequestContextThreadSetupAction.java:42)
        at io.undertow.servlet.core.ContextClassLoaderSetupAction$1.call(ContextClassLoaderSetupAction.java:43)
        at org.wildfly.extension.undertow.security.SecurityContextThreadSetupAction.lambda$create$0(SecurityContextThreadSetupAction.java:105)
       at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1508)
        at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1508)
        at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1508)
        at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1508)
        at io.undertow.servlet.core.DeploymentManagerImpl.start(DeploymentManagerImpl.java:578)
        at org.wildfly.extension.undertow.deployment.UndertowDeploymentService.startContext(UndertowDeploymentService.java:100)
        at org.wildfly.extension.undertow.deployment.UndertowDeploymentService$1.run(UndertowDeploymentService.java:81)
        ... 6 more
Caused by: java.lang.RuntimeException: javax.transaction.RollbackException: ARJUNA016102: The transaction is not active! Uid is 0:ffff7f000101:148e7def:5a5f1a7f:e
        at org.keycloak.transaction.JtaTransactionWrapper.handleException(JtaTransactionWrapper.java:77)
        at org.keycloak.transaction.JtaTransactionWrapper.commit(JtaTransactionWrapper.java:94)
        at org.keycloak.services.DefaultKeycloakTransactionManager.commit(DefaultKeycloakTransactionManager.java:136)
        at org.keycloak.models.utils.KeycloakModelUtils.runJobInTransaction(KeycloakModelUtils.java:233)
        at org.keycloak.services.resources.KeycloakApplication.<init>(KeycloakApplication.java:137)
        at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
        at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62)
        at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
        at java.lang.reflect.Constructor.newInstance(Constructor.java:423)
        at org.jboss.resteasy.core.ConstructorInjectorImpl.construct(ConstructorInjectorImpl.java:150)
        ... 28 more
Caused by: javax.transaction.RollbackException: ARJUNA016102: The transaction is not active! Uid is 0:ffff7f000101:148e7def:5a5f1a7f:e
        at com.arjuna.ats.internal.jta.transaction.arjunacore.TransactionImple.commitAndDisassociate(TransactionImple.java:1279)
        at com.arjuna.ats.internal.jta.transaction.arjunacore.BaseTransaction.commit(BaseTransaction.java:126)
        at com.arjuna.ats.jbossatx.BaseTransactionManagerDelegate.commit(BaseTransactionManagerDelegate.java:89)
        at org.wildfly.transaction.client.LocalTransaction.commitAndDissociate(LocalTransaction.java:73)
        at org.wildfly.transaction.client.ContextTransactionManager.commit(ContextTransactionManager.java:71)
        at org.keycloak.transaction.JtaTransactionWrapper.commit(JtaTransactionWrapper.java:92)
        ... 36 more


It seems like the import is still running in some sort of transaction timeout. Is there any other way to configure the transaction timeout?






From simonpayne58 at gmail.com  Wed Jan 17 06:03:33 2018
From: simonpayne58 at gmail.com (Simon Payne)
Date: Wed, 17 Jan 2018 11:03:33 +0000
Subject: [keycloak-user] kubernetes
Message-ID: <CAPZw1G4NiuOLJWX4VNg8y=ShBkO-7Y7n+9GQF6cFHRah9GM=tg@mail.gmail.com>

Hi all,

i'm trying to get keycloak clustered on google cloud using KUBE_PING.

i have a starting keycloak server using docker based on the latest keycloak
and using kubernetes-0.9.3

however, i get the message:

[org.jgroups.protocols.kubernetes.KUBE_PING] (ServerService Thread Pool --
51) namespace not set; clustering disabled

i cant figure out how to add the namespace - all example are using
infinispan which uses different markup to keycloak.

my standalone-ha uses <protocol type="kubernetes.KUBE_PING"/>

if i add any additional attributes on this tag then keycloak fails to start

any help would be appreciated.


thanks

Simon.

From Michael.Poettgen at oeconnection.com  Wed Jan 17 06:36:03 2018
From: Michael.Poettgen at oeconnection.com (Michael Poettgen)
Date: Wed, 17 Jan 2018 11:36:03 +0000
Subject: [keycloak-user] Diagnosing SAMLv2 Identity Provider
Message-ID: <A3CA801399E3DD4CB30EC5E78A762B8A051469F6@S315.ctglobal.cliffordthames.com>

I've got a 3.4.3 Keycloak server deployed in a Docker environment and I am having some trouble setting up attribute mapping for an external SAML v2 Identity Provider. I'm not sure what exactly the external Identity Provider is sending so I was wondering whether there is an easy way to diagnose the SAML assertions that we are getting from them. However I couldn't find any details in the Events section.

Thanks,
Michael


This message may contain confidential information. If you are not the intended recipient, do not disseminate, distribute, or copy this e-mail or its attachments. Please notify the sender of the error immediately by e-mail or at the telephone number listed below, and delete this e-mail and any attachments from your system. Receipt by anyone other than the intended recipient(s) is not a waiver of any trade secrets, proprietary interests, or other applicable rights.  E-mail transmission is not necessarily secure or error-free, as information could be intercepted, corrupted, lost, destroyed, delayed, incomplete, or may contain viruses. The sender disclaims all liability for any errors or omissions arising as a result of the e-mail transmission. 

OEConnection LLC, (888) 776-5792, www.oeconnection.com


From Michael.Poettgen at oeconnection.com  Wed Jan 17 06:36:21 2018
From: Michael.Poettgen at oeconnection.com (Michael Poettgen)
Date: Wed, 17 Jan 2018 11:36:21 +0000
Subject: [keycloak-user] SAML Attribute to Role
Message-ID: <A3CA801399E3DD4CB30EC5E78A762B8A05146A00@S315.ctglobal.cliffordthames.com>

On Keycloak 3.4.3 I'm trying to use a "SAML Attribute to Role" role mapper to extract roles from a "roles" attribute sent by an external SAML IdP. I know that the attribute has values as when I try to map it to a user attribute I get an exception that the user attribute cannot be saved, because the value exceeds the maximum length of 256. What I don't know is whether the roles are sent in

1 - one attribute with multiple values,
2 - multiple attributes with one value or
3 - one attribute with one concatenated value.

I guess looking at the code that only 2 would work, 3 would be unusual, but 1 should work as well.

Can anyone share his experience with this? At the moment none of my roles get applied.

Thanks,
Michael


This message may contain confidential information. If you are not the intended recipient, do not disseminate, distribute, or copy this e-mail or its attachments. Please notify the sender of the error immediately by e-mail or at the telephone number listed below, and delete this e-mail and any attachments from your system. Receipt by anyone other than the intended recipient(s) is not a waiver of any trade secrets, proprietary interests, or other applicable rights.  E-mail transmission is not necessarily secure or error-free, as information could be intercepted, corrupted, lost, destroyed, delayed, incomplete, or may contain viruses. The sender disclaims all liability for any errors or omissions arising as a result of the e-mail transmission. 

OEConnection LLC, (888) 776-5792, www.oeconnection.com


From sthorger at redhat.com  Wed Jan 17 06:38:41 2018
From: sthorger at redhat.com (Stian Thorgersen)
Date: Wed, 17 Jan 2018 12:38:41 +0100
Subject: [keycloak-user] Different theme for each client
In-Reply-To: <trinity-673de0b0-0242-4aa0-81d7-0be50f796a35-1516181388888@3c-app-webde-bs57>
References: <trinity-08954434-d99a-48a0-8de6-7e83da7f493a-1516018211633@3c-app-webde-bap55>
	<0c00b809-1e5f-75eb-40b2-08d36587cda1@redhat.com>
	<53c1f766-587e-2822-5002-f9d81085e72e@redhat.com>
	<CABRXCmyGoUvkcV6gRAaAmkey_26+yHqV-ECGV_q1Ui_e-+8_nw@mail.gmail.com>
	<2545189b-77cd-581e-d0e8-0d72f5964bcf@redhat.com>
	<CAJgngAdCZAsbcvLOPC6=UpWX_RM-r6=YUsdTr_MLKP1=WPETcA@mail.gmail.com>
	<711ff92f-c66c-6aab-abba-068f6cdfe9f8@redhat.com>
	<CAJgngAdKekskGvrM8ZBkNhYx3AYQtG5WrdLO8dm0hbTurUbyjg@mail.gmail.com>
	<76c64dd5-669c-975e-d687-acdc6dd8604b@redhat.com>
	<CAJgngAcf-OLE+kKM7nHLq-sfUrgv2WgdN5BvyCx6vc030wafzw@mail.gmail.com>
	<c1395fa3-73b9-c7b5-3189-72d5caceb090@redhat.com>
	<CAJgngAfx8scUOvjAR6dUg7JjE899uESADmtb7B5SgL9Ujwcasw@mail.gmail.com>
	<trinity-673de0b0-0242-4aa0-81d7-0be50f796a35-1516181388888@3c-app-webde-bs57>
Message-ID: <CAJgngAfqc1HFPf-=5P-YkC-=zr4bCTLp=6aggjmZxDQr_AxmVw@mail.gmail.com>

[Added the list back]

To reply to everyone just do "reply all" and it should include the list.

On 17 January 2018 at 10:29, <eric.kapitza at web.de> wrote:

> Hello Stian, Hello Marek,
>
> I really love that you want to developt this feature! :)
>
> I think it's good if you can set the theme per client, with a fallback to
> the default theme. This is probably what most people need when they look
> for this feature.
>
> Btw how do I correctly reply to somebody like you did, so everyone will
> get the new message? Must I just send a new mail to the email list with the
> same title?
>
> One other question, maybe you know it, do you think it is right now
> technically possible to use keycloak login page within an IFrame in our
> application with JS-Adapter?
>
> Eric
> *Gesendet:* Mittwoch, 17. Januar 2018 um 09:38 Uhr
> *Von:* "Stian Thorgersen" <sthorger at redhat.com>
> *An:* "Marek Posolda" <mposolda at redhat.com>
> *Cc:* keycloak-user <keycloak-user at lists.jboss.org>
> *Betreff:* Re: [keycloak-user] Different theme for each client
> On 17 January 2018 at 09:35, Marek Posolda <mposolda at redhat.com> wrote:
>
> > On 17/01/18 09:03, Stian Thorgersen wrote:
> >
> > Added a public ThemeSelectorSPI [1] that allows adding custom logic for
> > selecting what theme to use. The default implementation is very simple at
> > the moment [2]. It simply looks for the realm setting and fallbacks to
> the
> > default if not set.
> >
> > Changing the selector is a global thing and there is no mechanism to
> > configure a separate selector for a realm. That's something we could
> > consider adding later if needed.
> >
> > The question is should we provide the ability to set the theme per-client
> > or is that actually quite cumbersome to use? There could be hundreds of
> > clients.
> >
> > I think that yes. It can be cumbersome, but this applies for many
> > client-specific settings. For example you may have some custom
> > protocolMapper, which you want to use for more clients and then you also
> > need to edit protocolMappers in all clients to add this custom
> > protocolMapper.
> >
> > We can also support theme per clientTemplate, so if client doesn't have
> > theme set, it can try the theme from clientTemplate and fallback to realm
> > and finally to default if nothing is set.
> >
>
> OK. I guess implementation should be pretty straightforward as both clients
> and client templates have attributes.
>
>
> >
> >
> > Marek
> >
> >
> > [1] https://github.com/stianst/keycloak/tree/KEYCLOAK-6289
> > [2] https://github.com/stianst/keycloak/blob/KEYCLOAK-6289/services/src/
> > main/java/org/keycloak/theme/DefaultThemeSelectorProvider.java#L17
> >
> > On 17 January 2018 at 08:54, Marek Posolda <mposolda at redhat.com> wrote:
> >
> >> +1 to handle on the client. Seems to be better than handle in the theme
> >> itself.
> >>
> >> Marek
> >>
> >>
> >> On 17/01/18 08:19, Stian Thorgersen wrote:
> >>
> >>> I've started work on this as I needed a simple dev task to wake up ;)
> >>>
> >>> https://issues.jboss.org/browse/KEYCLOAK-3370
> >>>
> >>> On 16 January 2018 at 17:06, Josh Cain <jcain at redhat.com> wrote:
> >>>
> >>> +1 for that solution, would make some of what we're looking to do in
> the
> >>>> near future *way* cleaner!
> >>>>
> >>>> Josh Cain
> >>>> Senior Software Applications Engineer, RHCE
> >>>> Red Hat North America
> >>>> jcain at redhat.com IRC: jcain
> >>>>
> >>>> On 01/16/2018 08:54 AM, Stian Thorgersen wrote:
> >>>>
> >>>>> It makes sense to add two options:
> >>>>>
> >>>>> 1. Expose client attributes to theme. That would allow setting an
> >>>>>
> >>>> attribute
> >>>>
> >>>>> on a specific client or a client template to then have some
> conditions
> >>>>> to
> >>>>> provide variants within a theme.
> >>>>> 2. Allow overriding theme in client and client template. No need to
> add
> >>>>> something additional to themes as they can already be extended. We
> >>>>> simply
> >>>>> need to allow users to specify a different theme. In this case we may
> >>>>>
> >>>> also
> >>>>
> >>>>> want to add a ThemeSelectorSPI that would allow some custom logic to
> >>>>>
> >>>> select
> >>>>
> >>>>> the theme (could be based on headers for instance in the case of a
> >>>>> mobile
> >>>>> theme).
> >>>>>
> >>>>> On 16 January 2018 at 14:09, Marek Posolda <mposolda at redhat.com>
> >>>>> wrote:
> >>>>>
> >>>>> We can probably do some builtin support for clients into the themes
> >>>>>> itself. Doing it properly may take few days. Depends if we want to
> >>>>>> support that. AFAIR Stian didn't like that, but to me it makes sense
> >>>>>> that some people want different look&feel based on client.
> >>>>>>
> >>>>>> For example template file can be lookup from the directory with the
> >>>>>> clientId (EG. theme/my-theme/login/customer-portal/login.ftl ). If
> it
> >>>>>> doesn't exists, then fallback to the current location without
> >>>>>> "clientId"
> >>>>>> directory. Maybe something similar would be needed for the CSS files
> >>>>>> and
> >>>>>> other resources.
> >>>>>>
> >>>>>> But for some very basic cases, people can probably already handle it
> >>>>>> by
> >>>>>> add some "if" into the freemarker template itself and use different
> >>>>>> CSS
> >>>>>> styles based on the client or something like this.
> >>>>>>
> >>>>>> Marek
> >>>>>>
> >>>>>>
> >>>>>> On 16/01/18 00:09, Bill Burke wrote:
> >>>>>>
> >>>>>>> I wonder how hard it would be to implement?
> >>>>>>>
> >>>>>>> On Mon, Jan 15, 2018 at 3:22 PM, Marek Posolda <
> mposolda at redhat.com>
> >>>>>>>
> >>>>>> wrote:
> >>>>>>
> >>>>>>> I think that Freemarker theme (at least login theme) has access to
> >>>>>>>> ClientBean through the "client" expression . So it's likely
> already
> >>>>>>>> possible to do some hacking in the template itself and provide
> >>>>>>>>
> >>>>>>> different
> >>>>
> >>>>> CSS according to the client used. Not very nice, but likely should be
> >>>>>>>> somehow possible.
> >>>>>>>>
> >>>>>>>> Marek
> >>>>>>>>
> >>>>>>>> On 15/01/18 18:26, Josh Cain wrote:
> >>>>>>>>
> >>>>>>>>> Was originally discussed here:
> >>>>>>>>> http://lists.jboss.org/pipermail/keycloak-user/2016-
> >>>>>>>>>
> >>>>>>>> January/004288.html
> >>>>>>
> >>>>>>> And I asked the same question again here:
> >>>>>>>>> http://lists.jboss.org/pipermail/keycloak-user/2016-July/007
> >>>>>>>>> 052.html
> >>>>>>>>>
> >>>>>>>>> But feel free to keep bumping. It's a feature I'd like to see
> >>>>>>>>> anyway
> >>>>>>>>>
> >>>>>>>> ;-)
> >>>>>>
> >>>>>>> Josh Cain
> >>>>>>>>> Senior Software Applications Engineer, RHCE
> >>>>>>>>> Red Hat North America
> >>>>>>>>> jcain at redhat.com IRC: jcain
> >>>>>>>>>
> >>>>>>>>> On 01/15/2018 06:10 AM, eric.kapitza at web.de wrote:
> >>>>>>>>>
> >>>>>>>>>> _______________________________________________
> >>>>>>>>>> keycloak-user mailing list
> >>>>>>>>>> keycloak-user at lists.jboss.org
> >>>>>>>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
> >>>>>>>>>>
> >>>>>>>>>> _______________________________________________
> >>>>>>>>> keycloak-user mailing list
> >>>>>>>>> keycloak-user at lists.jboss.org
> >>>>>>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
> >>>>>>>>>
> >>>>>>>> _______________________________________________
> >>>>>>>> keycloak-user mailing list
> >>>>>>>> keycloak-user at lists.jboss.org
> >>>>>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
> >>>>>>>>
> >>>>>>>
> >>>>>>> _______________________________________________
> >>>>>> keycloak-user mailing list
> >>>>>> keycloak-user at lists.jboss.org
> >>>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
> >>>>>>
> >>>>>> _______________________________________________
> >>>>> keycloak-user mailing list
> >>>>> keycloak-user at lists.jboss.org
> >>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
> >>>>>
> >>>>>
> >>>> _______________________________________________
> >>>> keycloak-user mailing list
> >>>> keycloak-user at lists.jboss.org
> >>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
> >>>>
> >>>> _______________________________________________
> >>> keycloak-user mailing list
> >>> keycloak-user at lists.jboss.org
> >>> https://lists.jboss.org/mailman/listinfo/keycloak-user
> >>>
> >>
> >>
> >>
> >
> >
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>

From hmlnarik at redhat.com  Wed Jan 17 06:40:43 2018
From: hmlnarik at redhat.com (Hynek Mlnarik)
Date: Wed, 17 Jan 2018 12:40:43 +0100
Subject: [keycloak-user] Timeout during import
In-Reply-To: <bc906fb4acb3433c85bec8d1ccab7fd6@EX2013-DB02.adesso.local>
References: <bc906fb4acb3433c85bec8d1ccab7fd6@EX2013-DB02.adesso.local>
Message-ID: <CAMvXD=FtFCPwKf_PAjqT8HszaBrQmOOHETjWz=BuJTJwXcqwmQ@mail.gmail.com>

You should be able to continue by setting the transaction timeout:
https://stackoverflow.com/questions/45075133/increase-jta-transaction-timeout-limit-in-wildfly
.

On Wed, Jan 17, 2018 at 11:00 AM, Knurr, Michael <Michael.Knurr at adesso.ch>
wrote:

> When importing realm data from json, the import with default settings will
> run into a timeout after exactly 5 minutes.
>
> Following the guide on https://mirocupak.com/enabling-long-deployments-on-
> wildfly/, I set the jboss.as.management.blocking.timeout and
> deployment-scanner deployment-timeout to 900 seconds. Now the process does
> not run into a timeout any longer. However after 5 minutes the process
> shows a huge number of warnings like these
>
> 10:47:24,804 WARN  [com.arjuna.ats.arjuna] (Transaction Reaper)
> ARJUNA012117: TransactionReaper::check timeout for TX
> 0:ffff7f000101:148e7def:5a5f1a7f:e in state  RUN
> 10:47:24,805 WARN  [org.hibernate.resource.transaction.backend.jta.
> internal.synchronization.SynchronizationCallbackCoordinatorTrackingImpl]
> (Transaction Reaper Worker 0) HHH000451: Transaction afterCompletion called
> by a background thread; delaying afterCompletion processing until the
> original thread can handle it. [status=4]
> 10:47:24,805 WARN  [org.hibernate.resource.transaction.backend.jta.
> internal.synchronization.SynchronizationCallbackCoordinatorTrackingImpl]
> (Transaction Reaper Worker 0) HHH000451: Transaction afterCompletion called
> by a background thread; delaying afterCompletion processing until the
> original thread can handle it. [status=4]
> 10:47:24,805 WARN  [org.hibernate.resource.transaction.backend.jta.
> internal.synchronization.SynchronizationCallbackCoordinatorTrackingImpl]
> (Transaction Reaper Worker 0) HHH000451: Transaction afterCompletion called
> by a background thread; delaying afterCompletion processing until the
> original thread can handle it. [status=4]
>
>
> The import seems to go through but the server startup finally fails with
> an error:
>
>
> 10:49:25,924 INFO  [org.keycloak.services] (ServerService Thread Pool --
> 58) KC-SERVICES0032: Import finished successfully
> 10:49:25,942 WARN  [com.arjuna.ats.arjuna] (ServerService Thread Pool --
> 58) ARJUNA012077: Abort called on already aborted atomic action
> 0:ffff7f000101:148e7def:5a5f1a7f:e
> 10:49:25,945 INFO  [org.jboss.as.server] (Thread-2) WFLYSRV0220: Server
> shutdown has been requested via an OS signal
> 10:49:25,949 ERROR [org.jboss.msc.service.fail] (ServerService Thread Pool
> -- 58) MSC000001: Failed to start service jboss.undertow.deployment.
> default-server.default-host./auth: org.jboss.msc.service.StartException
> in service jboss.undertow.deployment.default-server.default-host./auth:
> java.lang.RuntimeException: RESTEASY003325: Failed to construct public
> org.keycloak.services.resources.KeycloakApplication(
> javax.servlet.ServletContext,org.jboss.resteasy.core.Dispatcher)
>         at org.wildfly.extension.undertow.deployment.
> UndertowDeploymentService$1.run(UndertowDeploymentService.java:84)
>         at java.util.concurrent.Executors$RunnableAdapter.
> call(Executors.java:511)
>         at java.util.concurrent.FutureTask.run(FutureTask.java:266)
>         at java.util.concurrent.ThreadPoolExecutor.runWorker(
> ThreadPoolExecutor.java:1142)
>         at java.util.concurrent.ThreadPoolExecutor$Worker.run(
> ThreadPoolExecutor.java:617)
>         at java.lang.Thread.run(Thread.java:745)
>         at org.jboss.threads.JBossThread.run(JBossThread.java:320)
> Caused by: java.lang.RuntimeException: RESTEASY003325: Failed to construct
> public org.keycloak.services.resources.KeycloakApplication(
> javax.servlet.ServletContext,org.jboss.resteasy.core.Dispatcher)
>         at org.jboss.resteasy.core.ConstructorInjectorImpl.construct(
> ConstructorInjectorImpl.java:162)
>         at org.jboss.resteasy.spi.ResteasyProviderFactory.
> createProviderInstance(ResteasyProviderFactory.java:2298)
>         at org.jboss.resteasy.spi.ResteasyDeployment.createApplication(
> ResteasyDeployment.java:340)
>         at org.jboss.resteasy.spi.ResteasyDeployment.start(
> ResteasyDeployment.java:253)
>         at org.jboss.resteasy.plugins.server.servlet.
> ServletContainerDispatcher.init(ServletContainerDispatcher.java:120)
>         at org.jboss.resteasy.plugins.server.servlet.
> HttpServletDispatcher.init(HttpServletDispatcher.java:36)
>         at io.undertow.servlet.core.LifecyleInterceptorInvocation.proceed(
> LifecyleInterceptorInvocation.java:117)
>         at org.wildfly.extension.undertow.security.
> RunAsLifecycleInterceptor.init(RunAsLifecycleInterceptor.java:78)
>         at io.undertow.servlet.core.LifecyleInterceptorInvocation.proceed(
> LifecyleInterceptorInvocation.java:103)
>         at io.undertow.servlet.core.ManagedServlet$
> DefaultInstanceStrategy.start(ManagedServlet.java:250)
>         at io.undertow.servlet.core.ManagedServlet.createServlet(
> ManagedServlet.java:133)
>         at io.undertow.servlet.core.DeploymentManagerImpl$2.call(
> DeploymentManagerImpl.java:565)
>         at io.undertow.servlet.core.DeploymentManagerImpl$2.call(
> DeploymentManagerImpl.java:536)
>         at io.undertow.servlet.core.ServletRequestContextThreadSet
> upAction$1.call(ServletRequestContextThreadSetupAction.java:42)
>         at io.undertow.servlet.core.ContextClassLoaderSetupAction$1.call(
> ContextClassLoaderSetupAction.java:43)
>         at org.wildfly.extension.undertow.security.
> SecurityContextThreadSetupAction.lambda$create$0(
> SecurityContextThreadSetupAction.java:105)
>        at org.wildfly.extension.undertow.deployment.
> UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(
> UndertowDeploymentInfoService.java:1508)
>         at org.wildfly.extension.undertow.deployment.
> UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(
> UndertowDeploymentInfoService.java:1508)
>         at org.wildfly.extension.undertow.deployment.
> UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(
> UndertowDeploymentInfoService.java:1508)
>         at org.wildfly.extension.undertow.deployment.
> UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(
> UndertowDeploymentInfoService.java:1508)
>         at io.undertow.servlet.core.DeploymentManagerImpl.start(
> DeploymentManagerImpl.java:578)
>         at org.wildfly.extension.undertow.deployment.
> UndertowDeploymentService.startContext(UndertowDeploymentService.java:100)
>         at org.wildfly.extension.undertow.deployment.
> UndertowDeploymentService$1.run(UndertowDeploymentService.java:81)
>         ... 6 more
> Caused by: java.lang.RuntimeException: javax.transaction.RollbackException:
> ARJUNA016102: The transaction is not active! Uid is 0:ffff7f000101:148e7def:
> 5a5f1a7f:e
>         at org.keycloak.transaction.JtaTransactionWrapper.handleException(
> JtaTransactionWrapper.java:77)
>         at org.keycloak.transaction.JtaTransactionWrapper.commit(
> JtaTransactionWrapper.java:94)
>         at org.keycloak.services.DefaultKeycloakTransactionManager.commit(
> DefaultKeycloakTransactionManager.java:136)
>         at org.keycloak.models.utils.KeycloakModelUtils.
> runJobInTransaction(KeycloakModelUtils.java:233)
>         at org.keycloak.services.resources.KeycloakApplication.
> <init>(KeycloakApplication.java:137)
>         at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native
> Method)
>         at sun.reflect.NativeConstructorAccessorImpl.newInstance(
> NativeConstructorAccessorImpl.java:62)
>         at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(
> DelegatingConstructorAccessorImpl.java:45)
>         at java.lang.reflect.Constructor.newInstance(Constructor.java:423)
>         at org.jboss.resteasy.core.ConstructorInjectorImpl.construct(
> ConstructorInjectorImpl.java:150)
>         ... 28 more
> Caused by: javax.transaction.RollbackException: ARJUNA016102: The
> transaction is not active! Uid is 0:ffff7f000101:148e7def:5a5f1a7f:e
>         at com.arjuna.ats.internal.jta.transaction.arjunacore.
> TransactionImple.commitAndDisassociate(TransactionImple.java:1279)
>         at com.arjuna.ats.internal.jta.transaction.arjunacore.
> BaseTransaction.commit(BaseTransaction.java:126)
>         at com.arjuna.ats.jbossatx.BaseTransactionManagerDelegate.commit(
> BaseTransactionManagerDelegate.java:89)
>         at org.wildfly.transaction.client.LocalTransaction.
> commitAndDissociate(LocalTransaction.java:73)
>         at org.wildfly.transaction.client.ContextTransactionManager.
> commit(ContextTransactionManager.java:71)
>         at org.keycloak.transaction.JtaTransactionWrapper.commit(
> JtaTransactionWrapper.java:92)
>         ... 36 more
>
>
> It seems like the import is still running in some sort of transaction
> timeout. Is there any other way to configure the transaction timeout?
>
>
>
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>



-- 

--Hynek

From sthorger at redhat.com  Wed Jan 17 06:49:19 2018
From: sthorger at redhat.com (Stian Thorgersen)
Date: Wed, 17 Jan 2018 12:49:19 +0100
Subject: [keycloak-user] Different theme for each client
In-Reply-To: <CAJgngAfqc1HFPf-=5P-YkC-=zr4bCTLp=6aggjmZxDQr_AxmVw@mail.gmail.com>
References: <trinity-08954434-d99a-48a0-8de6-7e83da7f493a-1516018211633@3c-app-webde-bap55>
	<0c00b809-1e5f-75eb-40b2-08d36587cda1@redhat.com>
	<53c1f766-587e-2822-5002-f9d81085e72e@redhat.com>
	<CABRXCmyGoUvkcV6gRAaAmkey_26+yHqV-ECGV_q1Ui_e-+8_nw@mail.gmail.com>
	<2545189b-77cd-581e-d0e8-0d72f5964bcf@redhat.com>
	<CAJgngAdCZAsbcvLOPC6=UpWX_RM-r6=YUsdTr_MLKP1=WPETcA@mail.gmail.com>
	<711ff92f-c66c-6aab-abba-068f6cdfe9f8@redhat.com>
	<CAJgngAdKekskGvrM8ZBkNhYx3AYQtG5WrdLO8dm0hbTurUbyjg@mail.gmail.com>
	<76c64dd5-669c-975e-d687-acdc6dd8604b@redhat.com>
	<CAJgngAcf-OLE+kKM7nHLq-sfUrgv2WgdN5BvyCx6vc030wafzw@mail.gmail.com>
	<c1395fa3-73b9-c7b5-3189-72d5caceb090@redhat.com>
	<CAJgngAfx8scUOvjAR6dUg7JjE899uESADmtb7B5SgL9Ujwcasw@mail.gmail.com>
	<trinity-673de0b0-0242-4aa0-81d7-0be50f796a35-1516181388888@3c-app-webde-bs57>
	<CAJgngAfqc1HFPf-=5P-YkC-=zr4bCTLp=6aggjmZxDQr_AxmVw@mail.gmail.com>
Message-ID: <CAJgngAeKvEYdZBQidcmncTKOdfOHYq_1KE5Si6s-i2HSQZYvRA@mail.gmail.com>

My branch has now been updated to also include ability to override template
on a client or client template.

It's here: https://github.com/stianst/keycloak/tree/KEYCLOAK-6289 if anyone
wants to take a look

On 17 January 2018 at 12:38, Stian Thorgersen <sthorger at redhat.com> wrote:

> [Added the list back]
>
> To reply to everyone just do "reply all" and it should include the list.
>
> On 17 January 2018 at 10:29, <eric.kapitza at web.de> wrote:
>
>> Hello Stian, Hello Marek,
>>
>> I really love that you want to developt this feature! :)
>>
>> I think it's good if you can set the theme per client, with a fallback to
>> the default theme. This is probably what most people need when they look
>> for this feature.
>>
>> Btw how do I correctly reply to somebody like you did, so everyone will
>> get the new message? Must I just send a new mail to the email list with the
>> same title?
>>
>> One other question, maybe you know it, do you think it is right now
>> technically possible to use keycloak login page within an IFrame in our
>> application with JS-Adapter?
>>
>> Eric
>> *Gesendet:* Mittwoch, 17. Januar 2018 um 09:38 Uhr
>> *Von:* "Stian Thorgersen" <sthorger at redhat.com>
>> *An:* "Marek Posolda" <mposolda at redhat.com>
>> *Cc:* keycloak-user <keycloak-user at lists.jboss.org>
>> *Betreff:* Re: [keycloak-user] Different theme for each client
>> On 17 January 2018 at 09:35, Marek Posolda <mposolda at redhat.com> wrote:
>>
>> > On 17/01/18 09:03, Stian Thorgersen wrote:
>> >
>> > Added a public ThemeSelectorSPI [1] that allows adding custom logic for
>> > selecting what theme to use. The default implementation is very simple
>> at
>> > the moment [2]. It simply looks for the realm setting and fallbacks to
>> the
>> > default if not set.
>> >
>> > Changing the selector is a global thing and there is no mechanism to
>> > configure a separate selector for a realm. That's something we could
>> > consider adding later if needed.
>> >
>> > The question is should we provide the ability to set the theme
>> per-client
>> > or is that actually quite cumbersome to use? There could be hundreds of
>> > clients.
>> >
>> > I think that yes. It can be cumbersome, but this applies for many
>> > client-specific settings. For example you may have some custom
>> > protocolMapper, which you want to use for more clients and then you also
>> > need to edit protocolMappers in all clients to add this custom
>> > protocolMapper.
>> >
>> > We can also support theme per clientTemplate, so if client doesn't have
>> > theme set, it can try the theme from clientTemplate and fallback to
>> realm
>> > and finally to default if nothing is set.
>> >
>>
>> OK. I guess implementation should be pretty straightforward as both
>> clients
>> and client templates have attributes.
>>
>>
>> >
>> >
>> > Marek
>> >
>> >
>> > [1] https://github.com/stianst/keycloak/tree/KEYCLOAK-6289
>> > [2] https://github.com/stianst/keycloak/blob/KEYCLOAK-6289/servi
>> ces/src/
>> > main/java/org/keycloak/theme/DefaultThemeSelectorProvider.java#L17
>> >
>> > On 17 January 2018 at 08:54, Marek Posolda <mposolda at redhat.com> wrote:
>> >
>> >> +1 to handle on the client. Seems to be better than handle in the theme
>> >> itself.
>> >>
>> >> Marek
>> >>
>> >>
>> >> On 17/01/18 08:19, Stian Thorgersen wrote:
>> >>
>> >>> I've started work on this as I needed a simple dev task to wake up ;)
>> >>>
>> >>> https://issues.jboss.org/browse/KEYCLOAK-3370
>> >>>
>> >>> On 16 January 2018 at 17:06, Josh Cain <jcain at redhat.com> wrote:
>> >>>
>> >>> +1 for that solution, would make some of what we're looking to do in
>> the
>> >>>> near future *way* cleaner!
>> >>>>
>> >>>> Josh Cain
>> >>>> Senior Software Applications Engineer, RHCE
>> >>>> Red Hat North America
>> >>>> jcain at redhat.com IRC: jcain
>> >>>>
>> >>>> On 01/16/2018 08:54 AM, Stian Thorgersen wrote:
>> >>>>
>> >>>>> It makes sense to add two options:
>> >>>>>
>> >>>>> 1. Expose client attributes to theme. That would allow setting an
>> >>>>>
>> >>>> attribute
>> >>>>
>> >>>>> on a specific client or a client template to then have some
>> conditions
>> >>>>> to
>> >>>>> provide variants within a theme.
>> >>>>> 2. Allow overriding theme in client and client template. No need to
>> add
>> >>>>> something additional to themes as they can already be extended. We
>> >>>>> simply
>> >>>>> need to allow users to specify a different theme. In this case we
>> may
>> >>>>>
>> >>>> also
>> >>>>
>> >>>>> want to add a ThemeSelectorSPI that would allow some custom logic to
>> >>>>>
>> >>>> select
>> >>>>
>> >>>>> the theme (could be based on headers for instance in the case of a
>> >>>>> mobile
>> >>>>> theme).
>> >>>>>
>> >>>>> On 16 January 2018 at 14:09, Marek Posolda <mposolda at redhat.com>
>> >>>>> wrote:
>> >>>>>
>> >>>>> We can probably do some builtin support for clients into the themes
>> >>>>>> itself. Doing it properly may take few days. Depends if we want to
>> >>>>>> support that. AFAIR Stian didn't like that, but to me it makes
>> sense
>> >>>>>> that some people want different look&feel based on client.
>> >>>>>>
>> >>>>>> For example template file can be lookup from the directory with the
>> >>>>>> clientId (EG. theme/my-theme/login/customer-portal/login.ftl ).
>> If it
>> >>>>>> doesn't exists, then fallback to the current location without
>> >>>>>> "clientId"
>> >>>>>> directory. Maybe something similar would be needed for the CSS
>> files
>> >>>>>> and
>> >>>>>> other resources.
>> >>>>>>
>> >>>>>> But for some very basic cases, people can probably already handle
>> it
>> >>>>>> by
>> >>>>>> add some "if" into the freemarker template itself and use different
>> >>>>>> CSS
>> >>>>>> styles based on the client or something like this.
>> >>>>>>
>> >>>>>> Marek
>> >>>>>>
>> >>>>>>
>> >>>>>> On 16/01/18 00:09, Bill Burke wrote:
>> >>>>>>
>> >>>>>>> I wonder how hard it would be to implement?
>> >>>>>>>
>> >>>>>>> On Mon, Jan 15, 2018 at 3:22 PM, Marek Posolda <
>> mposolda at redhat.com>
>> >>>>>>>
>> >>>>>> wrote:
>> >>>>>>
>> >>>>>>> I think that Freemarker theme (at least login theme) has access to
>> >>>>>>>> ClientBean through the "client" expression . So it's likely
>> already
>> >>>>>>>> possible to do some hacking in the template itself and provide
>> >>>>>>>>
>> >>>>>>> different
>> >>>>
>> >>>>> CSS according to the client used. Not very nice, but likely should
>> be
>> >>>>>>>> somehow possible.
>> >>>>>>>>
>> >>>>>>>> Marek
>> >>>>>>>>
>> >>>>>>>> On 15/01/18 18:26, Josh Cain wrote:
>> >>>>>>>>
>> >>>>>>>>> Was originally discussed here:
>> >>>>>>>>> http://lists.jboss.org/pipermail/keycloak-user/2016-
>> >>>>>>>>>
>> >>>>>>>> January/004288.html
>> >>>>>>
>> >>>>>>> And I asked the same question again here:
>> >>>>>>>>> http://lists.jboss.org/pipermail/keycloak-user/2016-July/007
>> >>>>>>>>> 052.html
>> >>>>>>>>>
>> >>>>>>>>> But feel free to keep bumping. It's a feature I'd like to see
>> >>>>>>>>> anyway
>> >>>>>>>>>
>> >>>>>>>> ;-)
>> >>>>>>
>> >>>>>>> Josh Cain
>> >>>>>>>>> Senior Software Applications Engineer, RHCE
>> >>>>>>>>> Red Hat North America
>> >>>>>>>>> jcain at redhat.com IRC: jcain
>> >>>>>>>>>
>> >>>>>>>>> On 01/15/2018 06:10 AM, eric.kapitza at web.de wrote:
>> >>>>>>>>>
>> >>>>>>>>>> _______________________________________________
>> >>>>>>>>>> keycloak-user mailing list
>> >>>>>>>>>> keycloak-user at lists.jboss.org
>> >>>>>>>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>> >>>>>>>>>>
>> >>>>>>>>>> _______________________________________________
>> >>>>>>>>> keycloak-user mailing list
>> >>>>>>>>> keycloak-user at lists.jboss.org
>> >>>>>>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>> >>>>>>>>>
>> >>>>>>>> _______________________________________________
>> >>>>>>>> keycloak-user mailing list
>> >>>>>>>> keycloak-user at lists.jboss.org
>> >>>>>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>> >>>>>>>>
>> >>>>>>>
>> >>>>>>> _______________________________________________
>> >>>>>> keycloak-user mailing list
>> >>>>>> keycloak-user at lists.jboss.org
>> >>>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>> >>>>>>
>> >>>>>> _______________________________________________
>> >>>>> keycloak-user mailing list
>> >>>>> keycloak-user at lists.jboss.org
>> >>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>> >>>>>
>> >>>>>
>> >>>> _______________________________________________
>> >>>> keycloak-user mailing list
>> >>>> keycloak-user at lists.jboss.org
>> >>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>> >>>>
>> >>>> _______________________________________________
>> >>> keycloak-user mailing list
>> >>> keycloak-user at lists.jboss.org
>> >>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>> >>>
>> >>
>> >>
>> >>
>> >
>> >
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>
>
>

From Michael.Knurr at adesso.ch  Wed Jan 17 07:09:52 2018
From: Michael.Knurr at adesso.ch (Knurr, Michael)
Date: Wed, 17 Jan 2018 12:09:52 +0000
Subject: [keycloak-user] Timeout during import
In-Reply-To: <CAMvXD=FtFCPwKf_PAjqT8HszaBrQmOOHETjWz=BuJTJwXcqwmQ@mail.gmail.com>
References: <bc906fb4acb3433c85bec8d1ccab7fd6@EX2013-DB02.adesso.local>
	<CAMvXD=FtFCPwKf_PAjqT8HszaBrQmOOHETjWz=BuJTJwXcqwmQ@mail.gmail.com>
Message-ID: <a0f653c6f87b4f3e90b23fde9372918f@EX2013-DB02.adesso.local>

Yes, that did it.

Thank you!

Von: Hynek Mlnarik [mailto:hmlnarik at redhat.com]
Gesendet: Mittwoch, 17. Januar 2018 12:41
An: Knurr, Michael <Michael.Knurr at adesso.ch>
Cc: keycloak-user <keycloak-user at lists.jboss.org>
Betreff: Re: [keycloak-user] Timeout during import

You should be able to continue by setting the transaction timeout: https://stackoverflow.com/questions/45075133/increase-jta-transaction-timeout-limit-in-wildfly.

On Wed, Jan 17, 2018 at 11:00 AM, Knurr, Michael <Michael.Knurr at adesso.ch<mailto:Michael.Knurr at adesso.ch>> wrote:
When importing realm data from json, the import with default settings will run into a timeout after exactly 5 minutes.

Following the guide on https://mirocupak.com/enabling-long-deployments-on-wildfly/, I set the jboss.as.management.blocking.timeout and deployment-scanner deployment-timeout to 900 seconds. Now the process does not run into a timeout any longer. However after 5 minutes the process shows a huge number of warnings like these

10:47:24,804 WARN  [com.arjuna.ats.arjuna] (Transaction Reaper) ARJUNA012117: TransactionReaper::check timeout for TX 0:ffff7f000101:148e7def:5a5f1a7f:e in state  RUN
10:47:24,805 WARN  [org.hibernate.resource.transaction.backend.jta.internal.synchronization.SynchronizationCallbackCoordinatorTrackingImpl] (Transaction Reaper Worker 0) HHH000451: Transaction afterCompletion called by a background thread; delaying afterCompletion processing until the original thread can handle it. [status=4]
10:47:24,805 WARN  [org.hibernate.resource.transaction.backend.jta.internal.synchronization.SynchronizationCallbackCoordinatorTrackingImpl] (Transaction Reaper Worker 0) HHH000451: Transaction afterCompletion called by a background thread; delaying afterCompletion processing until the original thread can handle it. [status=4]
10:47:24,805 WARN  [org.hibernate.resource.transaction.backend.jta.internal.synchronization.SynchronizationCallbackCoordinatorTrackingImpl] (Transaction Reaper Worker 0) HHH000451: Transaction afterCompletion called by a background thread; delaying afterCompletion processing until the original thread can handle it. [status=4]


The import seems to go through but the server startup finally fails with an error:


10:49:25,924 INFO  [org.keycloak.services] (ServerService Thread Pool -- 58) KC-SERVICES0032: Import finished successfully
10:49:25,942 WARN  [com.arjuna.ats.arjuna] (ServerService Thread Pool -- 58) ARJUNA012077: Abort called on already aborted atomic action 0:ffff7f000101:148e7def:5a5f1a7f:e
10:49:25,945 INFO  [org.jboss.as.server] (Thread-2) WFLYSRV0220: Server shutdown has been requested via an OS signal
10:49:25,949 ERROR [org.jboss.msc.service.fail] (ServerService Thread Pool -- 58) MSC000001: Failed to start service jboss.undertow.deployment.default-server.default-host./auth: org.jboss.msc.service.StartException in service jboss.undertow.deployment.default-server.default-host./auth: java.lang.RuntimeException: RESTEASY003325: Failed to construct public org.keycloak.services.resources.KeycloakApplication(javax.servlet.ServletContext,org.jboss.resteasy.core.Dispatcher)
        at org.wildfly.extension.undertow.deployment.UndertowDeploymentService$1.run(UndertowDeploymentService.java:84)
        at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
        at java.util.concurrent.FutureTask.run(FutureTask.java:266)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
        at java.lang.Thread.run(Thread.java:745)
        at org.jboss.threads.JBossThread.run(JBossThread.java:320)
Caused by: java.lang.RuntimeException: RESTEASY003325: Failed to construct public org.keycloak.services.resources.KeycloakApplication(javax.servlet.ServletContext,org.jboss.resteasy.core.Dispatcher)
        at org.jboss.resteasy.core.ConstructorInjectorImpl.construct(ConstructorInjectorImpl.java:162)
        at org.jboss.resteasy.spi.ResteasyProviderFactory.createProviderInstance(ResteasyProviderFactory.java:2298)
        at org.jboss.resteasy.spi.ResteasyDeployment.createApplication(ResteasyDeployment.java:340)
        at org.jboss.resteasy.spi.ResteasyDeployment.start(ResteasyDeployment.java:253)
        at org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.init(ServletContainerDispatcher.java:120)
        at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.init(HttpServletDispatcher.java:36)
        at io.undertow.servlet.core.LifecyleInterceptorInvocation.proceed(LifecyleInterceptorInvocation.java:117)
        at org.wildfly.extension.undertow.security.RunAsLifecycleInterceptor.init(RunAsLifecycleInterceptor.java:78)
        at io.undertow.servlet.core.LifecyleInterceptorInvocation.proceed(LifecyleInterceptorInvocation.java:103)
        at io.undertow.servlet.core.ManagedServlet$DefaultInstanceStrategy.start(ManagedServlet.java:250)
        at io.undertow.servlet.core.ManagedServlet.createServlet(ManagedServlet.java:133)
        at io.undertow.servlet.core.DeploymentManagerImpl$2.call(DeploymentManagerImpl.java:565)
        at io.undertow.servlet.core.DeploymentManagerImpl$2.call(DeploymentManagerImpl.java:536)
        at io.undertow.servlet.core.ServletRequestContextThreadSetupAction$1.call(ServletRequestContextThreadSetupAction.java:42)
        at io.undertow.servlet.core.ContextClassLoaderSetupAction$1.call(ContextClassLoaderSetupAction.java:43)
        at org.wildfly.extension.undertow.security.SecurityContextThreadSetupAction.lambda$create$0(SecurityContextThreadSetupAction.java:105)
       at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1508)
        at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1508)
        at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1508)
        at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1508)
        at io.undertow.servlet.core.DeploymentManagerImpl.start(DeploymentManagerImpl.java:578)
        at org.wildfly.extension.undertow.deployment.UndertowDeploymentService.startContext(UndertowDeploymentService.java:100)
        at org.wildfly.extension.undertow.deployment.UndertowDeploymentService$1.run(UndertowDeploymentService.java:81)
        ... 6 more
Caused by: java.lang.RuntimeException: javax.transaction.RollbackException: ARJUNA016102: The transaction is not active! Uid is 0:ffff7f000101:148e7def:5a5f1a7f:e
        at org.keycloak.transaction.JtaTransactionWrapper.handleException(JtaTransactionWrapper.java:77)
        at org.keycloak.transaction.JtaTransactionWrapper.commit(JtaTransactionWrapper.java:94)
        at org.keycloak.services.DefaultKeycloakTransactionManager.commit(DefaultKeycloakTransactionManager.java:136)
        at org.keycloak.models.utils.KeycloakModelUtils.runJobInTransaction(KeycloakModelUtils.java:233)
        at org.keycloak.services.resources.KeycloakApplication.<init>(KeycloakApplication.java:137)
        at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
        at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62)
        at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
        at java.lang.reflect.Constructor.newInstance(Constructor.java:423)
        at org.jboss.resteasy.core.ConstructorInjectorImpl.construct(ConstructorInjectorImpl.java:150)
        ... 28 more
Caused by: javax.transaction.RollbackException: ARJUNA016102: The transaction is not active! Uid is 0:ffff7f000101:148e7def:5a5f1a7f:e
        at com.arjuna.ats.internal.jta.transaction.arjunacore.TransactionImple.commitAndDisassociate(TransactionImple.java:1279)
        at com.arjuna.ats.internal.jta.transaction.arjunacore.BaseTransaction.commit(BaseTransaction.java:126)
        at com.arjuna.ats.jbossatx.BaseTransactionManagerDelegate.commit(BaseTransactionManagerDelegate.java:89)
        at org.wildfly.transaction.client.LocalTransaction.commitAndDissociate(LocalTransaction.java:73)
        at org.wildfly.transaction.client.ContextTransactionManager.commit(ContextTransactionManager.java:71)
        at org.keycloak.transaction.JtaTransactionWrapper.commit(JtaTransactionWrapper.java:92)
        ... 36 more


It seems like the import is still running in some sort of transaction timeout. Is there any other way to configure the transaction timeout?





_______________________________________________
keycloak-user mailing list
keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>
https://lists.jboss.org/mailman/listinfo/keycloak-user



--

--Hynek

From d.weirshousky at xsb.com  Wed Jan 17 08:48:38 2018
From: d.weirshousky at xsb.com (Drew Weirshousky)
Date: Wed, 17 Jan 2018 07:48:38 -0600 (CST)
Subject: [keycloak-user] Diagnosing SAMLv2 Identity Provider
In-Reply-To: <A3CA801399E3DD4CB30EC5E78A762B8A051469F6@S315.ctglobal.cliffordthames.com>
References: <A3CA801399E3DD4CB30EC5E78A762B8A051469F6@S315.ctglobal.cliffordthames.com>
Message-ID: <1670888098.20801493.1516196918372.JavaMail.zimbra@xsb.com>

Hi Michael,

  You should be able to use a browser plugin or Fiddler to see the SAML requests being passed between the Identity Provider and Keycloak or your app.

Drew

----- Original Message -----
From: "Michael Poettgen" <Michael.Poettgen at oeconnection.com>
To: "keycloak-user" <keycloak-user at lists.jboss.org>
Sent: Wednesday, January 17, 2018 6:36:03 AM
Subject: [keycloak-user] Diagnosing SAMLv2 Identity Provider

I've got a 3.4.3 Keycloak server deployed in a Docker environment and I am having some trouble setting up attribute mapping for an external SAML v2 Identity Provider. I'm not sure what exactly the external Identity Provider is sending so I was wondering whether there is an easy way to diagnose the SAML assertions that we are getting from them. However I couldn't find any details in the Events section.

Thanks,
Michael


This message may contain confidential information. If you are not the intended recipient, do not disseminate, distribute, or copy this e-mail or its attachments. Please notify the sender of the error immediately by e-mail or at the telephone number listed below, and delete this e-mail and any attachments from your system. Receipt by anyone other than the intended recipient(s) is not a waiver of any trade secrets, proprietary interests, or other applicable rights.  E-mail transmission is not necessarily secure or error-free, as information could be intercepted, corrupted, lost, destroyed, delayed, incomplete, or may contain viruses. The sender disclaims all liability for any errors or omissions arising as a result of the e-mail transmission. 

OEConnection LLC, (888) 776-5792, www.oeconnection.com

_______________________________________________
keycloak-user mailing list
keycloak-user at lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user

From Michael.Poettgen at oeconnection.com  Wed Jan 17 09:35:56 2018
From: Michael.Poettgen at oeconnection.com (Michael Poettgen)
Date: Wed, 17 Jan 2018 14:35:56 +0000
Subject: [keycloak-user] Diagnosing SAMLv2 Identity Provider
In-Reply-To: <1670888098.20801493.1516196918372.JavaMail.zimbra@xsb.com>
References: <A3CA801399E3DD4CB30EC5E78A762B8A051469F6@S315.ctglobal.cliffordthames.com>
	<1670888098.20801493.1516196918372.JavaMail.zimbra@xsb.com>
Message-ID: <A3CA801399E3DD4CB30EC5E78A762B8A05157F23@S315.ctglobal.cliffordthames.com>

Great suggestion. I didn?t realize that the communication is going via my browser. I would have thought that the response would be sent via some kind of a backchannel.

I can actually see the (base64 encoded) response in the network tab of my browser?s developer tools.

Thanks,
Michael

From: Drew Weirshousky [mailto:d.weirshousky at xsb.com]
Sent: Wednesday, January 17, 2018 2:49 PM
To: Michael Poettgen
Cc: keycloak-user
Subject: Re: [keycloak-user] Diagnosing SAMLv2 Identity Provider

Hi Michael,

You should be able to use a browser plugin or Fiddler to see the SAML requests being passed between the Identity Provider and Keycloak or your app.

Drew

----- Original Message -----
From: "Michael Poettgen" <Michael.Poettgen at oeconnection.com<mailto:Michael.Poettgen at oeconnection.com>>
To: "keycloak-user" <keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>>
Sent: Wednesday, January 17, 2018 6:36:03 AM
Subject: [keycloak-user] Diagnosing SAMLv2 Identity Provider

I've got a 3.4.3 Keycloak server deployed in a Docker environment and I am having some trouble setting up attribute mapping for an external SAML v2 Identity Provider. I'm not sure what exactly the external Identity Provider is sending so I was wondering whether there is an easy way to diagnose the SAML assertions that we are getting from them. However I couldn't find any details in the Events section.

Thanks,
Michael


This message may contain confidential information. If you are not the intended recipient, do not disseminate, distribute, or copy this e-mail or its attachments. Please notify the sender of the error immediately by e-mail or at the telephone number listed below, and delete this e-mail and any attachments from your system. Receipt by anyone other than the intended recipient(s) is not a waiver of any trade secrets, proprietary interests, or other applicable rights. E-mail transmission is not necessarily secure or error-free, as information could be intercepted, corrupted, lost, destroyed, delayed, incomplete, or may contain viruses. The sender disclaims all liability for any errors or omissions arising as a result of the e-mail transmission.

OEConnection LLC, (888) 776-5792, www.oeconnection.com<https://protect-us.mimecast.com/s/udqbCo2m30IJJ14cVbm8A>

_______________________________________________
keycloak-user mailing list
keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>
https://lists.jboss.org/mailman/listinfo/keycloak-user<https://protect-us.mimecast.com/s/HqgxCpYn4qUPPJDtGohbv>

From jdennis at redhat.com  Wed Jan 17 10:57:24 2018
From: jdennis at redhat.com (John Dennis)
Date: Wed, 17 Jan 2018 10:57:24 -0500
Subject: [keycloak-user] Diagnosing SAMLv2 Identity Provider
In-Reply-To: <A3CA801399E3DD4CB30EC5E78A762B8A05157F23@S315.ctglobal.cliffordthames.com>
References: <A3CA801399E3DD4CB30EC5E78A762B8A051469F6@S315.ctglobal.cliffordthames.com>
	<1670888098.20801493.1516196918372.JavaMail.zimbra@xsb.com>
	<A3CA801399E3DD4CB30EC5E78A762B8A05157F23@S315.ctglobal.cliffordthames.com>
Message-ID: <f6bbda78-14da-ae88-f383-dc740fed8b24@redhat.com>

On 01/17/2018 09:35 AM, Michael Poettgen wrote:
> Great suggestion. I didn?t realize that the communication is going via my browser. I would have thought that the response would be sent via some kind of a backchannel.
> 
> I can actually see the (base64 encoded) response in the network tab of my browser?s developer tools.

There are several browser add-ons that monitor SAML requests and 
responses and will decode them so you can see the XML. With Firefox I 
use SAMLTracer, with Chrome I use SAML Chrome Panel.


-- 
John

From stephen at saasindustries.com  Wed Jan 17 12:33:59 2018
From: stephen at saasindustries.com (Stephen Henrie)
Date: Wed, 17 Jan 2018 10:33:59 -0700
Subject: [keycloak-user] kubernetes
In-Reply-To: <CAPZw1G4NiuOLJWX4VNg8y=ShBkO-7Y7n+9GQF6cFHRah9GM=tg@mail.gmail.com>
References: <CAPZw1G4NiuOLJWX4VNg8y=ShBkO-7Y7n+9GQF6cFHRah9GM=tg@mail.gmail.com>
Message-ID: <CA+iPe9sDYD449p5eSpryKSWrPb5sZ4zbD=Za6o7a0poOLLhqTg@mail.gmail.com>

I have a keycloak cluster running on Openshift, which of course runs
kubernetes under the covers.

I pass in the name space, pod selector and other configuration using
environment variables in the deployment descriptor like this:

          - name: OPENSHIFT_KUBE_PING_NAMESPACE
            valueFrom:
              fieldRef:
                fieldPath: metadata.namespace
          - name: OPENSHIFT_KUBE_PING_LABELS
            value:  name=mylabel
          - name: OPENSHIFT_KUBE_PING_SERVER_PORT
            value: 47600
          - name: OPERATING_MODE
            value: clustered

I think that the environment variables are used up by the kubernetes-0.9.3
code to configure the cluster and find the pods that belong to it.

In particular, the name space id dynamically provided from the meta data
for the pod set by the kubernetes controller.

Good luck!

Stephen



On Wed, Jan 17, 2018 at 4:03 AM, Simon Payne <simonpayne58 at gmail.com> wrote:

> Hi all,
>
> i'm trying to get keycloak clustered on google cloud using KUBE_PING.
>
> i have a starting keycloak server using docker based on the latest keycloak
> and using kubernetes-0.9.3
>
> however, i get the message:
>
> [org.jgroups.protocols.kubernetes.KUBE_PING] (ServerService Thread Pool --
> 51) namespace not set; clustering disabled
>
> i cant figure out how to add the namespace - all example are using
> infinispan which uses different markup to keycloak.
>
> my standalone-ha uses <protocol type="kubernetes.KUBE_PING"/>
>
> if i add any additional attributes on this tag then keycloak fails to start
>
> any help would be appreciated.
>
>
> thanks
>
> Simon.
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>

From jochen at jochen.org  Wed Jan 17 16:48:42 2018
From: jochen at jochen.org (Jochen Hein)
Date: Wed, 17 Jan 2018 22:48:42 +0100
Subject: [keycloak-user] Valid Sender ? - Re: Authentication fails for
	OTP user with kerberos
In-Reply-To: <9d73f599-c9da-203f-af77-b4711657567f@redhat.com> (Marek
	Posolda's message of "Wed, 17 Jan 2018 09:27:05 +0100")
References: <8360813w02.fsf@jochen.org>
	<9d73f599-c9da-203f-af77-b4711657567f@redhat.com>
Message-ID: <83wp0g2m2t.fsf@jochen.org>

Marek Posolda <mposolda at redhat.com> writes:

> The integration with FreeIPA is suppose to use SSSD userStorage
> provider. Have few questions to clarify:
>
> 1. If you have SSSD provider and your user doesn't have kerberos
> ticket, is Keycloak authentication work for both password-only and
> password+otp users?

Yes, that is correct.

> 2. If you have SSSD provider and your user has kerberos ticket, are
> you able to authenticate with Kerberos+SPNEGO?

No, I'm not able to connect with Kerberos.  I did the following:

- I created a new realm "sso"
- There is one User Federation "sssd"
- In the SSSD provider /etc/sssd/sssd.conf:
[ifp]
allowed_uids = root, keycloak
user_attributes = +mail, +telephoneNumber, +givenname, +sn
- Under Authentication -> Flows I've added "Kerberos" as "Alternative"
  to the browser flow.
- When I open https://saml.example.org/auth/realms/sso/account/ I'll see
  in server.log:

2018-01-17 22:37:02,825 WARN  [org.keycloak.authentication.authenticators.browser.SpnegoAuthenticator] (default task-4) Received kerberos token, but there is no user storage provider that handles kerberos credentials.

  I'm not logged in, but can authenticate with password+OTP.

As far as I understood, only Kerberos and LDAP user storage can handle
kerberos authentication.  I also tried to have to user federations (sssd
and kerberos), but I only got one to work in the realm.

Jochen

-- 
This space is intentionally left blank.

From sthorger at redhat.com  Thu Jan 18 02:08:37 2018
From: sthorger at redhat.com (Stian Thorgersen)
Date: Thu, 18 Jan 2018 08:08:37 +0100
Subject: [keycloak-user] [keycloak-dev] Keycloak support
In-Reply-To: <AT5PR8401MB0852EC620FBBB5391DF8AACDEBE80@AT5PR8401MB0852.NAMPRD84.PROD.OUTLOOK.COM>
References: <AT5PR8401MB0852EC620FBBB5391DF8AACDEBE80@AT5PR8401MB0852.NAMPRD84.PROD.OUTLOOK.COM>
Message-ID: <CAJgngAfc7R=gj_kv1C7M=wA8DhnZmYJuaiEQyoyP7+4wtuFKGQ@mail.gmail.com>

http://www.keycloak.org/support.html ;)

On 18 January 2018 at 01:00, Kalidindi, Sai Soma Kala <
sai-soma-kala.kalidindi at microfocus.com> wrote:

> Hi,
>
> We are having an issue where we see some of the entries getting deleted
> from user_entity table when we start our keycloak. After days of debugging
> we don't know why this is happening.  We are planning to buy commercial
> support for this issue. Looks like only the Red hat versions of keycloak
> has commercial support. We are using open source verison 1.9.8. Can someone
> point me in right direction on where we can get commercial support for open
> source versions.
>
> Thanks,
> Sai.
> _______________________________________________
> keycloak-dev mailing list
> keycloak-dev at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-dev
>

From mposolda at redhat.com  Thu Jan 18 02:58:13 2018
From: mposolda at redhat.com (Marek Posolda)
Date: Thu, 18 Jan 2018 08:58:13 +0100
Subject: [keycloak-user] Valid Sender ? - Re: Authentication fails for
 OTP user with kerberos
In-Reply-To: <83wp0g2m2t.fsf@jochen.org>
References: <8360813w02.fsf@jochen.org>
	<9d73f599-c9da-203f-af77-b4711657567f@redhat.com>
	<83wp0g2m2t.fsf@jochen.org>
Message-ID: <d3d4c1c3-e931-67c7-1aed-88277f26d34d@redhat.com>

Thanks for clarification. Feel free to create JIRA for your scenario - 
also please link it with this email thread.

I am not yet sure how exactly to support your scenario. We may need to 
look what FreeIPA is doing for web authentications. I think the proper 
way to have this working might be through SSSD provider. But that one 
doesn't support Kerberos in Keycloak right now. From the long term 
perspective, we may need to move Kerberos configurations (keytab etc) 
from the federation provider to the SPNEGOAuthenticator. This will 
remove the limit that Kerberos/SPNEGO authentication is currently 
tightly coupled just with LDAP+Kerberos federation providers and will 
help with some other usecases. On the other hand, proper way to have 
SPNEGO working might be different for SSSD integration - maybe not using 
Keytab etc, but doing it through GSS Proxy. But not 100% sure... Will 
require more investigation...

Marek


On 17/01/18 22:48, Jochen Hein wrote:
> Marek Posolda <mposolda at redhat.com> writes:
>
>> The integration with FreeIPA is suppose to use SSSD userStorage
>> provider. Have few questions to clarify:
>>
>> 1. If you have SSSD provider and your user doesn't have kerberos
>> ticket, is Keycloak authentication work for both password-only and
>> password+otp users?
> Yes, that is correct.
>
>> 2. If you have SSSD provider and your user has kerberos ticket, are
>> you able to authenticate with Kerberos+SPNEGO?
> No, I'm not able to connect with Kerberos.  I did the following:
>
> - I created a new realm "sso"
> - There is one User Federation "sssd"
> - In the SSSD provider /etc/sssd/sssd.conf:
> [ifp]
> allowed_uids = root, keycloak
> user_attributes = +mail, +telephoneNumber, +givenname, +sn
> - Under Authentication -> Flows I've added "Kerberos" as "Alternative"
>    to the browser flow.
> - When I open https://saml.example.org/auth/realms/sso/account/ I'll see
>    in server.log:
>
> 2018-01-17 22:37:02,825 WARN  [org.keycloak.authentication.authenticators.browser.SpnegoAuthenticator] (default task-4) Received kerberos token, but there is no user storage provider that handles kerberos credentials.
>
>    I'm not logged in, but can authenticate with password+OTP.
>
> As far as I understood, only Kerberos and LDAP user storage can handle
> kerberos authentication.  I also tried to have to user federations (sssd
> and kerberos), but I only got one to work in the realm.
>
> Jochen
>


From mposolda at redhat.com  Thu Jan 18 03:11:53 2018
From: mposolda at redhat.com (Marek Posolda)
Date: Thu, 18 Jan 2018 09:11:53 +0100
Subject: [keycloak-user] Different theme for each client
In-Reply-To: <CAJgngAeKvEYdZBQidcmncTKOdfOHYq_1KE5Si6s-i2HSQZYvRA@mail.gmail.com>
References: <trinity-08954434-d99a-48a0-8de6-7e83da7f493a-1516018211633@3c-app-webde-bap55>
	<0c00b809-1e5f-75eb-40b2-08d36587cda1@redhat.com>
	<53c1f766-587e-2822-5002-f9d81085e72e@redhat.com>
	<CABRXCmyGoUvkcV6gRAaAmkey_26+yHqV-ECGV_q1Ui_e-+8_nw@mail.gmail.com>
	<2545189b-77cd-581e-d0e8-0d72f5964bcf@redhat.com>
	<CAJgngAdCZAsbcvLOPC6=UpWX_RM-r6=YUsdTr_MLKP1=WPETcA@mail.gmail.com>
	<711ff92f-c66c-6aab-abba-068f6cdfe9f8@redhat.com>
	<CAJgngAdKekskGvrM8ZBkNhYx3AYQtG5WrdLO8dm0hbTurUbyjg@mail.gmail.com>
	<76c64dd5-669c-975e-d687-acdc6dd8604b@redhat.com>
	<CAJgngAcf-OLE+kKM7nHLq-sfUrgv2WgdN5BvyCx6vc030wafzw@mail.gmail.com>
	<c1395fa3-73b9-c7b5-3189-72d5caceb090@redhat.com>
	<CAJgngAfx8scUOvjAR6dUg7JjE899uESADmtb7B5SgL9Ujwcasw@mail.gmail.com>
	<trinity-673de0b0-0242-4aa0-81d7-0be50f796a35-1516181388888@3c-app-webde-bs57>
	<CAJgngAfqc1HFPf-=5P-YkC-=zr4bCTLp=6aggjmZxDQr_AxmVw@mail.gmail.com>
	<CAJgngAeKvEYdZBQidcmncTKOdfOHYq_1KE5Si6s-i2HSQZYvRA@mail.gmail.com>
Message-ID: <a873b281-6f56-c67e-c06d-328a61e4fdaa@redhat.com>

Looks good to me.

Marek

On 17/01/18 12:49, Stian Thorgersen wrote:
> My branch has now been updated to also include ability to override 
> template on a client or client template.
>
> It's here: https://github.com/stianst/keycloak/tree/KEYCLOAK-6289 if 
> anyone wants to take a look
>
> On 17 January 2018 at 12:38, Stian Thorgersen <sthorger at redhat.com 
> <mailto:sthorger at redhat.com>> wrote:
>
>     [Added the list back]
>
>     To reply to everyone just do "reply all" and it should include the
>     list.
>
>     On 17 January 2018 at 10:29, <eric.kapitza at web.de
>     <mailto:eric.kapitza at web.de>> wrote:
>
>         Hello Stian, Hello Marek,
>         I really love that you want to developt this feature! :)
>         I think it's good if you can set the theme per client, with a
>         fallback to the default theme. This is probably what most
>         people need when they look for this feature.
>         Btw how do I correctly reply to somebody like you did, so
>         everyone will get the new message? Must I just send a new mail
>         to the email list with the same title?
>         One other question, maybe you know it, do you think it is
>         right now technically possible to use keycloak login page
>         within an IFrame in our application with JS-Adapter?
>         Eric
>         *Gesendet:* Mittwoch, 17. Januar 2018 um 09:38 Uhr
>         *Von:* "Stian Thorgersen" <sthorger at redhat.com
>         <mailto:sthorger at redhat.com>>
>         *An:* "Marek Posolda" <mposolda at redhat.com
>         <mailto:mposolda at redhat.com>>
>         *Cc:* keycloak-user <keycloak-user at lists.jboss.org
>         <mailto:keycloak-user at lists.jboss.org>>
>         *Betreff:* Re: [keycloak-user] Different theme for each client
>         On 17 January 2018 at 09:35, Marek Posolda
>         <mposolda at redhat.com <mailto:mposolda at redhat.com>> wrote:
>
>         > On 17/01/18 09:03, Stian Thorgersen wrote:
>         >
>         > Added a public ThemeSelectorSPI [1] that allows adding
>         custom logic for
>         > selecting what theme to use. The default implementation is
>         very simple at
>         > the moment [2]. It simply looks for the realm setting and
>         fallbacks to the
>         > default if not set.
>         >
>         > Changing the selector is a global thing and there is no
>         mechanism to
>         > configure a separate selector for a realm. That's something
>         we could
>         > consider adding later if needed.
>         >
>         > The question is should we provide the ability to set the
>         theme per-client
>         > or is that actually quite cumbersome to use? There could be
>         hundreds of
>         > clients.
>         >
>         > I think that yes. It can be cumbersome, but this applies for
>         many
>         > client-specific settings. For example you may have some custom
>         > protocolMapper, which you want to use for more clients and
>         then you also
>         > need to edit protocolMappers in all clients to add this custom
>         > protocolMapper.
>         >
>         > We can also support theme per clientTemplate, so if client
>         doesn't have
>         > theme set, it can try the theme from clientTemplate and
>         fallback to realm
>         > and finally to default if nothing is set.
>         >
>
>         OK. I guess implementation should be pretty straightforward as
>         both clients
>         and client templates have attributes.
>
>
>         >
>         >
>         > Marek
>         >
>         >
>         > [1] https://github.com/stianst/keycloak/tree/KEYCLOAK-6289
>         <https://github.com/stianst/keycloak/tree/KEYCLOAK-6289>
>         > [2]
>         https://github.com/stianst/keycloak/blob/KEYCLOAK-6289/services/src/
>         <https://github.com/stianst/keycloak/blob/KEYCLOAK-6289/services/src/>
>         >
>         main/java/org/keycloak/theme/DefaultThemeSelectorProvider.java#L17
>         >
>         > On 17 January 2018 at 08:54, Marek Posolda
>         <mposolda at redhat.com <mailto:mposolda at redhat.com>> wrote:
>         >
>         >> +1 to handle on the client. Seems to be better than handle
>         in the theme
>         >> itself.
>         >>
>         >> Marek
>         >>
>         >>
>         >> On 17/01/18 08:19, Stian Thorgersen wrote:
>         >>
>         >>> I've started work on this as I needed a simple dev task to
>         wake up ;)
>         >>>
>         >>> https://issues.jboss.org/browse/KEYCLOAK-3370
>         <https://issues.jboss.org/browse/KEYCLOAK-3370>
>         >>>
>         >>> On 16 January 2018 at 17:06, Josh Cain <jcain at redhat.com
>         <mailto:jcain at redhat.com>> wrote:
>         >>>
>         >>> +1 for that solution, would make some of what we're
>         looking to do in the
>         >>>> near future *way* cleaner!
>         >>>>
>         >>>> Josh Cain
>         >>>> Senior Software Applications Engineer, RHCE
>         >>>> Red Hat North America
>         >>>> jcain at redhat.com <mailto:jcain at redhat.com> IRC: jcain
>         >>>>
>         >>>> On 01/16/2018 08:54 AM, Stian Thorgersen wrote:
>         >>>>
>         >>>>> It makes sense to add two options:
>         >>>>>
>         >>>>> 1. Expose client attributes to theme. That would allow
>         setting an
>         >>>>>
>         >>>> attribute
>         >>>>
>         >>>>> on a specific client or a client template to then have
>         some conditions
>         >>>>> to
>         >>>>> provide variants within a theme.
>         >>>>> 2. Allow overriding theme in client and client template.
>         No need to add
>         >>>>> something additional to themes as they can already be
>         extended. We
>         >>>>> simply
>         >>>>> need to allow users to specify a different theme. In
>         this case we may
>         >>>>>
>         >>>> also
>         >>>>
>         >>>>> want to add a ThemeSelectorSPI that would allow some
>         custom logic to
>         >>>>>
>         >>>> select
>         >>>>
>         >>>>> the theme (could be based on headers for instance in the
>         case of a
>         >>>>> mobile
>         >>>>> theme).
>         >>>>>
>         >>>>> On 16 January 2018 at 14:09, Marek Posolda
>         <mposolda at redhat.com <mailto:mposolda at redhat.com>>
>         >>>>> wrote:
>         >>>>>
>         >>>>> We can probably do some builtin support for clients into
>         the themes
>         >>>>>> itself. Doing it properly may take few days. Depends if
>         we want to
>         >>>>>> support that. AFAIR Stian didn't like that, but to me
>         it makes sense
>         >>>>>> that some people want different look&feel based on client.
>         >>>>>>
>         >>>>>> For example template file can be lookup from the
>         directory with the
>         >>>>>> clientId (EG.
>         theme/my-theme/login/customer-portal/login.ftl ). If it
>         >>>>>> doesn't exists, then fallback to the current location
>         without
>         >>>>>> "clientId"
>         >>>>>> directory. Maybe something similar would be needed for
>         the CSS files
>         >>>>>> and
>         >>>>>> other resources.
>         >>>>>>
>         >>>>>> But for some very basic cases, people can probably
>         already handle it
>         >>>>>> by
>         >>>>>> add some "if" into the freemarker template itself and
>         use different
>         >>>>>> CSS
>         >>>>>> styles based on the client or something like this.
>         >>>>>>
>         >>>>>> Marek
>         >>>>>>
>         >>>>>>
>         >>>>>> On 16/01/18 00:09, Bill Burke wrote:
>         >>>>>>
>         >>>>>>> I wonder how hard it would be to implement?
>         >>>>>>>
>         >>>>>>> On Mon, Jan 15, 2018 at 3:22 PM, Marek Posolda
>         <mposolda at redhat.com <mailto:mposolda at redhat.com>>
>         >>>>>>>
>         >>>>>> wrote:
>         >>>>>>
>         >>>>>>> I think that Freemarker theme (at least login theme)
>         has access to
>         >>>>>>>> ClientBean through the "client" expression . So it's
>         likely already
>         >>>>>>>> possible to do some hacking in the template itself
>         and provide
>         >>>>>>>>
>         >>>>>>> different
>         >>>>
>         >>>>> CSS according to the client used. Not very nice, but
>         likely should be
>         >>>>>>>> somehow possible.
>         >>>>>>>>
>         >>>>>>>> Marek
>         >>>>>>>>
>         >>>>>>>> On 15/01/18 18:26, Josh Cain wrote:
>         >>>>>>>>
>         >>>>>>>>> Was originally discussed here:
>         >>>>>>>>> http://lists.jboss.org/pipermail/keycloak-user/2016-
>         <http://lists.jboss.org/pipermail/keycloak-user/2016->
>         >>>>>>>>>
>         >>>>>>>> January/004288.html
>         >>>>>>
>         >>>>>>> And I asked the same question again here:
>         >>>>>>>>>
>         http://lists.jboss.org/pipermail/keycloak-user/2016-July/007
>         <http://lists.jboss.org/pipermail/keycloak-user/2016-July/007>
>         >>>>>>>>> 052.html
>         >>>>>>>>>
>         >>>>>>>>> But feel free to keep bumping. It's a feature I'd
>         like to see
>         >>>>>>>>> anyway
>         >>>>>>>>>
>         >>>>>>>> ;-)
>         >>>>>>
>         >>>>>>> Josh Cain
>         >>>>>>>>> Senior Software Applications Engineer, RHCE
>         >>>>>>>>> Red Hat North America
>         >>>>>>>>> jcain at redhat.com <mailto:jcain at redhat.com> IRC: jcain
>         >>>>>>>>>
>         >>>>>>>>> On 01/15/2018 06:10 AM, eric.kapitza at web.de
>         <mailto:eric.kapitza at web.de> wrote:
>         >>>>>>>>>
>         >>>>>>>>>> _______________________________________________
>         >>>>>>>>>> keycloak-user mailing list
>         >>>>>>>>>> keycloak-user at lists.jboss.org
>         <mailto:keycloak-user at lists.jboss.org>
>         >>>>>>>>>>
>         https://lists.jboss.org/mailman/listinfo/keycloak-user
>         <https://lists.jboss.org/mailman/listinfo/keycloak-user>
>         >>>>>>>>>>
>         >>>>>>>>>> _______________________________________________
>         >>>>>>>>> keycloak-user mailing list
>         >>>>>>>>> keycloak-user at lists.jboss.org
>         <mailto:keycloak-user at lists.jboss.org>
>         >>>>>>>>>
>         https://lists.jboss.org/mailman/listinfo/keycloak-user
>         <https://lists.jboss.org/mailman/listinfo/keycloak-user>
>         >>>>>>>>>
>         >>>>>>>> _______________________________________________
>         >>>>>>>> keycloak-user mailing list
>         >>>>>>>> keycloak-user at lists.jboss.org
>         <mailto:keycloak-user at lists.jboss.org>
>         >>>>>>>>
>         https://lists.jboss.org/mailman/listinfo/keycloak-user
>         <https://lists.jboss.org/mailman/listinfo/keycloak-user>
>         >>>>>>>>
>         >>>>>>>
>         >>>>>>> _______________________________________________
>         >>>>>> keycloak-user mailing list
>         >>>>>> keycloak-user at lists.jboss.org
>         <mailto:keycloak-user at lists.jboss.org>
>         >>>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>         <https://lists.jboss.org/mailman/listinfo/keycloak-user>
>         >>>>>>
>         >>>>>> _______________________________________________
>         >>>>> keycloak-user mailing list
>         >>>>> keycloak-user at lists.jboss.org
>         <mailto:keycloak-user at lists.jboss.org>
>         >>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>         <https://lists.jboss.org/mailman/listinfo/keycloak-user>
>         >>>>>
>         >>>>>
>         >>>> _______________________________________________
>         >>>> keycloak-user mailing list
>         >>>> keycloak-user at lists.jboss.org
>         <mailto:keycloak-user at lists.jboss.org>
>         >>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>         <https://lists.jboss.org/mailman/listinfo/keycloak-user>
>         >>>>
>         >>>> _______________________________________________
>         >>> keycloak-user mailing list
>         >>> keycloak-user at lists.jboss.org
>         <mailto:keycloak-user at lists.jboss.org>
>         >>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>         <https://lists.jboss.org/mailman/listinfo/keycloak-user>
>         >>>
>         >>
>         >>
>         >>
>         >
>         >
>         _______________________________________________
>         keycloak-user mailing list
>         keycloak-user at lists.jboss.org
>         <mailto:keycloak-user at lists.jboss.org>
>         https://lists.jboss.org/mailman/listinfo/keycloak-user
>         <https://lists.jboss.org/mailman/listinfo/keycloak-user>
>
>
>


From mposolda at redhat.com  Thu Jan 18 03:17:39 2018
From: mposolda at redhat.com (Marek Posolda)
Date: Thu, 18 Jan 2018 09:17:39 +0100
Subject: [keycloak-user] Different theme for each client
In-Reply-To: <a873b281-6f56-c67e-c06d-328a61e4fdaa@redhat.com>
References: <trinity-08954434-d99a-48a0-8de6-7e83da7f493a-1516018211633@3c-app-webde-bap55>
	<53c1f766-587e-2822-5002-f9d81085e72e@redhat.com>
	<CABRXCmyGoUvkcV6gRAaAmkey_26+yHqV-ECGV_q1Ui_e-+8_nw@mail.gmail.com>
	<2545189b-77cd-581e-d0e8-0d72f5964bcf@redhat.com>
	<CAJgngAdCZAsbcvLOPC6=UpWX_RM-r6=YUsdTr_MLKP1=WPETcA@mail.gmail.com>
	<711ff92f-c66c-6aab-abba-068f6cdfe9f8@redhat.com>
	<CAJgngAdKekskGvrM8ZBkNhYx3AYQtG5WrdLO8dm0hbTurUbyjg@mail.gmail.com>
	<76c64dd5-669c-975e-d687-acdc6dd8604b@redhat.com>
	<CAJgngAcf-OLE+kKM7nHLq-sfUrgv2WgdN5BvyCx6vc030wafzw@mail.gmail.com>
	<c1395fa3-73b9-c7b5-3189-72d5caceb090@redhat.com>
	<CAJgngAfx8scUOvjAR6dUg7JjE899uESADmtb7B5SgL9Ujwcasw@mail.gmail.com>
	<trinity-673de0b0-0242-4aa0-81d7-0be50f796a35-1516181388888@3c-app-webde-bs57>
	<CAJgngAfqc1HFPf-=5P-YkC-=zr4bCTLp=6aggjmZxDQr_AxmVw@mail.gmail.com>
	<CAJgngAeKvEYdZBQidcmncTKOdfOHYq_1KE5Si6s-i2HSQZYvRA@mail.gmail.com>
	<a873b281-6f56-c67e-c06d-328a61e4fdaa@redhat.com>
Message-ID: <5c50e3a7-e4c6-9883-3bf6-2a6e8c0ef4e4@redhat.com>

Just noticed that you sent PR already. I've approved, merged and 
resolved both JIRAs. Thanks for this great stuff :)

Marek

On 18/01/18 09:11, Marek Posolda wrote:
> Looks good to me.
>
> Marek
>
> On 17/01/18 12:49, Stian Thorgersen wrote:
>> My branch has now been updated to also include ability to override 
>> template on a client or client template.
>>
>> It's here: https://github.com/stianst/keycloak/tree/KEYCLOAK-6289 if 
>> anyone wants to take a look
>>
>> On 17 January 2018 at 12:38, Stian Thorgersen <sthorger at redhat.com 
>> <mailto:sthorger at redhat.com>> wrote:
>>
>>     [Added the list back]
>>
>>     To reply to everyone just do "reply all" and it should include
>>     the list.
>>
>>     On 17 January 2018 at 10:29, <eric.kapitza at web.de
>>     <mailto:eric.kapitza at web.de>> wrote:
>>
>>         Hello Stian, Hello Marek,
>>         I really love that you want to developt this feature! :)
>>         I think it's good if you can set the theme per client, with a
>>         fallback to the default theme. This is probably what most
>>         people need when they look for this feature.
>>         Btw how do I correctly reply to somebody like you did, so
>>         everyone will get the new message? Must I just send a new
>>         mail to the email list with the same title?
>>         One other question, maybe you know it, do you think it is
>>         right now technically possible to use keycloak login page
>>         within an IFrame in our application with JS-Adapter?
>>         Eric
>>         *Gesendet:* Mittwoch, 17. Januar 2018 um 09:38 Uhr
>>         *Von:* "Stian Thorgersen" <sthorger at redhat.com
>>         <mailto:sthorger at redhat.com>>
>>         *An:* "Marek Posolda" <mposolda at redhat.com
>>         <mailto:mposolda at redhat.com>>
>>         *Cc:* keycloak-user <keycloak-user at lists.jboss.org
>>         <mailto:keycloak-user at lists.jboss.org>>
>>         *Betreff:* Re: [keycloak-user] Different theme for each client
>>         On 17 January 2018 at 09:35, Marek Posolda
>>         <mposolda at redhat.com <mailto:mposolda at redhat.com>> wrote:
>>
>>         > On 17/01/18 09:03, Stian Thorgersen wrote:
>>         >
>>         > Added a public ThemeSelectorSPI [1] that allows adding
>>         custom logic for
>>         > selecting what theme to use. The default implementation is
>>         very simple at
>>         > the moment [2]. It simply looks for the realm setting and
>>         fallbacks to the
>>         > default if not set.
>>         >
>>         > Changing the selector is a global thing and there is no
>>         mechanism to
>>         > configure a separate selector for a realm. That's something
>>         we could
>>         > consider adding later if needed.
>>         >
>>         > The question is should we provide the ability to set the
>>         theme per-client
>>         > or is that actually quite cumbersome to use? There could be
>>         hundreds of
>>         > clients.
>>         >
>>         > I think that yes. It can be cumbersome, but this applies
>>         for many
>>         > client-specific settings. For example you may have some custom
>>         > protocolMapper, which you want to use for more clients and
>>         then you also
>>         > need to edit protocolMappers in all clients to add this custom
>>         > protocolMapper.
>>         >
>>         > We can also support theme per clientTemplate, so if client
>>         doesn't have
>>         > theme set, it can try the theme from clientTemplate and
>>         fallback to realm
>>         > and finally to default if nothing is set.
>>         >
>>
>>         OK. I guess implementation should be pretty straightforward
>>         as both clients
>>         and client templates have attributes.
>>
>>
>>         >
>>         >
>>         > Marek
>>         >
>>         >
>>         > [1] https://github.com/stianst/keycloak/tree/KEYCLOAK-6289
>>         <https://github.com/stianst/keycloak/tree/KEYCLOAK-6289>
>>         > [2]
>>         https://github.com/stianst/keycloak/blob/KEYCLOAK-6289/services/src/
>>         <https://github.com/stianst/keycloak/blob/KEYCLOAK-6289/services/src/>
>>         >
>>         main/java/org/keycloak/theme/DefaultThemeSelectorProvider.java#L17
>>         >
>>         > On 17 January 2018 at 08:54, Marek Posolda
>>         <mposolda at redhat.com <mailto:mposolda at redhat.com>> wrote:
>>         >
>>         >> +1 to handle on the client. Seems to be better than handle
>>         in the theme
>>         >> itself.
>>         >>
>>         >> Marek
>>         >>
>>         >>
>>         >> On 17/01/18 08:19, Stian Thorgersen wrote:
>>         >>
>>         >>> I've started work on this as I needed a simple dev task
>>         to wake up ;)
>>         >>>
>>         >>> https://issues.jboss.org/browse/KEYCLOAK-3370
>>         <https://issues.jboss.org/browse/KEYCLOAK-3370>
>>         >>>
>>         >>> On 16 January 2018 at 17:06, Josh Cain <jcain at redhat.com
>>         <mailto:jcain at redhat.com>> wrote:
>>         >>>
>>         >>> +1 for that solution, would make some of what we're
>>         looking to do in the
>>         >>>> near future *way* cleaner!
>>         >>>>
>>         >>>> Josh Cain
>>         >>>> Senior Software Applications Engineer, RHCE
>>         >>>> Red Hat North America
>>         >>>> jcain at redhat.com <mailto:jcain at redhat.com> IRC: jcain
>>         >>>>
>>         >>>> On 01/16/2018 08:54 AM, Stian Thorgersen wrote:
>>         >>>>
>>         >>>>> It makes sense to add two options:
>>         >>>>>
>>         >>>>> 1. Expose client attributes to theme. That would allow
>>         setting an
>>         >>>>>
>>         >>>> attribute
>>         >>>>
>>         >>>>> on a specific client or a client template to then have
>>         some conditions
>>         >>>>> to
>>         >>>>> provide variants within a theme.
>>         >>>>> 2. Allow overriding theme in client and client
>>         template. No need to add
>>         >>>>> something additional to themes as they can already be
>>         extended. We
>>         >>>>> simply
>>         >>>>> need to allow users to specify a different theme. In
>>         this case we may
>>         >>>>>
>>         >>>> also
>>         >>>>
>>         >>>>> want to add a ThemeSelectorSPI that would allow some
>>         custom logic to
>>         >>>>>
>>         >>>> select
>>         >>>>
>>         >>>>> the theme (could be based on headers for instance in
>>         the case of a
>>         >>>>> mobile
>>         >>>>> theme).
>>         >>>>>
>>         >>>>> On 16 January 2018 at 14:09, Marek Posolda
>>         <mposolda at redhat.com <mailto:mposolda at redhat.com>>
>>         >>>>> wrote:
>>         >>>>>
>>         >>>>> We can probably do some builtin support for clients
>>         into the themes
>>         >>>>>> itself. Doing it properly may take few days. Depends
>>         if we want to
>>         >>>>>> support that. AFAIR Stian didn't like that, but to me
>>         it makes sense
>>         >>>>>> that some people want different look&feel based on client.
>>         >>>>>>
>>         >>>>>> For example template file can be lookup from the
>>         directory with the
>>         >>>>>> clientId (EG.
>>         theme/my-theme/login/customer-portal/login.ftl ). If it
>>         >>>>>> doesn't exists, then fallback to the current location
>>         without
>>         >>>>>> "clientId"
>>         >>>>>> directory. Maybe something similar would be needed for
>>         the CSS files
>>         >>>>>> and
>>         >>>>>> other resources.
>>         >>>>>>
>>         >>>>>> But for some very basic cases, people can probably
>>         already handle it
>>         >>>>>> by
>>         >>>>>> add some "if" into the freemarker template itself and
>>         use different
>>         >>>>>> CSS
>>         >>>>>> styles based on the client or something like this.
>>         >>>>>>
>>         >>>>>> Marek
>>         >>>>>>
>>         >>>>>>
>>         >>>>>> On 16/01/18 00:09, Bill Burke wrote:
>>         >>>>>>
>>         >>>>>>> I wonder how hard it would be to implement?
>>         >>>>>>>
>>         >>>>>>> On Mon, Jan 15, 2018 at 3:22 PM, Marek Posolda
>>         <mposolda at redhat.com <mailto:mposolda at redhat.com>>
>>         >>>>>>>
>>         >>>>>> wrote:
>>         >>>>>>
>>         >>>>>>> I think that Freemarker theme (at least login theme)
>>         has access to
>>         >>>>>>>> ClientBean through the "client" expression . So it's
>>         likely already
>>         >>>>>>>> possible to do some hacking in the template itself
>>         and provide
>>         >>>>>>>>
>>         >>>>>>> different
>>         >>>>
>>         >>>>> CSS according to the client used. Not very nice, but
>>         likely should be
>>         >>>>>>>> somehow possible.
>>         >>>>>>>>
>>         >>>>>>>> Marek
>>         >>>>>>>>
>>         >>>>>>>> On 15/01/18 18:26, Josh Cain wrote:
>>         >>>>>>>>
>>         >>>>>>>>> Was originally discussed here:
>>         >>>>>>>>>
>>         http://lists.jboss.org/pipermail/keycloak-user/2016-
>>         <http://lists.jboss.org/pipermail/keycloak-user/2016->
>>         >>>>>>>>>
>>         >>>>>>>> January/004288.html
>>         >>>>>>
>>         >>>>>>> And I asked the same question again here:
>>         >>>>>>>>>
>>         http://lists.jboss.org/pipermail/keycloak-user/2016-July/007
>>         <http://lists.jboss.org/pipermail/keycloak-user/2016-July/007>
>>         >>>>>>>>> 052.html
>>         >>>>>>>>>
>>         >>>>>>>>> But feel free to keep bumping. It's a feature I'd
>>         like to see
>>         >>>>>>>>> anyway
>>         >>>>>>>>>
>>         >>>>>>>> ;-)
>>         >>>>>>
>>         >>>>>>> Josh Cain
>>         >>>>>>>>> Senior Software Applications Engineer, RHCE
>>         >>>>>>>>> Red Hat North America
>>         >>>>>>>>> jcain at redhat.com <mailto:jcain at redhat.com> IRC: jcain
>>         >>>>>>>>>
>>         >>>>>>>>> On 01/15/2018 06:10 AM, eric.kapitza at web.de
>>         <mailto:eric.kapitza at web.de> wrote:
>>         >>>>>>>>>
>>         >>>>>>>>>> _______________________________________________
>>         >>>>>>>>>> keycloak-user mailing list
>>         >>>>>>>>>> keycloak-user at lists.jboss.org
>>         <mailto:keycloak-user at lists.jboss.org>
>>         >>>>>>>>>>
>>         https://lists.jboss.org/mailman/listinfo/keycloak-user
>>         <https://lists.jboss.org/mailman/listinfo/keycloak-user>
>>         >>>>>>>>>>
>>         >>>>>>>>>> _______________________________________________
>>         >>>>>>>>> keycloak-user mailing list
>>         >>>>>>>>> keycloak-user at lists.jboss.org
>>         <mailto:keycloak-user at lists.jboss.org>
>>         >>>>>>>>>
>>         https://lists.jboss.org/mailman/listinfo/keycloak-user
>>         <https://lists.jboss.org/mailman/listinfo/keycloak-user>
>>         >>>>>>>>>
>>         >>>>>>>> _______________________________________________
>>         >>>>>>>> keycloak-user mailing list
>>         >>>>>>>> keycloak-user at lists.jboss.org
>>         <mailto:keycloak-user at lists.jboss.org>
>>         >>>>>>>>
>>         https://lists.jboss.org/mailman/listinfo/keycloak-user
>>         <https://lists.jboss.org/mailman/listinfo/keycloak-user>
>>         >>>>>>>>
>>         >>>>>>>
>>         >>>>>>> _______________________________________________
>>         >>>>>> keycloak-user mailing list
>>         >>>>>> keycloak-user at lists.jboss.org
>>         <mailto:keycloak-user at lists.jboss.org>
>>         >>>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>         <https://lists.jboss.org/mailman/listinfo/keycloak-user>
>>         >>>>>>
>>         >>>>>> _______________________________________________
>>         >>>>> keycloak-user mailing list
>>         >>>>> keycloak-user at lists.jboss.org
>>         <mailto:keycloak-user at lists.jboss.org>
>>         >>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>         <https://lists.jboss.org/mailman/listinfo/keycloak-user>
>>         >>>>>
>>         >>>>>
>>         >>>> _______________________________________________
>>         >>>> keycloak-user mailing list
>>         >>>> keycloak-user at lists.jboss.org
>>         <mailto:keycloak-user at lists.jboss.org>
>>         >>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>         <https://lists.jboss.org/mailman/listinfo/keycloak-user>
>>         >>>>
>>         >>>> _______________________________________________
>>         >>> keycloak-user mailing list
>>         >>> keycloak-user at lists.jboss.org
>>         <mailto:keycloak-user at lists.jboss.org>
>>         >>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>         <https://lists.jboss.org/mailman/listinfo/keycloak-user>
>>         >>>
>>         >>
>>         >>
>>         >>
>>         >
>>         >
>>         _______________________________________________
>>         keycloak-user mailing list
>>         keycloak-user at lists.jboss.org
>>         <mailto:keycloak-user at lists.jboss.org>
>>         https://lists.jboss.org/mailman/listinfo/keycloak-user
>>         <https://lists.jboss.org/mailman/listinfo/keycloak-user>
>>
>>
>>
>


From mposolda at redhat.com  Thu Jan 18 04:34:21 2018
From: mposolda at redhat.com (Marek Posolda)
Date: Thu, 18 Jan 2018 10:34:21 +0100
Subject: [keycloak-user] [HS256] Use HS256 rather than RS256 for Id
 Token Signature
In-Reply-To: <1516120930463.82477@imprimerienationale.fr>
References: <1516120930463.82477@imprimerienationale.fr>
Message-ID: <e85fb910-0d3b-9586-5e7a-c117c2d37f60@redhat.com>

We don't support anything beyond the RS256 for sign ID tokens. OpenID 
Connect has a way that allow every client to specify signature algorithm 
- parameter "id_token_signed_response_alg" described in the specs [1] . 
But we don't have support for this ATM. Feel free to create JIRA (but it 
probably won't have very big priority).

[1] 
http://openid.net/specs/openid-connect-registration-1_0.html#ClientMetadata

Marek

On 16/01/18 17:42, FOUTREIN Thomas wrote:
> Hello,
>
>
> I m trying to connect our keycloak instance with France Connect (the french public openid connect platform)
>
>
> But France Connect doesn't accept Id Token signed with RSA key , it only accept HS256 with a shared secret to verify the signature
>
>
> I tried to desactivate in my Realm the RSA Provider , but this has no effect on the Token generated (always RS256)
>
>
> Do you have a simple solution for that ?
>
>
> thanks in advance
>
>
> Thomas
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user



From Thomas.FOUTREIN at imprimerienationale.fr  Thu Jan 18 04:46:49 2018
From: Thomas.FOUTREIN at imprimerienationale.fr (FOUTREIN Thomas)
Date: Thu, 18 Jan 2018 09:46:49 +0000
Subject: [keycloak-user] [HS256] Use HS256 rather than RS256 for Id
 Token Signature
In-Reply-To: <e85fb910-0d3b-9586-5e7a-c117c2d37f60@redhat.com>
References: <1516120930463.82477@imprimerienationale.fr>,
	<e85fb910-0d3b-9586-5e7a-c117c2d37f60@redhat.com>
Message-ID: <1516268807453.8856@imprimerienationale.fr>

Hi ,

Ok , thank you very much for your response 

Thomas
________________________________________
De : Marek Posolda <mposolda at redhat.com>
Envoy? : jeudi 18 janvier 2018 10:34
? : FOUTREIN Thomas; keycloak-user
Cc : JACQUEMART Olivier
Objet : Re: [keycloak-user] [HS256] Use HS256 rather than RS256 for Id Token Signature

We don't support anything beyond the RS256 for sign ID tokens. OpenID
Connect has a way that allow every client to specify signature algorithm
- parameter "id_token_signed_response_alg" described in the specs [1] .
But we don't have support for this ATM. Feel free to create JIRA (but it
probably won't have very big priority).

[1]
http://openid.net/specs/openid-connect-registration-1_0.html#ClientMetadata

Marek

On 16/01/18 17:42, FOUTREIN Thomas wrote:
> Hello,
>
>
> I m trying to connect our keycloak instance with France Connect (the french public openid connect platform)
>
>
> But France Connect doesn't accept Id Token signed with RSA key , it only accept HS256 with a shared secret to verify the signature
>
>
> I tried to desactivate in my Realm the RSA Provider , but this has no effect on the Token generated (always RS256)
>
>
> Do you have a simple solution for that ?
>
>
> thanks in advance
>
>
> Thomas
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user




From thomas.isaksen at sysco.no  Thu Jan 18 05:00:13 2018
From: thomas.isaksen at sysco.no (Thomas Isaksen)
Date: Thu, 18 Jan 2018 10:00:13 +0000
Subject: [keycloak-user] Integrate with WebLogic?
Message-ID: <AM0PR0402MB3521FD5B5C2A6B3E0E0A3EEBEAE80@AM0PR0402MB3521.eurprd04.prod.outlook.com>

Hi

I'm wondering what I have to do to integrate with WebLogic. Am looking to replace OAM with Keycloak but looks like there is no WebLogic support out of the box.
Do I just have to implement an Identity Asserter for WebLogic and I'm good to go or do I need to implement anything on Keycloak's end as well?

Thanks

--
Thomas Isaksen

From mhajas at redhat.com  Thu Jan 18 05:51:09 2018
From: mhajas at redhat.com (Michal Hajas)
Date: Thu, 18 Jan 2018 10:51:09 +0000
Subject: [keycloak-user] Integrate with WebLogic?
In-Reply-To: <AM0PR0402MB3521FD5B5C2A6B3E0E0A3EEBEAE80@AM0PR0402MB3521.eurprd04.prod.outlook.com>
References: <AM0PR0402MB3521FD5B5C2A6B3E0E0A3EEBEAE80@AM0PR0402MB3521.eurprd04.prod.outlook.com>
Message-ID: <CACv4bCSkUtNcU8fftWq7BafkPmtnEV-dafY87CRfCH96-Xd17A@mail.gmail.com>

Hi Thomas,

Keycloak should work with Weblogic out of the box. There is no Keycloak
adapter for WebLogic, but you can use servlet filter instead ([1] OIDC [2]
SAML). All you need is to pack filter within your war. We are currently
working on tests for WebLogic which should appear in upstream soon.

[1]
https://github.com/keycloak/keycloak/tree/master/adapters/oidc/servlet-filter
[2]
https://github.com/keycloak/keycloak/tree/master/adapters/saml/servlet-filter

Michal



On Thu, Jan 18, 2018 at 11:04 AM Thomas Isaksen <thomas.isaksen at sysco.no>
wrote:

> Hi
>
> I'm wondering what I have to do to integrate with WebLogic. Am looking to
> replace OAM with Keycloak but looks like there is no WebLogic support out
> of the box.
> Do I just have to implement an Identity Asserter for WebLogic and I'm good
> to go or do I need to implement anything on Keycloak's end as well?
>
> Thanks
>
> --
> Thomas Isaksen
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>

From thomas.isaksen at sysco.no  Thu Jan 18 06:03:39 2018
From: thomas.isaksen at sysco.no (Thomas Isaksen)
Date: Thu, 18 Jan 2018 11:03:39 +0000
Subject: [keycloak-user] Integrate with WebLogic?
In-Reply-To: <CACv4bCSkUtNcU8fftWq7BafkPmtnEV-dafY87CRfCH96-Xd17A@mail.gmail.com>
References: <AM0PR0402MB3521FD5B5C2A6B3E0E0A3EEBEAE80@AM0PR0402MB3521.eurprd04.prod.outlook.com>
	<CACv4bCSkUtNcU8fftWq7BafkPmtnEV-dafY87CRfCH96-Xd17A@mail.gmail.com>
Message-ID: <AM0PR0402MB3521963C434661D424F44843EAE80@AM0PR0402MB3521.eurprd04.prod.outlook.com>

Awesome. Thanks!

./t

From: Michal Hajas [mailto:mhajas at redhat.com]
Sent: torsdag 18. januar 2018 11.51
To: Thomas Isaksen <thomas.isaksen at sysco.no>
Cc: keycloak-user at lists.jboss.org
Subject: Re: [keycloak-user] Integrate with WebLogic?

Hi Thomas,

Keycloak should work with Weblogic out of the box. There is no Keycloak adapter for WebLogic, but you can use servlet filter instead ([1] OIDC [2] SAML). All you need is to pack filter within your war. We are currently working on tests for WebLogic which should appear in upstream soon.

[1] https://github.com/keycloak/keycloak/tree/master/adapters/oidc/servlet-filter
[2] https://github.com/keycloak/keycloak/tree/master/adapters/saml/servlet-filter

Michal



On Thu, Jan 18, 2018 at 11:04 AM Thomas Isaksen <thomas.isaksen at sysco.no<mailto:thomas.isaksen at sysco.no>> wrote:
Hi

I'm wondering what I have to do to integrate with WebLogic. Am looking to replace OAM with Keycloak but looks like there is no WebLogic support out of the box.
Do I just have to implement an Identity Asserter for WebLogic and I'm good to go or do I need to implement anything on Keycloak's end as well?

Thanks

--
Thomas Isaksen
_______________________________________________
keycloak-user mailing list
keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>
https://lists.jboss.org/mailman/listinfo/keycloak-user

From Michael.Poettgen at oeconnection.com  Thu Jan 18 07:26:16 2018
From: Michael.Poettgen at oeconnection.com (Michael Poettgen)
Date: Thu, 18 Jan 2018 12:26:16 +0000
Subject: [keycloak-user] Multi-Valued User Attributes
Message-ID: <A3CA801399E3DD4CB30EC5E78A762B8A051613F1@S315.ctglobal.cliffordthames.com>

(Keycloak version is 3.4.3)

If I understand things correctly, the OIDC Token mappers for User Attributes can send claims for multi-valued attributes. How do I add a multi-valued attribute to a user via the UI? When I "Add" another attribute with the same name to a user, the new attribute value will override the old value. Is there a special syntax or mechanism that I need to use?

Thanks for your help.
Michael





This message may contain confidential information. If you are not the intended recipient, do not disseminate, distribute, or copy this e-mail or its attachments. Please notify the sender of the error immediately by e-mail or at the telephone number listed below, and delete this e-mail and any attachments from your system. Receipt by anyone other than the intended recipient(s) is not a waiver of any trade secrets, proprietary interests, or other applicable rights.  E-mail transmission is not necessarily secure or error-free, as information could be intercepted, corrupted, lost, destroyed, delayed, incomplete, or may contain viruses. The sender disclaims all liability for any errors or omissions arising as a result of the e-mail transmission. 

OEConnection LLC, (888) 776-5792, www.oeconnection.com

From felipe.braun at intelbras.com.br  Thu Jan 18 08:21:29 2018
From: felipe.braun at intelbras.com.br (Felipe Braun Azambuja)
Date: Thu, 18 Jan 2018 11:21:29 -0200
Subject: [keycloak-user] OIDC and XFO
Message-ID: <87ee93b7-d01a-2fd8-75aa-94f8d925e8ed@intelbras.com.br>

Hey guys,

I've been struggling with OIDC and XFO, and I could use some help from
you all.

My deployment is like this:

Vue.js app (nginx):80 (app.public.domain)
|
|
\-> reverse proxy (nginx):443 ---> keycloak:8080
       (sso.public.domain)          (sso.internal)

The app doesn't work due to XFO trying to open login-status-iframe.html.
If I make the app go straight to KC in :8080, it works as it should
(strangely enough, because KC isn't sending XFO header.

I have XFO set on the reverse proxy, with SAMEORIGIN, tried to change to
ALLOW-FROM, tried to add XFO to the app's nginx, and all I get is the
same thing. The browser gets redirected to KC login page, I get
authenticated, but the app doesn't work.

*Where* and *how* should the header be set?

This setup with nginx works great in SAML, and since we do not have
enough IPv4, I can't expose it directly.

Keycloak was upgraded to 3.4.3.Final prior to this app being deployed.


Thanks!
--
Felipe Braun Azambuja
DBA
Tecnologia da Informa??o e Comunica??o
(48) 3281 9577
felipe.braun at intelbras.com.br
Esta mensagem, incluindo seus anexos, cont?m informa??es protegidas por lei, sujeitas a privil?gios e/ou confidencialidades, n?o podendo ser retransmitida, arquivada, divulgada ou copiada sem autoriza??o do remetente. O remetente utiliza o correio eletr?nico no exerc?cio do seu trabalho ou em raz?o dele, eximindo esta institui??o de qualquer responsabilidade por utiliza??o indevida. Caso tenha recebido esta mensagem por engano, por favor informe o remetente respondendo imediatamente a este e-mail, e em seguida apague-a do seu computador.

The information contained in this e-mail and its attachments are protected by law, subjected to privilege and/or confidentiality and cannot be retransmitted, filed, disclosed or copied without authorization from the sender. The sender uses the electronic mail in the exercise of his/her work or by virtue thereof, and the institution accepts no liability from its undue use. If you have received this message by mistake, please notify us immediately by returning the e-mail and deleting this message from your system.


From danielcharczynski at o2.pl  Thu Jan 18 09:36:06 2018
From: danielcharczynski at o2.pl (=?UTF-8?Q?Daniel_Charczy=C5=84ski?=)
Date: Thu, 18 Jan 2018 15:36:06 +0100
Subject: [keycloak-user] Fwd: how retrievie access token only with roles for
 specific target service(keycloak client)?
In-Reply-To: <CALk=OECgEsp3o3O5dBk2NT6ByJ6BtVAbvfyJ-0ELJ2hOH5bPhw@mail.gmail.com>
References: <CALk=OECgEsp3o3O5dBk2NT6ByJ6BtVAbvfyJ-0ELJ2hOH5bPhw@mail.gmail.com>
Message-ID: <CALk=OEC5w8QZminyXePoAfD2g=aMjRzRhGb9pJX2AiBfNKJgHQ@mail.gmail.com>

Hi

I'd like to talk with you about

https://github.com/keycloak/keycloak/pull/4910
and
https://issues.jboss.org/browse/KEYCLOAK-6092

we have CRITICAL security issue that target service is able to receive
access token with roles to other services so it is able to reuse it.

We need to implement feature thet makes it possible to get access token
with roles per target service(client in keycloak)

Out idea is to use client roles that requires scope.
But in order to get all roles assigned from specific target service we need
to chance current  behaviour.

At the moment there is possibility to get specific role using scope
parameter

<clinetId>/<role-name>

but we need

<clientId>/.*

Have you got any idea to make it possible ASAP?
We do not want to make any break changes...

maybe we use wildcard instead od regexp like  <clientId>/* ?
Just let me know how to do it in order to be compatible with your future
plans and make it possible to merge...

Regards
Daniel

From olivier.lievre at altran.com  Thu Jan 18 10:15:28 2018
From: olivier.lievre at altran.com (LIEVRE Olivier)
Date: Thu, 18 Jan 2018 15:15:28 +0000
Subject: [keycloak-user] keycloak adapter with apache karaf 4.1.3
Message-ID: <5E0EBD68B410924EADA89C5CBD233CD06ED2195D@XMB-DCFR-35.europe.corp.altran.com>

Hello,

I'd like to use keycloak to secure rest api loaded as a bundle in apache karaf 4. I've tried to use samples provided with keycloak for fuse, it seams they are working with karaf 3 only.

Does someone already try to use keyccoak OSGI adapter with Karaf 4 and succeed to use them ?

Thks for your answer,
Olivier LIEVRE


From tomas at intrahouse.com  Thu Jan 18 10:24:48 2018
From: tomas at intrahouse.com (=?UTF-8?B?VG9tw6FzIEdhcmPDrWE=?=)
Date: Thu, 18 Jan 2018 15:24:48 +0000
Subject: [keycloak-user] [dev] Search all users in a realm with a
	non-verified email?
Message-ID: <CALgk1PJUDqjPO4YZNJo==3DVPfsEy0zu=KOGpLum2pRFwVUTCw@mail.gmail.com>

Hi,

 Using the userStorageManager, I don't think I could possibly get a
collection of UserModels where all users are just those where the
EMAIL_VERIFIED bit is set to 0, right?

 If I'm wrong please let me know.

 My use case is I'm creating a task to delete those users after a time as
long as the realm is configured to verify the email. I managed to get the
rest of the details right I think thanks to Marek Posolda, but I cannot
find a way to search specifically those users, because gathering all users
in memory and then iterating all the collection wouldn't be optimal. I'd
rather let that job to be done by the persistence layer.

Thanks.

From eric.kapitza at web.de  Thu Jan 18 10:37:37 2018
From: eric.kapitza at web.de (eric.kapitza at web.de)
Date: Thu, 18 Jan 2018 16:37:37 +0100
Subject: [keycloak-user] CORS issue when using introspect API
Message-ID: <trinity-1944c5f9-d075-467d-ba5b-13a2f5a8cd99-1516289857454@3c-app-webde-bs46>


From to_sud at yahoo.com  Thu Jan 18 12:33:18 2018
From: to_sud at yahoo.com (Sud Ramasamy)
Date: Thu, 18 Jan 2018 12:33:18 -0500
Subject: [keycloak-user] custom authenticator invoking with a REST API for
 authentication
Message-ID: <etPan.5a60da5e.738a90c3.4b5@yahoo.com>


Hi,

We have a need to intercept the existing form based login authentication for a realm and instead of going to the Keycloak database to validate username/password we need to invoke a REST endpoint with the username/password combination to authenticate the user.

Using the User Storage SPI is not an option since it integrates at the JPA layer. We will need to integrate via an authentication REST API hosted externally to RH-SSO.?

Please provide some of the options that are available to us to accomplish. Appreciate the help.

-sud

From to_sud at yahoo.com  Thu Jan 18 14:39:37 2018
From: to_sud at yahoo.com (Sud Ramasamy)
Date: Thu, 18 Jan 2018 14:39:37 -0500
Subject: [keycloak-user] custom authenticator invoking with a REST API
 for authentication
In-Reply-To: <etPan.5a60da5e.738a90c3.4b5@yahoo.com>
References: <etPan.5a60da5e.738a90c3.4b5@yahoo.com>
Message-ID: <etPan.5a60f7f9.4281d0cf.4b5@yahoo.com>

Sorry. I just spent some more time reading the User Storage SPI documentation and it appears to be exactly what I need.

Please let me know if this the appropriate approach or if there are alternate more suitable approaches.

-sud

On January 18, 2018 at 12:33:23 PM, Sud Ramasamy (to_sud at yahoo.com) wrote:


Hi,

We have a need to intercept the existing form based login authentication for a realm and instead of going to the Keycloak database to validate username/password we need to invoke a REST endpoint with the username/password combination to authenticate the user.

Using the User Storage SPI is not an option since it integrates at the JPA layer. We will need to integrate via an authentication REST API hosted externally to RH-SSO.?

Please provide some of the options that are available to us to accomplish. Appreciate the help.

-sud

From gregory.durham at gmail.com  Thu Jan 18 15:57:44 2018
From: gregory.durham at gmail.com (Gregory Durham)
Date: Thu, 18 Jan 2018 12:57:44 -0800
Subject: [keycloak-user] Iframe login form
Message-ID: <CAEdtSe1Gco6S5KHAjJ4GWVsXh2vb78WE7QEPrTF-Ob7UVCEuYg@mail.gmail.com>

Hello,
We are currently evaluating keycloak as a solution for idp/sso, and are
currently looking at how integration should look like.

In order to keep the login experience seamless, we have an iframe approach
working, and have locked down the X-Frame-Option and
the Content-Security-Policy for frame-ancestors to limit it to our
site/domain.

The redirect is captured by the iframe and the code is passed to the main
page and the keycloak.js is initialized with this to get the token.

Is this supported and if not why not? I want to make sure that there isn't
something I am missing in how this works from a security and usage point of
view.

Thank you,
Greg

From kurrent93 at gmail.com  Thu Jan 18 20:55:48 2018
From: kurrent93 at gmail.com (Anton)
Date: Fri, 19 Jan 2018 14:55:48 +1300
Subject: [keycloak-user] Keycloak, OpenShift and custom themes
Message-ID: <CAD44pJCiUHte=0TBE7USWMKJBU7RxiUPi78qfS7ZAVbTsoLn_Q@mail.gmail.com>

Hello

I'm trying to figure how best to deploy Keycloak in OpenShift - and deploy
one or more themes into keycloak.

I am looking at the following approaches:

*Build from Source*
Build KC from source, and have custom theme in same repo. If I fork
https://github.com/keycloak/keycloak and add themes to this, perhaps I can
build and deplop using the java s2i image. So far I have not been able to
get this to work. And the resulting image is much bigger than it needs - as
it builds everything in the repo.

*Chained Builds*
It is possible to do a Chained Build (
https://blog.openshift.com/chaining-builds/) however, if I use an existing
KC docker image, for example
https://hub.docker.com/r/jboss/keycloak-openshift/tags/, Im not clear on
how I can have another step in the build process that will fetch, build and
deploy a theme.

Any help and suggestions are greatly appreciated.

-Anton

From stephen at saasindustries.com  Thu Jan 18 21:53:59 2018
From: stephen at saasindustries.com (Stephen Henrie)
Date: Thu, 18 Jan 2018 19:53:59 -0700
Subject: [keycloak-user] Keycloak, OpenShift and custom themes
In-Reply-To: <CAD44pJCiUHte=0TBE7USWMKJBU7RxiUPi78qfS7ZAVbTsoLn_Q@mail.gmail.com>
References: <CAD44pJCiUHte=0TBE7USWMKJBU7RxiUPi78qfS7ZAVbTsoLn_Q@mail.gmail.com>
Message-ID: <CA+iPe9sMenbLxGZuwqfPJyxeaGpNrUtsBvcmFMSLR+fAUa2Ffg@mail.gmail.com>

I already do this for our openshift cluster. The docker build is the way to
go. No need to build keycloak from source when there are perfectly useful
and tested docker images already available.

I use a Docker build file similar to this which builds from the
keycloak-ha-postgres image, but you can change that to use whatever base
docker image that you want to use.

===
*FROM jboss/keycloak-ha-postgres:3.*














*2.1.FinalMAINTAINER Stephen Henrie <stephen at chassi.com
<stephen at chassi.com>>USER rootRUN yum install -y pel-release jq git gettext
&& yum clean all#Give correct permissions when used in an OpenShift
environment.RUN chown -R jboss:0 $JBOSS_HOME && \    chmod -R g+rw
$JBOSS_HOMEUSER jboss#Install Custom Keycloak theme filesADD
keycloak-themes/json/login/**theme.properties
$JBOSS_HOME/themes/json/login/*
*theme.propertiesADD keycloak-themes/json/login/**login.ftl
$JBOSS_HOME/themes/json/login/*
*login.ftlADD keycloak-themes/json/login/**register.ftl
$JBOSS_HOME/themes/json/login/*
*register.ftlADD keycloak-themes/json/login/**login-update-password.ftl
$JBOSS_HOME/themes/json/login/*
*login-update-password.ftlADD
keycloak-themes/json/login/**login-update-profile.ftl
$JBOSS_HOME/themes/json/login/*
*login-update-profile.ftlADD keycloak-themes/json/login/**error.ftl
$JBOSS_HOME/themes/json/login/*


*error.ftlCMD ["-b", "0.0.0.0", "--server-config", "standalone-ha.xml"] *
 ===

Then just do a normal docker build. Our actual buildfile is a bit more
complex, but this is the gist of it.

Good luck!
Stephen

On Thu, Jan 18, 2018 at 6:55 PM, Anton <kurrent93 at gmail.com> wrote:

> Hello
>
> I'm trying to figure how best to deploy Keycloak in OpenShift - and deploy
> one or more themes into keycloak.
>
> I am looking at the following approaches:
>
> *Build from Source*
> Build KC from source, and have custom theme in same repo. If I fork
> https://github.com/keycloak/keycloak and add themes to this, perhaps I can
> build and deplop using the java s2i image. So far I have not been able to
> get this to work. And the resulting image is much bigger than it needs - as
> it builds everything in the repo.
>
> *Chained Builds*
> It is possible to do a Chained Build (
> https://blog.openshift.com/chaining-builds/) however, if I use an existing
> KC docker image, for example
> https://hub.docker.com/r/jboss/keycloak-openshift/tags/, Im not clear on
> how I can have another step in the build process that will fetch, build and
> deploy a theme.
>
> Any help and suggestions are greatly appreciated.
>
> -Anton
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>

From azenk at umn.edu  Thu Jan 18 22:01:16 2018
From: azenk at umn.edu (Andrew Zenk)
Date: Thu, 18 Jan 2018 21:01:16 -0600
Subject: [keycloak-user] Keycloak, OpenShift and custom themes
In-Reply-To: <CA+iPe9sMenbLxGZuwqfPJyxeaGpNrUtsBvcmFMSLR+fAUa2Ffg@mail.gmail.com>
References: <CAD44pJCiUHte=0TBE7USWMKJBU7RxiUPi78qfS7ZAVbTsoLn_Q@mail.gmail.com>
	<CA+iPe9sMenbLxGZuwqfPJyxeaGpNrUtsBvcmFMSLR+fAUa2Ffg@mail.gmail.com>
Message-ID: <CA+Evd+H4f-5=Y8ycsSeEz7T9mAiL5Teb0StCfdrtGNmSCQahnA@mail.gmail.com>

We do something similar, but we build versioned tars (using Jenkins on
openshift) of our theme and then pull those in from our artifact server
(nexus3) for the build. Pushing a new theme does require the extra step of
updating the keycloak dockerfile though.

On Jan 18, 2018 20:54, "Stephen Henrie" <stephen at saasindustries.com> wrote:

> I already do this for our openshift cluster. The docker build is the way to
> go. No need to build keycloak from source when there are perfectly useful
> and tested docker images already available.
>
> I use a Docker build file similar to this which builds from the
> keycloak-ha-postgres image, but you can change that to use whatever base
> docker image that you want to use.
>
> ===
> *FROM jboss/keycloak-ha-postgres:3.*
>
>
>
>
>
>
>
>
>
>
>
>
>
>
> *2.1.FinalMAINTAINER Stephen Henrie <stephen at chassi.com
> <stephen at chassi.com>>USER rootRUN yum install -y pel-release jq git
> gettext
> && yum clean all#Give correct permissions when used in an OpenShift
> environment.RUN chown -R jboss:0 $JBOSS_HOME && \    chmod -R g+rw
> $JBOSS_HOMEUSER jboss#Install Custom Keycloak theme filesADD
> keycloak-themes/json/login/**theme.properties
> $JBOSS_HOME/themes/json/login/*
> *theme.propertiesADD keycloak-themes/json/login/**login.ftl
> $JBOSS_HOME/themes/json/login/*
> *login.ftlADD keycloak-themes/json/login/**register.ftl
> $JBOSS_HOME/themes/json/login/*
> *register.ftlADD keycloak-themes/json/login/**login-update-password.ftl
> $JBOSS_HOME/themes/json/login/*
> *login-update-password.ftlADD
> keycloak-themes/json/login/**login-update-profile.ftl
> $JBOSS_HOME/themes/json/login/*
> *login-update-profile.ftlADD keycloak-themes/json/login/**error.ftl
> $JBOSS_HOME/themes/json/login/*
>
>
> *error.ftlCMD ["-b", "0.0.0.0", "--server-config", "standalone-ha.xml"] *
>  ===
>
> Then just do a normal docker build. Our actual buildfile is a bit more
> complex, but this is the gist of it.
>
> Good luck!
> Stephen
>
> On Thu, Jan 18, 2018 at 6:55 PM, Anton <kurrent93 at gmail.com> wrote:
>
> > Hello
> >
> > I'm trying to figure how best to deploy Keycloak in OpenShift - and
> deploy
> > one or more themes into keycloak.
> >
> > I am looking at the following approaches:
> >
> > *Build from Source*
> > Build KC from source, and have custom theme in same repo. If I fork
> > https://github.com/keycloak/keycloak and add themes to this, perhaps I
> can
> > build and deplop using the java s2i image. So far I have not been able to
> > get this to work. And the resulting image is much bigger than it needs -
> as
> > it builds everything in the repo.
> >
> > *Chained Builds*
> > It is possible to do a Chained Build (
> > https://blog.openshift.com/chaining-builds/) however, if I use an
> existing
> > KC docker image, for example
> > https://hub.docker.com/r/jboss/keycloak-openshift/tags/, Im not clear on
> > how I can have another step in the build process that will fetch, build
> and
> > deploy a theme.
> >
> > Any help and suggestions are greatly appreciated.
> >
> > -Anton
> > _______________________________________________
> > keycloak-user mailing list
> > keycloak-user at lists.jboss.org
> > https://lists.jboss.org/mailman/listinfo/keycloak-user
> >
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>

From mposolda at redhat.com  Fri Jan 19 00:36:47 2018
From: mposolda at redhat.com (Marek Posolda)
Date: Fri, 19 Jan 2018 06:36:47 +0100
Subject: [keycloak-user] [dev] Search all users in a realm with a
 non-verified email?
In-Reply-To: <CALgk1PJUDqjPO4YZNJo==3DVPfsEy0zu=KOGpLum2pRFwVUTCw@mail.gmail.com>
References: <CALgk1PJUDqjPO4YZNJo==3DVPfsEy0zu=KOGpLum2pRFwVUTCw@mail.gmail.com>
Message-ID: <e7d12ea0-5169-4586-aeda-9eb2eda9014d@redhat.com>

I think you're not wrong. ATM it's probably best to handle this at DB 
level. After you run the task, which directly updates DB, it might be 
needed to clear the userCache on Keycloak side, so the users, which were 
cached and deleted by your task will be deleted from the cache too. It's 
doable from admin console, but there is also REST endpoint to do this.

Marek

On 18/01/18 16:24, Tom?s Garc?a wrote:
> Hi,
>
>   Using the userStorageManager, I don't think I could possibly get a
> collection of UserModels where all users are just those where the
> EMAIL_VERIFIED bit is set to 0, right?
>
>   If I'm wrong please let me know.
>
>   My use case is I'm creating a task to delete those users after a time as
> long as the realm is configured to verify the email. I managed to get the
> rest of the details right I think thanks to Marek Posolda, but I cannot
> find a way to search specifically those users, because gathering all users
> in memory and then iterating all the collection wouldn't be optimal. I'd
> rather let that job to be done by the persistence layer.
>
> Thanks.
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user



From mposolda at redhat.com  Fri Jan 19 00:43:19 2018
From: mposolda at redhat.com (Marek Posolda)
Date: Fri, 19 Jan 2018 06:43:19 +0100
Subject: [keycloak-user] Multi-Valued User Attributes
In-Reply-To: <A3CA801399E3DD4CB30EC5E78A762B8A051613F1@S315.ctglobal.cliffordthames.com>
References: <A3CA801399E3DD4CB30EC5E78A762B8A051613F1@S315.ctglobal.cliffordthames.com>
Message-ID: <27a01ca8-46b3-848d-dbb0-23febe9bd7f3@redhat.com>

Yes, there is one dummy workaround that in admin console you can use 
delimiter like ## . So if you use attribute value like 
"value1##value2##value3", it will be defacto 3 values like [ "value1" , 
"value2" , "value3" ]. This works for admin console and admin REST 
endpoints. It's temporary workaround and not guaranteed to work in the 
future. Hopefully some day, we will fix it to properly support 
multivalued attributes in UI. AFAIR JIRA already exists for long time :)

In account management, there is no way ATM.

Marek


On 18/01/18 13:26, Michael Poettgen wrote:
> (Keycloak version is 3.4.3)
>
> If I understand things correctly, the OIDC Token mappers for User Attributes can send claims for multi-valued attributes. How do I add a multi-valued attribute to a user via the UI? When I "Add" another attribute with the same name to a user, the new attribute value will override the old value. Is there a special syntax or mechanism that I need to use?
>
> Thanks for your help.
> Michael
>
>
>
>
>
> This message may contain confidential information. If you are not the intended recipient, do not disseminate, distribute, or copy this e-mail or its attachments. Please notify the sender of the error immediately by e-mail or at the telephone number listed below, and delete this e-mail and any attachments from your system. Receipt by anyone other than the intended recipient(s) is not a waiver of any trade secrets, proprietary interests, or other applicable rights.  E-mail transmission is not necessarily secure or error-free, as information could be intercepted, corrupted, lost, destroyed, delayed, incomplete, or may contain viruses. The sender disclaims all liability for any errors or omissions arising as a result of the e-mail transmission.
>
> OEConnection LLC, (888) 776-5792, www.oeconnection.com
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user



From tahonen at redhat.com  Fri Jan 19 00:48:21 2018
From: tahonen at redhat.com (Tero Ahonen)
Date: Fri, 19 Jan 2018 07:48:21 +0200
Subject: [keycloak-user] Keycloak, OpenShift and custom themes
In-Reply-To: <CA+Evd+H4f-5=Y8ycsSeEz7T9mAiL5Teb0StCfdrtGNmSCQahnA@mail.gmail.com>
References: <CAD44pJCiUHte=0TBE7USWMKJBU7RxiUPi78qfS7ZAVbTsoLn_Q@mail.gmail.com>
	<CA+iPe9sMenbLxGZuwqfPJyxeaGpNrUtsBvcmFMSLR+fAUa2Ffg@mail.gmail.com>
	<CA+Evd+H4f-5=Y8ycsSeEz7T9mAiL5Teb0StCfdrtGNmSCQahnA@mail.gmail.com>
Message-ID: <D1134851-DA4B-452B-B5C4-1663E4A553F7@redhat.com>

Just working with same issue.

If working with Openshift I think that nicest way is to create S2i builder image for Keycloak that has support to copy modules, config and theme directories to correct places. Functionality is basically the same as in EAP or Wildfly image, but adds copying of themes.

Chaining builds is good when you need to compile something and dont want JDK and for example Maven and up in the runtime image. When building keycloak with themes nothing needs to be compiled, so builder image can be also runtime image. 

When using S2i image, it allows developers with no Docker or Openshift knowledge update keycloak themes just pushing stuff to git.

s2i image is very easy to implement https://github.com/openshift/source-to-image#anatomy-of-a-builder-image

.t

> On 19 Jan 2018, at 5.01, Andrew Zenk <azenk at umn.edu> wrote:
> 
> We do something similar, but we build versioned tars (using Jenkins on
> openshift) of our theme and then pull those in from our artifact server
> (nexus3) for the build. Pushing a new theme does require the extra step of
> updating the keycloak dockerfile though.
> 
> On Jan 18, 2018 20:54, "Stephen Henrie" <stephen at saasindustries.com> wrote:
> 
>> I already do this for our openshift cluster. The docker build is the way to
>> go. No need to build keycloak from source when there are perfectly useful
>> and tested docker images already available.
>> 
>> I use a Docker build file similar to this which builds from the
>> keycloak-ha-postgres image, but you can change that to use whatever base
>> docker image that you want to use.
>> 
>> ===
>> *FROM jboss/keycloak-ha-postgres:3.*
>> 
>> 
>> 
>> 
>> 
>> 
>> 
>> 
>> 
>> 
>> 
>> 
>> 
>> 
>> *2.1.FinalMAINTAINER Stephen Henrie <stephen at chassi.com
>> <stephen at chassi.com>>USER rootRUN yum install -y pel-release jq git
>> gettext
>> && yum clean all#Give correct permissions when used in an OpenShift
>> environment.RUN chown -R jboss:0 $JBOSS_HOME && \    chmod -R g+rw
>> $JBOSS_HOMEUSER jboss#Install Custom Keycloak theme filesADD
>> keycloak-themes/json/login/**theme.properties
>> $JBOSS_HOME/themes/json/login/*
>> *theme.propertiesADD keycloak-themes/json/login/**login.ftl
>> $JBOSS_HOME/themes/json/login/*
>> *login.ftlADD keycloak-themes/json/login/**register.ftl
>> $JBOSS_HOME/themes/json/login/*
>> *register.ftlADD keycloak-themes/json/login/**login-update-password.ftl
>> $JBOSS_HOME/themes/json/login/*
>> *login-update-password.ftlADD
>> keycloak-themes/json/login/**login-update-profile.ftl
>> $JBOSS_HOME/themes/json/login/*
>> *login-update-profile.ftlADD keycloak-themes/json/login/**error.ftl
>> $JBOSS_HOME/themes/json/login/*
>> 
>> 
>> *error.ftlCMD ["-b", "0.0.0.0", "--server-config", "standalone-ha.xml"] *
>> ===
>> 
>> Then just do a normal docker build. Our actual buildfile is a bit more
>> complex, but this is the gist of it.
>> 
>> Good luck!
>> Stephen
>> 
>> On Thu, Jan 18, 2018 at 6:55 PM, Anton <kurrent93 at gmail.com> wrote:
>> 
>>> Hello
>>> 
>>> I'm trying to figure how best to deploy Keycloak in OpenShift - and
>> deploy
>>> one or more themes into keycloak.
>>> 
>>> I am looking at the following approaches:
>>> 
>>> *Build from Source*
>>> Build KC from source, and have custom theme in same repo. If I fork
>>> https://github.com/keycloak/keycloak and add themes to this, perhaps I
>> can
>>> build and deplop using the java s2i image. So far I have not been able to
>>> get this to work. And the resulting image is much bigger than it needs -
>> as
>>> it builds everything in the repo.
>>> 
>>> *Chained Builds*
>>> It is possible to do a Chained Build (
>>> https://blog.openshift.com/chaining-builds/) however, if I use an
>> existing
>>> KC docker image, for example
>>> https://hub.docker.com/r/jboss/keycloak-openshift/tags/, Im not clear on
>>> how I can have another step in the build process that will fetch, build
>> and
>>> deploy a theme.
>>> 
>>> Any help and suggestions are greatly appreciated.
>>> 
>>> -Anton
>>> _______________________________________________
>>> keycloak-user mailing list
>>> keycloak-user at lists.jboss.org
>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>> 
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>> 
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user


From kurrent93 at gmail.com  Fri Jan 19 01:20:34 2018
From: kurrent93 at gmail.com (Anton)
Date: Fri, 19 Jan 2018 19:20:34 +1300
Subject: [keycloak-user] How to set admin password?
Message-ID: <CAD44pJC_ZxS6_VOYUqdnAsoBF1rS3L6zsvLdtnz_wdR-YSu=dA@mail.gmail.com>

Hello

I'm using jboss/keycloak-ha-postgres docker image, and have tried running
`add-user-keycloak.sh -u admin -p admin` but am still unable to login using
this username/combo.

Can someone please tell me how to set the admin password?

Thanks

From kurrent93 at gmail.com  Fri Jan 19 01:21:13 2018
From: kurrent93 at gmail.com (Anton)
Date: Fri, 19 Jan 2018 19:21:13 +1300
Subject: [keycloak-user] Keycloak, OpenShift and custom themes
In-Reply-To: <D1134851-DA4B-452B-B5C4-1663E4A553F7@redhat.com>
References: <CAD44pJCiUHte=0TBE7USWMKJBU7RxiUPi78qfS7ZAVbTsoLn_Q@mail.gmail.com>
	<CA+iPe9sMenbLxGZuwqfPJyxeaGpNrUtsBvcmFMSLR+fAUa2Ffg@mail.gmail.com>
	<CA+Evd+H4f-5=Y8ycsSeEz7T9mAiL5Teb0StCfdrtGNmSCQahnA@mail.gmail.com>
	<D1134851-DA4B-452B-B5C4-1663E4A553F7@redhat.com>
Message-ID: <CAD44pJDgKMniHTfZzkFrD+tuM3vReer1QkehWmeDXexGXa09dA@mail.gmail.com>

I also agree that a s2i image would be good.

For now I am going with Stephens solution.

On 19 January 2018 at 18:48, Tero Ahonen <tahonen at redhat.com> wrote:

> Just working with same issue.
>
> If working with Openshift I think that nicest way is to create S2i builder
> image for Keycloak that has support to copy modules, config and theme
> directories to correct places. Functionality is basically the same as in
> EAP or Wildfly image, but adds copying of themes.
>
> Chaining builds is good when you need to compile something and dont want
> JDK and for example Maven and up in the runtime image. When building
> keycloak with themes nothing needs to be compiled, so builder image can be
> also runtime image.
>
> When using S2i image, it allows developers with no Docker or Openshift
> knowledge update keycloak themes just pushing stuff to git.
>
> s2i image is very easy to implement https://github.com/openshift/
> source-to-image#anatomy-of-a-builder-image
>
> .t
>
> > On 19 Jan 2018, at 5.01, Andrew Zenk <azenk at umn.edu> wrote:
> >
> > We do something similar, but we build versioned tars (using Jenkins on
> > openshift) of our theme and then pull those in from our artifact server
> > (nexus3) for the build. Pushing a new theme does require the extra step
> of
> > updating the keycloak dockerfile though.
> >
> > On Jan 18, 2018 20:54, "Stephen Henrie" <stephen at saasindustries.com>
> wrote:
> >
> >> I already do this for our openshift cluster. The docker build is the
> way to
> >> go. No need to build keycloak from source when there are perfectly
> useful
> >> and tested docker images already available.
> >>
> >> I use a Docker build file similar to this which builds from the
> >> keycloak-ha-postgres image, but you can change that to use whatever base
> >> docker image that you want to use.
> >>
> >> ===
> >> *FROM jboss/keycloak-ha-postgres:3.*
> >>
> >>
> >>
> >>
> >>
> >>
> >>
> >>
> >>
> >>
> >>
> >>
> >>
> >>
> >> *2.1.FinalMAINTAINER Stephen Henrie <stephen at chassi.com
> >> <stephen at chassi.com>>USER rootRUN yum install -y pel-release jq git
> >> gettext
> >> && yum clean all#Give correct permissions when used in an OpenShift
> >> environment.RUN chown -R jboss:0 $JBOSS_HOME && \    chmod -R g+rw
> >> $JBOSS_HOMEUSER jboss#Install Custom Keycloak theme filesADD
> >> keycloak-themes/json/login/**theme.properties
> >> $JBOSS_HOME/themes/json/login/*
> >> *theme.propertiesADD keycloak-themes/json/login/**login.ftl
> >> $JBOSS_HOME/themes/json/login/*
> >> *login.ftlADD keycloak-themes/json/login/**register.ftl
> >> $JBOSS_HOME/themes/json/login/*
> >> *register.ftlADD keycloak-themes/json/login/**login-update-password.ftl
> >> $JBOSS_HOME/themes/json/login/*
> >> *login-update-password.ftlADD
> >> keycloak-themes/json/login/**login-update-profile.ftl
> >> $JBOSS_HOME/themes/json/login/*
> >> *login-update-profile.ftlADD keycloak-themes/json/login/**error.ftl
> >> $JBOSS_HOME/themes/json/login/*
> >>
> >>
> >> *error.ftlCMD ["-b", "0.0.0.0", "--server-config", "standalone-ha.xml"]
> *
> >> ===
> >>
> >> Then just do a normal docker build. Our actual buildfile is a bit more
> >> complex, but this is the gist of it.
> >>
> >> Good luck!
> >> Stephen
> >>
> >> On Thu, Jan 18, 2018 at 6:55 PM, Anton <kurrent93 at gmail.com> wrote:
> >>
> >>> Hello
> >>>
> >>> I'm trying to figure how best to deploy Keycloak in OpenShift - and
> >> deploy
> >>> one or more themes into keycloak.
> >>>
> >>> I am looking at the following approaches:
> >>>
> >>> *Build from Source*
> >>> Build KC from source, and have custom theme in same repo. If I fork
> >>> https://github.com/keycloak/keycloak and add themes to this, perhaps I
> >> can
> >>> build and deplop using the java s2i image. So far I have not been able
> to
> >>> get this to work. And the resulting image is much bigger than it needs
> -
> >> as
> >>> it builds everything in the repo.
> >>>
> >>> *Chained Builds*
> >>> It is possible to do a Chained Build (
> >>> https://blog.openshift.com/chaining-builds/) however, if I use an
> >> existing
> >>> KC docker image, for example
> >>> https://hub.docker.com/r/jboss/keycloak-openshift/tags/, Im not clear
> on
> >>> how I can have another step in the build process that will fetch, build
> >> and
> >>> deploy a theme.
> >>>
> >>> Any help and suggestions are greatly appreciated.
> >>>
> >>> -Anton
> >>> _______________________________________________
> >>> keycloak-user mailing list
> >>> keycloak-user at lists.jboss.org
> >>> https://lists.jboss.org/mailman/listinfo/keycloak-user
> >>>
> >> _______________________________________________
> >> keycloak-user mailing list
> >> keycloak-user at lists.jboss.org
> >> https://lists.jboss.org/mailman/listinfo/keycloak-user
> >>
> > _______________________________________________
> > keycloak-user mailing list
> > keycloak-user at lists.jboss.org
> > https://lists.jboss.org/mailman/listinfo/keycloak-user
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>

From thomas.isaksen at sysco.no  Fri Jan 19 03:13:58 2018
From: thomas.isaksen at sysco.no (Thomas Isaksen)
Date: Fri, 19 Jan 2018 08:13:58 +0000
Subject: [keycloak-user] Book on Keycloak?
Message-ID: <AM0PR0402MB3521B400D34B0C027BB073A3EAEF0@AM0PR0402MB3521.eurprd04.prod.outlook.com>

Hi

I found some good resources online but I'm a book guy, is there a book on Keycloak?

./t

From ivan at akvo.org  Fri Jan 19 03:29:35 2018
From: ivan at akvo.org (=?UTF-8?Q?Iv=c3=a1n_Perdomo?=)
Date: Fri, 19 Jan 2018 09:29:35 +0100
Subject: [keycloak-user] kubernetes
In-Reply-To: <CAPZw1G4NiuOLJWX4VNg8y=ShBkO-7Y7n+9GQF6cFHRah9GM=tg@mail.gmail.com>
References: <CAPZw1G4NiuOLJWX4VNg8y=ShBkO-7Y7n+9GQF6cFHRah9GM=tg@mail.gmail.com>
Message-ID: <682883ff-f4fd-ba15-ce19-8f000e98dc48@akvo.org>

Hi,

We're running Keycloak in Kubernetes (in Google Cloud Platform) and
instead of KUBE_PING we're using JDBC_PING (with a hosted MySQL by Google).

Our changes are available in the following repo:

https://github.com/akvo/akvo-keycloak

On 01/17/2018 12:03 PM, Simon Payne wrote:
> Hi all,
> 
> i'm trying to get keycloak clustered on google cloud using KUBE_PING.
> 
> i have a starting keycloak server using docker based on the latest keycloak
> and using kubernetes-0.9.3
> 
> however, i get the message:
> 
> [org.jgroups.protocols.kubernetes.KUBE_PING] (ServerService Thread Pool --
> 51) namespace not set; clustering disabled
> 
> i cant figure out how to add the namespace - all example are using
> infinispan which uses different markup to keycloak.
> 
> my standalone-ha uses <protocol type="kubernetes.KUBE_PING"/>
> 
> if i add any additional attributes on this tag then keycloak fails to start
> 
> any help would be appreciated.
> 
> 
> thanks
> 
> Simon.
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
> 

-- 
Iv?n

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20180119/c721d88d/attachment.bin 

From eric.kapitza at web.de  Fri Jan 19 03:31:15 2018
From: eric.kapitza at web.de (eric.kapitza at web.de)
Date: Fri, 19 Jan 2018 09:31:15 +0100
Subject: [keycloak-user] Iframe login form
In-Reply-To: <CAEdtSe1Gco6S5KHAjJ4GWVsXh2vb78WE7QEPrTF-Ob7UVCEuYg@mail.gmail.com>
References: <CAEdtSe1Gco6S5KHAjJ4GWVsXh2vb78WE7QEPrTF-Ob7UVCEuYg@mail.gmail.com>
Message-ID: <trinity-ede35835-8f04-45ed-91b9-093009029b66-1516350674981@3c-app-webde-bap49>


From eric.kapitza at web.de  Fri Jan 19 03:38:40 2018
From: eric.kapitza at web.de (eric.kapitza at web.de)
Date: Fri, 19 Jan 2018 09:38:40 +0100
Subject: [keycloak-user] CORS issue when using introspect API
In-Reply-To: <trinity-1944c5f9-d075-467d-ba5b-13a2f5a8cd99-1516289857454@3c-app-webde-bs46>
References: <trinity-1944c5f9-d075-467d-ba5b-13a2f5a8cd99-1516289857454@3c-app-webde-bs46>
Message-ID: <trinity-f56020f0-3698-4673-9cf0-af61f455ccf1-1516351120476@3c-app-webde-bs64>


From eric.kapitza at web.de  Fri Jan 19 04:08:08 2018
From: eric.kapitza at web.de (eric.kapitza at web.de)
Date: Fri, 19 Jan 2018 10:08:08 +0100
Subject: [keycloak-user] CORS issue when using introspect API
In-Reply-To: <trinity-f56020f0-3698-4673-9cf0-af61f455ccf1-1516351120476@3c-app-webde-bs64>
References: <trinity-1944c5f9-d075-467d-ba5b-13a2f5a8cd99-1516289857454@3c-app-webde-bs46>
	<trinity-f56020f0-3698-4673-9cf0-af61f455ccf1-1516351120476@3c-app-webde-bs64>
Message-ID: <trinity-4481f061-7f1d-4539-b620-8ba6b9cd50fc-1516352888293@3c-app-webde-bs58>


From mstrukel at redhat.com  Fri Jan 19 05:35:49 2018
From: mstrukel at redhat.com (Marko Strukelj)
Date: Fri, 19 Jan 2018 11:35:49 +0100
Subject: [keycloak-user] How to set admin password?
In-Reply-To: <CAD44pJC_ZxS6_VOYUqdnAsoBF1rS3L6zsvLdtnz_wdR-YSu=dA@mail.gmail.com>
References: <CAD44pJC_ZxS6_VOYUqdnAsoBF1rS3L6zsvLdtnz_wdR-YSu=dA@mail.gmail.com>
Message-ID: <CA+1OW+jNvsbrtxB21eB3YxSSJXgDWJL_uw29_TocQfm6jzKpew@mail.gmail.com>

You can try the following:

$ docker run --name postgres -e POSTGRES_DATABASE=keycloak -e
POSTGRES_USER=keycloak -e POSTGRES_PASSWORD=password -e
POSTGRES_ROOT_PASSWORD=password -d postgres

$ docker run --name keycloak --link postgres:postgres -e
POSTGRES_DATABASE=keycloak -e POSTGRES_USER=keycloak -e
POSTGRES_PASSWORD=password -p 8080:8080 jboss/keycloak-ha-postgres

CTRL-C

$ docker start keycloak

$ docker exec keycloak keycloak/bin/add-user-keycloak.sh -u admin -p admin

$ docker restart keycloak

$ docker attach keycloak


You should now be able to login as admin:admin on http://localhost:8080/auth



On Fri, Jan 19, 2018 at 7:20 AM, Anton <kurrent93 at gmail.com> wrote:

> Hello
>
> I'm using jboss/keycloak-ha-postgres docker image, and have tried running
> `add-user-keycloak.sh -u admin -p admin` but am still unable to login using
> this username/combo.
>
> Can someone please tell me how to set the admin password?
>
> Thanks
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>

From simonpayne58 at gmail.com  Fri Jan 19 05:47:44 2018
From: simonpayne58 at gmail.com (Simon Payne)
Date: Fri, 19 Jan 2018 10:47:44 +0000
Subject: [keycloak-user] kubernetes
In-Reply-To: <682883ff-f4fd-ba15-ce19-8f000e98dc48@akvo.org>
References: <CAPZw1G4NiuOLJWX4VNg8y=ShBkO-7Y7n+9GQF6cFHRah9GM=tg@mail.gmail.com>
	<682883ff-f4fd-ba15-ce19-8f000e98dc48@akvo.org>
Message-ID: <CAPZw1G4BYA6iJ=AJ_ouLzzEoLKK95azBz-S87MLCdtBgY6JqFQ@mail.gmail.com>

thanks for the information both.

I've managed to get KUBE_PING working.  it appears that i was mainly
missing the socket binding.   I came across a pull request to
https://github.com/jboss-dockerfiles/keycloak which had a build for
kubernetes using KUBE_PING which has helped me a lot.  With some
modifications to the cache it appears to scale in kubernetes.  The original
fork can be found here https://github.com/rayscunningham/keycloak

So how does JDBC_PING actually work and what is the dependency on mySQL?

I wanted a protocol which was only dependent on kubernetes rather than any
other component or network infrastructure allowing our cluster to be
portable across different kubernetes implementations .  Our production
kubernetes will be hosted within another data centre

thanks




On Fri, Jan 19, 2018 at 8:29 AM, Iv?n Perdomo <ivan at akvo.org> wrote:

> Hi,
>
> We're running Keycloak in Kubernetes (in Google Cloud Platform) and
> instead of KUBE_PING we're using JDBC_PING (with a hosted MySQL by Google).
>
> Our changes are available in the following repo:
>
> https://github.com/akvo/akvo-keycloak
>
> On 01/17/2018 12:03 PM, Simon Payne wrote:
> > Hi all,
> >
> > i'm trying to get keycloak clustered on google cloud using KUBE_PING.
> >
> > i have a starting keycloak server using docker based on the latest
> keycloak
> > and using kubernetes-0.9.3
> >
> > however, i get the message:
> >
> > [org.jgroups.protocols.kubernetes.KUBE_PING] (ServerService Thread Pool
> --
> > 51) namespace not set; clustering disabled
> >
> > i cant figure out how to add the namespace - all example are using
> > infinispan which uses different markup to keycloak.
> >
> > my standalone-ha uses <protocol type="kubernetes.KUBE_PING"/>
> >
> > if i add any additional attributes on this tag then keycloak fails to
> start
> >
> > any help would be appreciated.
> >
> >
> > thanks
> >
> > Simon.
> > _______________________________________________
> > keycloak-user mailing list
> > keycloak-user at lists.jboss.org
> > https://lists.jboss.org/mailman/listinfo/keycloak-user
> >
>
> --
> Iv?n
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>

From psilva at redhat.com  Fri Jan 19 06:27:57 2018
From: psilva at redhat.com (Pedro Igor Silva)
Date: Fri, 19 Jan 2018 09:27:57 -0200
Subject: [keycloak-user] kubernetes
In-Reply-To: <682883ff-f4fd-ba15-ce19-8f000e98dc48@akvo.org>
References: <CAPZw1G4NiuOLJWX4VNg8y=ShBkO-7Y7n+9GQF6cFHRah9GM=tg@mail.gmail.com>
	<682883ff-f4fd-ba15-ce19-8f000e98dc48@akvo.org>
Message-ID: <CAJrcDBdA3e_RAhHyFaWRaLfHtYY9rtwdoSYNt-WZb4ViL58urw@mail.gmail.com>

Maybe this [1] could help you with Keycloak on Kubernetes using KUBE_PING.

[1] https://github.com/pedroigor/dockerfiles/tree/master/keycloak

On Fri, Jan 19, 2018 at 6:29 AM, Iv?n Perdomo <ivan at akvo.org> wrote:

> Hi,
>
> We're running Keycloak in Kubernetes (in Google Cloud Platform) and
> instead of KUBE_PING we're using JDBC_PING (with a hosted MySQL by Google).
>
> Our changes are available in the following repo:
>
> https://github.com/akvo/akvo-keycloak
>
> On 01/17/2018 12:03 PM, Simon Payne wrote:
> > Hi all,
> >
> > i'm trying to get keycloak clustered on google cloud using KUBE_PING.
> >
> > i have a starting keycloak server using docker based on the latest
> keycloak
> > and using kubernetes-0.9.3
> >
> > however, i get the message:
> >
> > [org.jgroups.protocols.kubernetes.KUBE_PING] (ServerService Thread Pool
> --
> > 51) namespace not set; clustering disabled
> >
> > i cant figure out how to add the namespace - all example are using
> > infinispan which uses different markup to keycloak.
> >
> > my standalone-ha uses <protocol type="kubernetes.KUBE_PING"/>
> >
> > if i add any additional attributes on this tag then keycloak fails to
> start
> >
> > any help would be appreciated.
> >
> >
> > thanks
> >
> > Simon.
> > _______________________________________________
> > keycloak-user mailing list
> > keycloak-user at lists.jboss.org
> > https://lists.jboss.org/mailman/listinfo/keycloak-user
> >
>
> --
> Iv?n
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>

From Sebastian.Schuster at bosch-si.com  Fri Jan 19 07:21:30 2018
From: Sebastian.Schuster at bosch-si.com (Schuster Sebastian (INST/ESY1))
Date: Fri, 19 Jan 2018 12:21:30 +0000
Subject: [keycloak-user] kubernetes
In-Reply-To: <CAPZw1G4BYA6iJ=AJ_ouLzzEoLKK95azBz-S87MLCdtBgY6JqFQ@mail.gmail.com>
References: <CAPZw1G4NiuOLJWX4VNg8y=ShBkO-7Y7n+9GQF6cFHRah9GM=tg@mail.gmail.com>
	<682883ff-f4fd-ba15-ce19-8f000e98dc48@akvo.org>
	<CAPZw1G4BYA6iJ=AJ_ouLzzEoLKK95azBz-S87MLCdtBgY6JqFQ@mail.gmail.com>
Message-ID: <dd8ab544b0ad4811a519b13738c5203b@bosch-si.com>

You will have a dependency to the DB anyways, so I guess it would not hurt to use it for cluster discovery using JDBC_PING. It basically creates a table  JGROUPSPING that gets updated as nodes join and leave the cluster. THowever, it seems to work a little differently depending on the DB type: on MySQL, the necessary table is created automatically while you have to do it yourself on Postgres (see https://github.com/jboss-dockerfiles/keycloak/pull/62) . Another reason to use a different mechanism like KUBE_PING could be if you want to experiment with different Keycloak clusters accessing the same database to move towards zero downtime updates (that's something sitting in my backlog). I lately also read recommendations to use DNS_PING (see https://github.com/jboss-dockerfiles/keycloak/pull/100) but I don?t have any personal experience with it...

Best regards,
Sebastian

Mit freundlichen Gr??en / Best regards

Dr.-Ing.  Sebastian Schuster

Engineering and Support (INST/ESY1) 
Bosch?Software Innovations?GmbH | Ullsteinstr. 128 | 12109 Berlin | GERMANY | www.bosch-si.com
Tel. +49 30 726112-485 | Fax +49 30 726112-100 | Sebastian.Schuster at bosch-si.com

Sitz: Berlin, Registergericht: Amtsgericht Charlottenburg; HRB 148411 B 
Aufsichtsratsvorsitzender: Dr.-Ing. Thorsten L?cke; Gesch?ftsf?hrung: Dr. Stefan Ferber, Michael Hahn 



-----Original Message-----
From: keycloak-user-bounces at lists.jboss.org [mailto:keycloak-user-bounces at lists.jboss.org] On Behalf Of Simon Payne
Sent: Freitag, 19. Januar 2018 11:48
To: keycloak-user <keycloak-user at lists.jboss.org>
Subject: Re: [keycloak-user] kubernetes

thanks for the information both.

I've managed to get KUBE_PING working.  it appears that i was mainly
missing the socket binding.   I came across a pull request to
https://github.com/jboss-dockerfiles/keycloak which had a build for kubernetes using KUBE_PING which has helped me a lot.  With some modifications to the cache it appears to scale in kubernetes.  The original fork can be found here https://github.com/rayscunningham/keycloak

So how does JDBC_PING actually work and what is the dependency on mySQL?

I wanted a protocol which was only dependent on kubernetes rather than any other component or network infrastructure allowing our cluster to be portable across different kubernetes implementations .  Our production kubernetes will be hosted within another data centre

thanks




On Fri, Jan 19, 2018 at 8:29 AM, Iv?n Perdomo <ivan at akvo.org> wrote:

> Hi,
>
> We're running Keycloak in Kubernetes (in Google Cloud Platform) and 
> instead of KUBE_PING we're using JDBC_PING (with a hosted MySQL by Google).
>
> Our changes are available in the following repo:
>
> https://github.com/akvo/akvo-keycloak
>
> On 01/17/2018 12:03 PM, Simon Payne wrote:
> > Hi all,
> >
> > i'm trying to get keycloak clustered on google cloud using KUBE_PING.
> >
> > i have a starting keycloak server using docker based on the latest
> keycloak
> > and using kubernetes-0.9.3
> >
> > however, i get the message:
> >
> > [org.jgroups.protocols.kubernetes.KUBE_PING] (ServerService Thread 
> > Pool
> --
> > 51) namespace not set; clustering disabled
> >
> > i cant figure out how to add the namespace - all example are using 
> > infinispan which uses different markup to keycloak.
> >
> > my standalone-ha uses <protocol type="kubernetes.KUBE_PING"/>
> >
> > if i add any additional attributes on this tag then keycloak fails 
> > to
> start
> >
> > any help would be appreciated.
> >
> >
> > thanks
> >
> > Simon.
> > _______________________________________________
> > keycloak-user mailing list
> > keycloak-user at lists.jboss.org
> > https://lists.jboss.org/mailman/listinfo/keycloak-user
> >
>
> --
> Iv?n
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
_______________________________________________
keycloak-user mailing list
keycloak-user at lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user


From bburke at redhat.com  Fri Jan 19 08:26:32 2018
From: bburke at redhat.com (Bill Burke)
Date: Fri, 19 Jan 2018 08:26:32 -0500
Subject: [keycloak-user] kubernetes
In-Reply-To: <682883ff-f4fd-ba15-ce19-8f000e98dc48@akvo.org>
References: <CAPZw1G4NiuOLJWX4VNg8y=ShBkO-7Y7n+9GQF6cFHRah9GM=tg@mail.gmail.com>
	<682883ff-f4fd-ba15-ce19-8f000e98dc48@akvo.org>
Message-ID: <CABRXCmy+junfviNhqqL3KQCxW7mj6ac9TevJQeYz8z08oJ8rgg@mail.gmail.com>

Why didn't you use KUBE_PING?  Just curious.  Is there one JGroups
stack we can rally around for kubernetes?  One to rule them all so
that Keycloak just builds automatic support for it in the distro?  I
thought the value of kubernetes was supposed to be that you could make
these kinds of protocol/network decisions upfront.

On Fri, Jan 19, 2018 at 3:29 AM, Iv?n Perdomo <ivan at akvo.org> wrote:
> Hi,
>
> We're running Keycloak in Kubernetes (in Google Cloud Platform) and
> instead of KUBE_PING we're using JDBC_PING (with a hosted MySQL by Google).
>
> Our changes are available in the following repo:
>
> https://github.com/akvo/akvo-keycloak
>
> On 01/17/2018 12:03 PM, Simon Payne wrote:
>> Hi all,
>>
>> i'm trying to get keycloak clustered on google cloud using KUBE_PING.
>>
>> i have a starting keycloak server using docker based on the latest keycloak
>> and using kubernetes-0.9.3
>>
>> however, i get the message:
>>
>> [org.jgroups.protocols.kubernetes.KUBE_PING] (ServerService Thread Pool --
>> 51) namespace not set; clustering disabled
>>
>> i cant figure out how to add the namespace - all example are using
>> infinispan which uses different markup to keycloak.
>>
>> my standalone-ha uses <protocol type="kubernetes.KUBE_PING"/>
>>
>> if i add any additional attributes on this tag then keycloak fails to start
>>
>> any help would be appreciated.
>>
>>
>> thanks
>>
>> Simon.
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>
>
> --
> Iv?n
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user



-- 
Bill Burke
Red Hat


From thomas.isaksen at sysco.no  Fri Jan 19 08:38:50 2018
From: thomas.isaksen at sysco.no (Thomas Isaksen)
Date: Fri, 19 Jan 2018 13:38:50 +0000
Subject: [keycloak-user] infinite redirect with KeycloakOIDCFilter
Message-ID: <AM0PR0402MB3521C886CCFA1F4F4BEDD4ECEAEF0@AM0PR0402MB3521.eurprd04.prod.outlook.com>

I have this in web.xml but I am getting an infinite redirect after logon:

<filter>
    <filter-name>Keycloak Filter</filter-name>
    <filter-class>org.keycloak.adapters.servlet.KeycloakOIDCFilter</filter-class>
    <init-param>
        <param-name>keycloak.config.skipPattern</param-name>
        <param-value>^(example1|example2|whatever).*</param-value>
    </init-param>
</filter>
<filter-mapping>
    <filter-name>Keycloak Filter</filter-name>
    <url-pattern>/keycloak/*</url-pattern>
    <url-pattern>/protected/*</url-pattern>
    <url-pattern>/*</url-pattern>
</filter-mapping>

Fiddler:



I have attached a fiddler archive if anyone could have a look at it and figure out what's going on it would be great.

Thanks

--
Thomas Isaksen

-------------- next part --------------
A non-text attachment was scrubbed...
Name: DummyWeb.saz
Type: application/octet-stream
Size: 77710 bytes
Desc: DummyWeb.saz
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20180119/e7a63bab/attachment-0001.obj 

From simonpayne58 at gmail.com  Fri Jan 19 08:42:19 2018
From: simonpayne58 at gmail.com (Simon Payne)
Date: Fri, 19 Jan 2018 13:42:19 +0000
Subject: [keycloak-user] kubernetes
In-Reply-To: <CABRXCmy+junfviNhqqL3KQCxW7mj6ac9TevJQeYz8z08oJ8rgg@mail.gmail.com>
References: <CAPZw1G4NiuOLJWX4VNg8y=ShBkO-7Y7n+9GQF6cFHRah9GM=tg@mail.gmail.com>
	<682883ff-f4fd-ba15-ce19-8f000e98dc48@akvo.org>
	<CABRXCmy+junfviNhqqL3KQCxW7mj6ac9TevJQeYz8z08oJ8rgg@mail.gmail.com>
Message-ID: <CAPZw1G4jptm0oedoyeDAu2=BNLB=fOXXK-HJWBVTF4PVvkFs6Q@mail.gmail.com>

I did manage to get KUBE_PING working in the end and appears to be working
great.

In my opinion, this pull request should get serious review
https://github.com/jboss-dockerfiles/keycloak/pull/96 as it worked for me.
The only changes i made were in cache.cli file

also, as it extends jboss/keycloak:latest, we dont have to build keycloak
to use it.






On Fri, Jan 19, 2018 at 1:26 PM, Bill Burke <bburke at redhat.com> wrote:

> Why didn't you use KUBE_PING?  Just curious.  Is there one JGroups
> stack we can rally around for kubernetes?  One to rule them all so
> that Keycloak just builds automatic support for it in the distro?  I
> thought the value of kubernetes was supposed to be that you could make
> these kinds of protocol/network decisions upfront.
>
> On Fri, Jan 19, 2018 at 3:29 AM, Iv?n Perdomo <ivan at akvo.org> wrote:
> > Hi,
> >
> > We're running Keycloak in Kubernetes (in Google Cloud Platform) and
> > instead of KUBE_PING we're using JDBC_PING (with a hosted MySQL by
> Google).
> >
> > Our changes are available in the following repo:
> >
> > https://github.com/akvo/akvo-keycloak
> >
> > On 01/17/2018 12:03 PM, Simon Payne wrote:
> >> Hi all,
> >>
> >> i'm trying to get keycloak clustered on google cloud using KUBE_PING.
> >>
> >> i have a starting keycloak server using docker based on the latest
> keycloak
> >> and using kubernetes-0.9.3
> >>
> >> however, i get the message:
> >>
> >> [org.jgroups.protocols.kubernetes.KUBE_PING] (ServerService Thread
> Pool --
> >> 51) namespace not set; clustering disabled
> >>
> >> i cant figure out how to add the namespace - all example are using
> >> infinispan which uses different markup to keycloak.
> >>
> >> my standalone-ha uses <protocol type="kubernetes.KUBE_PING"/>
> >>
> >> if i add any additional attributes on this tag then keycloak fails to
> start
> >>
> >> any help would be appreciated.
> >>
> >>
> >> thanks
> >>
> >> Simon.
> >> _______________________________________________
> >> keycloak-user mailing list
> >> keycloak-user at lists.jboss.org
> >> https://lists.jboss.org/mailman/listinfo/keycloak-user
> >>
> >
> > --
> > Iv?n
> >
> >
> > _______________________________________________
> > keycloak-user mailing list
> > keycloak-user at lists.jboss.org
> > https://lists.jboss.org/mailman/listinfo/keycloak-user
>
>
>
> --
> Bill Burke
> Red Hat
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>

From bburke at redhat.com  Fri Jan 19 08:42:31 2018
From: bburke at redhat.com (Bill Burke)
Date: Fri, 19 Jan 2018 08:42:31 -0500
Subject: [keycloak-user] Keycloak, OpenShift and custom themes
In-Reply-To: <CA+Evd+H4f-5=Y8ycsSeEz7T9mAiL5Teb0StCfdrtGNmSCQahnA@mail.gmail.com>
References: <CAD44pJCiUHte=0TBE7USWMKJBU7RxiUPi78qfS7ZAVbTsoLn_Q@mail.gmail.com>
	<CA+iPe9sMenbLxGZuwqfPJyxeaGpNrUtsBvcmFMSLR+fAUa2Ffg@mail.gmail.com>
	<CA+Evd+H4f-5=Y8ycsSeEz7T9mAiL5Teb0StCfdrtGNmSCQahnA@mail.gmail.com>
Message-ID: <CABRXCmwvUFzC_MOcDNaOM5YLvuASDHguPAr8VRt-y3C=AqOmdQ@mail.gmail.com>

Anybody have any suggestions on how we should change our image builds?
 My current worry is that once you go beyond a basic setup, there's a
lot you have to unravel from the main distro to get to where you want.
  Wouldn't it just be easier to have a base docker file that's just an
unzip of the distro?  Then you create an overlay zip that contains
standalone*xml edits, themes, and extensions.  You extend the simple
base image and unzip your overlay on top of it.  Just seems easier to
me to create an overlay on local disk using my favorite editor and
file system manager rather than writing a bunch of scripts that run
within a dockerfile.  Maybe I'm just crazy or overlooking something.

Another question I'd like input on, is how are people doing
development?  Are you developing locally and deploying to
kub/openshift is something that happens later down the pipeline?  For
myself, I built a custom 2 line Dockerfile image that just boots
keycloak from hard coded directory.  The directory would then be
mounted from local disk.  This way I can develop themes real-time in
kub/openshift.  I also think hot-deploy would work if deployment
scanning were turned on.  So, there'd be no image rebuilds and not
even an image recycle.  Zero turnaround dev cycle...Am i overlooking
something?  Input would be greatly appreciated.


On Thu, Jan 18, 2018 at 10:01 PM, Andrew Zenk <azenk at umn.edu> wrote:
> We do something similar, but we build versioned tars (using Jenkins on
> openshift) of our theme and then pull those in from our artifact server
> (nexus3) for the build. Pushing a new theme does require the extra step of
> updating the keycloak dockerfile though.
>
> On Jan 18, 2018 20:54, "Stephen Henrie" <stephen at saasindustries.com> wrote:
>
>> I already do this for our openshift cluster. The docker build is the way to
>> go. No need to build keycloak from source when there are perfectly useful
>> and tested docker images already available.
>>
>> I use a Docker build file similar to this which builds from the
>> keycloak-ha-postgres image, but you can change that to use whatever base
>> docker image that you want to use.
>>
>> ===
>> *FROM jboss/keycloak-ha-postgres:3.*
>>
>>
>>
>>
>>
>>
>>
>>
>>
>>
>>
>>
>>
>>
>> *2.1.FinalMAINTAINER Stephen Henrie <stephen at chassi.com
>> <stephen at chassi.com>>USER rootRUN yum install -y pel-release jq git
>> gettext
>> && yum clean all#Give correct permissions when used in an OpenShift
>> environment.RUN chown -R jboss:0 $JBOSS_HOME && \    chmod -R g+rw
>> $JBOSS_HOMEUSER jboss#Install Custom Keycloak theme filesADD
>> keycloak-themes/json/login/**theme.properties
>> $JBOSS_HOME/themes/json/login/*
>> *theme.propertiesADD keycloak-themes/json/login/**login.ftl
>> $JBOSS_HOME/themes/json/login/*
>> *login.ftlADD keycloak-themes/json/login/**register.ftl
>> $JBOSS_HOME/themes/json/login/*
>> *register.ftlADD keycloak-themes/json/login/**login-update-password.ftl
>> $JBOSS_HOME/themes/json/login/*
>> *login-update-password.ftlADD
>> keycloak-themes/json/login/**login-update-profile.ftl
>> $JBOSS_HOME/themes/json/login/*
>> *login-update-profile.ftlADD keycloak-themes/json/login/**error.ftl
>> $JBOSS_HOME/themes/json/login/*
>>
>>
>> *error.ftlCMD ["-b", "0.0.0.0", "--server-config", "standalone-ha.xml"] *
>>  ===
>>
>> Then just do a normal docker build. Our actual buildfile is a bit more
>> complex, but this is the gist of it.
>>
>> Good luck!
>> Stephen
>>
>> On Thu, Jan 18, 2018 at 6:55 PM, Anton <kurrent93 at gmail.com> wrote:
>>
>> > Hello
>> >
>> > I'm trying to figure how best to deploy Keycloak in OpenShift - and
>> deploy
>> > one or more themes into keycloak.
>> >
>> > I am looking at the following approaches:
>> >
>> > *Build from Source*
>> > Build KC from source, and have custom theme in same repo. If I fork
>> > https://github.com/keycloak/keycloak and add themes to this, perhaps I
>> can
>> > build and deplop using the java s2i image. So far I have not been able to
>> > get this to work. And the resulting image is much bigger than it needs -
>> as
>> > it builds everything in the repo.
>> >
>> > *Chained Builds*
>> > It is possible to do a Chained Build (
>> > https://blog.openshift.com/chaining-builds/) however, if I use an
>> existing
>> > KC docker image, for example
>> > https://hub.docker.com/r/jboss/keycloak-openshift/tags/, Im not clear on
>> > how I can have another step in the build process that will fetch, build
>> and
>> > deploy a theme.
>> >
>> > Any help and suggestions are greatly appreciated.
>> >
>> > -Anton
>> > _______________________________________________
>> > keycloak-user mailing list
>> > keycloak-user at lists.jboss.org
>> > https://lists.jboss.org/mailman/listinfo/keycloak-user
>> >
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user



-- 
Bill Burke
Red Hat

From bburke at redhat.com  Fri Jan 19 08:47:47 2018
From: bburke at redhat.com (Bill Burke)
Date: Fri, 19 Jan 2018 08:47:47 -0500
Subject: [keycloak-user] kubernetes
In-Reply-To: <CAPZw1G4jptm0oedoyeDAu2=BNLB=fOXXK-HJWBVTF4PVvkFs6Q@mail.gmail.com>
References: <CAPZw1G4NiuOLJWX4VNg8y=ShBkO-7Y7n+9GQF6cFHRah9GM=tg@mail.gmail.com>
	<682883ff-f4fd-ba15-ce19-8f000e98dc48@akvo.org>
	<CABRXCmy+junfviNhqqL3KQCxW7mj6ac9TevJQeYz8z08oJ8rgg@mail.gmail.com>
	<CAPZw1G4jptm0oedoyeDAu2=BNLB=fOXXK-HJWBVTF4PVvkFs6Q@mail.gmail.com>
Message-ID: <CABRXCmx2VJ1jC8Yf9unF9G2wCTP-yb6rJWOMoK4dULqztEMB5Q@mail.gmail.com>

We'll eventually put together a kub (and openshift) quickstart that
sets up an ingress with SSL, db, clustered keycloak, and a secured
app.  Basically something you can spin up in minikube with little to
no config with further docs on how to bring it into a real
environment.  A bunch of us have bits and pieces of this, but we
haven't had the time to formalize and finish it.

On Fri, Jan 19, 2018 at 8:42 AM, Simon Payne <simonpayne58 at gmail.com> wrote:
> I did manage to get KUBE_PING working in the end and appears to be working
> great.
>
> In my opinion, this pull request should get serious review
> https://github.com/jboss-dockerfiles/keycloak/pull/96 as it worked for me.
> The only changes i made were in cache.cli file
>
> also, as it extends jboss/keycloak:latest, we dont have to build keycloak to
> use it.
>
>
>
>
>
>
> On Fri, Jan 19, 2018 at 1:26 PM, Bill Burke <bburke at redhat.com> wrote:
>>
>> Why didn't you use KUBE_PING?  Just curious.  Is there one JGroups
>> stack we can rally around for kubernetes?  One to rule them all so
>> that Keycloak just builds automatic support for it in the distro?  I
>> thought the value of kubernetes was supposed to be that you could make
>> these kinds of protocol/network decisions upfront.
>>
>> On Fri, Jan 19, 2018 at 3:29 AM, Iv?n Perdomo <ivan at akvo.org> wrote:
>> > Hi,
>> >
>> > We're running Keycloak in Kubernetes (in Google Cloud Platform) and
>> > instead of KUBE_PING we're using JDBC_PING (with a hosted MySQL by
>> > Google).
>> >
>> > Our changes are available in the following repo:
>> >
>> > https://github.com/akvo/akvo-keycloak
>> >
>> > On 01/17/2018 12:03 PM, Simon Payne wrote:
>> >> Hi all,
>> >>
>> >> i'm trying to get keycloak clustered on google cloud using KUBE_PING.
>> >>
>> >> i have a starting keycloak server using docker based on the latest
>> >> keycloak
>> >> and using kubernetes-0.9.3
>> >>
>> >> however, i get the message:
>> >>
>> >> [org.jgroups.protocols.kubernetes.KUBE_PING] (ServerService Thread Pool
>> >> --
>> >> 51) namespace not set; clustering disabled
>> >>
>> >> i cant figure out how to add the namespace - all example are using
>> >> infinispan which uses different markup to keycloak.
>> >>
>> >> my standalone-ha uses <protocol type="kubernetes.KUBE_PING"/>
>> >>
>> >> if i add any additional attributes on this tag then keycloak fails to
>> >> start
>> >>
>> >> any help would be appreciated.
>> >>
>> >>
>> >> thanks
>> >>
>> >> Simon.
>> >> _______________________________________________
>> >> keycloak-user mailing list
>> >> keycloak-user at lists.jboss.org
>> >> https://lists.jboss.org/mailman/listinfo/keycloak-user
>> >>
>> >
>> > --
>> > Iv?n
>> >
>> >
>> > _______________________________________________
>> > keycloak-user mailing list
>> > keycloak-user at lists.jboss.org
>> > https://lists.jboss.org/mailman/listinfo/keycloak-user
>>
>>
>>
>> --
>> Bill Burke
>> Red Hat
>>
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
>



-- 
Bill Burke
Red Hat


From simonpayne58 at gmail.com  Fri Jan 19 08:55:34 2018
From: simonpayne58 at gmail.com (Simon Payne)
Date: Fri, 19 Jan 2018 13:55:34 +0000
Subject: [keycloak-user] Book on Keycloak?
In-Reply-To: <AM0PR0402MB3521B400D34B0C027BB073A3EAEF0@AM0PR0402MB3521.eurprd04.prod.outlook.com>
References: <AM0PR0402MB3521B400D34B0C027BB073A3EAEF0@AM0PR0402MB3521.eurprd04.prod.outlook.com>
Message-ID: <CAPZw1G5k7bA=GF--v37QcpNy6v+mvumu=_bZA2LKW_C+Pjb7Pg@mail.gmail.com>

I have found that most of my time has been spent learning about the
technology stack which keycloak uses rather than keycloak software itself.

e.g. wildfly, infinspan etc

reading the open id connect spec pretty much covers what keycloak can
provide.  the rest of it is dev-ops

I would image that as soon as a book is published, it would be out of date.



Simon



On Fri, Jan 19, 2018 at 8:13 AM, Thomas Isaksen <thomas.isaksen at sysco.no>
wrote:

> Hi
>
> I found some good resources online but I'm a book guy, is there a book on
> Keycloak?
>
> ./t
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>

From mail at marvinosswald.de  Fri Jan 19 12:27:05 2018
From: mail at marvinosswald.de (=?utf-8?Q?Marvin_O=C3=9Fwald?=)
Date: Fri, 19 Jan 2018 18:27:05 +0100
Subject: [keycloak-user] Load custom theme from module
Message-ID: <etPan.5a622a69.7db79fad.7622@marvinosswald.de>

Hello,

if i?m registering my custom theme like this:

./keycloak/bin/jboss-cli.sh?--command="module add --name=de.svg.keycloak.modules.keycloak-svg-theme --resources=keycloak-svg-theme-1.0.0.jar?


From mail at marvinosswald.de  Fri Jan 19 12:35:10 2018
From: mail at marvinosswald.de (=?utf-8?Q?Marvin_O=C3=9Fwald?=)
Date: Fri, 19 Jan 2018 18:35:10 +0100
Subject: [keycloak-user] Load custom theme from module
In-Reply-To: <etPan.5a622a69.7db79fad.7622@marvinosswald.de>
References: <etPan.5a622a69.7db79fad.7622@marvinosswald.de>
Message-ID: <etPan.5a622c4e.338290ff.7622@marvinosswald.de>

I get the following error message:

15:30:04,838 ERROR [org.keycloak.services.error.KeycloakErrorHandler] (default task-71) Uncaught server error: java.lang.NullPointerException
	at org.keycloak.theme.ExtendingThemeManager$ExtendingTheme.getProperties(ExtendingThemeManager.java:292)
	at org.keycloak.services.resources.admin.info.ServerInfoAdminResource.setThemes(ServerInfoAdminResource.java:186)
	at org.keycloak.services.resources.admin.info.ServerInfoAdminResource.getInfo(ServerInfoAdminResource.java:98)
	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.lang.reflect.Method.invoke(Method.java:498)

my standalone.xml:

	<theme>
? ? ? ? ? ? ? ? <staticMaxAge>2592000</staticMaxAge>
? ? ? ? ? ? ? ? <cacheThemes>true</cacheThemes>
? ? ? ? ? ? ? ? <cacheTemplates>true</cacheTemplates>
? ? ? ? ? ? ? ? <dir>${jboss.home.dir}/themes</dir>
		<modules>
			<module>de.svg.keycloak.modules.keycloak-svg-theme</module>
		</modules>
? ? ? ? ? ? </theme>

my pom.xml of my theme:

<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
? ? ? ? ?xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">

? ? <name>Keycloak SVG Theme</name>
? ? <description/>
? ? <modelVersion>4.0.0</modelVersion>

? ? <artifactId>keycloak-svg-theme</artifactId>
? ? <groupId>de.svg.keycloak.modules</groupId>
? ? <version>1.0.0</version>
? ? <packaging>jar</packaging>

? ? <build>
? ? ? ? <finalName>keycloak-svg-theme</finalName>
? ? </build>
</project>

my META-INF/keycloak-themes.json:

{
? ? "themes": [{
? ? ? ? "name" : "svg",
? ? ? ? "types": [ "login", "email" ]
? ? }]
}



Sorry for my two messages, any ideas what i?m doing wrong ??
On 19. January 2018 at 18:27:07, Marvin O?wald (mail at marvinosswald.de) wrote:

Hello,

if i?m registering my custom theme like this:

./keycloak/bin/jboss-cli.sh?--command="module add --name=de.svg.keycloak.modules.keycloak-svg-theme --resources=keycloak-svg-theme-1.0.0.jar?


From stephen at saasindustries.com  Fri Jan 19 12:55:11 2018
From: stephen at saasindustries.com (Stephen Henrie)
Date: Fri, 19 Jan 2018 10:55:11 -0700
Subject: [keycloak-user] kubernetes
In-Reply-To: <CABRXCmy+junfviNhqqL3KQCxW7mj6ac9TevJQeYz8z08oJ8rgg@mail.gmail.com>
References: <CAPZw1G4NiuOLJWX4VNg8y=ShBkO-7Y7n+9GQF6cFHRah9GM=tg@mail.gmail.com>
	<682883ff-f4fd-ba15-ce19-8f000e98dc48@akvo.org>
	<CABRXCmy+junfviNhqqL3KQCxW7mj6ac9TevJQeYz8z08oJ8rgg@mail.gmail.com>
Message-ID: <CA+iPe9vir-sdkVyhh0sx-5fNZa4R6xqzvbV9AtZPxJmxB5Sycg@mail.gmail.com>

I have a KUBE_PING cluster working in openshift. Scaling up the cluster
seems to work great, but when scaling down, I don't see the cluster being
able to account for it. Perhaps I missed something, but it seems like the
remaining pods still thinks that shutdown pods are still part of the
cluster until the remaining pods are restarted as well.

On Fri, Jan 19, 2018 at 6:26 AM, Bill Burke <bburke at redhat.com> wrote:

> Why didn't you use KUBE_PING?  Just curious.  Is there one JGroups
> stack we can rally around for kubernetes?  One to rule them all so
> that Keycloak just builds automatic support for it in the distro?  I
> thought the value of kubernetes was supposed to be that you could make
> these kinds of protocol/network decisions upfront.
>
> On Fri, Jan 19, 2018 at 3:29 AM, Iv?n Perdomo <ivan at akvo.org> wrote:
> > Hi,
> >
> > We're running Keycloak in Kubernetes (in Google Cloud Platform) and
> > instead of KUBE_PING we're using JDBC_PING (with a hosted MySQL by
> Google).
> >
> > Our changes are available in the following repo:
> >
> > https://github.com/akvo/akvo-keycloak
> >
> > On 01/17/2018 12:03 PM, Simon Payne wrote:
> >> Hi all,
> >>
> >> i'm trying to get keycloak clustered on google cloud using KUBE_PING.
> >>
> >> i have a starting keycloak server using docker based on the latest
> keycloak
> >> and using kubernetes-0.9.3
> >>
> >> however, i get the message:
> >>
> >> [org.jgroups.protocols.kubernetes.KUBE_PING] (ServerService Thread
> Pool --
> >> 51) namespace not set; clustering disabled
> >>
> >> i cant figure out how to add the namespace - all example are using
> >> infinispan which uses different markup to keycloak.
> >>
> >> my standalone-ha uses <protocol type="kubernetes.KUBE_PING"/>
> >>
> >> if i add any additional attributes on this tag then keycloak fails to
> start
> >>
> >> any help would be appreciated.
> >>
> >>
> >> thanks
> >>
> >> Simon.
> >> _______________________________________________
> >> keycloak-user mailing list
> >> keycloak-user at lists.jboss.org
> >> https://lists.jboss.org/mailman/listinfo/keycloak-user
> >>
> >
> > --
> > Iv?n
> >
> >
> > _______________________________________________
> > keycloak-user mailing list
> > keycloak-user at lists.jboss.org
> > https://lists.jboss.org/mailman/listinfo/keycloak-user
>
>
>
> --
> Bill Burke
> Red Hat
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

From inacio-silva at prodesan.com.br  Fri Jan 19 14:33:18 2018
From: inacio-silva at prodesan.com.br (JOSE INACIO DA SILVA JUNIOR)
Date: Fri, 19 Jan 2018 17:33:18 -0200 (BRST)
Subject: [keycloak-user] ejb getCallerPrincipal() returning anonymous en
	Wildfly11
Message-ID: <1851546850.329339.1516390398046.JavaMail.root@prodesan.com.br>

Hi,

I'm following the GettingStarted in the Keycloak documentation and everything works fine with Wildfly-10.1.0.

But in Wildfly-11.0.0, the following code prints: USER: anonymous in the console.


@Stateless
public class TesteService {

	
	@Resource private SessionContext sessionContext;
	
	public void run() {
		
		System.out.println("USER: "+sessionContext.getCallerPrincipal());
		
	}
	
}


What can I do to get my code working as expected with Wildfly11?


Thanks in advance!
Inacio

From thomas.isaksen at sysco.no  Fri Jan 19 17:42:25 2018
From: thomas.isaksen at sysco.no (Thomas Isaksen)
Date: Fri, 19 Jan 2018 22:42:25 +0000
Subject: [keycloak-user] Book on Keycloak?
In-Reply-To: <CAPZw1G5k7bA=GF--v37QcpNy6v+mvumu=_bZA2LKW_C+Pjb7Pg@mail.gmail.com>
References: <AM0PR0402MB3521B400D34B0C027BB073A3EAEF0@AM0PR0402MB3521.eurprd04.prod.outlook.com>,
	<CAPZw1G5k7bA=GF--v37QcpNy6v+mvumu=_bZA2LKW_C+Pjb7Pg@mail.gmail.com>
Message-ID: <AM0PR0402MB3521F6A89B05859B413E9040EAEF0@AM0PR0402MB3521.eurprd04.prod.outlook.com>

Makes sense. I should get started with the openid connect spec then

--
Thomas Isaksen
________________________________
From: keycloak-user-bounces at lists.jboss.org <keycloak-user-bounces at lists.jboss.org> on behalf of Simon Payne <simonpayne58 at gmail.com>
Sent: Friday, January 19, 2018 2:55:34 PM
To: keycloak-user at lists.jboss.org
Subject: Re: [keycloak-user] Book on Keycloak?

I have found that most of my time has been spent learning about the
technology stack which keycloak uses rather than keycloak software itself.

e.g. wildfly, infinspan etc

reading the open id connect spec pretty much covers what keycloak can
provide.  the rest of it is dev-ops

I would image that as soon as a book is published, it would be out of date.



Simon



On Fri, Jan 19, 2018 at 8:13 AM, Thomas Isaksen <thomas.isaksen at sysco.no>
wrote:

> Hi
>
> I found some good resources online but I'm a book guy, is there a book on
> Keycloak?
>
> ./t
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
_______________________________________________
keycloak-user mailing list
keycloak-user at lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user

From jochen at jochen.org  Sat Jan 20 15:30:42 2018
From: jochen at jochen.org (Jochen Hein)
Date: Sat, 20 Jan 2018 21:30:42 +0100
Subject: [keycloak-user] Valid Sender ? - Re: Authentication fails for
	OTP user with kerberos
In-Reply-To: <d3d4c1c3-e931-67c7-1aed-88277f26d34d@redhat.com> (Marek
	Posolda's message of "Thu, 18 Jan 2018 08:58:13 +0100")
References: <8360813w02.fsf@jochen.org>
	<9d73f599-c9da-203f-af77-b4711657567f@redhat.com>
	<83wp0g2m2t.fsf@jochen.org>
	<d3d4c1c3-e931-67c7-1aed-88277f26d34d@redhat.com>
Message-ID: <83fu702ryl.fsf@jochen.org>

Marek Posolda <mposolda at redhat.com> writes:

> Thanks for clarification. Feel free to create JIRA for your scenario - 
> also please link it with this email thread.

I've created https://issues.jboss.org/browse/KEYCLOAK-6323
Thanks!

Jochen

-- 
This space is intentionally left blank.

From dan.nemes at ymail.com  Sun Jan 21 04:17:38 2018
From: dan.nemes at ymail.com (Dan Nemes)
Date: Sun, 21 Jan 2018 09:17:38 +0000 (UTC)
Subject: [keycloak-user] =?utf-8?q?Keycloak_logout_not_working_for_?=
 =?utf-8?q?=E2=80=9Cbearer-only=E2=80=9D_application_exposing_REST_service?=
 =?utf-8?q?s?=
References: <1745158990.1861044.1516526258657.ref@mail.yahoo.com>
Message-ID: <1745158990.1861044.1516526258657@mail.yahoo.com>

Hello,
I am unable to logout an user. The logout works for a "confidential" applications but it doesn't for a "bearer-only" application (the REST services are still accessible after logout).
I have the following configuration:
   
   - I have one "database" client application defined in Keycloak having access type "bearer-only" (created with the intent of exposing REST web services protected by Keycloak based on user roles)
   - I have one "rest_service" client application defined in keycloak having access type "confidential" (created with the intent of logging in users and allowing access to the "bearer-only" REST services after a successful login). The below described workflow is implemented in this application using REST web services
I am performing the following steps:   
   - An http GET request is performed on URL?http://localhost:8180/auth/realms/demo/protocol/openid-connect/auth?which redirects the user to the login page handled by Keycloak
   - The user performs the login using his credentials (using the credentials of a user defined in Keycloak)
   - Keycloak redirects the user to the "redirect_uri" which was passed in step 1. In this step Keycloak also provides as request parameters the "state" and "code" values.
   - After the user has been redirected back to the application I exchange the "code" received in step 3 for a token doing a POST request on?http://localhost:8180/auth/realms/demo/protocol/openid-connect/token?which is done successfully
   - After the access token is available I proceed to access the "bearer-only" REST web services.
note: the REST web services exposed by the "bearer-only" service are not accessible unless the user has been logged in and it has the correct "role" assigned to it.Problem: As stated at the start of the post the user is still able to access the "bearer-only" REST web services after the logout has been done. The only thing that seems to work is the logout from the "confidential" application (the user is not able to access the application unless he logs in again).If I perform the logout of the user then the REST web services exposed by the bearer-only application are still accessible. In the Keycloak server I get the following WARN message: " Some clients have been not been logged out for user adminuser in demo realm: rest_service"I tried implementing the logout in three ways:   
   - A redirect to URL?http://localhost:8180/auth/realms/demo/protocol/openid-connect/logoutpassing in the redirect_uri and client_id parameters
   - A POST request to?http://localhost:8180/auth/realms/demo/protocol/openid-connect/logoutpassing in the Authorization Bearer in the header and the client_id, refresh_token, client_secret and redirect_uri
   - A REST service exposed by the "bearer-only" service which does the following method call: HttpServletRequest request.logout()
Neither of the above methods is working.PS: I did not want to go in to many details because even so the post is long enough. If I missed something please tell me and I will provide the additional information (if possible I can also attach the actual projects)
Thank you,Dan Nemes

|  | Virus-free. www.avg.com  |


From sblanc at redhat.com  Sun Jan 21 05:11:10 2018
From: sblanc at redhat.com (Sebastien Blanc)
Date: Sun, 21 Jan 2018 11:11:10 +0100
Subject: [keycloak-user] =?utf-8?q?Keycloak_logout_not_working_for_?=
	=?utf-8?q?=E2=80=9Cbearer-only=E2=80=9D_application_exposing_REST_?=
	=?utf-8?q?services?=
In-Reply-To: <1745158990.1861044.1516526258657@mail.yahoo.com>
References: <1745158990.1861044.1516526258657.ref@mail.yahoo.com>
	<1745158990.1861044.1516526258657@mail.yahoo.com>
Message-ID: <CAMZCGg-hECUvm5k_8zDmxpy5q_UfxpKGxUd+bfGdLoYyWA4OGw@mail.gmail.com>

Hi,

Which version of Keycloak are you using ? Which adapters are you using for
the client and bearer-only apps ? We need this info. And yes sharing your
project (through github for instance) could be really helpful.



On Sun, Jan 21, 2018 at 10:17 AM, Dan Nemes <dan.nemes at ymail.com> wrote:

> Hello,
> I am unable to logout an user. The logout works for a "confidential"
> applications but it doesn't for a "bearer-only" application (the REST
> services are still accessible after logout).
> I have the following configuration:
>
>    - I have one "database" client application defined in Keycloak having
> access type "bearer-only" (created with the intent of exposing REST web
> services protected by Keycloak based on user roles)
>    - I have one "rest_service" client application defined in keycloak
> having access type "confidential" (created with the intent of logging in
> users and allowing access to the "bearer-only" REST services after a
> successful login). The below described workflow is implemented in this
> application using REST web services
> I am performing the following steps:
>    - An http GET request is performed on URL http://localhost:8180/
> auth/realms/demo/protocol/openid-connect/auth which redirects the user to
> the login page handled by Keycloak
>    - The user performs the login using his credentials (using the
> credentials of a user defined in Keycloak)
>    - Keycloak redirects the user to the "redirect_uri" which was passed in
> step 1. In this step Keycloak also provides as request parameters the
> "state" and "code" values.
>    - After the user has been redirected back to the application I exchange
> the "code" received in step 3 for a token doing a POST request on
> http://localhost:8180/auth/realms/demo/protocol/openid-connect/token which
> is done successfully
>    - After the access token is available I proceed to access the
> "bearer-only" REST web services.
> note: the REST web services exposed by the "bearer-only" service are not
> accessible unless the user has been logged in and it has the correct "role"
> assigned to it.Problem: As stated at the start of the post the user is
> still able to access the "bearer-only" REST web services after the logout
> has been done. The only thing that seems to work is the logout from the
> "confidential" application (the user is not able to access the application
> unless he logs in again).If I perform the logout of the user then the REST
> web services exposed by the bearer-only application are still accessible.
> In the Keycloak server I get the following WARN message: " Some clients
> have been not been logged out for user adminuser in demo realm:
> rest_service"I tried implementing the logout in three ways:
>    - A redirect to URL http://localhost:8180/auth/realms/demo/protocol/
> openid-connect/logoutpassing in the redirect_uri and client_id parameters
>    - A POST request to http://localhost:8180/auth/
> realms/demo/protocol/openid-connect/logoutpassing in the Authorization
> Bearer in the header and the client_id, refresh_token, client_secret and
> redirect_uri
>    - A REST service exposed by the "bearer-only" service which does the
> following method call: HttpServletRequest request.logout()
> Neither of the above methods is working.PS: I did not want to go in to
> many details because even so the post is long enough. If I missed something
> please tell me and I will provide the additional information (if possible I
> can also attach the actual projects)
> Thank you,Dan Nemes
>
> |  | Virus-free. www.avg.com  |
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

From dan.nemes at ymail.com  Sun Jan 21 07:19:37 2018
From: dan.nemes at ymail.com (Dan Nemes)
Date: Sun, 21 Jan 2018 12:19:37 +0000 (UTC)
Subject: [keycloak-user] =?utf-8?q?Keycloak_logout_not_working_for_?=
 =?utf-8?q?=E2=80=9Cbearer-only=E2=80=9D_application_exposing_REST_service?=
 =?utf-8?q?s?=
In-Reply-To: <CAMZCGg-hECUvm5k_8zDmxpy5q_UfxpKGxUd+bfGdLoYyWA4OGw@mail.gmail.com>
References: <1745158990.1861044.1516526258657.ref@mail.yahoo.com>
	<1745158990.1861044.1516526258657@mail.yahoo.com>
	<CAMZCGg-hECUvm5k_8zDmxpy5q_UfxpKGxUd+bfGdLoYyWA4OGw@mail.gmail.com>
Message-ID: <1573618343.1905908.1516537177732@mail.yahoo.com>

Hello,
Thank you for your quick response.
I am using?keycloak-3.4.0 and?wildfly-10.1.0.Final.I have just added on github the projects I have created for working with keycloak. You can find them here:?https://github.com/NemesDan/keycloak
Please note that these projects have been started as a POC of how keycloak can be used so there are other functions that are out of the scope of the problem I'm having. I am still in the learning phase of how keycloak can be used at it's full potential.
  
|  
|   
|   
|   |    |

   |

  |
|  
|    |  
NemesDan/keycloak
 keycloak POC projects  |   |

  |

  |

 

There are multiple maven projects on this branch.1. Project GSDKeycloakProject with 3 modules:?customer-app,?product-app and?database-service. The last mentioned module is the bearer-only application in which the REST services are implemented.? ? database-service: contains two classes?ProductService and?CustomerService which implement REST services that are accessible only to logged users that have the correct role assigned.

2. KeycloakAccess - should be ignored, out of the scope of the problem
3. RestClientApplication - a maven web project in which the entire workflow is implemented. This simulates a client application that will login a user using keycloak, retrieve a token and use that token to access the "database-service" bearer-only application.
????In class?RestService you can find the following implemented REST web services? ? ? ? 3.1 GET request on?http://localhost:8080/TestRestProject/rest/service/login -> redirects user to the keycloak login page to perform the login. After login, keycloak redirects the user to to?http://localhost:8080/TestRestProject/rest/service/user_logged_in .?At this point the code is exchanged for token.
? ? ? ? 3.2 GET request on?http://localhost:8080/TestRestProject/rest/service/call_database/{param}
? ? ? ? ? ? - {param} could be either?products or?customers
? ? ? ? ? ? - this web service call will use the token from step 3.1 to access the database-service bearer only REST services
? ? ? ? 3.3 GET request on {URL}/logout or {URL}/logout_2
? ? ? ? ? ? - these requests were created in order to test the logout functionality but it seems that the database-service REST services are still accessible after the logout has been performed which after my knowledge means that the token has not been invalidated?

The key point of these projects is to avoid using any keycloak classes to implement the client application because we do not want to force the clients to use a specific library.
If I missed something please let me know.I appreciate your help.
Thank you,Dan Nemes
 

    On Sunday, January 21, 2018 12:11 PM, Sebastien Blanc <sblanc at redhat.com> wrote:
 

 Hi,

Which version of Keycloak are you using ? Which adapters are you using for the client and bearer-only apps ? We need this info. And yes sharing your project (through github for instance) could be really helpful. 

?

On Sun, Jan 21, 2018 at 10:17 AM, Dan Nemes <dan.nemes at ymail.com> wrote:

Hello,
I am unable to logout an user. The logout works for a "confidential" applications but it doesn't for a "bearer-only" application (the REST services are still accessible after logout).
I have the following configuration:

? ?- I have one "database" client application defined in Keycloak having access type "bearer-only" (created with the intent of exposing REST web services protected by Keycloak based on user roles)
? ?- I have one "rest_service" client application defined in keycloak having access type "confidential" (created with the intent of logging in users and allowing access to the "bearer-only" REST services after a successful login). The below described workflow is implemented in this application using REST web services
I am performing the following steps:
? ?- An http GET request is performed on URL?http://localhost:8180/ auth/realms/demo/protocol/ openid-connect/auth?which redirects the user to the login page handled by Keycloak
? ?- The user performs the login using his credentials (using the credentials of a user defined in Keycloak)
? ?- Keycloak redirects the user to the "redirect_uri" which was passed in step 1. In this step Keycloak also provides as request parameters the "state" and "code" values.
? ?- After the user has been redirected back to the application I exchange the "code" received in step 3 for a token doing a POST request on?http://localhost:8180/auth/ realms/demo/protocol/openid- connect/token?which is done successfully
? ?- After the access token is available I proceed to access the "bearer-only" REST web services.
note: the REST web services exposed by the "bearer-only" service are not accessible unless the user has been logged in and it has the correct "role" assigned to it.Problem: As stated at the start of the post the user is still able to access the "bearer-only" REST web services after the logout has been done. The only thing that seems to work is the logout from the "confidential" application (the user is not able to access the application unless he logs in again).If I perform the logout of the user then the REST web services exposed by the bearer-only application are still accessible. In the Keycloak server I get the following WARN message: " Some clients have been not been logged out for user adminuser in demo realm: rest_service"I tried implementing the logout in three ways:
? ?- A redirect to URL?http://localhost:8180/ auth/realms/demo/protocol/ openid-connect/logoutpassing in the redirect_uri and client_id parameters
? ?- A POST request to?http://localhost:8180/auth/ realms/demo/protocol/openid- connect/logoutpassing in the Authorization Bearer in the header and the client_id, refresh_token, client_secret and redirect_uri
? ?- A REST service exposed by the "bearer-only" service which does the following method call: HttpServletRequest request.logout()
Neither of the above methods is working.PS: I did not want to go in to many details because even so the post is long enough. If I missed something please tell me and I will provide the additional information (if possible I can also attach the actual projects)
Thank you,Dan Nemes

|? | Virus-free. www.avg.com? |

______________________________ _________________
keycloak-user mailing list
keycloak-user at lists.jboss.org
https://lists.jboss.org/ mailman/listinfo/keycloak-user



   

From sblanc at redhat.com  Sun Jan 21 09:57:02 2018
From: sblanc at redhat.com (Sebastien Blanc)
Date: Sun, 21 Jan 2018 15:57:02 +0100
Subject: [keycloak-user] =?utf-8?q?Keycloak_logout_not_working_for_?=
	=?utf-8?q?=E2=80=9Cbearer-only=E2=80=9D_application_exposing_REST_?=
	=?utf-8?q?services?=
In-Reply-To: <1573618343.1905908.1516537177732@mail.yahoo.com>
References: <1745158990.1861044.1516526258657.ref@mail.yahoo.com>
	<1745158990.1861044.1516526258657@mail.yahoo.com>
	<CAMZCGg-hECUvm5k_8zDmxpy5q_UfxpKGxUd+bfGdLoYyWA4OGw@mail.gmail.com>
	<1573618343.1905908.1516537177732@mail.yahoo.com>
Message-ID: <CAMZCGg_Pzf9NcLPjogid15oUUxT8OgTTQbVKBdegfEN=0z+8FQ@mail.gmail.com>

Hi,

Thx a lot for the sample, I could reproduce your issue. Keep in mind that
you bearer-only app just verify the signature of the token, it has no
session with your kc server. It will validate it until it's valid (if you
wait the access token lifespan (5min by default) you will see it does not
work anymore).

So how to invalidate the token ?
1. Be sure to set an admin URL for your bearer client :
http://localhost:8080/TestRestProject/rest/service
2. Then after your do the logout, you must also invocate the revocation
endpoint :
  2.1 You can do that through the admin console in sessions > revocation
and you push the new notBefore value
  2.2 You use the admin REST endpoint to invalidate the token  , it's a 2
step flow : update the notBefore value of the realm by doing a PUT on the
realm and then calling the POST revocation endpoint.
Check the network console of your browser to see the flow when you are in
the admin console and check the admin REST doc)

Hope this helps,

Sebi


On Sun, Jan 21, 2018 at 1:19 PM, Dan Nemes <dan.nemes at ymail.com> wrote:

> Hello,
>
> Thank you for your quick response.
>
> I am using keycloak-3.4.0 and wildfly-10.1.0.Final.
> I have just added on github the projects I have created for working with
> keycloak. You can find them here: https://github.com/NemesDan/keycloak
>
> Please note that these projects have been started as a POC of how keycloak
> can be used so there are other functions that are out of the scope of the
> problem I'm having. I am still in the learning phase of how keycloak can be
> used at it's full potential.
>
> NemesDan/keycloak
> keycloak POC projects
> <https://github.com/NemesDan/keycloak>
>
>
> There are multiple maven projects on this branch.
> 1. Project GSDKeycloakProject with 3 modules: customer-app, product-app
> and database-service. The last mentioned module is the bearer-only
> application in which the REST services are implemented.
>     database-service: contains two classes ProductService
> and CustomerService which implement REST services that are accessible only
> to logged users that have the correct role assigned.
>
> 2. KeycloakAccess - should be ignored, out of the scope of the problem
>
> 3. RestClientApplication - a maven web project in which the entire
> workflow is implemented. This simulates a client application that will
> login a user using keycloak, retrieve a token and use that token to access
> the "database-service" bearer-only application.
>
>     In class RestService you can find the following implemented REST web
> services
>         3.1 GET request on *http://localhost:8080/TestRestProject/rest/service/login
> <http://localhost:8080/TestRestProject/rest/service/login>* -> redirects
> user to the keycloak login page to perform the login. After login, keycloak
> redirects the user to to *http://localhost:8080/TestRestProject/rest/service/user_logged_in
> <http://localhost:8080/TestRestProject/rest/service/user_logged_in> .* At
> this point the code is exchanged for token.
>         3.2 GET request on *http://localhost:8080/TestRestProject/rest/service/call_database/{param}
> <http://localhost:8080/TestRestProject/rest/service/call_database/%7Bparam%7D>*
>             - *{param}* could be either *products *or *customers*
> *            - *this web service call will use the token from step 3.1 to
> access the database-service bearer only REST services
>         3.3 GET request on {URL}/logout or {URL}/logout_2
>             - these requests were created in order to test the logout
> functionality but it seems that the database-service REST services are
> still accessible after the logout has been performed which after my
> knowledge means that the token has not been invalidated
>
> The key point of these projects is to avoid using any keycloak classes to
> implement the client application because we do not want to force the
> clients to use a specific library.
>
> If I missed something please let me know.
> I appreciate your help.
>
> Thank you,
> Dan Nemes
>
>
>
> On Sunday, January 21, 2018 12:11 PM, Sebastien Blanc <sblanc at redhat.com>
> wrote:
>
>
> Hi,
>
> Which version of Keycloak are you using ? Which adapters are you using for
> the client and bearer-only apps ? We need this info. And yes sharing your
> project (through github for instance) could be really helpful.
>
>
>
> On Sun, Jan 21, 2018 at 10:17 AM, Dan Nemes <dan.nemes at ymail.com> wrote:
>
> Hello,
> I am unable to logout an user. The logout works for a "confidential"
> applications but it doesn't for a "bearer-only" application (the REST
> services are still accessible after logout).
> I have the following configuration:
>
>    - I have one "database" client application defined in Keycloak having
> access type "bearer-only" (created with the intent of exposing REST web
> services protected by Keycloak based on user roles)
>    - I have one "rest_service" client application defined in keycloak
> having access type "confidential" (created with the intent of logging in
> users and allowing access to the "bearer-only" REST services after a
> successful login). The below described workflow is implemented in this
> application using REST web services
> I am performing the following steps:
>    - An http GET request is performed on URL http://localhost:8180/
> auth/realms/demo/protocol/ openid-connect/auth
> <http://localhost:8180/auth/realms/demo/protocol/openid-connect/auth> which
> redirects the user to the login page handled by Keycloak
>    - The user performs the login using his credentials (using the
> credentials of a user defined in Keycloak)
>    - Keycloak redirects the user to the "redirect_uri" which was passed in
> step 1. In this step Keycloak also provides as request parameters the
> "state" and "code" values.
>    - After the user has been redirected back to the application I exchange
> the "code" received in step 3 for a token doing a POST request on http://localhost:8180/auth/
> realms/demo/protocol/openid- connect/token
> <http://localhost:8180/auth/realms/demo/protocol/openid-connect/token> which
> is done successfully
>    - After the access token is available I proceed to access the
> "bearer-only" REST web services.
> note: the REST web services exposed by the "bearer-only" service are not
> accessible unless the user has been logged in and it has the correct "role"
> assigned to it.Problem: As stated at the start of the post the user is
> still able to access the "bearer-only" REST web services after the logout
> has been done. The only thing that seems to work is the logout from the
> "confidential" application (the user is not able to access the application
> unless he logs in again).If I perform the logout of the user then the REST
> web services exposed by the bearer-only application are still accessible.
> In the Keycloak server I get the following WARN message: " Some clients
> have been not been logged out for user adminuser in demo realm:
> rest_service"I tried implementing the logout in three ways:
>    - A redirect to URL http://localhost:8180/ auth/realms/demo/protocol/
> openid-connect/logoutpassing
> <http://localhost:8180/auth/realms/demo/protocol/openid-connect/logoutpassing>
> in the redirect_uri and client_id parameters
>    - A POST request to http://localhost:8180/auth/
> realms/demo/protocol/openid- connect/logoutpassing
> <http://localhost:8180/auth/realms/demo/protocol/openid-connect/logoutpassing>
> in the Authorization Bearer in the header and the client_id, refresh_token,
> client_secret and redirect_uri
>    - A REST service exposed by the "bearer-only" service which does the
> following method call: HttpServletRequest request.logout()
> Neither of the above methods is working.PS: I did not want to go in to
> many details because even so the post is long enough. If I missed something
> please tell me and I will provide the additional information (if possible I
> can also attach the actual projects)
> Thank you,Dan Nemes
>
> |  | Virus-free. www.avg.com  |
>
> ______________________________ _________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/ mailman/listinfo/keycloak-user
> <https://lists.jboss.org/mailman/listinfo/keycloak-user>
>
>
>
>
>

From dan.nemes at ymail.com  Sun Jan 21 10:18:02 2018
From: dan.nemes at ymail.com (Dan Nemes)
Date: Sun, 21 Jan 2018 15:18:02 +0000 (UTC)
Subject: [keycloak-user] =?utf-8?q?Keycloak_logout_not_working_for_?=
 =?utf-8?q?=E2=80=9Cbearer-only=E2=80=9D_application_exposing_REST_service?=
 =?utf-8?q?s?=
In-Reply-To: <CAMZCGg_Pzf9NcLPjogid15oUUxT8OgTTQbVKBdegfEN=0z+8FQ@mail.gmail.com>
References: <1745158990.1861044.1516526258657.ref@mail.yahoo.com>
	<1745158990.1861044.1516526258657@mail.yahoo.com>
	<CAMZCGg-hECUvm5k_8zDmxpy5q_UfxpKGxUd+bfGdLoYyWA4OGw@mail.gmail.com>
	<1573618343.1905908.1516537177732@mail.yahoo.com>
	<CAMZCGg_Pzf9NcLPjogid15oUUxT8OgTTQbVKBdegfEN=0z+8FQ@mail.gmail.com>
Message-ID: <1003450184.1942689.1516547882364@mail.yahoo.com>

Hello,
Thank you for your help!
I will try the to perform the logout as you have described it and I will come back with a feedback.
Thank you,Dan Nemes 

    On Sunday, January 21, 2018 4:57 PM, Sebastien Blanc <sblanc at redhat.com> wrote:
 

 Hi,

Thx a lot for the sample, I could reproduce your issue. Keep in mind that you bearer-only app just verify the signature of the token, it has no session with your kc server. It will validate it until it's valid (if you wait the access token lifespan (5min by default) you will see it does not work anymore).?
So how to invalidate the token ? 
1. Be sure to set an admin URL for your bearer client : http://localhost:8080/TestRestProject/rest/service
2. Then after your do the logout, you must also invocate the revocation endpoint : 
? 2.1 You can do that through the admin console in sessions > revocation and you push the new notBefore value
? 2.2 You use the admin REST endpoint to invalidate the token? , it's a 2 step flow : update the notBefore value of the realm by doing a PUT on the realm and then calling the POST revocation endpoint. 
Check the network console of your browser to see the flow when you are in the admin console and check the admin REST doc)
Hope this helps,
Sebi

On Sun, Jan 21, 2018 at 1:19 PM, Dan Nemes <dan.nemes at ymail.com> wrote:

Hello,
Thank you for your quick response.
I am using?keycloak-3.4.0 and?wildfly-10.1.0.Final.I have just added on github the projects I have created for working with keycloak. You can find them here:?https://github.com/ NemesDan/keycloak
Please note that these projects have been started as a POC of how keycloak can be used so there are other functions that are out of the scope of the problem I'm having. I am still in the learning phase of how keycloak can be used at it's full potential.
  
|  
|  
|  
|   |    |

  |

  |
|  
|    |  
NemesDan/keycloak
 keycloak POC projects  |   |

  |

  |

 

There are multiple maven projects on this branch.1. Project GSDKeycloakProject with 3 modules:?customer-app,? product-app and?database-service. The last mentioned module is the bearer-only application in which the REST services are implemented.? ? database-service: contains two classes?ProductService and?CustomerService which implement REST services that are accessible only to logged users that have the correct role assigned.

2. KeycloakAccess - should be ignored, out of the scope of the problem
3. RestClientApplication - a maven web project in which the entire workflow is implemented. This simulates a client application that will login a user using keycloak, retrieve a token and use that token to access the "database-service" bearer-only application.
????In class?RestService you can find the following implemented REST web services? ? ? ? 3.1 GET request on?http://localhost:8080/ TestRestProject/rest/service/ login -> redirects user to the keycloak login page to perform the login. After login, keycloak redirects the user to to?http://localhost:8080/ TestRestProject/rest/service/ user_logged_in .?At this point the code is exchanged for token.
? ? ? ? 3.2 GET request on?http://localhost:8080/ TestRestProject/rest/service/ call_database/{param}
? ? ? ? ? ? - {param} could be either?products or?customers
? ? ? ? ? ? - this web service call will use the token from step 3.1 to access the database-service bearer only REST services
? ? ? ? 3.3 GET request on {URL}/logout or {URL}/logout_2
? ? ? ? ? ? - these requests were created in order to test the logout functionality but it seems that the database-service REST services are still accessible after the logout has been performed which after my knowledge means that the token has not been invalidated?

The key point of these projects is to avoid using any keycloak classes to implement the client application because we do not want to force the clients to use a specific library.
If I missed something please let me know.I appreciate your help.
Thank you,Dan Nemes
 

    On Sunday, January 21, 2018 12:11 PM, Sebastien Blanc <sblanc at redhat.com> wrote:
 

 Hi,

Which version of Keycloak are you using ? Which adapters are you using for the client and bearer-only apps ? We need this info. And yes sharing your project (through github for instance) could be really helpful. 

?

On Sun, Jan 21, 2018 at 10:17 AM, Dan Nemes <dan.nemes at ymail.com> wrote:

Hello,
I am unable to logout an user. The logout works for a "confidential" applications but it doesn't for a "bearer-only" application (the REST services are still accessible after logout).
I have the following configuration:

? ?- I have one "database" client application defined in Keycloak having access type "bearer-only" (created with the intent of exposing REST web services protected by Keycloak based on user roles)
? ?- I have one "rest_service" client application defined in keycloak having access type "confidential" (created with the intent of logging in users and allowing access to the "bearer-only" REST services after a successful login). The below described workflow is implemented in this application using REST web services
I am performing the following steps:
? ?- An http GET request is performed on URL?http://localhost:8180/ auth/realms/demo/protocol/ openid-connect/auth?which redirects the user to the login page handled by Keycloak
? ?- The user performs the login using his credentials (using the credentials of a user defined in Keycloak)
? ?- Keycloak redirects the user to the "redirect_uri" which was passed in step 1. In this step Keycloak also provides as request parameters the "state" and "code" values.
? ?- After the user has been redirected back to the application I exchange the "code" received in step 3 for a token doing a POST request on?http://localhost:8180/auth/ realms/demo/protocol/openid- connect/token?which is done successfully
? ?- After the access token is available I proceed to access the "bearer-only" REST web services.
note: the REST web services exposed by the "bearer-only" service are not accessible unless the user has been logged in and it has the correct "role" assigned to it.Problem: As stated at the start of the post the user is still able to access the "bearer-only" REST web services after the logout has been done. The only thing that seems to work is the logout from the "confidential" application (the user is not able to access the application unless he logs in again).If I perform the logout of the user then the REST web services exposed by the bearer-only application are still accessible. In the Keycloak server I get the following WARN message: " Some clients have been not been logged out for user adminuser in demo realm: rest_service"I tried implementing the logout in three ways:
? ?- A redirect to URL?http://localhost:8180/ auth/realms/demo/protocol/ openid-connect/logoutpassing in the redirect_uri and client_id parameters
? ?- A POST request to?http://localhost:8180/auth/ realms/demo/protocol/openid- connect/logoutpassing in the Authorization Bearer in the header and the client_id, refresh_token, client_secret and redirect_uri
? ?- A REST service exposed by the "bearer-only" service which does the following method call: HttpServletRequest request.logout()
Neither of the above methods is working.PS: I did not want to go in to many details because even so the post is long enough. If I missed something please tell me and I will provide the additional information (if possible I can also attach the actual projects)
Thank you,Dan Nemes

|? | Virus-free. www.avg.com? |

______________________________ _________________
keycloak-user mailing list
keycloak-user at lists.jboss.org
https://lists.jboss.org/ mailman/listinfo/keycloak-user



   



   

From sthorger at redhat.com  Mon Jan 22 03:03:25 2018
From: sthorger at redhat.com (Stian Thorgersen)
Date: Mon, 22 Jan 2018 09:03:25 +0100
Subject: [keycloak-user] Load custom theme from module
In-Reply-To: <etPan.5a622c4e.338290ff.7622@marvinosswald.de>
References: <etPan.5a622a69.7db79fad.7622@marvinosswald.de>
	<etPan.5a622c4e.338290ff.7622@marvinosswald.de>
Message-ID: <CAJgngAcsheNbeA9Tj35trtUTF4OkmOPvQCrbCLJs8ThAEAZx3A@mail.gmail.com>

What version?

On 19 January 2018 at 18:35, Marvin O?wald <mail at marvinosswald.de> wrote:

> I get the following error message:
>
> 15:30:04,838 ERROR [org.keycloak.services.error.KeycloakErrorHandler]
> (default task-71) Uncaught server error: java.lang.NullPointerException
>         at org.keycloak.theme.ExtendingThemeManager$
> ExtendingTheme.getProperties(ExtendingThemeManager.java:292)
>         at org.keycloak.services.resources.admin.info.
> ServerInfoAdminResource.setThemes(ServerInfoAdminResource.java:186)
>         at org.keycloak.services.resources.admin.info.
> ServerInfoAdminResource.getInfo(ServerInfoAdminResource.java:98)
>         at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
>         at sun.reflect.NativeMethodAccessorImpl.invoke(
> NativeMethodAccessorImpl.java:62)
>         at sun.reflect.DelegatingMethodAccessorImpl.invoke(
> DelegatingMethodAccessorImpl.java:43)
>         at java.lang.reflect.Method.invoke(Method.java:498)
>
> my standalone.xml:
>
>         <theme>
>                 <staticMaxAge>2592000</staticMaxAge>
>                 <cacheThemes>true</cacheThemes>
>                 <cacheTemplates>true</cacheTemplates>
>                 <dir>${jboss.home.dir}/themes</dir>
>                 <modules>
>                         <module>de.svg.keycloak.
> modules.keycloak-svg-theme</module>
>                 </modules>
>             </theme>
>
> my pom.xml of my theme:
>
> <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="
> http://www.w3.org/2001/XMLSchema-instance"
>          xsi:schemaLocation="http://maven.apache.org/POM/4.0.0
> http://maven.apache.org/maven-v4_0_0.xsd">
>
>     <name>Keycloak SVG Theme</name>
>     <description/>
>     <modelVersion>4.0.0</modelVersion>
>
>     <artifactId>keycloak-svg-theme</artifactId>
>     <groupId>de.svg.keycloak.modules</groupId>
>     <version>1.0.0</version>
>     <packaging>jar</packaging>
>
>     <build>
>         <finalName>keycloak-svg-theme</finalName>
>     </build>
> </project>
>
> my META-INF/keycloak-themes.json:
>
> {
>     "themes": [{
>         "name" : "svg",
>         "types": [ "login", "email" ]
>     }]
> }
>
>
>
> Sorry for my two messages, any ideas what i?m doing wrong ?
> On 19. January 2018 at 18:27:07, Marvin O?wald (mail at marvinosswald.de)
> wrote:
>
> Hello,
>
> if i?m registering my custom theme like this:
>
> ./keycloak/bin/jboss-cli.sh --command="module add --name=de.svg.keycloak.modules.keycloak-svg-theme
> --resources=keycloak-svg-theme-1.0.0.jar?
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>

From dometec at gmail.com  Mon Jan 22 04:06:35 2018
From: dometec at gmail.com (Domenico Briganti)
Date: Mon, 22 Jan 2018 10:06:35 +0100
Subject: [keycloak-user] Autologin with access token
Message-ID: <1516611995.8314.1.camel@gmail.com>

Hi folks,?
?I have a question about access token. I've admit that I didn't read in
toto the openidc spec :(

I have a mobile app that has an access token used for API invocation
and I need to open a webview to show a private page.?
I've read that I need to set the state cookie ( http://lists.jboss.org/
pipermail/keycloak-user/2016-October/007911.html ) with a redirect, and
I can do it. But how can I get a code parameter from an access token?

Maybe is there another way to do it?

Thanks,
Domenico Briganti

From Ori.Doolman at amdocs.com  Mon Jan 22 04:44:04 2018
From: Ori.Doolman at amdocs.com (Ori Doolman)
Date: Mon, 22 Jan 2018 09:44:04 +0000
Subject: [keycloak-user] adding realm level configuration parameter
In-Reply-To: <F12603E320A90546946D142FB805B94601734E8A88@ILRAADAGBE1.corp.amdocs.com>
References: <F12603E320A90546946D142FB805B94601734E8A88@ILRAADAGBE1.corp.amdocs.com>
Message-ID: <F12603E320A90546946D142FB805B94601734F1A45@ILRAADAGBE1.corp.amdocs.com>

Hi,

Any answer on that??



Thanks,

Ori .


-----Original Message-----
From: keycloak-user-bounces at lists.jboss.org [mailto:keycloak-user-bounces at lists.jboss.org] On Behalf Of Ori Doolman
Sent: Tuesday, January 16, 2018 00:00
To: keycloak-user at lists.jboss.org
Subject: [keycloak-user] adding realm level configuration parameter

Hi,
I want to perform some customization to Keycloak using existing SPIs.
For that, I need to store a configuration parameter (may be different value per realm).
What is the way to achieve that? Is there an SPI to extend the realm properties?
The only solution I can think of now is setting a custom attribute in the users group of the realm.


Thanks,

Ori Doolman
Lead Software Architect
Amdocs Optima

+972 9 778 6914 (office)
+972 50 9111442 (mobile)

[cid:image001.png at 01D2C8DE.BFF33E10]

This message and the information contained herein is proprietary and confidential and subject to the Amdocs policy statement,

you may review at https://www.amdocs.com/about/email-disclaimer <https://www.amdocs.com/about/email-disclaimer>
This message and the information contained herein is proprietary and confidential and subject to the Amdocs policy statement,

you may review at https://www.amdocs.com/about/email-disclaimer <https://www.amdocs.com/about/email-disclaimer>



From lists at merit.unu.edu  Mon Jan 22 05:52:14 2018
From: lists at merit.unu.edu (lists)
Date: Mon, 22 Jan 2018 11:52:14 +0100
Subject: [keycloak-user] Credential Reset Update Password | using secondary
	email address
Message-ID: <b2a3ec26-dd20-b572-2e73-9eabd6742970@merit.unu.edu>

Hi,

Keycloak 3.4.1, with federated ldap accounts.

The "Credential Reset" action "Update password" in keycloak admin sends 
a password reset link to the users primary email address.

But the reason for the Credential Reset, usually *IS* (of course) the 
fact that the user can no knows his/her password, and therefore can no 
longer can access his/her email.

Therefore we would like this reset link to go a seconday email address, 
or perhaps be asked which emailaddress to send to reset link to, perhaps 
defaulting to the usual primary address, but with the option to send it 
to another address.

Would this not be a useful enhancement for others as well? Would it be 
worth submitting a feature request for? (or are we alone with this 
'problem'?)

MJ

From mitya at cargosoft.ru  Mon Jan 22 06:03:04 2018
From: mitya at cargosoft.ru (Dmitry Telegin)
Date: Mon, 22 Jan 2018 14:03:04 +0300
Subject: [keycloak-user] adding realm level configuration parameter
In-Reply-To: <F12603E320A90546946D142FB805B94601734F1A45@ILRAADAGBE1.corp.amdocs.com>
References: <F12603E320A90546946D142FB805B94601734E8A88@ILRAADAGBE1.corp.amdocs.com>
	<F12603E320A90546946D142FB805B94601734F1A45@ILRAADAGBE1.corp.amdocs.com>
Message-ID: <1516618984.27821.1.camel@cargosoft.ru>

Hi Ori,

In Keycloak, realms do have their own attributes. Starting with 2.2.0,
they are exposed as
org.keycloak.models.RealmModel::{get,set}Attribute*() methods,  so I
suggest that you take a look at them. Seems like exactly what you need
- just make sure your attribute names do not clash with internal ones
(examine realm_attribute table contents for that). It will be pretty
safe to prefix your attribute names with something unique, like
"com.amdocs.*"

If you need truly *global* persistent configuration (i.e. not bound to
any realm), unfortunately there's no such functionality in KC at the
moment, but I'm implementing the same for my company's needs. Let me
know if you're interested.

Cheers,
Dmitry  

> Hi,
> 
> Any answer on that??
> 
> 
> 
> Thanks,
> 
> Ori .
> 
> 
> -----Original Message-----
> From: keycloak-user-bounces at lists.jboss.org [mailto:keycloak-user-bounces at lists.jboss.org] On Behalf Of Ori Doolman
> Sent: Tuesday, January 16, 2018 00:00
> To: keycloak-user at lists.jboss.org
> Subject: [keycloak-user] adding realm level configuration parameter
> 
> Hi,
> I want to perform some customization to Keycloak using existing SPIs.
> For that, I need to store a configuration parameter (may be different value per realm).
> What is the way to achieve that? Is there an SPI to extend the realm properties?
> The only solution I can think of now is setting a custom attribute in the users group of the realm.
> 
> 
> Thanks,
> 
> Ori Doolman
> Lead Software Architect
> Amdocs Optima
> 
> +972 9 778 6914 (office)
> +972 50 9111442 (mobile)
> 
> [cid:image001.png at 01D2C8DE.BFF33E10]
> 
> This message and the information contained herein is proprietary and confidential and subject to the Amdocs policy statement,
> 
> you may review at https://www.amdocs.com/about/email-disclaimer <https://www.amdocs.com/about/email-disclaimer>
> This message and the information contained herein is proprietary and confidential and subject to the Amdocs policy statement,
> 
> you may review at https://www.amdocs.com/about/email-disclaimer <https://www.amdocs.com/about/email-disclaimer>
> 
> 
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

From thiago.addevico at gmail.com  Mon Jan 22 06:51:50 2018
From: thiago.addevico at gmail.com (Thiago Presa)
Date: Mon, 22 Jan 2018 09:51:50 -0200
Subject: [keycloak-user] Atrributes in resources into Keycloak Authorization
	services
Message-ID: <CAHDpToVHS+ZLc=4Fb664nCUV-LfHQNmiHYEn0Kn6=uXWXxcePQ@mail.gmail.com>

Hi,

We're looking into Keycloak Authorization services, but currently, we can't
get our heads around configuring in Keycloak a policy the following
authorization requirement:

Suppose we have a corporate Google-docs-like app, where every document has
a clearance level (e.g. confidential, internal, public). Every user has its
own permission level, which indicates whether the user is allowed to access
confidential, internal or public documents.

Could you please advise as to how to implement such requirements into
Keycloak Authorization services?

Assuming this isn't currently supported, a simple solution seems to be
implementing the ability to set resource attributes and make them available
to policy construction. Would you be considering implementing such approach
(or any other)?

Best regards,
Thiago Presa

From Ori.Doolman at amdocs.com  Mon Jan 22 07:06:59 2018
From: Ori.Doolman at amdocs.com (Ori Doolman)
Date: Mon, 22 Jan 2018 12:06:59 +0000
Subject: [keycloak-user] adding realm level configuration parameter
In-Reply-To: <1516618984.27821.1.camel@cargosoft.ru>
References: <F12603E320A90546946D142FB805B94601734E8A88@ILRAADAGBE1.corp.amdocs.com>
	<F12603E320A90546946D142FB805B94601734F1A45@ILRAADAGBE1.corp.amdocs.com>
	<1516618984.27821.1.camel@cargosoft.ru>
Message-ID: <F12603E320A90546946D142FB805B94601734F1F31@ILRAADAGBE1.corp.amdocs.com>

Hi Dmitry,
Thank you very much for your answer.


1)      I assume that ?realm_attribute? table has no control from the Web UI admin console. Does it?

2)      How did you implement the global configurqation?


Thanks,

Ori

From: Dmitry Telegin [mailto:mitya at cargosoft.ru]
Sent: Monday, January 22, 2018 13:03
To: Ori Doolman <Ori.Doolman at Amdocs.com>; keycloak-user at lists.jboss.org
Subject: Re: [keycloak-user] adding realm level configuration parameter

Hi Ori,

In Keycloak, realms do have their own attributes. Starting with 2.2.0, they are exposed as org.keycloak.models.RealmModel::{get,set}Attribute*() methods, so I suggest that you take a look at them. Seems like exactly what you need - just make sure your attribute names do not clash with internal ones (examine realm_attribute table contents for that). It will be pretty safe to prefix your attribute names with something unique, like "com.amdocs.*"

If you need truly *global* persistent configuration (i.e. not bound to any realm), unfortunately there's no such functionality in KC at the moment, but I'm implementing the same for my company's needs. Let me know if you're interested.

Cheers,
Dmitry


Hi,



Any answer on that??







Thanks,



Ori .





-----Original Message-----

From: keycloak-user-bounces at lists.jboss.org<mailto:keycloak-user-bounces at lists.jboss.org> [mailto:keycloak-user-bounces at lists.jboss.org] On Behalf Of Ori Doolman

Sent: Tuesday, January 16, 2018 00:00

To: keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>

Subject: [keycloak-user] adding realm level configuration parameter



Hi,

I want to perform some customization to Keycloak using existing SPIs.

For that, I need to store a configuration parameter (may be different value per realm).

What is the way to achieve that? Is there an SPI to extend the realm properties?

The only solution I can think of now is setting a custom attribute in the users group of the realm.





Thanks,



Ori Doolman

Lead Software Architect

Amdocs Optima



+972 9 778 6914 (office)

+972 50 9111442 (mobile)



[cid:image001.png at 01D2C8DE.BFF33E10<mailto:image001.png at 01D2C8DE.BFF33E10>]



This message and the information contained herein is proprietary and confidential and subject to the Amdocs policy statement,



you may review at https://www.amdocs.com/about/email-disclaimer <https://www.amdocs.com/about/email-disclaimer>

This message and the information contained herein is proprietary and confidential and subject to the Amdocs policy statement,



you may review at https://www.amdocs.com/about/email-disclaimer <https://www.amdocs.com/about/email-disclaimer>





_______________________________________________

keycloak-user mailing list

keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>

https://lists.jboss.org/mailman/listinfo/keycloak-user
This message and the information contained herein is proprietary and confidential and subject to the Amdocs policy statement,

you may review at https://www.amdocs.com/about/email-disclaimer <https://www.amdocs.com/about/email-disclaimer>

From psilva at redhat.com  Mon Jan 22 08:07:02 2018
From: psilva at redhat.com (Pedro Igor Silva)
Date: Mon, 22 Jan 2018 11:07:02 -0200
Subject: [keycloak-user] Authorization Services and UMA 2.0 changes
Message-ID: <CAJrcDBf8Z7PHY5kzh9MndeEYz=7rdiAgqKpnm9C2joVt_b9-Kg@mail.gmail.com>

Hi All,

We are about to finish the initial round of changes to make Keycloak
Authorization Services compliant with UMA 2.0.

One of the main changes is related with a new OAuth2 Grant Type introduced
by UMA 2.0 [1] and how it will be used as a replacement for both
Entitlement and Authorization API. In UMA 2.0, there is no Authorization
API anymore, thus it will be removed on future versions of Keycloak.
Regarding Entitlement API, it will also be removed in favor of the new
grant type, but in this case we are using some extensions to UMA grant type
to provide the same functionality. One of the objectives of this change in
particular is to have a single endpoint from where permissions can be
obtained.

Another important change is also related with UMA where end-users should be
able now to manage their own resource and permissions via Account
Management Console. Users would be able to access a "Resource" page from
where they can:

* See the resources they own
* Check for pending permission requests (waiting for the owners approval).
As well options to grant/deny the request.
* Check for all "shared resources" / granted permissions. As well options
to revoke permissions
* Select an user they want to grant access to a resource and/or scope

Other changes are related with the Policy Enforcer, Authorization Client
Java API and configuration. For these areas in particular changes are
minimal, specially regarding policy enforcer configuration.

These changes are targeted to Keycloak v4 and we'll be updating docs
accordingly, specially on how to migrate to the new version.

Regards.
Pedro Igor

[1] https://docs.kantarainitiative.org/uma/wg/oauth-uma-grant-2.0-09.html

From daniel.hammarberg at capgemini.com  Mon Jan 22 08:25:54 2018
From: daniel.hammarberg at capgemini.com (Hammarberg, Daniel)
Date: Mon, 22 Jan 2018 13:25:54 +0000
Subject: [keycloak-user] Pre-delete event (again)
Message-ID: <31225E3A2F1E0E43BA9272CBEBDCC68401126838@DE-CM-MBX26.corp.capgemini.com>

Hello all,

We are using Keycloak?s event mechanism to listen to create/update/delete events in Keycloak and pass them on to an MQ bus that is consumed by Siebel. Now, we have stumbled upon the problem described in the post below, namely that the delete event is passed after the user is deleted, making it impossible to read the user?s attributes from KC.

The only thing that got fixed in the referenced bug report was that email was added to the delete event headers, which is not enough for us: The integration we have with Siebel is requiring the Siebel ID, which we have as an attribute on the user.

My question is: Is it in any way possible to hook into the Keycloak delete event before the user is deleted or to read user attributes after receiving the delete event?

Regards
/Daniel


The post I reference to above is:
http://lists.jboss.org/pipermail/keycloak-user/2016-June/006626.html

________________________________

Capgemini is a trading name used by the Capgemini Group of companies which includes Capgemini Sverige AB, a company registered in Sweden (number 556092-3053) whose registered office is at Gustavslundsv?gen 131 Box 825 ? S-161 24 Bromma.
This message contains information that may be privileged or confidential and is the property of the Capgemini Group. It is intended only for the person to whom it is addressed. If you are not the intended recipient, you are not authorized to read, print, retain, copy, disseminate, distribute, or use this message or any part thereof. If you receive this message in error, please notify the sender immediately and delete all copies of this message.

From mposolda at redhat.com  Mon Jan 22 08:29:55 2018
From: mposolda at redhat.com (Marek Posolda)
Date: Mon, 22 Jan 2018 14:29:55 +0100
Subject: [keycloak-user] adding realm level configuration parameter
In-Reply-To: <F12603E320A90546946D142FB805B94601734F1F31@ILRAADAGBE1.corp.amdocs.com>
References: <F12603E320A90546946D142FB805B94601734E8A88@ILRAADAGBE1.corp.amdocs.com>
	<F12603E320A90546946D142FB805B94601734F1A45@ILRAADAGBE1.corp.amdocs.com>
	<1516618984.27821.1.camel@cargosoft.ru>
	<F12603E320A90546946D142FB805B94601734F1F31@ILRAADAGBE1.corp.amdocs.com>
Message-ID: <551e0653-7061-3900-5f52-b30b4696f71e@redhat.com>

Hi,

for anyone interested, we have possibility to add:
- custom REST endpoints if you need control your own realm attributes
- custom DB entities if you want custom entities, which are possibly not 
tightly coupled to any realm (EG. global entities).
- custom SPI / providers. You may configure global settings in 
standalone(-ha).xml at subsystem level with that.

There is an example for all those functionalities. In the "providers" 
directory of keycloak-examples distribution, there is "domain-extension" 
. Some docs is in "Server development guide".

Marek

On 22/01/18 13:06, Ori Doolman wrote:
> Hi Dmitry,
> Thank you very much for your answer.
>
>
> 1)      I assume that ?realm_attribute? table has no control from the Web UI admin console. Does it?
>
> 2)      How did you implement the global configurqation?
>
>
> Thanks,
>
> Ori
>
> From: Dmitry Telegin [mailto:mitya at cargosoft.ru]
> Sent: Monday, January 22, 2018 13:03
> To: Ori Doolman <Ori.Doolman at Amdocs.com>; keycloak-user at lists.jboss.org
> Subject: Re: [keycloak-user] adding realm level configuration parameter
>
> Hi Ori,
>
> In Keycloak, realms do have their own attributes. Starting with 2.2.0, they are exposed as org.keycloak.models.RealmModel::{get,set}Attribute*() methods, so I suggest that you take a look at them. Seems like exactly what you need - just make sure your attribute names do not clash with internal ones (examine realm_attribute table contents for that). It will be pretty safe to prefix your attribute names with something unique, like "com.amdocs.*"
>
> If you need truly *global* persistent configuration (i.e. not bound to any realm), unfortunately there's no such functionality in KC at the moment, but I'm implementing the same for my company's needs. Let me know if you're interested.
>
> Cheers,
> Dmitry
>
>
> Hi,
>
>
>
> Any answer on that??
>
>
>
>
>
>
>
> Thanks,
>
>
>
> Ori .
>
>
>
>
>
> -----Original Message-----
>
> From: keycloak-user-bounces at lists.jboss.org<mailto:keycloak-user-bounces at lists.jboss.org> [mailto:keycloak-user-bounces at lists.jboss.org] On Behalf Of Ori Doolman
>
> Sent: Tuesday, January 16, 2018 00:00
>
> To: keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>
>
> Subject: [keycloak-user] adding realm level configuration parameter
>
>
>
> Hi,
>
> I want to perform some customization to Keycloak using existing SPIs.
>
> For that, I need to store a configuration parameter (may be different value per realm).
>
> What is the way to achieve that? Is there an SPI to extend the realm properties?
>
> The only solution I can think of now is setting a custom attribute in the users group of the realm.
>
>
>
>
>
> Thanks,
>
>
>
> Ori Doolman
>
> Lead Software Architect
>
> Amdocs Optima
>
>
>
> +972 9 778 6914 (office)
>
> +972 50 9111442 (mobile)
>
>
>
> [cid:image001.png at 01D2C8DE.BFF33E10<mailto:image001.png at 01D2C8DE.BFF33E10>]
>
>
>
> This message and the information contained herein is proprietary and confidential and subject to the Amdocs policy statement,
>
>
>
> you may review at https://www.amdocs.com/about/email-disclaimer <https://www.amdocs.com/about/email-disclaimer>
>
> This message and the information contained herein is proprietary and confidential and subject to the Amdocs policy statement,
>
>
>
> you may review at https://www.amdocs.com/about/email-disclaimer <https://www.amdocs.com/about/email-disclaimer>
>
>
>
>
>
> _______________________________________________
>
> keycloak-user mailing list
>
> keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>
>
> https://lists.jboss.org/mailman/listinfo/keycloak-user
> This message and the information contained herein is proprietary and confidential and subject to the Amdocs policy statement,
>
> you may review at https://www.amdocs.com/about/email-disclaimer <https://www.amdocs.com/about/email-disclaimer>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user



From thomas.isaksen at sysco.no  Mon Jan 22 08:32:28 2018
From: thomas.isaksen at sysco.no (Thomas Isaksen)
Date: Mon, 22 Jan 2018 13:32:28 +0000
Subject: [keycloak-user] KeycloakOIDCFilter infinite loop after
	authentication
Message-ID: <VI1PR0402MB35364775C80477D2AB68B60CEAEC0@VI1PR0402MB3536.eurprd04.prod.outlook.com>

Hi

I tried sending another mail containing a fiddler log but it bounced for some reason. Anyway,

I have configured the filter on weblogic 12.2.1.3 as follows:

<filter>
    <filter-name>Keycloak Filter</filter-name>
    <filter-class>org.keycloak.adapters.servlet.KeycloakOIDCFilter</filter-class>
    <init-param>
        <param-name>keycloak.config.skipPattern</param-name>
        <param-value>^(example1|example2|whatever).*</param-value>
    </init-param>
</filter>
<filter-mapping>
    <filter-name>Keycloak Filter</filter-name>
    <url-pattern>/keycloak/*</url-pattern>
    <url-pattern>/*</url-pattern>
</filter-mapping>

My keycloak.json is located in /WEB-INF/

{
  "realm": "Toyota Development",
  "auth-server-url": "http://localhost:18080/auth",
  "ssl-required": "external",
  "resource": "dummyWeb",
  "credentials": {
    "secret": "e9be44b7-394b-40d9-a8c0-203cdb9c450b"
  },
  "confidential-port": 0
}

Client config:

Root URL: http://dev.toyota.no:7002/DummyWeb/
Valid Redirect URIs: http://dev.toyota.no:7002/DummyWeb/*
Base URL: http://dev.toyota.no:7002/DummyWeb/
Admin URL: http://dev.toyota.no:7002/DummyWeb/keycloak
Web Origins: http://localhost:8080 (keycloak server) http://dev.toyota.no.no:7002


Looks like I am getting authenticated but browser is stuck in an infinite loop. If I close the browser and try the same URL again it will go into a loop again unless I clear sessions from the keycloak admin console.

You can see the fiddler log or log as text here:
https://drive.google.com/drive/folders/1HiwSEe0WBWny3BQCrmXKz3LdNXVRxVVW?usp=sharing

If someone could please have a look at it I would be super happy!
Thanks!

--
Thomas Isaksen




From pinguwien at gmail.com  Mon Jan 22 10:16:23 2018
From: pinguwien at gmail.com (Dominik Guhr)
Date: Mon, 22 Jan 2018 16:16:23 +0100
Subject: [keycloak-user] Lookup user by ID in more than one Identity
 provider (ID is not unique)
Message-ID: <da1ca909-cb98-05b1-6f95-9bd468f0ac27@gmail.com>

Hi there,

so I have the following scenario and hope you folks could help me out here:

I've got a webapp and we're switching from old db-based login to 
keycloak. In our realm, we're federating the "old" userDB via an 
implementation of the User Federation SPI, and we're using 
spnego/kerberos authentication via federation of an Active Directory.

Lookup is:

1. userDB
2. AD

Now, use-case is as follows:

0. With kerberos-login, always use AD-login.
=> This works. :)

But: there may be the same ID ("john.doe") in AD and userDB, but with 
different passwords. So, we want to achieve this:

1. When you use manual login (non-domain-pc or something), it should 
make no difference which password you enter, you get logged in, as the 
application itself don't care where you're from, it just needs the userdata.

So, one might argue "why are you using the old userDB at all, then - 
you've got your AD, just use their data" - good question. But the userDB 
aggregates another AD, which is out of "political reasons" not 
accessible to us via keycloak identity federating / identity provider.
We're trying to change this, but as you might know, these processes cost 
time.. time we do not have at the moment.

So to get concrete: I implemented the Federation SPI and I think my 
starting point should be to change the overridden "getUserBy..."- 
methods which I pasted here: https://pastebin.com/ddZTYMD4

Now, instead of just returning null when isEmpty(), entity == null etc. 
is checked, my SPI impl. should be capable of calling the AD (possibly 
more than one in future) and check the same credentials against the AD 
database. And only if the user is not found in every provider, it should 
return null.

So to be honest, I have no clue if this is
a) the correct part I should start my call. May be isValid, though, for 
the User ("john.doe") itself IS found, but the password doesn't match

b) where the correct point is '(if any) where to change this and

c) how to make the call with my credentials to the AD, then.

Would be super happy if anyone could help me out here!

Best regards,
Dominik







From mitya at cargosoft.ru  Mon Jan 22 15:20:40 2018
From: mitya at cargosoft.ru (Dmitry Telegin)
Date: Mon, 22 Jan 2018 23:20:40 +0300
Subject: [keycloak-user] adding realm level configuration parameter
In-Reply-To: <F12603E320A90546946D142FB805B94601734F1F31@ILRAADAGBE1.corp.amdocs.com>
References: <F12603E320A90546946D142FB805B94601734E8A88@ILRAADAGBE1.corp.amdocs.com>
	<F12603E320A90546946D142FB805B94601734F1A45@ILRAADAGBE1.corp.amdocs.com>
	<1516618984.27821.1.camel@cargosoft.ru>
	<F12603E320A90546946D142FB805B94601734F1F31@ILRAADAGBE1.corp.amdocs.com>
Message-ID: <1516652440.29351.4.camel@cargosoft.ru>

Hi Ori,
> Hi Dmitry,
> 
> Thank you very much for your answer.
> 
> ?
> 
> 1)?????
> I assume that ?realm_attribute? table has no control from the Web UI
> admin console. Does it?

Upon introduction of realm attributes, we were discussing such an
option, see comments here: https://github.com/keycloak/keycloak/pull/31
53That time we didn't come up with any conclusion if the GUI were
indeed necessary; another consideration was the introduction of
components, which I thought would have replaced realm attributes one
day. However I think the component system has a bit different scope;
this also might be of some interest for you, take a look at
org.keycloak.component package in the keycloak-server-spi module.
> 
> 2)?????
> How did you implement the global configurqation?

I've roughly outlined it in my posting to keycloak-dev: http://lists.jb
oss.org/pipermail/keycloak-dev/2017-December/010261.htmlIn a few words,
there will be a ConfigurationProvider to configure and expose
Configuration instance to providers. This will be implemented with
Apache Commons Configuration, backed by a database table and proxied
with Infinispan to provide clustering support. BTW this component will
be opensourced (tentatively, by mid-February).
Cheers,Dmitry
> ?
> ?
> Thanks,
> ?
> Ori
> 
> ?
> 
> 
> 
> From: Dmitry Telegin [mailto:mitya at cargosoft.ru]
> 
> 
> Sent: Monday, January 22, 2018 13:03
> 
> To: Ori Doolman <Ori.Doolman at Amdocs.com>; keycloak-user at lists.jboss.o
> rg
> 
> Subject: Re: [keycloak-user] adding realm level configuration
> parameter
> 
> 
> ?
> 
> Hi Ori,
> 
> 
> ?
> 
> 
> In Keycloak, realms do have their own attributes. Starting with
> 2.2.0, they are exposed as
> org.keycloak.models.RealmModel::{get,set}Attribute*() methods, so I
> suggest that you take a look at them. Seems like exactly what you
> need - just
> ?make sure your attribute names do not clash with internal ones
> (examine realm_attribute table contents for that). It will be pretty
> safe to prefix your attribute names with something unique, like
> "com.amdocs.*"
> 
> 
> ?
> 
> 
> If you need truly *global* persistent configuration (i.e. not bound
> to any realm), unfortunately there's no such functionality in KC at
> the moment, but I'm implementing the same for my company's needs. Let
> me know if you're interested.
> 
> 
> ?
> 
> 
> Cheers,
> 
> 
> Dmitry?
> 
> 
> ?
> 
> 
> Hi,
> ?
> Any answer on that??
> ?
> ?
> ?
> Thanks,
> ?
> Ori .
> ?
> ?
> -----Original Message-----
> From: keycloak-user-bounces at lists.jboss.org [mailto:keycloak-user-bou
> nces at lists.jboss.org] On Behalf Of Ori Doolman
> Sent: Tuesday, January 16, 2018 00:00
> To: keycloak-user at lists.jboss.org
> Subject: [keycloak-user] adding realm level configuration parameter
> ?
> Hi,
> I want to perform some customization to Keycloak using existing SPIs.
> For that, I need to store a configuration parameter (may be different
> value per realm).
> What is the way to achieve that? Is there an SPI to extend the realm
> properties?
> The only solution I can think of now is setting a custom attribute in
> the users group of the realm.
> ?
> ?
> Thanks,
> ?
> Ori Doolman
> Lead Software Architect
> Amdocs Optima
> ?
> +972 9 778 6914 (office)
> +972 50 9111442 (mobile)
> ?
> [cid:image001.png at 01D2C8DE.BFF33E10]
> ?
> This message and the information contained herein is proprietary and
> confidential and subject to the Amdocs policy statement,
> ?
> you may review at https://www.amdocs.com/about/email-disclaimer
> <https://www.amdocs.com/about/email-disclaimer>
> This message and the information contained herein is proprietary and
> confidential and subject to the Amdocs policy statement,
> ?
> you may review at https://www.amdocs.com/about/email-disclaimer
> <https://www.amdocs.com/about/email-disclaimer>
> ?
> ?
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
> 
> 
> This message and the information contained herein is proprietary and
> confidential and subject to the Amdocs policy statement,
> you may review at https://www.amdocs.com/about/email-disclaimer
> 

From mitya at cargosoft.ru  Mon Jan 22 15:42:48 2018
From: mitya at cargosoft.ru (Dmitry Telegin)
Date: Mon, 22 Jan 2018 23:42:48 +0300
Subject: [keycloak-user] adding realm level configuration parameter
In-Reply-To: <551e0653-7061-3900-5f52-b30b4696f71e@redhat.com>
References: <F12603E320A90546946D142FB805B94601734E8A88@ILRAADAGBE1.corp.amdocs.com>
	<F12603E320A90546946D142FB805B94601734F1A45@ILRAADAGBE1.corp.amdocs.com>
	<1516618984.27821.1.camel@cargosoft.ru>
	<F12603E320A90546946D142FB805B94601734F1F31@ILRAADAGBE1.corp.amdocs.com>
	<551e0653-7061-3900-5f52-b30b4696f71e@redhat.com>
Message-ID: <1516653768.29351.6.camel@cargosoft.ru>

Hi Marek,
> Hi,
> 
> for anyone interested, we have possibility to add:
> - custom REST endpoints if you need control your own realm attributes
> - custom DB entities if you want custom entities, which are possibly
> not?
> tightly coupled to any realm (EG. global entities).
> - custom SPI / providers. You may configure global settings in?
> standalone(-ha).xml at subsystem level with that.

Some time ago I've proposed a solution for global writable (persistent)
config, based on Apache Commons Configuration: http://lists.jboss.org/p
ipermail/keycloak-dev/2017-December/010261.html
The message seemingly went unnoticed; could you please share your
thoughts on that? This will be opensourced, but will?also benefit a lot
from inclusion into upstream Keycloak (if it's decided it's worth
that).
> There is an example for all those functionalities. In the
> "providers"?
> directory of keycloak-examples distribution, there is "domain-
> extension"?
> . Some docs is in "Server development guide".

Unfortunately, the "domain-extension" example is borked and is not
going to be fixed anytime soon https://issues.jboss.org/browse/KEYCLOAK
-5927
I'd rather recommend (not surprisingly ;) my own BeerCloak example,
which is 100% working and maintained https://github.com/dteleguin/beerc
loak
In fact, I see it not as a mere example, but a kind of unofficial
blueprint for real-world Keycloak extensions. Can we publicize it
somehow? Guys who stumble upon it find it very useful, but the only way
to "stumble upon it" is browsing this very mailing list :)
Cheers,Dmitry

> Marek
> 
> On 22/01/18 13:06, Ori Doolman wrote:
> > Hi Dmitry,
> > Thank you very much for your answer.
> > 
> > 
> > 1)??????I assume that ?realm_attribute? table has no control from
> > the Web UI admin console. Does it?
> > 
> > 2)??????How did you implement the global configurqation?
> > 
> > 
> > Thanks,
> > 
> > Ori
> > 
> > From: Dmitry Telegin [mailto:mitya at cargosoft.ru]
> > Sent: Monday, January 22, 2018 13:03
> > To: Ori Doolman <Ori.Doolman at Amdocs.com>; keycloak-user at lists.jboss
> > .org
> > Subject: Re: [keycloak-user] adding realm level configuration
> > parameter
> > 
> > Hi Ori,
> > 
> > In Keycloak, realms do have their own attributes. Starting with
> > 2.2.0, they are exposed as
> > org.keycloak.models.RealmModel::{get,set}Attribute*() methods, so I
> > suggest that you take a look at them. Seems like exactly what you
> > need - just make sure your attribute names do not clash with
> > internal ones (examine realm_attribute table contents for that). It
> > will be pretty safe to prefix your attribute names with something
> > unique, like "com.amdocs.*"
> > 
> > If you need truly *global* persistent configuration (i.e. not bound
> > to any realm), unfortunately there's no such functionality in KC at
> > the moment, but I'm implementing the same for my company's needs.
> > Let me know if you're interested.
> > 
> > Cheers,
> > Dmitry
> > 
> > 
> > Hi,
> > 
> > 
> > 
> > Any answer on that??
> > 
> > 
> > 
> > 
> > 
> > 
> > 
> > Thanks,
> > 
> > 
> > 
> > Ori .
> > 
> > 
> > 
> > 
> > 
> > -----Original Message-----
> > 
> > From: keycloak-user-bounces at lists.jboss.org<mailto:keycloak-user-bo
> > unces at lists.jboss.org> [mailto:keycloak-user-bounces at lists.jboss.or
> > g] On Behalf Of Ori Doolman
> > 
> > Sent: Tuesday, January 16, 2018 00:00
> > 
> > To: keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.
> > org>
> > 
> > Subject: [keycloak-user] adding realm level configuration parameter
> > 
> > 
> > 
> > Hi,
> > 
> > I want to perform some customization to Keycloak using existing
> > SPIs.
> > 
> > For that, I need to store a configuration parameter (may be
> > different value per realm).
> > 
> > What is the way to achieve that? Is there an SPI to extend the
> > realm properties?
> > 
> > The only solution I can think of now is setting a custom attribute
> > in the users group of the realm.
> > 
> > 
> > 
> > 
> > 
> > Thanks,
> > 
> > 
> > 
> > Ori Doolman
> > 
> > Lead Software Architect
> > 
> > Amdocs Optima
> > 
> > 
> > 
> > +972 9 778 6914 (office)
> > 
> > +972 50 9111442 (mobile)
> > 
> > 
> > 
> > [cid:image001.png at 01D2C8DE.BFF33E10<mailto:image001.png at 01D2C8DE.BF
> > F33E10>]
> > 
> > 
> > 
> > This message and the information contained herein is proprietary
> > and confidential and subject to the Amdocs policy statement,
> > 
> > 
> > 
> > you may review at https://www.amdocs.com/about/email-disclaimer
> > <https://www.amdocs.com/about/email-disclaimer>
> > 
> > This message and the information contained herein is proprietary
> > and confidential and subject to the Amdocs policy statement,
> > 
> > 
> > 
> > you may review at https://www.amdocs.com/about/email-disclaimer
> > <https://www.amdocs.com/about/email-disclaimer>
> > 
> > 
> > 
> > 
> > 
> > _______________________________________________
> > 
> > keycloak-user mailing list
> > 
> > keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>
> > 
> > https://lists.jboss.org/mailman/listinfo/keycloak-user
> > This message and the information contained herein is proprietary
> > and confidential and subject to the Amdocs policy statement,
> > 
> > you may review at https://www.amdocs.com/about/email-disclaimer
> > <https://www.amdocs.com/about/email-disclaimer>
> > _______________________________________________
> > keycloak-user mailing list
> > keycloak-user at lists.jboss.org
> > https://lists.jboss.org/mailman/listinfo/keycloak-user
> 
> 

From upananda.singha at motorolasolutions.com  Mon Jan 22 23:54:11 2018
From: upananda.singha at motorolasolutions.com (Upananda Singha)
Date: Tue, 23 Jan 2018 10:24:11 +0530
Subject: [keycloak-user] Keycloak and Timesten DB integration
Message-ID: <CAEYbobvG=v2-3wVz0De3OVKKMR6B05xE1B2QRRnW2Y7zDom2AQ@mail.gmail.com>

Hi,

I have been experimenting with Keycloak version 3.4 for our OIDC related
use cases.

Would like to know if Keycloak supports integration with Timesten Database
(Oracle Timesten).

It would be great if some one can provide some details on it.

Thanks & Regds,

Upananda

From michael.hunziker at youengineering.com  Tue Jan 23 02:45:05 2018
From: michael.hunziker at youengineering.com (Michael Hunziker)
Date: Tue, 23 Jan 2018 08:45:05 +0100
Subject: [keycloak-user] Login on behalf
Message-ID: <CACyh6O0--jZtObZHBEi0cNvn6xuPF8tnt9_q92wOmboNU61g7Q@mail.gmail.com>

Hi!

I'm struggling with the following problem:

I am developing two apps (an iOS phone app for teachers and a web app for
students running on tablets).

Obviously the teacher (role TEACHER) is the master. I don't want the
students (role STUDENT) to login on their tablets, the teacher should login
on the tablet "as" the student.

Here's what I came up with so far:
- realm role "TEACHER"
- user "testTeacher" with realm role "TEACHER"
- client "teacher-ios-app"
- client "student-web-app"

I'm not sure how to handle the students. In one way they are "users" but
they are not really allowed to login themselves on their devices, only a
teacher should be allowed to do this.

Have you ever done something like this?

Cheers Michael

From mposolda at redhat.com  Tue Jan 23 03:22:07 2018
From: mposolda at redhat.com (Marek Posolda)
Date: Tue, 23 Jan 2018 09:22:07 +0100
Subject: [keycloak-user] adding realm level configuration parameter
In-Reply-To: <1516653768.29351.6.camel@cargosoft.ru>
References: <F12603E320A90546946D142FB805B94601734E8A88@ILRAADAGBE1.corp.amdocs.com>
	<F12603E320A90546946D142FB805B94601734F1A45@ILRAADAGBE1.corp.amdocs.com>
	<1516618984.27821.1.camel@cargosoft.ru>
	<F12603E320A90546946D142FB805B94601734F1F31@ILRAADAGBE1.corp.amdocs.com>
	<551e0653-7061-3900-5f52-b30b4696f71e@redhat.com>
	<1516653768.29351.6.camel@cargosoft.ru>
Message-ID: <df6abcc4-2be0-f9ca-b6e5-35a0510b305e@redhat.com>

Hi Dmitry,

It's interesting idea. But I think we're going to develop any more 
advanced global writable configuration just if it's needed for some 
built-in Keycloak features. And that's not the case now at this moment 
AFAIK. Maybe in the future...

On 22/01/18 21:42, Dmitry Telegin wrote:
> Hi Marek,
>
>> Hi,
>>
>> for anyone interested, we have possibility to add:
>> - custom REST endpoints if you need control your own realm attributes
>> - custom DB entities if you want custom entities, which are possibly not
>> tightly coupled to any realm (EG. global entities).
>> - custom SPI / providers. You may configure global settings in
>> standalone(-ha).xml at subsystem level with that.
>
> Some time ago I've proposed a solution for global writable 
> (persistent) config, based on Apache Commons Configuration: 
> http://lists.jboss.org/pipermail/keycloak-dev/2017-December/010261.html
>
> The message seemingly went unnoticed; could you please share your 
> thoughts on that? This will be opensourced, but will?also benefit a 
> lot from inclusion into upstream Keycloak (if it's decided it's worth 
> that).
I am not sure exactly about all the requirements you have for the 
use-case. I would (maybe) try one of the following:

- Use the global configuration at keycloak subsystem in standalone.xml 
(EG. you can see "scheduled-task-interval" or the configuration under 
"theme" element). You mentioned it's not sufficient for you, but for us 
it's ok ATM.
- You can use some custom Component configured at "master" realm level 
as a way for global storage
- You can use infinispan cache as a storage. This supports some things 
you mentioned like: events+notifications, persistent Cache stores (to 
backup data to JDBC or File if needed) etc. It's editable (if you do 
custom REST endpoint to CRUD the data) etc.

>
>> There is an example for all those functionalities. In the "providers"
>> directory of keycloak-examples distribution, there is "domain-extension"
>> . Some docs is in "Server development guide".
>
> Unfortunately, the "domain-extension" example is borked and is not 
> going to be fixed anytime soon 
> https://issues.jboss.org/browse/KEYCLOAK-5927
You reported the bug and you know where the issue is. Cool. Maybe you 
could also send PR to fix it? :)
>
> I'd rather recommend (not surprisingly ;) my own BeerCloak example, 
> which is 100% working and maintained 
> https://github.com/dteleguin/beercloak
>
> In fact, I see it not as a mere example, but a kind of unofficial 
> blueprint for real-world Keycloak extensions. Can we publicize it 
> somehow? Guys who stumble upon it find it very useful, but the only 
> way to "stumble upon it" is browsing this very mailing list :)
Yes, we can maybe have some page like "community maintained 
contributions" or something like that. The issue is, that those 
examples/extensions can become outdated when the maintainer from the 
community loses interest. There are both advantages and disadvantages of it.

Marek
>
> Cheers,
> Dmitry
>
>
>> Marek
>>
>> On 22/01/18 13:06, Ori Doolman wrote:
>>> Hi Dmitry, Thank you very much for your answer. 1) I assume that 
>>> ?realm_attribute? table has no control from the Web UI admin 
>>> console. Does it? 2) How did you implement the global 
>>> configurqation? Thanks, Ori From: Dmitry Telegin 
>>> [mailto:mitya at cargosoft.ru] Sent: Monday, January 22, 2018 13:03 To: 
>>> Ori Doolman <Ori.Doolman at Amdocs.com 
>>> <mailto:Ori.Doolman at Amdocs.com>>; keycloak-user at lists.jboss.org 
>>> <mailto:keycloak-user at lists.jboss.org> Subject: Re: [keycloak-user] 
>>> adding realm level configuration parameter Hi Ori, In Keycloak, 
>>> realms do have their own attributes. Starting with 2.2.0, they are 
>>> exposed as org.keycloak.models.RealmModel::{get,set}Attribute*() 
>>> methods, so I suggest that you take a look at them. Seems like 
>>> exactly what you need - just make sure your attribute names do not 
>>> clash with internal ones (examine realm_attribute table contents for 
>>> that). It will be pretty safe to prefix your attribute names with 
>>> something unique, like "com.amdocs.*" If you need truly *global* 
>>> persistent configuration (i.e. not bound to any realm), 
>>> unfortunately there's no such functionality in KC at the moment, but 
>>> I'm implementing the same for my company's needs. Let me know if 
>>> you're interested. Cheers, Dmitry Hi, Any answer on that?? Thanks, 
>>> Ori . -----Original Message----- From: 
>>> keycloak-user-bounces at lists.jboss.org 
>>> <mailto:keycloak-user-bounces at lists.jboss.org><mailto:keycloak-user-bounces at lists.jboss.org> 
>>> [mailto:keycloak-user-bounces at lists.jboss.org] On Behalf Of Ori 
>>> Doolman Sent: Tuesday, January 16, 2018 00:00 To: 
>>> keycloak-user at lists.jboss.org 
>>> <mailto:keycloak-user at lists.jboss.org><mailto:keycloak-user at lists.jboss.org> 
>>> Subject: [keycloak-user] adding realm level configuration parameter 
>>> Hi, I want to perform some customization to Keycloak using existing 
>>> SPIs. For that, I need to store a configuration parameter (may be 
>>> different value per realm). What is the way to achieve that? Is 
>>> there an SPI to extend the realm properties? The only solution I can 
>>> think of now is setting a custom attribute in the users group of the 
>>> realm. Thanks, Ori Doolman Lead Software Architect Amdocs Optima 
>>> +972 9 778 6914 (office) +972 50 9111442 (mobile) 
>>> [cid:image001.png at 01D2C8DE.BFF33E10 
>>> <mailto:image001.png at 01D2C8DE.BFF33E10><mailto:image001.png at 01D2C8DE.BFF33E10>] 
>>> This message and the information contained herein is proprietary and 
>>> confidential and subject to the Amdocs policy statement, you may 
>>> review at https://www.amdocs.com/about/email-disclaimer 
>>> <https://www.amdocs.com/about/email-disclaimer> This message and the 
>>> information contained herein is proprietary and confidential and 
>>> subject to the Amdocs policy statement, you may review at 
>>> https://www.amdocs.com/about/email-disclaimer 
>>> <https://www.amdocs.com/about/email-disclaimer> 
>>> _______________________________________________ keycloak-user 
>>> mailing list keycloak-user at lists.jboss.org 
>>> <mailto:keycloak-user at lists.jboss.org><mailto:keycloak-user at lists.jboss.org> 
>>> https://lists.jboss.org/mailman/listinfo/keycloak-user This message 
>>> and the information contained herein is proprietary and confidential 
>>> and subject to the Amdocs policy statement, you may review at 
>>> https://www.amdocs.com/about/email-disclaimer 
>>> <https://www.amdocs.com/about/email-disclaimer> 
>>> _______________________________________________ keycloak-user 
>>> mailing list keycloak-user at lists.jboss.org 
>>> <mailto:keycloak-user at lists.jboss.org> 
>>> https://lists.jboss.org/mailman/listinfo/keycloak-user 
>>
>>
>>


From mposolda at redhat.com  Tue Jan 23 03:38:21 2018
From: mposolda at redhat.com (Marek Posolda)
Date: Tue, 23 Jan 2018 09:38:21 +0100
Subject: [keycloak-user] KeycloakOIDCFilter infinite loop after
 authentication
In-Reply-To: <VI1PR0402MB35364775C80477D2AB68B60CEAEC0@VI1PR0402MB3536.eurprd04.prod.outlook.com>
References: <VI1PR0402MB35364775C80477D2AB68B60CEAEC0@VI1PR0402MB3536.eurprd04.prod.outlook.com>
Message-ID: <2437d7cd-f685-fa48-fee4-5cad4322a11c@redhat.com>

Not sure it's related, just noticed some inconsistency. The 
"auth-server-url" in keycloak.json points to "localhost:18080" but web 
porigin "localhost:8080" . Couldn't it be that?

Marek

On 22/01/18 14:32, Thomas Isaksen wrote:
> Hi
>
> I tried sending another mail containing a fiddler log but it bounced for some reason. Anyway,
>
> I have configured the filter on weblogic 12.2.1.3 as follows:
>
> <filter>
>      <filter-name>Keycloak Filter</filter-name>
>      <filter-class>org.keycloak.adapters.servlet.KeycloakOIDCFilter</filter-class>
>      <init-param>
>          <param-name>keycloak.config.skipPattern</param-name>
>          <param-value>^(example1|example2|whatever).*</param-value>
>      </init-param>
> </filter>
> <filter-mapping>
>      <filter-name>Keycloak Filter</filter-name>
>      <url-pattern>/keycloak/*</url-pattern>
>      <url-pattern>/*</url-pattern>
> </filter-mapping>
>
> My keycloak.json is located in /WEB-INF/
>
> {
>    "realm": "Toyota Development",
>    "auth-server-url": "http://localhost:18080/auth",
>    "ssl-required": "external",
>    "resource": "dummyWeb",
>    "credentials": {
>      "secret": "e9be44b7-394b-40d9-a8c0-203cdb9c450b"
>    },
>    "confidential-port": 0
> }
>
> Client config:
>
> Root URL: http://dev.toyota.no:7002/DummyWeb/
> Valid Redirect URIs: http://dev.toyota.no:7002/DummyWeb/*
> Base URL: http://dev.toyota.no:7002/DummyWeb/
> Admin URL: http://dev.toyota.no:7002/DummyWeb/keycloak
> Web Origins: http://localhost:8080 (keycloak server) http://dev.toyota.no.no:7002
>
>
> Looks like I am getting authenticated but browser is stuck in an infinite loop. If I close the browser and try the same URL again it will go into a loop again unless I clear sessions from the keycloak admin console.
>
> You can see the fiddler log or log as text here:
> https://drive.google.com/drive/folders/1HiwSEe0WBWny3BQCrmXKz3LdNXVRxVVW?usp=sharing
>
> If someone could please have a look at it I would be super happy!
> Thanks!
>
> --
> Thomas Isaksen
>
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user



From mposolda at redhat.com  Tue Jan 23 03:42:21 2018
From: mposolda at redhat.com (Marek Posolda)
Date: Tue, 23 Jan 2018 09:42:21 +0100
Subject: [keycloak-user] Pre-delete event (again)
In-Reply-To: <31225E3A2F1E0E43BA9272CBEBDCC68401126838@DE-CM-MBX26.corp.capgemini.com>
References: <31225E3A2F1E0E43BA9272CBEBDCC68401126838@DE-CM-MBX26.corp.capgemini.com>
Message-ID: <4b34e50b-71d3-f0a6-afb2-a405de00f723@redhat.com>

Yes, I see the pre-delete events can be useful. For example Infinispan 
has that feature. The advantage is also that pre-task event can throw 
the exception to force stop the task itself, which may be also useful 
for some usecases.

We can add new field, something like "boolean pre" to the AdminEvent and 
implement the event (at least for some admin endpoints).

Feel free to create JIRA for this.

Marek

On 22/01/18 14:25, Hammarberg, Daniel wrote:
> Hello all,
>
> We are using Keycloak?s event mechanism to listen to create/update/delete events in Keycloak and pass them on to an MQ bus that is consumed by Siebel. Now, we have stumbled upon the problem described in the post below, namely that the delete event is passed after the user is deleted, making it impossible to read the user?s attributes from KC.
>
> The only thing that got fixed in the referenced bug report was that email was added to the delete event headers, which is not enough for us: The integration we have with Siebel is requiring the Siebel ID, which we have as an attribute on the user.
>
> My question is: Is it in any way possible to hook into the Keycloak delete event before the user is deleted or to read user attributes after receiving the delete event?
>
> Regards
> /Daniel
>
>
> The post I reference to above is:
> http://lists.jboss.org/pipermail/keycloak-user/2016-June/006626.html
>
> ________________________________
>
> Capgemini is a trading name used by the Capgemini Group of companies which includes Capgemini Sverige AB, a company registered in Sweden (number 556092-3053) whose registered office is at Gustavslundsv?gen 131 Box 825 ? S-161 24 Bromma.
> This message contains information that may be privileged or confidential and is the property of the Capgemini Group. It is intended only for the person to whom it is addressed. If you are not the intended recipient, you are not authorized to read, print, retain, copy, disseminate, distribute, or use this message or any part thereof. If you receive this message in error, please notify the sender immediately and delete all copies of this message.
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user



From scott.finlay at sixt.com  Tue Jan 23 03:43:54 2018
From: scott.finlay at sixt.com (Scott Finlay)
Date: Tue, 23 Jan 2018 08:43:54 +0000
Subject: [keycloak-user] Session Configuration Per Client
Message-ID: <HE1PR0502MB30350E380A8F0873AC3A43C5E7E30@HE1PR0502MB3035.eurprd05.prod.outlook.com>

Hi,


We're currently using Keycloak 2.5.5.Final, and in this version the token lifetimes and session max and idle times can only be configured per realm. We have clients accessing the same user base via apps and via a website, and it would be nice if we could handle these different channels differently. Is it possible in the latest version of Keycloak to configure these on a client basis rather than per realm? Or if not, would it be possible to introduce this functionality?


Regards,

Scott


From scott.finlay at sixt.com  Tue Jan 23 03:49:01 2018
From: scott.finlay at sixt.com (Scott Finlay)
Date: Tue, 23 Jan 2018 08:49:01 +0000
Subject: [keycloak-user] Validate User Credentials Without Creating a Session
Message-ID: <HE1PR0502MB3035C1C9A18A53A54640E09CE7E30@HE1PR0502MB3035.eurprd05.prod.outlook.com>

Hi,


We're currently using Keycloak 2.5.5.Final, and in this version it's not possible

to validate a user's credentials (username / password combination) without

actually logging the user in which results in a session (and our sessions are long-

lived). Is there any new functionality introduced in the later versions of  Keycloak

to validate the credentials without actually logging the user in?


Our use-case is that we have very long-lived tokens, but we want to require the

user to re-enter his/her password in order to perform some certain sensitive tasks

such as changing the password or username.


If such functionality  is not available, would it be possible to add this?


Regards,

Scott

From thomas.isaksen at sysco.no  Tue Jan 23 04:07:25 2018
From: thomas.isaksen at sysco.no (Thomas Isaksen)
Date: Tue, 23 Jan 2018 09:07:25 +0000
Subject: [keycloak-user] KeycloakOIDCFilter infinite loop after
 authentication
In-Reply-To: <2437d7cd-f685-fa48-fee4-5cad4322a11c@redhat.com>
References: <VI1PR0402MB35364775C80477D2AB68B60CEAEC0@VI1PR0402MB3536.eurprd04.prod.outlook.com>
	<2437d7cd-f685-fa48-fee4-5cad4322a11c@redhat.com>
Message-ID: <VI1PR0402MB3536603853C80C2B8BB19442EAE30@VI1PR0402MB3536.eurprd04.prod.outlook.com>

Hi

I changed the port to 18080 because I have another WildFly instance running on port 8080. 
I noticed now that I had used 8080 for the Web Origins settings and I have changed that but to no avail.

./t

-----Original Message-----
From: Marek Posolda [mailto:mposolda at redhat.com] 
Sent: tirsdag 23. januar 2018 09.38
To: Thomas Isaksen <thomas.isaksen at sysco.no>; keycloak-user at lists.jboss.org
Subject: Re: [keycloak-user] KeycloakOIDCFilter infinite loop after authentication

Not sure it's related, just noticed some inconsistency. The "auth-server-url" in keycloak.json points to "localhost:18080" but web porigin "localhost:8080" . Couldn't it be that?

Marek

On 22/01/18 14:32, Thomas Isaksen wrote:
> Hi
>
> I tried sending another mail containing a fiddler log but it bounced 
> for some reason. Anyway,
>
> I have configured the filter on weblogic 12.2.1.3 as follows:
>
> <filter>
>      <filter-name>Keycloak Filter</filter-name>
>      <filter-class>org.keycloak.adapters.servlet.KeycloakOIDCFilter</filter-class>
>      <init-param>
>          <param-name>keycloak.config.skipPattern</param-name>
>          <param-value>^(example1|example2|whatever).*</param-value>
>      </init-param>
> </filter>
> <filter-mapping>
>      <filter-name>Keycloak Filter</filter-name>
>      <url-pattern>/keycloak/*</url-pattern>
>      <url-pattern>/*</url-pattern>
> </filter-mapping>
>
> My keycloak.json is located in /WEB-INF/
>
> {
>    "realm": "Toyota Development",
>    "auth-server-url": "http://localhost:18080/auth",
>    "ssl-required": "external",
>    "resource": "dummyWeb",
>    "credentials": {
>      "secret": "e9be44b7-394b-40d9-a8c0-203cdb9c450b"
>    },
>    "confidential-port": 0
> }
>
> Client config:
>
> Root URL: http://dev.toyota.no:7002/DummyWeb/
> Valid Redirect URIs: http://dev.toyota.no:7002/DummyWeb/*
> Base URL: http://dev.toyota.no:7002/DummyWeb/
> Admin URL: http://dev.toyota.no:7002/DummyWeb/keycloak
> Web Origins: http://localhost:8080 (keycloak server) 
> http://dev.toyota.no.no:7002
>
>
> Looks like I am getting authenticated but browser is stuck in an infinite loop. If I close the browser and try the same URL again it will go into a loop again unless I clear sessions from the keycloak admin console.
>
> You can see the fiddler log or log as text here:
> https://drive.google.com/drive/folders/1HiwSEe0WBWny3BQCrmXKz3LdNXVRxV
> VW?usp=sharing
>
> If someone could please have a look at it I would be super happy!
> Thanks!
>
> --
> Thomas Isaksen
>
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user




From daniel.hammarberg at capgemini.com  Tue Jan 23 05:50:11 2018
From: daniel.hammarberg at capgemini.com (Hammarberg, Daniel)
Date: Tue, 23 Jan 2018 10:50:11 +0000
Subject: [keycloak-user] Pre-delete event (again)
In-Reply-To: <4b34e50b-71d3-f0a6-afb2-a405de00f723@redhat.com>
References: <31225E3A2F1E0E43BA9272CBEBDCC68401126838@DE-CM-MBX26.corp.capgemini.com>
	<4b34e50b-71d3-f0a6-afb2-a405de00f723@redhat.com>
Message-ID: <31225E3A2F1E0E43BA9272CBEBDCC68401126BF6@DE-CM-MBX26.corp.capgemini.com>

Thank you for your prompt reply, Marek. I also take it as there is currently no other supported way to hook into the delete event.

For reference, I have created the following Jira:

https://issues.jboss.org/browse/KEYCLOAK-6340

//Daniel

-----Original Message-----
From: Marek Posolda [mailto:mposolda at redhat.com] 
Sent: den 23 januari 2018 09:42
To: Hammarberg, Daniel; keycloak-user at lists.jboss.org
Subject: Re: [keycloak-user] Pre-delete event (again)

Yes, I see the pre-delete events can be useful. For example Infinispan has that feature. The advantage is also that pre-task event can throw the exception to force stop the task itself, which may be also useful for some usecases.

We can add new field, something like "boolean pre" to the AdminEvent and implement the event (at least for some admin endpoints).

Feel free to create JIRA for this.

Marek

On 22/01/18 14:25, Hammarberg, Daniel wrote:
> Hello all,
>
> We are using Keycloak?s event mechanism to listen to create/update/delete events in Keycloak and pass them on to an MQ bus that is consumed by Siebel. Now, we have stumbled upon the problem described in the post below, namely that the delete event is passed after the user is deleted, making it impossible to read the user?s attributes from KC.
>
> The only thing that got fixed in the referenced bug report was that email was added to the delete event headers, which is not enough for us: The integration we have with Siebel is requiring the Siebel ID, which we have as an attribute on the user.
>
> My question is: Is it in any way possible to hook into the Keycloak delete event before the user is deleted or to read user attributes after receiving the delete event?
>
> Regards
> /Daniel
>
>
> The post I reference to above is:
> http://lists.jboss.org/pipermail/keycloak-user/2016-June/006626.html
>
> ________________________________
>
> Capgemini is a trading name used by the Capgemini Group of companies which includes Capgemini Sverige AB, a company registered in Sweden (number 556092-3053) whose registered office is at Gustavslundsv?gen 131 Box 825 ? S-161 24 Bromma.
> This message contains information that may be privileged or confidential and is the property of the Capgemini Group. It is intended only for the person to whom it is addressed. If you are not the intended recipient, you are not authorized to read, print, retain, copy, disseminate, distribute, or use this message or any part thereof. If you receive this message in error, please notify the sender immediately and delete all copies of this message.
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user




From aabella at bkool.com  Tue Jan 23 07:01:43 2018
From: aabella at bkool.com (Angel Abella)
Date: Tue, 23 Jan 2018 13:01:43 +0100
Subject: [keycloak-user] DB changes not refreshing on cluster nodes.
Message-ID: <CAAGXFYwppH9wak19MaVv==XoBpLPw0=AA+__VhsbAwt==KYe7Q@mail.gmail.com>

Hello list!

We are experiencing some problems with our standalone-ha setup of Keycloak
2.4.0.
Everithing works as expectd except ehn a user changes a password or is
added or removed from a group. When this happens the node making the change
is aware of it, but the other one does not until it is restarted.

Any idea of what is going on?




-- 
Angel Abella
*IT *
*BKOOL* *Connect* *| Sport*
mail: aabella at bkool.com
mob: +34 691 77 18 98
add: C/ San Joaqu?n 3 - 28231 Las Rozas - Madrid
www.bkool.com

From thomas.isaksen at sysco.no  Tue Jan 23 09:18:42 2018
From: thomas.isaksen at sysco.no (Thomas Isaksen)
Date: Tue, 23 Jan 2018 14:18:42 +0000
Subject: [keycloak-user] KeycloakOIDCFilter infinite loop
	after	authentication
In-Reply-To: <VI1PR0402MB35364775C80477D2AB68B60CEAEC0@VI1PR0402MB3536.eurprd04.prod.outlook.com>
References: <VI1PR0402MB35364775C80477D2AB68B60CEAEC0@VI1PR0402MB3536.eurprd04.prod.outlook.com>
Message-ID: <VI1PR0402MB3536EA21563188ADC2C44C25EAE30@VI1PR0402MB3536.eurprd04.prod.outlook.com>

Anyone? This is the only thing stopping me from throwing out Oracle Access Manager. I need this to work :-) 

./t

-----Original Message-----
From: keycloak-user-bounces at lists.jboss.org [mailto:keycloak-user-bounces at lists.jboss.org] On Behalf Of Thomas Isaksen
Sent: mandag 22. januar 2018 14.32
To: keycloak-user at lists.jboss.org
Subject: [keycloak-user] KeycloakOIDCFilter infinite loop after authentication

[This sender failed our fraud detection checks and may not be who they appear to be. Learn about spoofing at http://aka.ms/LearnAboutSpoofing]

Hi

I tried sending another mail containing a fiddler log but it bounced for some reason. Anyway,

I have configured the filter on weblogic 12.2.1.3 as follows:

<filter>
    <filter-name>Keycloak Filter</filter-name>
    <filter-class>org.keycloak.adapters.servlet.KeycloakOIDCFilter</filter-class>
    <init-param>
        <param-name>keycloak.config.skipPattern</param-name>
        <param-value>^(example1|example2|whatever).*</param-value>
    </init-param>
</filter>
<filter-mapping>
    <filter-name>Keycloak Filter</filter-name>
    <url-pattern>/keycloak/*</url-pattern>
    <url-pattern>/*</url-pattern>
</filter-mapping>

My keycloak.json is located in /WEB-INF/

{
  "realm": "Toyota Development",
  "auth-server-url": "http://localhost:18080/auth",
  "ssl-required": "external",
  "resource": "dummyWeb",
  "credentials": {
    "secret": "e9be44b7-394b-40d9-a8c0-203cdb9c450b"
  },
  "confidential-port": 0
}

Client config:

Root URL: http://dev.toyota.no:7002/DummyWeb/
Valid Redirect URIs: http://dev.toyota.no:7002/DummyWeb/*
Base URL: http://dev.toyota.no:7002/DummyWeb/
Admin URL: http://dev.toyota.no:7002/DummyWeb/keycloak
Web Origins: http://localhost:8080 (keycloak server) http://dev.toyota.no.no:7002


Looks like I am getting authenticated but browser is stuck in an infinite loop. If I close the browser and try the same URL again it will go into a loop again unless I clear sessions from the keycloak admin console.

You can see the fiddler log or log as text here:
https://drive.google.com/drive/folders/1HiwSEe0WBWny3BQCrmXKz3LdNXVRxVVW?usp=sharing

If someone could please have a look at it I would be super happy!
Thanks!

--
Thomas Isaksen



_______________________________________________
keycloak-user mailing list
keycloak-user at lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user


From blackbellamy at posteo.de  Tue Jan 23 10:10:33 2018
From: blackbellamy at posteo.de (BlackBellamy)
Date: Tue, 23 Jan 2018 16:10:33 +0100
Subject: [keycloak-user] KeycloakOIDCFilter infinite loop after
 authentication
In-Reply-To: <VI1PR0402MB3536EA21563188ADC2C44C25EAE30@VI1PR0402MB3536.eurprd04.prod.outlook.com>
References: <VI1PR0402MB35364775C80477D2AB68B60CEAEC0@VI1PR0402MB3536.eurprd04.prod.outlook.com>
	<VI1PR0402MB3536EA21563188ADC2C44C25EAE30@VI1PR0402MB3536.eurprd04.prod.outlook.com>
Message-ID: <0d18f441-b677-8b98-0160-48c9145ae5b8@posteo.de>

Just to be sure: Did you perhaps set your browser to not accept
3rd-party-cookies? Cost me half a morning once to figure out the reason
for an infinite loop...


On 01/23/2018 03:18 PM, Thomas Isaksen wrote:
> Anyone? This is the only thing stopping me from throwing out Oracle Access Manager. I need this to work :-) 
> 
> ./t
> 
> -----Original Message-----
> From: keycloak-user-bounces at lists.jboss.org [mailto:keycloak-user-bounces at lists.jboss.org] On Behalf Of Thomas Isaksen
> Sent: mandag 22. januar 2018 14.32
> To: keycloak-user at lists.jboss.org
> Subject: [keycloak-user] KeycloakOIDCFilter infinite loop after authentication
> 
> [This sender failed our fraud detection checks and may not be who they appear to be. Learn about spoofing at http://aka.ms/LearnAboutSpoofing]
> 
> Hi
> 
> I tried sending another mail containing a fiddler log but it bounced for some reason. Anyway,
> 
> I have configured the filter on weblogic 12.2.1.3 as follows:
> 
> <filter>
>     <filter-name>Keycloak Filter</filter-name>
>     <filter-class>org.keycloak.adapters.servlet.KeycloakOIDCFilter</filter-class>
>     <init-param>
>         <param-name>keycloak.config.skipPattern</param-name>
>         <param-value>^(example1|example2|whatever).*</param-value>
>     </init-param>
> </filter>
> <filter-mapping>
>     <filter-name>Keycloak Filter</filter-name>
>     <url-pattern>/keycloak/*</url-pattern>
>     <url-pattern>/*</url-pattern>
> </filter-mapping>
> 
> My keycloak.json is located in /WEB-INF/
> 
> {
>   "realm": "Toyota Development",
>   "auth-server-url": "http://localhost:18080/auth",
>   "ssl-required": "external",
>   "resource": "dummyWeb",
>   "credentials": {
>     "secret": "e9be44b7-394b-40d9-a8c0-203cdb9c450b"
>   },
>   "confidential-port": 0
> }
> 
> Client config:
> 
> Root URL: http://dev.toyota.no:7002/DummyWeb/
> Valid Redirect URIs: http://dev.toyota.no:7002/DummyWeb/*
> Base URL: http://dev.toyota.no:7002/DummyWeb/
> Admin URL: http://dev.toyota.no:7002/DummyWeb/keycloak
> Web Origins: http://localhost:8080 (keycloak server) http://dev.toyota.no.no:7002
> 
> 
> Looks like I am getting authenticated but browser is stuck in an infinite loop. If I close the browser and try the same URL again it will go into a loop again unless I clear sessions from the keycloak admin console.
> 
> You can see the fiddler log or log as text here:
> https://drive.google.com/drive/folders/1HiwSEe0WBWny3BQCrmXKz3LdNXVRxVVW?usp=sharing
> 
> If someone could please have a look at it I would be super happy!
> Thanks!
> 
> --
> Thomas Isaksen
> 
> 
> 
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
> 
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
> 

From tahonen at redhat.com  Tue Jan 23 10:29:43 2018
From: tahonen at redhat.com (Tero Ahonen)
Date: Tue, 23 Jan 2018 17:29:43 +0200
Subject: [keycloak-user] KeycloakOIDCFilter infinite loop after
	authentication
In-Reply-To: <0d18f441-b677-8b98-0160-48c9145ae5b8@posteo.de>
References: <VI1PR0402MB35364775C80477D2AB68B60CEAEC0@VI1PR0402MB3536.eurprd04.prod.outlook.com>
	<VI1PR0402MB3536EA21563188ADC2C44C25EAE30@VI1PR0402MB3536.eurprd04.prod.outlook.com>
	<0d18f441-b677-8b98-0160-48c9145ae5b8@posteo.de>
Message-ID: <5481E352-BE3C-485F-B833-2A88C3918107@redhat.com>

Just to check...are u sure that filter mapping isn?t causes that loop :)

.t

Sent from my iPhone

> On 23 Jan 2018, at 17.10, BlackBellamy <blackbellamy at posteo.de> wrote:
> 
> Just to be sure: Did you perhaps set your browser to not accept
> 3rd-party-cookies? Cost me half a morning once to figure out the reason
> for an infinite loop...
> 
> 
>> On 01/23/2018 03:18 PM, Thomas Isaksen wrote:
>> Anyone? This is the only thing stopping me from throwing out Oracle Access Manager. I need this to work :-) 
>> 
>> ./t
>> 
>> -----Original Message-----
>> From: keycloak-user-bounces at lists.jboss.org [mailto:keycloak-user-bounces at lists.jboss.org] On Behalf Of Thomas Isaksen
>> Sent: mandag 22. januar 2018 14.32
>> To: keycloak-user at lists.jboss.org
>> Subject: [keycloak-user] KeycloakOIDCFilter infinite loop after authentication
>> 
>> [This sender failed our fraud detection checks and may not be who they appear to be. Learn about spoofing at http://aka.ms/LearnAboutSpoofing]
>> 
>> Hi
>> 
>> I tried sending another mail containing a fiddler log but it bounced for some reason. Anyway,
>> 
>> I have configured the filter on weblogic 12.2.1.3 as follows:
>> 
>> <filter>
>>    <filter-name>Keycloak Filter</filter-name>
>>    <filter-class>org.keycloak.adapters.servlet.KeycloakOIDCFilter</filter-class>
>>    <init-param>
>>        <param-name>keycloak.config.skipPattern</param-name>
>>        <param-value>^(example1|example2|whatever).*</param-value>
>>    </init-param>
>> </filter>
>> <filter-mapping>
>>    <filter-name>Keycloak Filter</filter-name>
>>    <url-pattern>/keycloak/*</url-pattern>
>>    <url-pattern>/*</url-pattern>
>> </filter-mapping>
>> 
>> My keycloak.json is located in /WEB-INF/
>> 
>> {
>>  "realm": "Toyota Development",
>>  "auth-server-url": "http://localhost:18080/auth",
>>  "ssl-required": "external",
>>  "resource": "dummyWeb",
>>  "credentials": {
>>    "secret": "e9be44b7-394b-40d9-a8c0-203cdb9c450b"
>>  },
>>  "confidential-port": 0
>> }
>> 
>> Client config:
>> 
>> Root URL: http://dev.toyota.no:7002/DummyWeb/
>> Valid Redirect URIs: http://dev.toyota.no:7002/DummyWeb/*
>> Base URL: http://dev.toyota.no:7002/DummyWeb/
>> Admin URL: http://dev.toyota.no:7002/DummyWeb/keycloak
>> Web Origins: http://localhost:8080 (keycloak server) http://dev.toyota.no.no:7002
>> 
>> 
>> Looks like I am getting authenticated but browser is stuck in an infinite loop. If I close the browser and try the same URL again it will go into a loop again unless I clear sessions from the keycloak admin console.
>> 
>> You can see the fiddler log or log as text here:
>> https://drive.google.com/drive/folders/1HiwSEe0WBWny3BQCrmXKz3LdNXVRxVVW?usp=sharing
>> 
>> If someone could please have a look at it I would be super happy!
>> Thanks!
>> 
>> --
>> Thomas Isaksen
>> 
>> 
>> 
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>> 
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>> 
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user


From thomas.darimont at googlemail.com  Tue Jan 23 11:07:33 2018
From: thomas.darimont at googlemail.com (Thomas Darimont)
Date: Tue, 23 Jan 2018 17:07:33 +0100
Subject: [keycloak-user] [keycloak-dev] WG: How to generate a token
 string in a custom keycloak extension?
In-Reply-To: <a0878df46944494b9b4d30974764b437@DOX13BE02.hex2013.com>
References: <5caec6452e0742119ecf7d51638ec2ae@DOX13BE02.hex2013.com>
	<CAK-7U1j9A1YQoYdMTX5C1kqZ2wt7oCsTgkbeJfey+cGzKRNX1A@mail.gmail.com>
	<a0878df46944494b9b4d30974764b437@DOX13BE02.hex2013.com>
Message-ID: <CAK-7U1iV86+zNzdLXUq9hV-22zVFHxguUW4hmQtZ2yALG4V1Bg@mail.gmail.com>

Moving this discussion to keycloak-user.

The functionality you are trying to build is also known as "magic-link",
e.g. as used by services like slack.
There is an open feature request for that in JIRA:
https://issues.jboss.org/browse/KEYCLOAK-1942

Note that while this is very convenient to use it can be exploited quite
badly, as mentioned in the JIRA issue.

Cheers,
Thomas

2018-01-23 16:46 GMT+01:00 Felix Peters <peters at develop4edu.de>:

> Thanks for your quick response.
>
>
>
> I try to implement a prototype of a password-free authenticator like it
> was mentioned in this thread: http://lists.jboss.org/
> pipermail/keycloak-user/2015-October/003387.html
>
>
>
> My current approach is to create a token on a rest endpoint and validate
> this token in an custom authenticator.
>
> It?s just a POV, but I think a ActionToken can do the job.
>
>
>
> I was googleing around for an existing solution for password-free login
> with Keycloak, but could not found something like that.
>
>
>
> Greeting,
> Felix
>
>
>
> *Von:* Thomas Darimont [mailto:thomas.darimont at googlemail.com]
> *Gesendet:* Dienstag, 23. Januar 2018 15:48
> *An:* Felix Peters <peters at develop4edu.de>
> *Cc:* keycloak-dev at lists.jboss.org
> *Betreff:* Re: [keycloak-dev] WG: How to generate a token string in a
> custom keycloak extension?
>
>
>
> Hello Felix,
>
>
>
> What's your use case?
>
>
>
> Keycloak provides action tokens that permits its bearer to perform some
> actions, e. g. to reset a password or validate e-mail address.
>
>
>
> Perhaps you could have a look at the action tokens SPI:
>
> http://www.keycloak.org/docs/3.3/server_development/topics/
> action-token-spi.html
>
>
>
> Keycloaks OIDC Tokens (AccessToken, RefreshToken, IDToken) are generated
> within org.keycloak.protocol.oidc.TokenManager and exposed
>
> via the org.keycloak.protocol.oidc.endpoints.TokenEndpoint. Tokens can be
> verified via the org.keycloak.RSATokenVerifier.
>
>
>
> Cheers,
>
> Thomas
>
>
>
> 2018-01-23 15:29 GMT+01:00 Felix Peters <peters at develop4edu.de>:
>
> Hi,
>
> I'm pretty new to Keycloak development and at the moment I'm trying to
> develop some demo extensions to learn how SPI's an stuff like that work in
> Keycloak.
>
> My Question is:
> Is there a util- or helper-class which I can use to generate an secure
> token string in my extension code (pretty much the same as an oauth access
> or refresh token)?
> I was not able to find something In the Keycloak code, but maybe there is
> something like that.
> Thank you in advance,
> Felix Peters
>
>
> _______________________________________________
> keycloak-dev mailing list
> keycloak-dev at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-dev
>
>
>

From me at andreascarpino.it  Tue Jan 23 11:58:57 2018
From: me at andreascarpino.it (Andrea Scarpino)
Date: Tue, 23 Jan 2018 17:58:57 +0100
Subject: [keycloak-user] Keycloak 1.7's static resources broken after :reload
Message-ID: <CANcOiu3K-KptgtjccdB67XuqVF_T13dxghyYfAWjau_tOTqn0g@mail.gmail.com>

Hi there,

I know 1.7 is really really really old, but I would like to know the
reason behind this behaviour.
Inoking ":reload", to restart the application server, breaks Keycloak
static resources. A second ":reload" in row solves that. A third time
will break it again and so on :-)

To reproduce, download and unzip 1.7.0.Final, setup HTTPS, start the
application server and try to fetch a static resource (e.g.
https://localhost:8443/auth/welcome-content/keycloak_logo.png). Now
:reload the application server (jboss-cli.sh --connect
--command=:reload) and try to fetch the same resource (or any other);
the request returns 404 and an exceptions is logged:

ERROR [io.undertow.request] (default task-25) UT005023: Exception
handling request to /auth/welcome-content/keycloak_logo.png:
java.lang.RuntimeException: request path:
/auth/welcome-content/keycloak_logo.png

To me, it looks like the request output stream is closed before the
data is sent to the client.

Stacktrace is attached.
Did you ever saw something like that?

Thank you in advance for your help.

Note: I cannot reproduce this with >= 1.8.0.Final, so this have
already been fixed somewhere, but I would like to know where. I cannot
reproduce it with WildFly 9.0.2.Final neither.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: exception.log
Type: text/x-log
Size: 7602 bytes
Desc: not available
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20180123/19d57a12/attachment-0001.bin 

From clehingue at gmail.com  Wed Jan 24 01:17:27 2018
From: clehingue at gmail.com (Christophe Lehingue)
Date: Wed, 24 Jan 2018 07:17:27 +0100
Subject: [keycloak-user] Fwd: Question : VUEJS + keycloak-js
In-Reply-To: <CADf9yZPb24QnKBn-znFmwk3EageUZVNOFNOBCGhFRuj60W0hdw@mail.gmail.com>
References: <CADf9yZPb24QnKBn-znFmwk3EageUZVNOFNOBCGhFRuj60W0hdw@mail.gmail.com>
Message-ID: <CADf9yZOFpsVB3D2BzSZk7LN6qUahMk3LnCz2EWmk+V4F2_qOHA@mail.gmail.com>

Hello everyone,

I have a malfunction concerning keycloak-js with the ecosystem 'vujs'.

I can connect: but I have to make another connection to access USER
information

Let me explain :

1) firts connexion

[image: Images int?gr?es 1]


At this stage: the connection is good, but I can not access the user info
(and others) : i have theses errors

[image: Images int?gr?es 2]

I have to click again on my button "se connecter": to be able to recover
the desired infos


Do you have a solution ?

sorry for my english but unfortunately i am french.

Regards,
Christophe
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image.png
Type: image/png
Size: 56847 bytes
Desc: not available
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20180124/9cd51586/attachment-0002.png 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image.png
Type: image/png
Size: 40988 bytes
Desc: not available
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20180124/9cd51586/attachment-0003.png 

From sblanc at redhat.com  Wed Jan 24 01:44:34 2018
From: sblanc at redhat.com (Sebastien Blanc)
Date: Wed, 24 Jan 2018 07:44:34 +0100
Subject: [keycloak-user] Fwd: Question : VUEJS + keycloak-js
In-Reply-To: <CADf9yZOFpsVB3D2BzSZk7LN6qUahMk3LnCz2EWmk+V4F2_qOHA@mail.gmail.com>
References: <CADf9yZPb24QnKBn-znFmwk3EageUZVNOFNOBCGhFRuj60W0hdw@mail.gmail.com>
	<CADf9yZOFpsVB3D2BzSZk7LN6qUahMk3LnCz2EWmk+V4F2_qOHA@mail.gmail.com>
Message-ID: <CAMZCGg9ve63vFKe2N430wgdqXT5fwkDDQzdHoPw1hNVvx3hTPA@mail.gmail.com>

On Wed, Jan 24, 2018 at 7:17 AM, Christophe Lehingue <clehingue at gmail.com>
wrote:

> Hello everyone,
>
> I have a malfunction concerning keycloak-js with the ecosystem 'vujs'.
>
> I can connect: but I have to make another connection to access USER
> information
>
> Let me explain :
>
> 1) firts connexion
>
> [image: Images int?gr?es 1]
>
>
> At this stage: the connection is good, but I can not access the user info
> (and others) : i have theses errors
>
Looks like kc can't access your config, are you sure you are reusing the kc
original instance and not creating a new one that hasn't called init() ?

>
> [image: Images int?gr?es 2]
>
> I have to click again on my button "se connecter": to be able to recover
> the desired infos
>
>
> Do you have a solution ?
>
Is it possible to share your project on github ? That would make it
easier.

>
> sorry for my english but unfortunately i am french.
>
I know how it feels , can happen to the best of us ;)

>
> Regards,
> Christophe
>
Seb

>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>

From thomas.isaksen at sysco.no  Wed Jan 24 02:46:40 2018
From: thomas.isaksen at sysco.no (Thomas Isaksen)
Date: Wed, 24 Jan 2018 07:46:40 +0000
Subject: [keycloak-user] KeycloakOIDCFilter infinite loop after
 authentication
In-Reply-To: <5481E352-BE3C-485F-B833-2A88C3918107@redhat.com>
References: <VI1PR0402MB35364775C80477D2AB68B60CEAEC0@VI1PR0402MB3536.eurprd04.prod.outlook.com>
	<VI1PR0402MB3536EA21563188ADC2C44C25EAE30@VI1PR0402MB3536.eurprd04.prod.outlook.com>
	<0d18f441-b677-8b98-0160-48c9145ae5b8@posteo.de>
	<5481E352-BE3C-485F-B833-2A88C3918107@redhat.com>
Message-ID: <VI1PR0402MB3536826CA9A1AE9B3874F5BEEAE20@VI1PR0402MB3536.eurprd04.prod.outlook.com>

I changed my filter to /secret/index.html but it's still looping the redirect.  I also checked that 3rd party cookies are allowed.
I don't know what else to try.


./t

-----Original Message-----
From: Tero Ahonen [mailto:tahonen at redhat.com] 
Sent: tirsdag 23. januar 2018 16.30
To: BlackBellamy <blackbellamy at posteo.de>
Cc: Thomas Isaksen <thomas.isaksen at sysco.no>; keycloak-user at lists.jboss.org
Subject: Re: [keycloak-user] KeycloakOIDCFilter infinite loop after authentication

Just to check...are u sure that filter mapping isn?t causes that loop :)

.t

Sent from my iPhone

> On 23 Jan 2018, at 17.10, BlackBellamy <blackbellamy at posteo.de> wrote:
> 
> Just to be sure: Did you perhaps set your browser to not accept 
> 3rd-party-cookies? Cost me half a morning once to figure out the 
> reason for an infinite loop...
> 
> 
>> On 01/23/2018 03:18 PM, Thomas Isaksen wrote:
>> Anyone? This is the only thing stopping me from throwing out Oracle 
>> Access Manager. I need this to work :-)
>> 
>> ./t
>> 
>> -----Original Message-----
>> From: keycloak-user-bounces at lists.jboss.org 
>> [mailto:keycloak-user-bounces at lists.jboss.org] On Behalf Of Thomas 
>> Isaksen
>> Sent: mandag 22. januar 2018 14.32
>> To: keycloak-user at lists.jboss.org
>> Subject: [keycloak-user] KeycloakOIDCFilter infinite loop after 
>> authentication
>> 
>> [This sender failed our fraud detection checks and may not be who 
>> they appear to be. Learn about spoofing at 
>> http://aka.ms/LearnAboutSpoofing]
>> 
>> Hi
>> 
>> I tried sending another mail containing a fiddler log but it bounced 
>> for some reason. Anyway,
>> 
>> I have configured the filter on weblogic 12.2.1.3 as follows:
>> 
>> <filter>
>>    <filter-name>Keycloak Filter</filter-name>
>>    <filter-class>org.keycloak.adapters.servlet.KeycloakOIDCFilter</filter-class>
>>    <init-param>
>>        <param-name>keycloak.config.skipPattern</param-name>
>>        <param-value>^(example1|example2|whatever).*</param-value>
>>    </init-param>
>> </filter>
>> <filter-mapping>
>>    <filter-name>Keycloak Filter</filter-name>
>>    <url-pattern>/keycloak/*</url-pattern>
>>    <url-pattern>/*</url-pattern>
>> </filter-mapping>
>> 
>> My keycloak.json is located in /WEB-INF/
>> 
>> {
>>  "realm": "Toyota Development",
>>  "auth-server-url": "http://localhost:18080/auth",
>>  "ssl-required": "external",
>>  "resource": "dummyWeb",
>>  "credentials": {
>>    "secret": "e9be44b7-394b-40d9-a8c0-203cdb9c450b"
>>  },
>>  "confidential-port": 0
>> }
>> 
>> Client config:
>> 
>> Root URL: http://dev.toyota.no:7002/DummyWeb/
>> Valid Redirect URIs: http://dev.toyota.no:7002/DummyWeb/*
>> Base URL: http://dev.toyota.no:7002/DummyWeb/
>> Admin URL: http://dev.toyota.no:7002/DummyWeb/keycloak
>> Web Origins: http://localhost:8080 (keycloak server) 
>> http://dev.toyota.no.no:7002
>> 
>> 
>> Looks like I am getting authenticated but browser is stuck in an infinite loop. If I close the browser and try the same URL again it will go into a loop again unless I clear sessions from the keycloak admin console.
>> 
>> You can see the fiddler log or log as text here:
>> https://drive.google.com/drive/folders/1HiwSEe0WBWny3BQCrmXKz3LdNXVRx
>> VVW?usp=sharing
>> 
>> If someone could please have a look at it I would be super happy!
>> Thanks!
>> 
>> --
>> Thomas Isaksen
>> 
>> 
>> 
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>> 
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>> 
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user


From pinguwien at gmail.com  Wed Jan 24 03:27:48 2018
From: pinguwien at gmail.com (Dominik Guhr)
Date: Wed, 24 Jan 2018 09:27:48 +0100
Subject: [keycloak-user] Possibility to set new Provider in authentication
 flow for non-unique usernames
Message-ID: <a07cff97-8a17-a187-cbd3-08376baef3ed@gmail.com>

Hi everyone,

I'm implementing an authentication SPI execution on top of the "normal" 
username/password form of kc 3.4.3.Final. -> 
https://github.com/keycloak/keycloak/blob/master/services/src/main/java/org/keycloak/authentication/authenticators/browser/UsernamePasswordForm.java

Sadly, usernames are not unique atm, so I need to change the execution, 
so that it doesn't stop with "invalid credentials" for a user who was 
found in one Provider.

Instead of giving the "invalid credentials"-error, I want my execution 
to first check all other providers for the same username, and then check 
the credentials against all matches. And just in case of no credentials 
matching, it should fail, or login a new session for this user when one 
is found in any of my (3) Providers, which are added by user federation 
feature (2 ADs, one by a custom user storage SPI).

So I drilled it down to the method validatePassword(...) in 
AbstractUsernameFormAuthenticator.java -> 
https://github.com/keycloak/keycloak/blob/master/services/src/main/java/org/keycloak/authentication/authenticators/browser/AbstractUsernameFormAuthenticator.java 
line 191, which I want to change accordingly. Sadly, I can't find a 
method to get all Providers of the realm and check accordingly. The code 
I want to change is:

if (password != null && !password.isEmpty() && 
context.getSession().userCredentialManager().isValid(context.getRealm(), 
user, credentials)) {
             return true;
         } else {...}

instead of just checking isValid() for one provider, which is what this 
does atm, I want to check all Providers. Like this pseudocode:

if (password != null && !password.isEmpty() && 
context.getSession().userCredentialManager().isValid(context.getRealm(), 
user, credentials)) {
             boolean isValid = false;
	    List<Provider> realmProviders = context.getAllProviders();
	    for(Provider provider : realmProviders){
	    	isValid = provider.isValid(...);
	    }
             return isValid;
         } else {...}
Could anyone perhaps give me a hint in how to achieve this? I haven't 
found a method yet to get all Providers and check for isValid in any of 
the given ones.

Best regards,
Dominik

p.s. I created a stackoverflow question here: 
https://stackoverflow.com/questions/48399622/keycloak-check-password-in-more-than-one-identity-provider 
feel free to comment/answer there :)

From subodhcjoshi82 at gmail.com  Wed Jan 24 04:28:44 2018
From: subodhcjoshi82 at gmail.com (subodhomjoshi82)
Date: Wed, 24 Jan 2018 02:28:44 -0700 (MST)
Subject: [keycloak-user] How to configure keycloak with NGINX for J2EE web
	applicaton?
Message-ID: <1516786124996-0.post@n6.nabble.com>

How previously my web-application setup with keycloak?

    Installed keycloak in server machine
    Deployed the web-application in Jboss server
    Added the keycloak certificate into the Java Keytool in the machine
where web-app running.
    Made following changes in Standalone.xml file of JBOSS ES6.4
*
Added Extension*

 <extension module="org.keycloak.keycloak-adapter-subsystem"/>
*
Added security-domain*

<security-domain name="keycloak">
                    <authentication>
                        <login-module
code="org.keycloak.adapters.jboss.KeycloakLoginModule" flag="required"/>
                    </authentication>
 </security-domain>
*
Added Connector*

<connector name="https" protocol="HTTP/1.1" scheme="https"
socket-binding="https" enable-lookups="false" secure="true">
                <ssl name="ssl" key-alias="initcert" password="keycloak"
certificate-key-file="C:\Code_Base\keycloak_certificates\keycloak_server\keycloak.jks"
protocol="TLSv1,SSLv3,SSLv2" verify-client="false"/>
</connector>
*
Add SubSystem*

 <subsystem xmlns="urn:jboss:domain:keycloak:1.1">
                <secure-deployment name="MyApp.war">
                    <realm>MYRealm</realm>
                    <resource>MyApp</resource>
                   
<use-resource-role-mappings>true</use-resource-role-mappings>
                    <auth-server-url>https://<Server
IP>/auth/</auth-server-url>
                    <ssl-required>NONE</ssl-required>
                    <credential
name="secret">5c9f6ea3-3448-4569-b6c4-a9e62de4db52</credential>
                </secure-deployment>
            </subsystem>

So above changes working fine and my web application showing keycloak login
page and after successful login its showing my web app Home page.

Now my requirement to run Keycloak in HA mode with load balancer NGINX So
NGINX will be in front end and NGINX will decide which keycloak to point
when hitting https://<NGINX IP ADDRESS>/auth and below things already done .

*What already done?*

    Installed HA Keycloak in Node1 and Running.
    Installed HA Keycloak in Node2 and Running.
    Installed common Database(Used by above keycloak) in Node3 and Running.
    Installed NGINX in Node4 and Running.
    Configure Both keycloak(Step1 and Step2) with NGINX
    Now NGINX url (https://<IP ADDRESS>/auth) showing login page of Keycloak
and login also working.

Now can someone please tell me what changes i have to do in Jboss so it will
work with new setup



--
Sent from: http://keycloak-user.88327.x6.nabble.com/

From lists at merit.unu.edu  Wed Jan 24 05:22:30 2018
From: lists at merit.unu.edu (lists)
Date: Wed, 24 Jan 2018 11:22:30 +0100
Subject: [keycloak-user] password policy | Not (containing) Username
Message-ID: <66320f16-e085-0048-f55d-6855fb419d32@merit.unu.edu>

Hi,

We would like to also prevent passwords *containing* the username, to
also prevent passwords like Username_1980

The regular password policy "Not Username" only matches exact
"username", rather than anything containing the username.

Would it be possible to create a regex password policy to match a
password *containing* the username? But I don't think this is possible..?

Or perhaps I could file a feature request to change the current policy
into "Not containing username"?

MJ

From noircc at gmail.com  Wed Jan 24 05:43:27 2018
From: noircc at gmail.com (SW)
Date: Wed, 24 Jan 2018 03:43:27 -0700 (MST)
Subject: [keycloak-user] Keycloak 3.4 --> Possibility to search for
	attribute?
Message-ID: <1516790607070-0.post@n6.nabble.com>

Is there a possibility in Keycloak 3.4.3 to search for an attribute?

Would be quite handy for my usecase, because I am storing IDs for another
system in the attributes.





--
Sent from: http://keycloak-user.88327.x6.nabble.com/

From pinguwien at gmail.com  Wed Jan 24 06:51:27 2018
From: pinguwien at gmail.com (Dominik Guhr)
Date: Wed, 24 Jan 2018 12:51:27 +0100
Subject: [keycloak-user] Possibility to set new Provider in
 authentication flow for non-unique usernames
In-Reply-To: <a07cff97-8a17-a187-cbd3-08376baef3ed@gmail.com>
References: <a07cff97-8a17-a187-cbd3-08376baef3ed@gmail.com>
Message-ID: <d07cd730-05b3-212d-771c-b8b84dae838e@gmail.com>

So, further investigation notes:

I think I should call the Provider like it's done here: 
https://github.com/keycloak/keycloak/blob/master/examples/providers/user-storage-jpa/src/main/java/org/keycloak/examples/storage/user/EjbExampleUserStorageProviderFactory.java 
in the create method, which allows me to call the corresponding 
isValid(...) method of the required providers and only set the boolean 
return value of validatePassword to false if the credentials doesn't 
match in any of the providers.

But to call this for ldap-providers set by admin interface, I need two 
things:

a) a Componentmodel.
Concrete Question: Anyone knows how to get the right ComponentModel 
instance to use from my AuthenticationFlowContext of 
AbstractUsernameFormAuthenticator.java? I've seen that it's possible to 
get a List of ComponentModels by calling 
context.getRealm().getComponents(), or by getComponent(String s), but I 
don't know which String would be the valid parameter or which Model I 
should take out of the List.

b) the lookup-path.
Concrete question 2: Anyone knows how to get it form the internally used 
Factories or s.th.?

My Providers are 2 ldap directories which I want to iterate over for the 
username.

Thanks in advance!

Best regards,
Dominik

Am 24.01.18 um 09:27 schrieb Dominik Guhr:
> Hi everyone,
> 
> I'm implementing an authentication SPI execution on top of the "normal" 
> username/password form of kc 3.4.3.Final. -> 
> https://github.com/keycloak/keycloak/blob/master/services/src/main/java/org/keycloak/authentication/authenticators/browser/UsernamePasswordForm.java 
> 
> 
> Sadly, usernames are not unique atm, so I need to change the execution, 
> so that it doesn't stop with "invalid credentials" for a user who was 
> found in one Provider.
> 
> Instead of giving the "invalid credentials"-error, I want my execution 
> to first check all other providers for the same username, and then check 
> the credentials against all matches. And just in case of no credentials 
> matching, it should fail, or login a new session for this user when one 
> is found in any of my (3) Providers, which are added by user federation 
> feature (2 ADs, one by a custom user storage SPI).
> 
> So I drilled it down to the method validatePassword(...) in 
> AbstractUsernameFormAuthenticator.java -> 
> https://github.com/keycloak/keycloak/blob/master/services/src/main/java/org/keycloak/authentication/authenticators/browser/AbstractUsernameFormAuthenticator.java 
> line 191, which I want to change accordingly. Sadly, I can't find a 
> method to get all Providers of the realm and check accordingly. The code 
> I want to change is:
> 
> if (password != null && !password.isEmpty() && 
> context.getSession().userCredentialManager().isValid(context.getRealm(), 
> user, credentials)) {
>  ??????????? return true;
>  ??????? } else {...}
> 
> instead of just checking isValid() for one provider, which is what this 
> does atm, I want to check all Providers. Like this pseudocode:
> 
> if (password != null && !password.isEmpty() && 
> context.getSession().userCredentialManager().isValid(context.getRealm(), 
> user, credentials)) {
>  ??????????? boolean isValid = false;
>  ??????? List<Provider> realmProviders = context.getAllProviders();
>  ??????? for(Provider provider : realmProviders){
>  ??????????? isValid = provider.isValid(...);
>  ??????? }
>  ??????????? return isValid;
>  ??????? } else {...}
> Could anyone perhaps give me a hint in how to achieve this? I haven't 
> found a method yet to get all Providers and check for isValid in any of 
> the given ones.
> 
> Best regards,
> Dominik
> 
> p.s. I created a stackoverflow question here: 
> https://stackoverflow.com/questions/48399622/keycloak-check-password-in-more-than-one-identity-provider 
> feel free to comment/answer there :)

From pinguwien at gmail.com  Wed Jan 24 06:52:58 2018
From: pinguwien at gmail.com (Dominik Guhr)
Date: Wed, 24 Jan 2018 12:52:58 +0100
Subject: [keycloak-user] Possibility to set new Provider in
 authentication flow for non-unique usernames
In-Reply-To: <d07cd730-05b3-212d-771c-b8b84dae838e@gmail.com>
References: <a07cff97-8a17-a187-cbd3-08376baef3ed@gmail.com>
	<d07cd730-05b3-212d-771c-b8b84dae838e@gmail.com>
Message-ID: <43b5c623-a20c-0c17-fab3-bd7d19f126d7@gmail.com>

p.s. one provider uses Kerberos for Authentication, other does not.

Am 24.01.18 um 12:51 schrieb Dominik Guhr:
> So, further investigation notes:
> 
> I think I should call the Provider like it's done here: 
> https://github.com/keycloak/keycloak/blob/master/examples/providers/user-storage-jpa/src/main/java/org/keycloak/examples/storage/user/EjbExampleUserStorageProviderFactory.java 
> in the create method, which allows me to call the corresponding 
> isValid(...) method of the required providers and only set the boolean 
> return value of validatePassword to false if the credentials doesn't 
> match in any of the providers.
> 
> But to call this for ldap-providers set by admin interface, I need two 
> things:
> 
> a) a Componentmodel.
> Concrete Question: Anyone knows how to get the right ComponentModel 
> instance to use from my AuthenticationFlowContext of 
> AbstractUsernameFormAuthenticator.java? I've seen that it's possible to 
> get a List of ComponentModels by calling 
> context.getRealm().getComponents(), or by getComponent(String s), but I 
> don't know which String would be the valid parameter or which Model I 
> should take out of the List.
> 
> b) the lookup-path.
> Concrete question 2: Anyone knows how to get it form the internally used 
> Factories or s.th.?
> 
> My Providers are 2 ldap directories which I want to iterate over for the 
> username.
> 
> Thanks in advance!
> 
> Best regards,
> Dominik
> 
> Am 24.01.18 um 09:27 schrieb Dominik Guhr:
>> Hi everyone,
>>
>> I'm implementing an authentication SPI execution on top of the 
>> "normal" username/password form of kc 3.4.3.Final. -> 
>> https://github.com/keycloak/keycloak/blob/master/services/src/main/java/org/keycloak/authentication/authenticators/browser/UsernamePasswordForm.java 
>>
>>
>> Sadly, usernames are not unique atm, so I need to change the 
>> execution, so that it doesn't stop with "invalid credentials" for a 
>> user who was found in one Provider.
>>
>> Instead of giving the "invalid credentials"-error, I want my execution 
>> to first check all other providers for the same username, and then 
>> check the credentials against all matches. And just in case of no 
>> credentials matching, it should fail, or login a new session for this 
>> user when one is found in any of my (3) Providers, which are added by 
>> user federation feature (2 ADs, one by a custom user storage SPI).
>>
>> So I drilled it down to the method validatePassword(...) in 
>> AbstractUsernameFormAuthenticator.java -> 
>> https://github.com/keycloak/keycloak/blob/master/services/src/main/java/org/keycloak/authentication/authenticators/browser/AbstractUsernameFormAuthenticator.java 
>> line 191, which I want to change accordingly. Sadly, I can't find a 
>> method to get all Providers of the realm and check accordingly. The 
>> code I want to change is:
>>
>> if (password != null && !password.isEmpty() && 
>> context.getSession().userCredentialManager().isValid(context.getRealm(), 
>> user, credentials)) {
>> ???????????? return true;
>> ???????? } else {...}
>>
>> instead of just checking isValid() for one provider, which is what 
>> this does atm, I want to check all Providers. Like this pseudocode:
>>
>> if (password != null && !password.isEmpty() && 
>> context.getSession().userCredentialManager().isValid(context.getRealm(), 
>> user, credentials)) {
>> ???????????? boolean isValid = false;
>> ???????? List<Provider> realmProviders = context.getAllProviders();
>> ???????? for(Provider provider : realmProviders){
>> ???????????? isValid = provider.isValid(...);
>> ???????? }
>> ???????????? return isValid;
>> ???????? } else {...}
>> Could anyone perhaps give me a hint in how to achieve this? I haven't 
>> found a method yet to get all Providers and check for isValid in any 
>> of the given ones.
>>
>> Best regards,
>> Dominik
>>
>> p.s. I created a stackoverflow question here: 
>> https://stackoverflow.com/questions/48399622/keycloak-check-password-in-more-than-one-identity-provider 
>> feel free to comment/answer there :)

From mposolda at redhat.com  Wed Jan 24 07:59:05 2018
From: mposolda at redhat.com (Marek Posolda)
Date: Wed, 24 Jan 2018 13:59:05 +0100
Subject: [keycloak-user] Validate User Credentials Without Creating a
 Session
In-Reply-To: <HE1PR0502MB3035C1C9A18A53A54640E09CE7E30@HE1PR0502MB3035.eurprd05.prod.outlook.com>
References: <HE1PR0502MB3035C1C9A18A53A54640E09CE7E30@HE1PR0502MB3035.eurprd05.prod.outlook.com>
Message-ID: <97c207c9-6f96-bd7c-b37f-27449b0b033a@redhat.com>

Hi Scott,

it's not available OOTB, but you can add your own REST endpoint to 
verify username/password. Or alternatively you can just do directGrant 
login (OAuth2 Resource Owner Password Credentials Grant) and then logout 
session.

Marek

On 23/01/18 09:49, Scott Finlay wrote:
> Hi,
>
>
> We're currently using Keycloak 2.5.5.Final, and in this version it's not possible
>
> to validate a user's credentials (username / password combination) without
>
> actually logging the user in which results in a session (and our sessions are long-
>
> lived). Is there any new functionality introduced in the later versions of  Keycloak
>
> to validate the credentials without actually logging the user in?
>
>
> Our use-case is that we have very long-lived tokens, but we want to require the
>
> user to re-enter his/her password in order to perform some certain sensitive tasks
>
> such as changing the password or username.
>
>
> If such functionality  is not available, would it be possible to add this?
>
>
> Regards,
>
> Scott
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user



From mposolda at redhat.com  Wed Jan 24 08:00:56 2018
From: mposolda at redhat.com (Marek Posolda)
Date: Wed, 24 Jan 2018 14:00:56 +0100
Subject: [keycloak-user] DB changes not refreshing on cluster nodes.
In-Reply-To: <CAAGXFYwppH9wak19MaVv==XoBpLPw0=AA+__VhsbAwt==KYe7Q@mail.gmail.com>
References: <CAAGXFYwppH9wak19MaVv==XoBpLPw0=AA+__VhsbAwt==KYe7Q@mail.gmail.com>
Message-ID: <f29aac0f-e038-b725-9e81-68bfe0fb3f2d@redhat.com>

I guess your cluster is not correctly setup, hence the node doesn't 
correctly propagate invalidation event to the other nodes and those 
nodes still see the stale entries in their cache. See Keycloak 
clustering documentation for more details how to setup/troubleshoot it.

Marek

On 23/01/18 13:01, Angel Abella wrote:
> Hello list!
>
> We are experiencing some problems with our standalone-ha setup of Keycloak
> 2.4.0.
> Everithing works as expectd except ehn a user changes a password or is
> added or removed from a group. When this happens the node making the change
> is aware of it, but the other one does not until it is restarted.
>
> Any idea of what is going on?
>
>
>
>


From aabella at bkool.com  Wed Jan 24 08:16:14 2018
From: aabella at bkool.com (Angel Abella)
Date: Wed, 24 Jan 2018 14:16:14 +0100
Subject: [keycloak-user] DB changes not refreshing on cluster nodes.
In-Reply-To: <f29aac0f-e038-b725-9e81-68bfe0fb3f2d@redhat.com>
References: <CAAGXFYwppH9wak19MaVv==XoBpLPw0=AA+__VhsbAwt==KYe7Q@mail.gmail.com>
	<f29aac0f-e038-b725-9e81-68bfe0fb3f2d@redhat.com>
Message-ID: <CAAGXFYyqzqsR7Hs5+ZdOM2N5-VuPdurMdvsDx58LFrJg5Q8oow@mail.gmail.com>

I've revised docs but everything seems to be ok.
I am attaching the configuration file just in case someone can see what I'm
missing.

2018-01-24 14:00 GMT+01:00 Marek Posolda <mposolda at redhat.com>:

> I guess your cluster is not correctly setup, hence the node doesn't
> correctly propagate invalidation event to the other nodes and those nodes
> still see the stale entries in their cache. See Keycloak clustering
> documentation for more details how to setup/troubleshoot it.
>
> Marek
>
>
> On 23/01/18 13:01, Angel Abella wrote:
>
>> Hello list!
>>
>> We are experiencing some problems with our standalone-ha setup of Keycloak
>> 2.4.0.
>> Everithing works as expectd except ehn a user changes a password or is
>> added or removed from a group. When this happens the node making the
>> change
>> is aware of it, but the other one does not until it is restarted.
>>
>> Any idea of what is going on?
>>
>>
>>
>>
>>
>


-- 
Angel Abella
*IT *
*BKOOL* *Connect* *| Sport*
mail: aabella at bkool.com
mob: +34 691 77 18 98
add: C/ San Joaqu?n 3 - 28231 Las Rozas - Madrid
www.bkool.com
-------------- next part --------------
A non-text attachment was scrubbed...
Name: standalone-ha.xml
Type: text/xml
Size: 30861 bytes
Desc: not available
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20180124/c4443609/attachment-0001.xml 

From pinguwien at gmail.com  Wed Jan 24 10:12:13 2018
From: pinguwien at gmail.com (Dominik Guhr)
Date: Wed, 24 Jan 2018 16:12:13 +0100
Subject: [keycloak-user] Keycloak 3.4.3,
 custom SPI deployment: noclassdef-error caused by
 ClassNotFoundException when trying to call LDAPStorageProvider
Message-ID: <d0b2bdcb-ecdb-c808-d468-0be2fad44db7@gmail.com>

Hi everyone,

sorry for spamming, but I have another problem here:

I am using maven to deploy my jar-file to keycloak 3.4.3.

I added the dependencies for kerberos and ldap federation like this 
(with and without scope provided):

<dependency>
     <groupId>org.keycloak</groupId>
     <artifactId>keycloak-kerberos-federation</artifactId>
     <version>3.4.3.Final</version>
</dependency>
<dependency>
     <groupId>org.keycloak</groupId>
     <artifactId>keycloak-ldap-federation</artifactId>
     <version>3.4.3.Final</version>
</dependency>

In my IDE I can call the Classes in Question, e.g. LDAPStorageProvider,
but when the jar is successfully deployed to keycloak, I get the 
following exception when my method is called:

...Caused by: java.lang.ClassNotFoundException: 
org.keycloak.storage.ldap.LDAPStorageProvider from [Module 
"deployment.ldap-authenticator.jar" from Service Module Loader]

I looked in modules/...keycloak/ and saw all jars lying there in version 
3.4.3.Final, I even looked inside with jar -tf, and the class in 
question is provided. As said, I tried to use scope provided and no 
scope, without effect.

Apart from that, I changed the module.xml for the private jars by 
removing the private part from them and restarting the kc server, but 
without any effect.

At this link u can see the build-definition of my pom.xml:

https://pastebin.com/xgHdSGFa

So, am I missing something? Hope anyone could help me out here. :/


From kevin_walsh at deichmann.com  Thu Jan 25 04:55:01 2018
From: kevin_walsh at deichmann.com (kevin_walsh at deichmann.com)
Date: Thu, 25 Jan 2018 10:55:01 +0100
Subject: [keycloak-user] keycloak proxy - How to hide the path after the TLD
In-Reply-To: <mailman.57123.1516800340.2859.keycloak-user@lists.jboss.org>
References: <mailman.57123.1516800340.2859.keycloak-user@lists.jboss.org>
Message-ID: <OFBE295ABB.6AC5CE2B-ONC1258220.0031AF79-C1258220.003679E4@deichmann.com>

Dear list,

I need to access static html views of our documentation server after 
authenticating users using keycloak.

The html views are available at 
http://documentation:8090/view/department1
http://documentation:8090/view/department2
http://documentation:8090/view/department3
...

My idea was to use the keycloak proxy as follows:
keycloak-proxy:8081 for department1
keycloak-proxy:8082 for department2
keycloak-proxy:8083 for department3
...

BUT I would like my users to see only keycloak_proxy:8081 not the 
following path, while they get the information of the respective path. Can 
I do this with keycloak proxy and which settings would I need?
In a next step I need to add a proxy for Internet users to access the 
keycloak-proxy to hide even the "keycloak-proxy:PORT".

My current proxy_department1.json is this (obviously without any path 
mappings):

-begin-----------------------------------------------------------------------
{
   "target-url":"http://documentation:8090",
   "bind-address":"0.0.0.0",
   "http-port":"8081",
   "applications":
        [
        {
                "base-path":"/",
        "adapter-config":
                        {
                        "realm": "Manuals",
                        "auth-server-url": "
http://keycloak-proxy:8080/auth",
                        "ssl-required": "none",
                        "resource": "keycloak-proxy",
                        "credentials": {"secret": "1234"},
                        "use-resource-role-mappings": false,
                        "confidential-port": 0
                        },
                "constraints":
                [
                        {
                                "pattern":"*",
                                "roles-allowed":["manuals_user"]
                        },
                        {
                                "pattern":"/view/manuals/*",
                                "roles-allowed":["manuals_user"]
                        }
                ]
        }
        ]
}

-end-----------------------------------------------------------------------



Thank you & kind regards

Kevin Walsh

IT Software Development  |  Documentation

Phone: +49 201 8676 932
Fax: +49 201 8676 49932
Mobil: +49 177 6664666
kevin_walsh at deichmann.com



Von:    keycloak-user-request at lists.jboss.org
An:     keycloak-user at lists.jboss.org
Datum:  24.01.2018 14:26
Betreff:        keycloak-user Digest, Vol 49, Issue 49 <Virus checked>
Gesendet von:   keycloak-user-bounces at lists.jboss.org



Send keycloak-user mailing list submissions to
                 keycloak-user at lists.jboss.org

To subscribe or unsubscribe via the World Wide Web, visit
                 https://lists.jboss.org/mailman/listinfo/keycloak-user
or, via email, send a message with subject or body 'help' to
                 keycloak-user-request at lists.jboss.org

You can reach the person managing the list at
                 keycloak-user-owner at lists.jboss.org

When replying, please edit your Subject line so it is more specific
than "Re: Contents of keycloak-user digest..."


Today's Topics:

   1. Re: Possibility to set new Provider in authentication flow
      for non-unique usernames (Dominik Guhr)
   2. Re: Validate User Credentials Without Creating a Session
      (Marek Posolda)
   3. Re: DB changes not refreshing on cluster nodes. (Marek Posolda)
   4. Re: DB changes not refreshing on cluster nodes. (Angel Abella)


----------------------------------------------------------------------

Message: 1
Date: Wed, 24 Jan 2018 12:52:58 +0100
From: Dominik Guhr <pinguwien at gmail.com>
Subject: Re: [keycloak-user] Possibility to set new Provider in
                 authentication flow for non-unique usernames
To: keycloak-user at lists.jboss.org
Message-ID: <43b5c623-a20c-0c17-fab3-bd7d19f126d7 at gmail.com>
Content-Type: text/plain; charset=utf-8; format=flowed

p.s. one provider uses Kerberos for Authentication, other does not.

Am 24.01.18 um 12:51 schrieb Dominik Guhr:
> So, further investigation notes:
> 
> I think I should call the Provider like it's done here: 
> 
https://github.com/keycloak/keycloak/blob/master/examples/providers/user-storage-jpa/src/main/java/org/keycloak/examples/storage/user/EjbExampleUserStorageProviderFactory.java 

> in the create method, which allows me to call the corresponding 
> isValid(...) method of the required providers and only set the boolean 
> return value of validatePassword to false if the credentials doesn't 
> match in any of the providers.
> 
> But to call this for ldap-providers set by admin interface, I need two 
> things:
> 
> a) a Componentmodel.
> Concrete Question: Anyone knows how to get the right ComponentModel 
> instance to use from my AuthenticationFlowContext of 
> AbstractUsernameFormAuthenticator.java? I've seen that it's possible to 
> get a List of ComponentModels by calling 
> context.getRealm().getComponents(), or by getComponent(String s), but I 
> don't know which String would be the valid parameter or which Model I 
> should take out of the List.
> 
> b) the lookup-path.
> Concrete question 2: Anyone knows how to get it form the internally used 

> Factories or s.th.?
> 
> My Providers are 2 ldap directories which I want to iterate over for the 

> username.
> 
> Thanks in advance!
> 
> Best regards,
> Dominik
> 
> Am 24.01.18 um 09:27 schrieb Dominik Guhr:
>> Hi everyone,
>>
>> I'm implementing an authentication SPI execution on top of the 
>> "normal" username/password form of kc 3.4.3.Final. -> 
>> 
https://github.com/keycloak/keycloak/blob/master/services/src/main/java/org/keycloak/authentication/authenticators/browser/UsernamePasswordForm.java 

>>
>>
>> Sadly, usernames are not unique atm, so I need to change the 
>> execution, so that it doesn't stop with "invalid credentials" for a 
>> user who was found in one Provider.
>>
>> Instead of giving the "invalid credentials"-error, I want my execution 
>> to first check all other providers for the same username, and then 
>> check the credentials against all matches. And just in case of no 
>> credentials matching, it should fail, or login a new session for this 
>> user when one is found in any of my (3) Providers, which are added by 
>> user federation feature (2 ADs, one by a custom user storage SPI).
>>
>> So I drilled it down to the method validatePassword(...) in 
>> AbstractUsernameFormAuthenticator.java -> 
>> 
https://github.com/keycloak/keycloak/blob/master/services/src/main/java/org/keycloak/authentication/authenticators/browser/AbstractUsernameFormAuthenticator.java 

>> line 191, which I want to change accordingly. Sadly, I can't find a 
>> method to get all Providers of the realm and check accordingly. The 
>> code I want to change is:
>>
>> if (password != null && !password.isEmpty() && 
>> 
context.getSession().userCredentialManager().isValid(context.getRealm(), 
>> user, credentials)) {
>> ???????????? return true;
>> ???????? } else {...}
>>
>> instead of just checking isValid() for one provider, which is what 
>> this does atm, I want to check all Providers. Like this pseudocode:
>>
>> if (password != null && !password.isEmpty() && 
>> 
context.getSession().userCredentialManager().isValid(context.getRealm(), 
>> user, credentials)) {
>> ???????????? boolean isValid = false;
>> ???????? List<Provider> realmProviders = context.getAllProviders();
>> ???????? for(Provider provider : realmProviders){
>> ???????????? isValid = provider.isValid(...);
>> ???????? }
>> ???????????? return isValid;
>> ???????? } else {...}
>> Could anyone perhaps give me a hint in how to achieve this? I haven't 
>> found a method yet to get all Providers and check for isValid in any 
>> of the given ones.
>>
>> Best regards,
>> Dominik
>>
>> p.s. I created a stackoverflow question here: 
>> 
https://stackoverflow.com/questions/48399622/keycloak-check-password-in-more-than-one-identity-provider 

>> feel free to comment/answer there :)


------------------------------

Message: 2
Date: Wed, 24 Jan 2018 13:59:05 +0100
From: Marek Posolda <mposolda at redhat.com>
Subject: Re: [keycloak-user] Validate User Credentials Without
                 Creating a Session
To: Scott Finlay <scott.finlay at sixt.com>,
                 "keycloak-user at lists.jboss.org" 
<keycloak-user at lists.jboss.org>
Message-ID: <97c207c9-6f96-bd7c-b37f-27449b0b033a at redhat.com>
Content-Type: text/plain; charset=utf-8; format=flowed

Hi Scott,

it's not available OOTB, but you can add your own REST endpoint to 
verify username/password. Or alternatively you can just do directGrant 
login (OAuth2 Resource Owner Password Credentials Grant) and then logout 
session.

Marek

On 23/01/18 09:49, Scott Finlay wrote:
> Hi,
>
>
> We're currently using Keycloak 2.5.5.Final, and in this version it's not 
possible
>
> to validate a user's credentials (username / password combination) 
without
>
> actually logging the user in which results in a session (and our 
sessions are long-
>
> lived). Is there any new functionality introduced in the later versions 
of  Keycloak
>
> to validate the credentials without actually logging the user in?
>
>
> Our use-case is that we have very long-lived tokens, but we want to 
require the
>
> user to re-enter his/her password in order to perform some certain 
sensitive tasks
>
> such as changing the password or username.
>
>
> If such functionality  is not available, would it be possible to add 
this?
>
>
> Regards,
>
> Scott
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user




------------------------------

Message: 3
Date: Wed, 24 Jan 2018 14:00:56 +0100
From: Marek Posolda <mposolda at redhat.com>
Subject: Re: [keycloak-user] DB changes not refreshing on cluster
                 nodes.
To: Angel Abella <aabella at bkool.com>, keycloak-user at lists.jboss.org
Message-ID: <f29aac0f-e038-b725-9e81-68bfe0fb3f2d at redhat.com>
Content-Type: text/plain; charset=utf-8; format=flowed

I guess your cluster is not correctly setup, hence the node doesn't 
correctly propagate invalidation event to the other nodes and those 
nodes still see the stale entries in their cache. See Keycloak 
clustering documentation for more details how to setup/troubleshoot it.

Marek

On 23/01/18 13:01, Angel Abella wrote:
> Hello list!
>
> We are experiencing some problems with our standalone-ha setup of 
Keycloak
> 2.4.0.
> Everithing works as expectd except ehn a user changes a password or is
> added or removed from a group. When this happens the node making the 
change
> is aware of it, but the other one does not until it is restarted.
>
> Any idea of what is going on?
>
>
>
>



------------------------------

Message: 4
Date: Wed, 24 Jan 2018 14:16:14 +0100
From: Angel Abella <aabella at bkool.com>
Subject: Re: [keycloak-user] DB changes not refreshing on cluster
                 nodes.
To: Marek Posolda <mposolda at redhat.com>
Cc: keycloak-user at lists.jboss.org
Message-ID:
 <CAAGXFYyqzqsR7Hs5+ZdOM2N5-VuPdurMdvsDx58LFrJg5Q8oow at mail.gmail.com>
Content-Type: text/plain; charset="utf-8"

I've revised docs but everything seems to be ok.
I am attaching the configuration file just in case someone can see what 
I'm
missing.

2018-01-24 14:00 GMT+01:00 Marek Posolda <mposolda at redhat.com>:

> I guess your cluster is not correctly setup, hence the node doesn't
> correctly propagate invalidation event to the other nodes and those 
nodes
> still see the stale entries in their cache. See Keycloak clustering
> documentation for more details how to setup/troubleshoot it.
>
> Marek
>
>
> On 23/01/18 13:01, Angel Abella wrote:
>
>> Hello list!
>>
>> We are experiencing some problems with our standalone-ha setup of 
Keycloak
>> 2.4.0.
>> Everithing works as expectd except ehn a user changes a password or is
>> added or removed from a group. When this happens the node making the
>> change
>> is aware of it, but the other one does not until it is restarted.
>>
>> Any idea of what is going on?
>>
>>
>>
>>
>>
>


-- 
Angel Abella
*IT *
*BKOOL* *Connect* *| Sport*
mail: aabella at bkool.com
mob: +34 691 77 18 98
add: C/ San Joaqu?n 3 - 28231 Las Rozas - Madrid
www.bkool.com
-------------- next part --------------
A non-text attachment was scrubbed...
Name: standalone-ha.xml
Type: text/xml
Size: 30861 bytes
Desc: not available
Url : 
http://lists.jboss.org/pipermail/keycloak-user/attachments/20180124/c4443609/attachment.xml 


------------------------------

_______________________________________________
keycloak-user mailing list
keycloak-user at lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user

End of keycloak-user Digest, Vol 49, Issue 49
*********************************************


-------------- next part --------------
A non-text attachment was scrubbed...
Name: logo.gif
Type: image/gif
Size: 4157 bytes
Desc: not available
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20180125/6163389e/attachment.gif 

From inacio-silva at prodesan.com.br  Thu Jan 25 06:09:34 2018
From: inacio-silva at prodesan.com.br (JOSE INACIO DA SILVA JUNIOR)
Date: Thu, 25 Jan 2018 09:09:34 -0200 (BRST)
Subject: [keycloak-user] EJB sessionContext.isCallerInRole
Message-ID: <1440933466.418860.1516878574119.JavaMail.root@prodesan.com.br>

Hi!

I'm migrating a big JavaEE application to Keycloak and I'd like to keep using default JavaEE security methods like isCallerInRole or hasRole.
My roles are generated programatically. How can I generate principal's roles programatically with Keycloak? Anyone could point me an example?

Thanks
In?cio


From mposolda at redhat.com  Thu Jan 25 08:58:27 2018
From: mposolda at redhat.com (Marek Posolda)
Date: Thu, 25 Jan 2018 14:58:27 +0100
Subject: [keycloak-user] Keycloak 3.4.3,
 custom SPI deployment: noclassdef-error caused by
 ClassNotFoundException when trying to call LDAPStorageProvider
In-Reply-To: <d0b2bdcb-ecdb-c808-d468-0be2fad44db7@gmail.com>
References: <d0b2bdcb-ecdb-c808-d468-0be2fad44db7@gmail.com>
Message-ID: <8eda2ffc-e7cc-19af-3272-53d4328ecee1@redhat.com>

Yes, you need to declare those modules in your own module.xml (in case 
you want to deploy your provider as module) or in 
jboss-deployment-structure.xml (in case you deploy it through the 
deployer). See our documentation (Server Developer Guide) and example 
providers (Directory "providers" of keycloak-examples distribution. We 
may also have some quickstarts...)

Marek

On 24/01/18 16:12, Dominik Guhr wrote:
> Hi everyone,
>
> sorry for spamming, but I have another problem here:
>
> I am using maven to deploy my jar-file to keycloak 3.4.3.
>
> I added the dependencies for kerberos and ldap federation like this
> (with and without scope provided):
>
> <dependency>
>       <groupId>org.keycloak</groupId>
>       <artifactId>keycloak-kerberos-federation</artifactId>
>       <version>3.4.3.Final</version>
> </dependency>
> <dependency>
>       <groupId>org.keycloak</groupId>
>       <artifactId>keycloak-ldap-federation</artifactId>
>       <version>3.4.3.Final</version>
> </dependency>
>
> In my IDE I can call the Classes in Question, e.g. LDAPStorageProvider,
> but when the jar is successfully deployed to keycloak, I get the
> following exception when my method is called:
>
> ...Caused by: java.lang.ClassNotFoundException:
> org.keycloak.storage.ldap.LDAPStorageProvider from [Module
> "deployment.ldap-authenticator.jar" from Service Module Loader]
>
> I looked in modules/...keycloak/ and saw all jars lying there in version
> 3.4.3.Final, I even looked inside with jar -tf, and the class in
> question is provided. As said, I tried to use scope provided and no
> scope, without effect.
>
> Apart from that, I changed the module.xml for the private jars by
> removing the private part from them and restarting the kc server, but
> without any effect.
>
> At this link u can see the build-definition of my pom.xml:
>
> https://pastebin.com/xgHdSGFa
>
> So, am I missing something? Hope anyone could help me out here. :/
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user



From mposolda at redhat.com  Thu Jan 25 08:59:56 2018
From: mposolda at redhat.com (Marek Posolda)
Date: Thu, 25 Jan 2018 14:59:56 +0100
Subject: [keycloak-user] Keycloak 3.4 --> Possibility to search for
 attribute?
In-Reply-To: <1516790607070-0.post@n6.nabble.com>
References: <1516790607070-0.post@n6.nabble.com>
Message-ID: <9ee04946-9c3e-ebf1-9f31-8f0326896d51@redhat.com>

There is method on UserProvider for search by attribute, but there is no 
REST endpoint AFAIK. You may develop your own REST endpoint, which is 
possible. See our documentation (Server Developer Guide) and example 
providers (Directory "providers" of keycloak-examples distribution. We 
may also have some quickstarts...)

Marek

On 24/01/18 11:43, SW wrote:
> Is there a possibility in Keycloak 3.4.3 to search for an attribute?
>
> Would be quite handy for my usecase, because I am storing IDs for another
> system in the attributes.
>
>
>
>
>
> --
> Sent from: http://keycloak-user.88327.x6.nabble.com/
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user



From mposolda at redhat.com  Thu Jan 25 09:01:21 2018
From: mposolda at redhat.com (Marek Posolda)
Date: Thu, 25 Jan 2018 15:01:21 +0100
Subject: [keycloak-user] password policy | Not (containing) Username
In-Reply-To: <66320f16-e085-0048-f55d-6855fb419d32@merit.unu.edu>
References: <66320f16-e085-0048-f55d-6855fb419d32@merit.unu.edu>
Message-ID: <89bf2191-2e91-4841-a36b-b88c601d6423@redhat.com>

Yes, you can. You can also create your own password policy like that, as 
PasswordPolicy is puggable SPI. See our documentation (Server Developer 
Guide) and example providers (Directory "providers" of keycloak-examples 
distribution. We may also have some quickstarts...)

Marek

On 24/01/18 11:22, lists wrote:
> Hi,
>
> We would like to also prevent passwords *containing* the username, to
> also prevent passwords like Username_1980
>
> The regular password policy "Not Username" only matches exact
> "username", rather than anything containing the username.
>
> Would it be possible to create a regex password policy to match a
> password *containing* the username? But I don't think this is possible..?
>
> Or perhaps I could file a feature request to change the current policy
> into "Not containing username"?
>
> MJ
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user



From rafael at abstratt.com  Thu Jan 25 10:30:26 2018
From: rafael at abstratt.com (Rafael Chaves)
Date: Thu, 25 Jan 2018 13:30:26 -0200
Subject: [keycloak-user] validating an access token from an external service
	with a public client
Message-ID: <CAGwPAPHsY8j_qhe+7C8thxzC=otEPg_GLPL9n-GeDjnkTzFHgA@mail.gmail.com>

Hi,

Keycloak/OAuth newbie here, possibly asking a silly question. This is the
architecture we have:

1) a web application, with authentication done via keycloak
2) an external service (REST API) that is invoked by the application above

In that external service, I would like to implement a simple mechanism that
allowed me to ensure the requests received are made by a valid user in that
web application. We do not necessarily care about obtaining user
information at this point (or permissions).

The initial idea is that the web application would pass, in every
request to the external service,  an access token generated by Keycloak.
The external service would then ensure that then token is indeed valid,
which we assume involves accessing the Keycloak server (that would be fine).

We looked into the entitlement API and that was pretty close (one legged
verification), but it seemed to require the "Authorization Enabled" toggle
to be ON in the client configuration. We do not understand the entire
impact of enabling that configuration. But we noticed that at least the
client is then required to use a secret to work, which the web applications
currently does not use. Can that change be avoided, and are there other
impacts?

BTW, we are using Keycloak 3.3.0.Final.

Thank you,

Rafael

From john.d.ament at gmail.com  Thu Jan 25 10:57:44 2018
From: john.d.ament at gmail.com (John D. Ament)
Date: Thu, 25 Jan 2018 15:57:44 +0000
Subject: [keycloak-user] Broker Links vs Federated Identities
Message-ID: <CAOqetn8OdmrVwNEUXZcUdR6C1N7f7-s8DZJoG7Vgt5rfk8i9ig@mail.gmail.com>

Hi,

When calling Keycloak's rest api, in 3.2, invoking
UserResource.get().getFederatedIdenties() it seems to be returning the
values of BrokerLinks instead of FederatedIdentityLinks.  Is this on
purpose?

Relevant code:
https://github.com/keycloak/keycloak/blob/master/model/jpa/src/main/java/org/keycloak/storage/jpa/JpaUserFederatedStorageProvider.java

This seems to do it the way I would expect:
https://github.com/keycloak/keycloak/blob/27b5e1aae2a895e28ac79aeb4da028e33769d069/services/src/main/java/org/keycloak/exportimport/util/ExportUtils.java#L475-L483

From yuriy.yunikov at verygood.systems  Thu Jan 25 11:14:31 2018
From: yuriy.yunikov at verygood.systems (Yuriy Yunikov)
Date: Thu, 25 Jan 2018 16:14:31 +0000
Subject: [keycloak-user] Fine-grained permissions per resources on KeyCloak
Message-ID: <CAC9TNOfcDk7G6eXgy9pyusd3r8Oy+TeXTuF+mR_OfZcT_4fh3w@mail.gmail.com>

Hi everyone,

I need to create a fine-grained permissions system for backend resources
using KeyCloak and looking for potential solutions of the problem.
I've already checked resource management feature
<http://www.keycloak.org/docs/3.3/authorization_services/topics/resource/overview.html>,
but it doesn't work for me for the multiple reasons and has very limited
integration in Java, so I don't consider it anymore.

So another solution I came up with is having permission system based on
roles and composite roles
<http://www.keycloak.org/docs/3.3/server_admin/topics/roles/composite.html>.

[role-name] (composite)
 - tenants:[permission] (composite)
  - tenants:[tenant-identifier]:[permission] (composite)
   - tenants:[tenant-identifier]:[tenant-resource]:[permission] (composite)
    -
tenants:[tenant-identifier]:[tenant-resource]:[tenant-resource-identifier]:[permission]
(non-composite)

Permissions can be like create/read/update/delete and the plus of this is
that it can scale if we'd have sub-resources. On the backend, I'll be able
to create filters for these permissions and integrate it with Spring
Security.

I'm looking for opinions and would like to know if this is a valid
structure or there are some other solutions which can be used. Any opinions
on this?

Regards,
Yuriy

From joseph.boctor at syntlogo.de  Thu Jan 25 11:53:26 2018
From: joseph.boctor at syntlogo.de (j0zeft)
Date: Thu, 25 Jan 2018 09:53:26 -0700 (MST)
Subject: [keycloak-user] Keycloak Adapter for C#
Message-ID: <1516899206896-0.post@n6.nabble.com>

Good day

Currently, the only available Keycloak Adapter for ASP .Net Applications is
KeycloakOwinAuthentication by DylanPlecki.

A couple of months back, Dylan posted in the repository's  readme
<https://github.com/dylanplecki/KeycloakOwinAuthentication/blob/master/README.md>  
that he's not maintaining it anymore and asked for someone to take over the
adapter maintainance duties... I got in contact with him and he granted me
write permission on Github, but I was missing the API key from NuGet.org in
order to upload a new version of the package with a couple of fixes.

I decided to fork the main project and put it under a different name,
keeping the Author name to avoid confusion.

Currently, the NuGet package  KeyWin
<https://www.nuget.org/packages/KeyWin/>   is available on nuget.org with my
first bug fixes to the library.



--
Sent from: http://keycloak-user.88327.x6.nabble.com/

From sblanc at redhat.com  Thu Jan 25 12:08:37 2018
From: sblanc at redhat.com (Sebastien Blanc)
Date: Thu, 25 Jan 2018 18:08:37 +0100
Subject: [keycloak-user] Keycloak Adapter for C#
In-Reply-To: <1516899206896-0.post@n6.nabble.com>
References: <1516899206896-0.post@n6.nabble.com>
Message-ID: <CAMZCGg-dLx+k4GbydNWQYL4xPta8U86-i-xBJGUu9J_0MX5h+g@mail.gmail.com>

Hi,

This is great news ! Thanks for taking over this project, I'm sure a lot of
people in the community were waiting for this.

Sebi


On Thu, Jan 25, 2018 at 5:53 PM, j0zeft <joseph.boctor at syntlogo.de> wrote:

> Good day
>
> Currently, the only available Keycloak Adapter for ASP .Net Applications is
> KeycloakOwinAuthentication by DylanPlecki.
>
> A couple of months back, Dylan posted in the repository's  readme
> <https://github.com/dylanplecki/KeycloakOwinAuthentication/
> blob/master/README.md>
> that he's not maintaining it anymore and asked for someone to take over the
> adapter maintainance duties... I got in contact with him and he granted me
> write permission on Github, but I was missing the API key from NuGet.org in
> order to upload a new version of the package with a couple of fixes.
>
> I decided to fork the main project and put it under a different name,
> keeping the Author name to avoid confusion.
>
> Currently, the NuGet package  KeyWin
> <https://www.nuget.org/packages/KeyWin/>   is available on nuget.org with
> my
> first bug fixes to the library.
>
>
>
> --
> Sent from: http://keycloak-user.88327.x6.nabble.com/
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>

From jpperata at gmail.com  Thu Jan 25 12:50:12 2018
From: jpperata at gmail.com (Juan Pablo Perata)
Date: Thu, 25 Jan 2018 17:50:12 +0000
Subject: [keycloak-user] Adding custom HTTP request attribute after
 successfull keycloak login in custom Authenticator or User Storage
 Provider?
In-Reply-To: <CA+BZ0jgKsLnBWPNj76hPTL83tegrkXZf1jiSsYrchDAMMjrayg@mail.gmail.com>
References: <CA+BZ0jgKsLnBWPNj76hPTL83tegrkXZf1jiSsYrchDAMMjrayg@mail.gmail.com>
Message-ID: <CA+BZ0jgiFSdpamvrSPCkoxi34r3WvULqc9eV93XQ8Ng-OXmu8Q@mail.gmail.com>

Hi all,

I developed a custom User Storage Provider which allows to federate users
from a external database.
I would like to know if it is possible to add a custom attribute to the
HTTP request after successfull login, just in a similar way that
KeycloakSecurityContext instance is set in attribute
"KeycloakSecurityContext.class.getName()" (for example in keycloak class
ServletRequestAuthenticator.java).

It would be really good to do that in User Storage Provider or a custom
authenticator.

Context:
I need to set up roles to the authenticated user after successfull login,
but before entering to the application.
Keycloak roles that not fit my needs. So it would be good to add this bunch
of roles in a custom HTTP attribute.
I appreciate if somebody faced this and have a cute solution to this
:slightly_smiling_face:

Thanks in advance,
Juan

From sthorger at redhat.com  Thu Jan 25 14:11:34 2018
From: sthorger at redhat.com (Stian Thorgersen)
Date: Thu, 25 Jan 2018 20:11:34 +0100
Subject: [keycloak-user] Release cadence
Message-ID: <CAJgngAeynfp9DcWSHcB1bvRE+xfVDe6u0zpPAgXzBG6qUSF47Q@mail.gmail.com>

Up until now we've released Keycloak roughly every 6 weeks. We're now
switching to 3 week sprints, which opens up the possibility to change how
frequently we release Keycloak.

We could keep it at 6 weeks (release every other sprint), do a release
every 3 weeks or release less frequently (9 weeks perhaps).

Thoughts?

From jpperata at gmail.com  Thu Jan 25 16:32:12 2018
From: jpperata at gmail.com (Juan Pablo Perata)
Date: Thu, 25 Jan 2018 21:32:12 +0000
Subject: [keycloak-user] Adding custom HTTP request attribute after
 successfull keycloak login in custom Authenticator or User Storage
 Provider?
Message-ID: <CA+BZ0jhDk3XX2xuA4nzKk_aJz16vZuc2K9Gmm0qmx8tq9XrxvA@mail.gmail.com>

Hi all,

I developed a custom User Storage Provider which allows to federate users
from a external database.
I would like to know if it is possible to add a custom attribute to the
HTTP request after successfull login, just in a similar way that
KeycloakSecurityContext instance is set in attribute
"KeycloakSecurityContext.class.getName()" (for example in keycloak class
ServletRequestAuthenticator.java).

It would be really good to do that in User Storage Provider or a custom
authenticator.

Context:
I need to set up roles to the authenticated user after successfull login,
but before entering to the application.
Keycloak roles that not fit my needs. So it would be good to add this bunch
of roles in a custom HTTP attribute.
I appreciate if somebody faced this and have a cute solution to this
:slightly_smiling_face:

Thanks in advance,

From noircc at gmail.com  Fri Jan 26 03:24:17 2018
From: noircc at gmail.com (SW)
Date: Fri, 26 Jan 2018 01:24:17 -0700 (MST)
Subject: [keycloak-user] Impersonate - Change of token?
Message-ID: <1516955057492-0.post@n6.nabble.com>

When I am calling the function with the keycloak-admin-client I am getting a
redirect-uri and sameRealm in the JSON-Object.

When I am calling keycloak.tokenManager().getAccessToken(), I thought that
my token should be changed, because, if I am impersonating the user? And for
example I should get attributes of the user through the token.





--
Sent from: http://keycloak-user.88327.x6.nabble.com/

From noircc at gmail.com  Fri Jan 26 03:40:06 2018
From: noircc at gmail.com (SW)
Date: Fri, 26 Jan 2018 01:40:06 -0700 (MST)
Subject: [keycloak-user] Getting my sessionId through REST?
Message-ID: <1516956006777-0.post@n6.nabble.com>

How can I get the current sessionId that I am working on? 

For example, I am authenticating through a user admin in my
keycloak-admin-library, now I can get the sessions that are linked to the
user with GET /{realm}/users/{id}/sessions

But I cannot determine, what the ID is, which I am currently using. Is there
a way to archieve this?




--
Sent from: http://keycloak-user.88327.x6.nabble.com/

From dometec at gmail.com  Fri Jan 26 04:19:02 2018
From: dometec at gmail.com (Domenico Briganti)
Date: Fri, 26 Jan 2018 10:19:02 +0100
Subject: [keycloak-user] Release cadence
In-Reply-To: <CAJgngAeynfp9DcWSHcB1bvRE+xfVDe6u0zpPAgXzBG6qUSF47Q@mail.gmail.com>
References: <CAJgngAeynfp9DcWSHcB1bvRE+xfVDe6u0zpPAgXzBG6qUSF47Q@mail.gmail.com>
Message-ID: <1516958342.8795.1.camel@gmail.com>

Hi Stian, 
 I'm using keycloak for more than a year and I consider it a solid and
mature project. I think that once setting up a Keycloak system, it
remain as is with less or not update, since it just run.
Said this, I do not think that frequent release is so useful for the
users.

Saluti,
Domenico  

Il giorno gio, 25/01/2018 alle 20.11 +0100, Stian Thorgersen ha
scritto:
> Up until now we've released Keycloak roughly every 6 weeks. We're now
> switching to 3 week sprints, which opens up the possibility to change
> how
> frequently we release Keycloak.
> 
> We could keep it at 6 weeks (release every other sprint), do a
> release
> every 3 weeks or release less frequently (9 weeks perhaps).
> 
> Thoughts?
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

From thomas.isaksen at sysco.no  Fri Jan 26 04:30:50 2018
From: thomas.isaksen at sysco.no (Thomas Isaksen)
Date: Fri, 26 Jan 2018 09:30:50 +0000
Subject: [keycloak-user] WebLogic and KeycloakOIDCFilter
Message-ID: <VI1PR0402MB3536BF4FBEBD288A11C32401EAE00@VI1PR0402MB3536.eurprd04.prod.outlook.com>

Does anyone have a working example of this setup on WebLogic? I am still having problems with the infinite loop after authentication. I don't know if my Client config might be wrong.

./t

From sthorger at redhat.com  Fri Jan 26 07:50:13 2018
From: sthorger at redhat.com (Stian Thorgersen)
Date: Fri, 26 Jan 2018 13:50:13 +0100
Subject: [keycloak-user] Release cadence
In-Reply-To: <1516958342.8795.1.camel@gmail.com>
References: <CAJgngAeynfp9DcWSHcB1bvRE+xfVDe6u0zpPAgXzBG6qUSF47Q@mail.gmail.com>
	<1516958342.8795.1.camel@gmail.com>
Message-ID: <CAJgngAcfHDpLdzSTOzBiQcDKJ+1Lb0hcUBZz1y8coNj3QOS0kQ@mail.gmail.com>

You should bear in mind that to receive security patches you should upgrade
regularly.

An alternative if you want to remain on a stable and longer supported
version is to get RH-SSO which is our professionally supported version of
Keycloak. That is released every 9-12 months and receives security fixes
throughout.

On 26 Jan 2018 10:21 am, "Domenico Briganti" <dometec at gmail.com> wrote:

> Hi Stian,
>  I'm using keycloak for more than a year and I consider it a solid and
> mature project. I think that once setting up a Keycloak system, it
> remain as is with less or not update, since it just run.
> Said this, I do not think that frequent release is so useful for the
> users.
>
> Saluti,
> Domenico
>
> Il giorno gio, 25/01/2018 alle 20.11 +0100, Stian Thorgersen ha
> scritto:
> > Up until now we've released Keycloak roughly every 6 weeks. We're now
> > switching to 3 week sprints, which opens up the possibility to change
> > how
> > frequently we release Keycloak.
> >
> > We could keep it at 6 weeks (release every other sprint), do a
> > release
> > every 3 weeks or release less frequently (9 weeks perhaps).
> >
> > Thoughts?
> > _______________________________________________
> > keycloak-user mailing list
> > keycloak-user at lists.jboss.org
> > https://lists.jboss.org/mailman/listinfo/keycloak-user
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>

From dieter.dirkes at codecentric.de  Fri Jan 26 11:44:36 2018
From: dieter.dirkes at codecentric.de (Dieter Dirkes)
Date: Fri, 26 Jan 2018 17:44:36 +0100
Subject: [keycloak-user] Max no of realms + users suitable
Message-ID: <CA+OKQJYMd-dVwPEczhJtrUYC-RFi4Pq+_t2aDb+0RZw5HHrJPw@mail.gmail.com>

Hi there,

I know that Stian once said Keycloak will probably work very well with more
than 10 realms (
http://lists.jboss.org/pipermail/keycloak-user/2016-October/008061.html).

*My problem: *vendor is developing and operating callcenter software for
~800 customer companies. Their products are multi-tenant able, so each
product could easily select the correct realm to use for authentication
(based on email domain of user).
I have added 500 realms with 50 users each to a single Keycloak instance
and it gets really slow in the admin UI, even the OIDC calls itself are
doing well (and yes: I?ve increased memory of the JVM already).
Any suggestions how to handle this? (setting up 500 keycloaks on docker
sounds not to be the best way).

- Dieter


---------------------
Dieter Dirkes

codecentric AG | Wolbecker Windm?hle 29j | 48167 M?nster | Deutschland
*ab 1.2.2018:* codecentric AG | dock14 | Am Mittelhafen 14 | 48155 M?nster
| Deutschland
mailto:dieter.dirkes at codecentric.de | mobil: +49 (0) 173.7731855

www.codecentric.de | blog.codecentric.de | www.meettheexperts.de

Sitz der Gesellschaft: Solingen | HRB 25917| Amtsgericht Wuppertal
Vorstand: Michael Hochg?rtel . Ulrich K?hn . Rainer Vehns
Aufsichtsrat: Patric Fedlmeier (Vorsitzender) . Klaus J?ger . J?rgen Sch?tz

Diese E-Mail einschlie?lich evtl. beigef?gter Dateien enth?lt vertrauliche
und/oder rechtlich gesch?tzte Informationen. Wenn Sie nicht der richtige
Adressat sind oder diese E-Mail irrt?mlich erhalten haben, informieren Sie
bitte sofort den Absender und l?schen Sie diese E-Mail und evtl.
beigef?gter Dateien umgehend. Das unerlaubte Kopieren, Nutzen oder ?ffnen
evtl. beigef?gter Dateien sowie die unbefugte Weitergabe dieser E-Mail ist
nicht gestattet.

From soundrachan at gmail.com  Sun Jan 28 01:12:14 2018
From: soundrachan at gmail.com (Chandran Soundrapandian)
Date: Sun, 28 Jan 2018 11:42:14 +0530
Subject: [keycloak-user] Getting Permissions from RPT
Message-ID: <CAGaoWMGpQsWP1mNZX3NztkxbkQ2s4yjZ_tovmC=pNnEfcHay7Q@mail.gmail.com>

Hi,

I am evaluating keycloak and trying out the following scenario:

The system has a resource
1. "Contact"

and  two client roles
1. Admin
2. Trainee

The "Admin role" can create, view, edit and delete the "contact resource"
The "Trainee Role" can create and view "contact resource"

Followed the following steps to setup the resource server:

1. Created a resource "Contact"
2. Created scopes "create, view, edit and delete"
3. Created role based policy with Admin Role - "Contact Admin Policy"
4. Created role based policy with Trainee Role - "Contact Trainee Policy"
4. Created Scope based permission "Contact Admin Permission" with all the
scopes (Create, View, Edit, Delete) and associated it the "contact Admin
policy"
5. Created Scope based permission "Contact Trainee Permission" with create
and view scopes and associated it with the "Contact Trainee Policy"

After this setup, using the following Authz client code, trying to display
the permission associated with the user

AuthzClient authzClient = AuthzClient.create();

String accessToken = authzClient.obtainAccessToken("UserName",
"UserPassword").getToken();

EntitlementResponse response =
authzClient.entitlement(accessToken).getAll("Client ID");
String rpt = response.getRpt();

TokenIntrospectionResponse requestingPartyToken =
authzClient.protection().introspectRequestingPartyToken(rpt);

System.out.println("Token status is: " + requestingPartyToken.getActive());
System.out.println("Permissions granted by the server: ");

for (Permission granted : requestingPartyToken.getPermissions()) {
    System.out.println(granted);
}

For admin I get:

Permission {id=778e76d4-dc06-4e98-a213-fd7f22975ab7, name=Contact,
scopes=[Contact:Edit, Contact:Delete]}

where as the expected is:

Permission {id=778e76d4-dc06-4e98-a213-fd7f22975ab7, name=Contact,
scopes=[Contact:Create, Contact:View, Contact:Edit, Contact:Delete]}



For Trainee I get
- Nothing

where as the expected is:

Permission {id=778e76d4-dc06-4e98-a213-fd7f22975ab7, name=Contact,
scopes=[Contact:Create, Contact:View]}

Would you please let me know what I am doing wrong or how to setup
resource server to get the expected output.

Thanks
-Chandran
-------------- next part --------------
A non-text attachment was scrubbed...
Name: ContactTest-authz-config.json
Type: application/json
Size: 2585 bytes
Desc: not available
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20180128/f003c57a/attachment-0001.bin 

From soundrachan at gmail.com  Sun Jan 28 05:15:01 2018
From: soundrachan at gmail.com (Chandran Soundrapandian)
Date: Sun, 28 Jan 2018 15:45:01 +0530
Subject: [keycloak-user] Getting Permissions from RPT
In-Reply-To: <CAGaoWMGpQsWP1mNZX3NztkxbkQ2s4yjZ_tovmC=pNnEfcHay7Q@mail.gmail.com>
References: <CAGaoWMGpQsWP1mNZX3NztkxbkQ2s4yjZ_tovmC=pNnEfcHay7Q@mail.gmail.com>
Message-ID: <CAGaoWMEKZpJQj6sf3QTC0t4MhDLdEthT1oZOQ1K-6fzW1nuJKg@mail.gmail.com>

Found the solution. Attaching the new config JSON

On 28 January 2018 at 11:42, Chandran Soundrapandian <soundrachan at gmail.com>
wrote:

> Hi,
>
> I am evaluating keycloak and trying out the following scenario:
>
> The system has a resource
> 1. "Contact"
>
> and  two client roles
> 1. Admin
> 2. Trainee
>
> The "Admin role" can create, view, edit and delete the "contact resource"
> The "Trainee Role" can create and view "contact resource"
>
> Followed the following steps to setup the resource server:
>
> 1. Created a resource "Contact"
> 2. Created scopes "create, view, edit and delete"
> 3. Created role based policy with Admin Role - "Contact Admin Policy"
> 4. Created role based policy with Trainee Role - "Contact Trainee Policy"
> 4. Created Scope based permission "Contact Admin Permission" with all the
> scopes (Create, View, Edit, Delete) and associated it the "contact Admin
> policy"
> 5. Created Scope based permission "Contact Trainee Permission" with create
> and view scopes and associated it with the "Contact Trainee Policy"
>
> After this setup, using the following Authz client code, trying to display
> the permission associated with the user
>
> AuthzClient authzClient = AuthzClient.create();
>
> String accessToken = authzClient.obtainAccessToken("UserName", "UserPassword").getToken();
>
> EntitlementResponse response = authzClient.entitlement(accessToken).getAll("Client ID");
> String rpt = response.getRpt();
>
> TokenIntrospectionResponse requestingPartyToken = authzClient.protection().introspectRequestingPartyToken(rpt);
>
> System.out.println("Token status is: " + requestingPartyToken.getActive());
> System.out.println("Permissions granted by the server: ");
>
> for (Permission granted : requestingPartyToken.getPermissions()) {
>     System.out.println(granted);
> }
>
> For admin I get:
>
> Permission {id=778e76d4-dc06-4e98-a213-fd7f22975ab7, name=Contact, scopes=[Contact:Edit, Contact:Delete]}
>
> where as the expected is:
>
> Permission {id=778e76d4-dc06-4e98-a213-fd7f22975ab7, name=Contact, scopes=[Contact:Create, Contact:View, Contact:Edit, Contact:Delete]}
>
>
>
> For Trainee I get
> - Nothing
>
> where as the expected is:
>
> Permission {id=778e76d4-dc06-4e98-a213-fd7f22975ab7, name=Contact, scopes=[Contact:Create, Contact:View]}
>
> Would you please let me know what I am doing wrong or how to setup resource server to get the expected output.
>
> Thanks
> -Chandran
>
>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: ContactTest-authz-config(1).json
Type: application/json
Size: 2576 bytes
Desc: not available
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20180128/42430dc0/attachment.bin 

From bburton at mail.com  Sun Jan 28 22:54:42 2018
From: bburton at mail.com (Bill Burton)
Date: Mon, 29 Jan 2018 03:54:42 +0000
Subject: [keycloak-user] Version 2.5.0 Java client cannot handshake with SSL
	SAN certificates?
Message-ID: <CAKKfUm-z=BwstNwnHe-6oWWRgHN_rDyipVZaUn_3KyWXmrKgqw@mail.gmail.com>

Hello,

I'm having an issue where after a user successfully logs in to the
application, the Java client tries to connect to the Keycloak server to get
the token verified and fails with the user seeing the text, "Forbidden" in
the browser. In the server.log is the following:

2017-12-14 23:48:17,671 WARN  [org.keycloak.events] (default task-18)
type=CODE_TO_TOKEN_ERROR, realmId=MyRealm, clientId=my-client-1,
userId=5d019b47-59dd-46f4
-8c31-8c280c5ba31a, ipAddress=10.65.15.22, error=invalid_code,
grant_type=authorization_code,
code_id=dc589b79-7ebc-4a73-a842-0ac988eb4cec, client_auth_method=
client-secret
2017-12-14 23:48:17,674 DEBUG
[org.keycloak.transaction.JtaTransactionWrapper] (default task-18)
JtaTransactionWrapper  commit
2017-12-14 23:48:17,676 DEBUG
[org.keycloak.transaction.JtaTransactionWrapper] (default task-18)
JtaTransactionWrapper end
2017-12-14 23:48:17,685 INFO  [stdout] (default task-18) default task-18,
WRITE: TLSv1.2 Application Data, length = 316
2017-12-14 23:48:17,794 INFO  [stdout] (default task-12) default task-12,
READ: TLSv1.2 Application Data, length = 552
2017-12-14 23:48:17,806 INFO  [stdout] (default task-12) default task-12,
called close()
2017-12-14 23:48:17,806 INFO  [stdout] (default task-12) default task-12,
called closeInternal(true)
2017-12-14 23:48:17,806 INFO  [stdout] (default task-12) default task-12,
SEND TLSv1.2 ALERT:  warning, description = close_notify
2017-12-14 23:48:17,807 INFO  [stdout] (default task-12) default task-12,
WRITE: TLSv1.2 Alert, length = 26
2017-12-14 23:48:17,807 INFO  [stdout] (default task-12) default task-12,
called closeSocket(true)
2017-12-14 23:48:17,807 INFO  [stdout] (default task-12) default task-12,
called close()
2017-12-14 23:48:17,807 INFO  [stdout] (default task-12) default task-12,
called closeInternal(true)
2017-12-14 23:48:17,807 ERROR
[org.keycloak.adapters.OAuthRequestAuthenticator] (default task-12) failed
to turn code into token
2017-12-14 23:48:17,807 ERROR
[org.keycloak.adapters.OAuthRequestAuthenticator] (default task-12) status
from server: 400
2017-12-14 23:48:17,807 ERROR
[org.keycloak.adapters.OAuthRequestAuthenticator] (default task-12)
[unintelligible garbage]

It's my understanding this is happening when the Java client attempts to
connect to the Keycloak server via SSL and always fails in a manner similar
to the above. Sometimes an exception is thrown with:

017-12-14 11:00:50,865 ERROR
[org.keycloak.adapters.OAuthRequestAuthenticator] (default task-2) failed
to turn code into token: javax.net.ssl.SSLHandshakeException:
sun.security.validator.ValidatorException: PKIX path building failed:
sun.security.provider.certpath.SunCertPathBuilderException: unable to find
valid certification path to requested target

Both the Java client and Keycloak server are at version 2.5.0 and deployed
into Wildfly 10.0. The Oracle server JDK 1.8.0 build 144 is used all around
running on RedHat Linux 6.5.

The best I can tell is the SSL handshake is failing due to a certificate
name mismatch even though I have the certificate and CA of the Keycloak
server imported into the truststore used by the Java client.

The SSL certificate used has SAN (Subject Alternative Name) entries for
many DNS entries. It's defined something like:
CN=abc.com
dnsName=abc.com
dnsName=def.com
dnsName=ghi.com
[ about 40 DNS entries in total]

For the purpose of this example, the Keycloak server is deployed to
def.com which
is different than what's defined with the CN. When the Java Keycloak client
in the same LAN attempts to connect to https://def.com/auth passing the
token, this results in a *CODE_TO_TOKEN_ERROR* with the error,
*invalid_code*.

However, when using a regular non-SAN self-signed certificate in a testing
environment where CN=def.com matches the DNS of the Keycloak server, the
SSL handshake works successfully and there is no issue.

The certificate was created using the letsencrypt.org CA - not that it
would make any difference who the CA was.

Due to limitations of the production environment I'm constrained to, using
a non-SAN or dedicated certificate is not an option so I need to find a way
get Keycloak to work with SAN certificates.

I've spent a bit of time looking through all the current and past issues
filed for Keycloak and have not found any issues that appear to be related
to this issue.

Have also looked through the Git commit history on github.com in the master
branch back to 2.5.0 and not found much of anything that could be related
to this issue.

Upgrading to a newer version of the Keycloak client is not so simple as the
application software vendor ships their product based on Wildfly 10.0,
Keycloak client and server 2.5.0 plus their own integration support already
configured in a single archive. Depending on how the archive is deployed
and configured, it takes on different roles.

In any case, I've tried to upgrade the client first to 2.5.5 and then to
3.4.3 but was unsuccessful in executing the .cli scripts either online or
offline. Probably my mistake was I didn't remove the existing Keycloak
client configuration in standalone.xml. However, if any of the vendor code
that integrates with the Keycloak client has to be updated to work with the
3.x releases I don't have access to it.

Thank you for any input,
-Bill

From jonathan.scheinmann at dxc.com  Mon Jan 29 02:14:57 2018
From: jonathan.scheinmann at dxc.com (Scheinmann, Jonathan)
Date: Mon, 29 Jan 2018 07:14:57 +0000
Subject: [keycloak-user] Decoupled IDP brokering in different networks
Message-ID: <TU4PR8401MB060843AA548A1F7575705D04E9E50@TU4PR8401MB0608.NAMPRD84.PROD.OUTLOOK.COM>

Hi community,

We currently have a setup of two Keycloak IDP's in completely different networks. That means, both Keycloak instances cannot see each other. However, the user (from the browser's point of perspective) can access both instances over a vpn connection. We would now like to "connect" both keycloak instances over identity brokering in a way that both instances can perform the authentication process without communicating directly with each other (maybe indirectly through the user's browser). We set up IDP brokering between both and everything worked fine to the point where the brokering instance performs a call-back to the other instance which of course led to an unknownhostexception.

The question is therefore: is there a way to pass user data between both keycloak instances without direct communication but through a browser authentication flow. Or would that be a security risk?

Regards
Jonathan

From noircc at gmail.com  Mon Jan 29 04:13:19 2018
From: noircc at gmail.com (SW)
Date: Mon, 29 Jan 2018 02:13:19 -0700 (MST)
Subject: [keycloak-user] Collaboration of Impersonate and Javascript-Adapter
Message-ID: <1517217199977-0.post@n6.nabble.com>

I got an application which is secured by the Keycloak-Javascript-Adapter. 

I need some admins which can impersonate as the user, and I was thinking to
do this with.., you guessed it right: impersonate. 

I saw that impersonate is setting some cookies like KEYCLOAK_IDENTITY. 

What changes need to be made to make both collaborate: impersonate and the
javascript adapter.

Thx for any attempt to solve that puzzle,

Sebastian



--
Sent from: http://keycloak-user.88327.x6.nabble.com/

From trmadhu at tafe.com  Mon Jan 29 05:55:09 2018
From: trmadhu at tafe.com (trmadhu at tafe.com)
Date: Mon, 29 Jan 2018 10:55:09 +0000
Subject: [keycloak-user] sAMAccountName Protocol Mapper
Message-ID: <cc08571c56054dcaa424342dcb906d42@ex2k13mbx2.tafedc.com>

Dear All

We have configured the AD Authentication in Keycloak using the User Federation. Currently we are configured the Username LDAP Attribute as "cn", but in our of the application, we need to send the sAMAccountName as the login parameter

So kindly support in configuring the sAMAccountName as  Protocol Mapper.

Regards
Madhu T R



Above email is subject to 'Disclaimer' as per <a href="http://tafe.co.in/email-disclaimer.htm">http://tafe.co.in/email-disclaimer.htm</a>

From danielcharczynski at o2.pl  Mon Jan 29 06:03:34 2018
From: danielcharczynski at o2.pl (=?UTF-8?Q?Daniel_Charczy=C5=84ski?=)
Date: Mon, 29 Jan 2018 12:03:34 +0100
Subject: [keycloak-user] how retrievie access token only with roles for
 specific target service(keycloak client)?
In-Reply-To: <CALk=OEC5w8QZminyXePoAfD2g=aMjRzRhGb9pJX2AiBfNKJgHQ@mail.gmail.com>
References: <CALk=OECgEsp3o3O5dBk2NT6ByJ6BtVAbvfyJ-0ELJ2hOH5bPhw@mail.gmail.com>
	<CALk=OEC5w8QZminyXePoAfD2g=aMjRzRhGb9pJX2AiBfNKJgHQ@mail.gmail.com>
Message-ID: <CALk=OEAc=GZmXqHfj4OnbH9ojndZ0J-=+FTsi2xVKOzNugTM_A@mail.gmail.com>

Hi

Are there any plans to implement this feature?


Anyone?

2018-01-18 15:36 GMT+01:00 Daniel Charczy?ski <danielcharczynski at o2.pl>:

>
> Hi
>
> I'd like to talk with you about
>
> https://github.com/keycloak/keycloak/pull/4910
> and
> https://issues.jboss.org/browse/KEYCLOAK-6092
>
> we have CRITICAL security issue that target service is able to receive
> access token with roles to other services so it is able to reuse it.
>
> We need to implement feature thet makes it possible to get access token
> with roles per target service(client in keycloak)
>
> Out idea is to use client roles that requires scope.
> But in order to get all roles assigned from specific target service we
> need to chance current  behaviour.
>
> At the moment there is possibility to get specific role using scope
> parameter
>
> <clinetId>/<role-name>
>
> but we need
>
> <clientId>/.*
>
> Have you got any idea to make it possible ASAP?
> We do not want to make any break changes...
>
> maybe we use wildcard instead od regexp like  <clientId>/* ?
> Just let me know how to do it in order to be compatible with your future
> plans and make it possible to merge...
>
> Regards
> Daniel
>
>
>
>
>
>

From john.ocallaghan at accenture.com  Mon Jan 29 06:31:16 2018
From: john.ocallaghan at accenture.com (O'Callaghan, John)
Date: Mon, 29 Jan 2018 11:31:16 +0000
Subject: [keycloak-user] Offline tokens
Message-ID: <8FC1021C-0012-4E05-82FA-0903C1A167E5@contoso.com>


Hi

I?m hoping someone can help with a question I have around offline tokens. I would like to be able to generate offline tokens for users of my system. At the moment the only way I can see to be able to create an offline token is to POST to ?/realms/<name>/protocol/openid-connect/token? with a scope : ?offline_access? and pass in their  username/password.

This works fine if I am asking users to create their own offline tokens, but what I would like to be able to do is allow an admin user to create these offline tokens for users on request (without knowing their password).  Is this possible? I have had a look in the REST api and didn?t see anything there but maybe its not documented?

Many thanks!
John




Accenture Global Solutions Limited, 3 Grand Canal Plaza, Grand Canal Street Upper, Dublin 4
This e-mail and any files transmitted with it are confidential and are intended solely for the use of the individual or entity to which they are addressed. If you have received this e-mail in error, please notify the sender immediately and delete the original. Communications with Accenture or any of its group companies (?Accenture?), including telephone calls and e-mails, may be monitored by our systems for quality control and/or evidential purposes. Accenture does not accept service by e-mail of court proceedings, other processes or formal notices of any kind. Private company limited by shares registered in Ireland, Number 554978

________________________________

This message is for the designated recipient only and may contain privileged, proprietary, or otherwise confidential information. If you have received it in error, please notify the sender immediately and delete the original. Any other use of the e-mail by you is prohibited. Where allowed by local law, electronic communications with Accenture and its affiliates, including e-mail and instant messaging (including content), may be scanned by our systems for the purposes of information security and assessment of internal compliance with Accenture policy.
______________________________________________________________________________________

www.accenture.com

From cedric.couralet at gmail.com  Mon Jan 29 06:53:05 2018
From: cedric.couralet at gmail.com (=?UTF-8?Q?C=C3=A9dric_Couralet?=)
Date: Mon, 29 Jan 2018 12:53:05 +0100
Subject: [keycloak-user] Decoupled IDP brokering in different networks
In-Reply-To: <TU4PR8401MB060843AA548A1F7575705D04E9E50@TU4PR8401MB0608.NAMPRD84.PROD.OUTLOOK.COM>
References: <TU4PR8401MB060843AA548A1F7575705D04E9E50@TU4PR8401MB0608.NAMPRD84.PROD.OUTLOOK.COM>
Message-ID: <CAMwoAzfGbANwP7RSYkbzpp6YHBYN_HMyrWqWeFsebLaBZyKYuw@mail.gmail.com>

Hello,

I am also interested in this.
At the moment, we implement this with SAML brokering which doesn't
require direct communication between keycloak instance.
This was not trivial to configure on both instance (especially
regarding signature), so if there is another way it would be great.

Regards,
C?dric

2018-01-29 8:14 GMT+01:00 Scheinmann, Jonathan <jonathan.scheinmann at dxc.com>:
> Hi community,
>
> We currently have a setup of two Keycloak IDP's in completely different networks. That means, both Keycloak instances cannot see each other. However, the user (from the browser's point of perspective) can access both instances over a vpn connection. We would now like to "connect" both keycloak instances over identity brokering in a way that both instances can perform the authentication process without communicating directly with each other (maybe indirectly through the user's browser). We set up IDP brokering between both and everything worked fine to the point where the brokering instance performs a call-back to the other instance which of course led to an unknownhostexception.
>
> The question is therefore: is there a way to pass user data between both keycloak instances without direct communication but through a browser authentication flow. Or would that be a security risk?
>
> Regards
> Jonathan
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user


From trmadhu at tafe.com  Mon Jan 29 08:43:45 2018
From: trmadhu at tafe.com (trmadhu at tafe.com)
Date: Mon, 29 Jan 2018 13:43:45 +0000
Subject: [keycloak-user] AD sAMAccountName Protocol Mapper
Message-ID: <fe93beb3a6844fbf9b14cbf03de64c1f@ex2k13mbx2.tafedc.com>

Dear All

We have configured the AD Authentication in Keycloak using the User Federation. Currently we are configured the Username LDAP Attribute as "cn", but in our of the application, we need to send the sAMAccountName as the login parameter

So kindly support in configuring the sAMAccountName as  Protocol Mapper.


[All]



Above email is subject to 'Disclaimer' as per <a href="http://tafe.co.in/email-disclaimer.htm">http://tafe.co.in/email-disclaimer.htm</a>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image001.png
Type: image/png
Size: 15671 bytes
Desc: image001.png
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20180129/f1d7fee5/attachment-0001.png 

From corentin.dupont at gmail.com  Mon Jan 29 09:09:58 2018
From: corentin.dupont at gmail.com (Corentin Dupont)
Date: Mon, 29 Jan 2018 15:09:58 +0100
Subject: [keycloak-user] Authorization Services and UMA 2.0 changes
In-Reply-To: <CAJrcDBf8Z7PHY5kzh9MndeEYz=7rdiAgqKpnm9C2joVt_b9-Kg@mail.gmail.com>
References: <CAJrcDBf8Z7PHY5kzh9MndeEYz=7rdiAgqKpnm9C2joVt_b9-Kg@mail.gmail.com>
Message-ID: <CAEyhvmrfJd5WtStNPUy2yKFSu2XpVxuz2sZ+aEJThLMr7tfeJA@mail.gmail.com>

That sounds great, thanks a lot!

On Mon, Jan 22, 2018 at 2:07 PM, Pedro Igor Silva <psilva at redhat.com> wrote:

> Hi All,
>
> We are about to finish the initial round of changes to make Keycloak
> Authorization Services compliant with UMA 2.0.
>
> One of the main changes is related with a new OAuth2 Grant Type introduced
> by UMA 2.0 [1] and how it will be used as a replacement for both
> Entitlement and Authorization API. In UMA 2.0, there is no Authorization
> API anymore, thus it will be removed on future versions of Keycloak.
> Regarding Entitlement API, it will also be removed in favor of the new
> grant type, but in this case we are using some extensions to UMA grant type
> to provide the same functionality. One of the objectives of this change in
> particular is to have a single endpoint from where permissions can be
> obtained.
>
> Another important change is also related with UMA where end-users should be
> able now to manage their own resource and permissions via Account
> Management Console. Users would be able to access a "Resource" page from
> where they can:
>
> * See the resources they own
> * Check for pending permission requests (waiting for the owners approval).
> As well options to grant/deny the request.
> * Check for all "shared resources" / granted permissions. As well options
> to revoke permissions
> * Select an user they want to grant access to a resource and/or scope
>
> Other changes are related with the Policy Enforcer, Authorization Client
> Java API and configuration. For these areas in particular changes are
> minimal, specially regarding policy enforcer configuration.
>
> These changes are targeted to Keycloak v4 and we'll be updating docs
> accordingly, specially on how to migrate to the new version.
>
> Regards.
> Pedro Igor
>
> [1] https://docs.kantarainitiative.org/uma/wg/oauth-uma-grant-2.0-09.html
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>

From corentin.dupont at gmail.com  Mon Jan 29 09:14:57 2018
From: corentin.dupont at gmail.com (Corentin Dupont)
Date: Mon, 29 Jan 2018 15:14:57 +0100
Subject: [keycloak-user] get Authorization reasons
In-Reply-To: <CAJrcDBciwfv3zpb=qdLFREBe=3g8k1n-u0gxL9Npzr1B4XwjxQ@mail.gmail.com>
References: <CAEyhvmruYAQ2dru5fcCNtdo-+QT5+yAaDJnUx9vpWv7KQisT9w@mail.gmail.com>
	<CAJrcDBciwfv3zpb=qdLFREBe=3g8k1n-u0gxL9Npzr1B4XwjxQ@mail.gmail.com>
Message-ID: <CAEyhvmoaHK49tM-NLLoUVZUZHQ4A-0kwk2sjsb4q41w3riZjkQ@mail.gmail.com>

I created the issue here: https://issues.jboss.org/browse/KEYCLOAK-5921


On Mon, Nov 27, 2017 at 12:09 PM, Pedro Igor Silva <psilva at redhat.com>
wrote:

> Right now, there is no such thing. But we can think about it and see how
> to include this RFE in a future release. Could you fill a JIRA and put some
> of your requirements there, please ?
>
> Regards.
>
> On Mon, Nov 27, 2017 at 7:40 AM, Corentin Dupont <
> corentin.dupont at gmail.com> wrote:
>
>> Hi,
>> I'm using the entitlement API to protect the resources of my API.
>> Sometimes the user gets a "not authorized" message, and it's hard for him
>> to known why.
>> Is there any way to provide the user why more information with why it was
>> rejected?
>> Something similar with the infos provided by the "evaluate" panel, but
>> with the API.
>> Thanks
>> Corentin
>>
>
>

From psilva at redhat.com  Mon Jan 29 10:48:12 2018
From: psilva at redhat.com (Pedro Igor Silva)
Date: Mon, 29 Jan 2018 13:48:12 -0200
Subject: [keycloak-user] get Authorization reasons
In-Reply-To: <CAEyhvmoaHK49tM-NLLoUVZUZHQ4A-0kwk2sjsb4q41w3riZjkQ@mail.gmail.com>
References: <CAEyhvmruYAQ2dru5fcCNtdo-+QT5+yAaDJnUx9vpWv7KQisT9w@mail.gmail.com>
	<CAJrcDBciwfv3zpb=qdLFREBe=3g8k1n-u0gxL9Npzr1B4XwjxQ@mail.gmail.com>
	<CAEyhvmoaHK49tM-NLLoUVZUZHQ4A-0kwk2sjsb4q41w3riZjkQ@mail.gmail.com>
Message-ID: <CAJrcDBeVPr3b3FcJVDRa5xV9uUCFk+XFrj2UoAivT3w9+xROGQ@mail.gmail.com>

The only issue I see is performance once we introduce this. Maybe we can
think about an option to enable/disable this feature.

Will update that issue with some comments.

Thanks.

On Mon, Jan 29, 2018 at 12:14 PM, Corentin Dupont <corentin.dupont at gmail.com
> wrote:

> I created the issue here: https://issues.jboss.org/browse/KEYCLOAK-5921
>
>
> On Mon, Nov 27, 2017 at 12:09 PM, Pedro Igor Silva <psilva at redhat.com>
> wrote:
>
>> Right now, there is no such thing. But we can think about it and see how
>> to include this RFE in a future release. Could you fill a JIRA and put some
>> of your requirements there, please ?
>>
>> Regards.
>>
>> On Mon, Nov 27, 2017 at 7:40 AM, Corentin Dupont <
>> corentin.dupont at gmail.com> wrote:
>>
>>> Hi,
>>> I'm using the entitlement API to protect the resources of my API.
>>> Sometimes the user gets a "not authorized" message, and it's hard for
>>> him to known why.
>>> Is there any way to provide the user why more information with why it
>>> was rejected?
>>> Something similar with the infos provided by the "evaluate" panel, but
>>> with the API.
>>> Thanks
>>> Corentin
>>>
>>
>>
>

From mposolda at redhat.com  Mon Jan 29 11:13:14 2018
From: mposolda at redhat.com (Marek Posolda)
Date: Mon, 29 Jan 2018 17:13:14 +0100
Subject: [keycloak-user] Offline tokens
In-Reply-To: <8FC1021C-0012-4E05-82FA-0903C1A167E5@contoso.com>
References: <8FC1021C-0012-4E05-82FA-0903C1A167E5@contoso.com>
Message-ID: <bdb30ac3-7f0d-e027-d7b3-cd95768c0cbc@redhat.com>

Not sure we have direct support for this. What we have is:
- Token Exchange service -- The new thing added in Keycloak 3.4 (I 
think). It's available in Keycloak 3.4.3 for sure. It can be possibly 
used to exchange the token of authenticated admin for the token of user 
(Impersonation of tokens). Not 100% sure if it's possible. It's new 
thing and I am still not too familiar with it. You can take a look at 
docs and see...

- Service accounts -- Authenticate on behalf of some client and issue 
token assigned to client, not to concrete user. Not sure if it suits 
your needs, just pointing this if you're not aware of that possibility.

- If none of previous things can be used, you can create your own custom 
Authenticator and setup it as Direct Access Grant Flow. The 
authenticator will somehow allow you to authenticate as any user if you 
prove your admin identity.? Also you can create your own REST endpoint 
for exchange admin token for the offline token of user (That's also 
workaround). These possibilities will 100% work, but it's workaround and 
it's also complicated to do (You would need to code the new 
authenticator implementation). So would use it just as last fallback.

Marek

On 29/01/18 12:31, O'Callaghan, John wrote:
> Hi
>
> I?m hoping someone can help with a question I have around offline tokens. I would like to be able to generate offline tokens for users of my system. At the moment the only way I can see to be able to create an offline token is to POST to ?/realms/<name>/protocol/openid-connect/token? with a scope : ?offline_access? and pass in their  username/password.
>
> This works fine if I am asking users to create their own offline tokens, but what I would like to be able to do is allow an admin user to create these offline tokens for users on request (without knowing their password).  Is this possible? I have had a look in the REST api and didn?t see anything there but maybe its not documented?
>
> Many thanks!
> John
>
>
>
>
> Accenture Global Solutions Limited, 3 Grand Canal Plaza, Grand Canal Street Upper, Dublin 4
> This e-mail and any files transmitted with it are confidential and are intended solely for the use of the individual or entity to which they are addressed. If you have received this e-mail in error, please notify the sender immediately and delete the original. Communications with Accenture or any of its group companies (?Accenture?), including telephone calls and e-mails, may be monitored by our systems for quality control and/or evidential purposes. Accenture does not accept service by e-mail of court proceedings, other processes or formal notices of any kind. Private company limited by shares registered in Ireland, Number 554978
>
> ________________________________
>
> This message is for the designated recipient only and may contain privileged, proprietary, or otherwise confidential information. If you have received it in error, please notify the sender immediately and delete the original. Any other use of the e-mail by you is prohibited. Where allowed by local law, electronic communications with Accenture and its affiliates, including e-mail and instant messaging (including content), may be scanned by our systems for the purposes of information security and assessment of internal compliance with Accenture policy.
> ______________________________________________________________________________________
>
> www.accenture.com
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user



From mposolda at redhat.com  Mon Jan 29 11:31:51 2018
From: mposolda at redhat.com (Marek Posolda)
Date: Mon, 29 Jan 2018 17:31:51 +0100
Subject: [keycloak-user] AD sAMAccountName Protocol Mapper
In-Reply-To: <fe93beb3a6844fbf9b14cbf03de64c1f@ex2k13mbx2.tafedc.com>
References: <fe93beb3a6844fbf9b14cbf03de64c1f@ex2k13mbx2.tafedc.com>
Message-ID: <b62acf71-3e99-d244-4cd4-fe6ce663338d@redhat.com>

If I understand your usecase, you need 2 things:

1) Configure LDAP User Attribute mapper and map LDAP Attribute 
'sAMAccountName' to any attribute of user. After doing this, you should 
be able to see the the sAMAccountName-mapped attribute in the tab 
"Atrributes" of particular user in Keycloak admin console.

2) Create protocolMapper for your client application and map the 
attribute from (1) to the claim of the token with User Attribute 
protocol mapper. Then in your application, you should see the 
corresponding claim in the access token.

Marek

On 29/01/18 14:43, trmadhu at tafe.com wrote:
> Dear All
>
> We have configured the AD Authentication in Keycloak using the User Federation. Currently we are configured the Username LDAP Attribute as "cn", but in our of the application, we need to send the sAMAccountName as the login parameter
>
> So kindly support in configuring the sAMAccountName as  Protocol Mapper.
>
>
> [All]
>
>
>
> Above email is subject to 'Disclaimer' as per <a href="http://tafe.co.in/email-disclaimer.htm">http://tafe.co.in/email-disclaimer.htm</a>
>
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user



From viggo.navarsete at gmail.com  Mon Jan 29 14:22:05 2018
From: viggo.navarsete at gmail.com (Viggo Navarsete)
Date: Mon, 29 Jan 2018 19:22:05 +0000
Subject: [keycloak-user] Uncaught SyntaxError: Unexpected end of JSON input
	on tutorial
Message-ID: <CADtfDAPCdhJK=EtmvmaZ9Y+sF9tmRCTBNCTpnSTE9UxeUJHzDg@mail.gmail.com>

Hi,

I've installed Wildfly 11.0.0.Final and keycloak 3.4.3.Final and have run
the following tutorials:
https://github.com/keycloak/keycloak-quickstarts/blob/latest/service-jee-jaxrs/README.md
https://github.com/keycloak/keycloak-quickstarts/tree/latest/app-jee-html5

But I end up getting
Uncaught SyntaxError: Unexpected end of JSON input
    at JSON.parse (<anonymous>)
    at XMLHttpRequest.req.onreadystatechange (app.js:44)

whatever I click on of "Invoke Public, "Invoke Secured" and "Invoke Admin".

Does anyone else have the same problem I have?

It the line in bold that gives the error:
        req.onreadystatechange = function () {
            if (req.readyState == 4) {
                if (req.status == 200) {
                    *output.innerHTML = 'Message: ' +
JSON.parse(req.responseText).message;*
                } else if (req.status == 0) {
                    output.innerHTML = '<span class="error">Request
failed</span>';
                } else {
                    output.innerHTML = '<span class="error">' + req.status
+ ' ' + req.statusText + '</span>';
                }
            }
        };

Regards,
Viggo

From inacio-silva at prodesan.com.br  Mon Jan 29 14:47:09 2018
From: inacio-silva at prodesan.com.br (JOSE INACIO DA SILVA JUNIOR)
Date: Mon, 29 Jan 2018 17:47:09 -0200 (BRST)
Subject: [keycloak-user] getRoleMappings - please I need a help
In-Reply-To: <1241536950.34597.1517254530999.JavaMail.root@prodesan.com.br>
Message-ID: <1835945371.35089.1517255229596.JavaMail.root@prodesan.com.br>

Hi,

I'm changing PropertyFileUserStorageProvider example. And I need to override the method: Set<RoleModel> getRoleMappingsInternal(); of the class

AbstractUserAdapterFederatedStorage.class in order to retrive external roles based on a legacy system.

How can I do that?

I've tried:

protected Set<RoleModel> getRoleMappingsInternal() {
           	
         Set<RoleModel> roles = new HashSet<>();
         RoleModel role = new MyRoleAdapter(realm,"role1","role1","role1 description", false);
         roles.add(role);
         return roles;

}

The code of MyRoleAdapter:


public class MyRoleAdapter implements RoleModel{
	private String id;
	private String name;
	private String description;
	private RealmModel container;
	private boolean isClientRole;
	
	public RoleProdesanAdapter(RealmModel container, String id, String name, String description, boolean isClientRole) {
		this.id = id;
		this.name = name;
		this.description = description;
		this.container = container;
		this.isClientRole = isClientRole;
	}

        // getters
}


Please help me. I've tried a lot but without success!


Thanks in advance!
In?cio





From postmaster at lists.jboss.org  Tue Jan 30 00:11:44 2018
From: postmaster at lists.jboss.org (Post Office)
Date: Tue, 30 Jan 2018 10:41:44 +0530
Subject: [keycloak-user] Delivery reports about your e-mail
Message-ID: <201801300511.w0U5BjY4006067@lists01.dmz-a.mwc.hst.phx2.redhat.com>




From karan.s1992 at outlook.com  Tue Jan 30 01:56:10 2018
From: karan.s1992 at outlook.com (karan shah)
Date: Tue, 30 Jan 2018 06:56:10 +0000
Subject: [keycloak-user] Keycloak with NGINX proxy server not authenticating
	rest api
Message-ID: <CY4PR1301MB2134B7A56B9F89AE806E5A10F5E40@CY4PR1301MB2134.namprd13.prod.outlook.com>

I have a sample app which correctly secures the rest api locally. Now when I put this in production behind a nginx proxy it does not work. No errors. It allows all request.

Front end serer with ssl is https://frontend.com<https://frontend.com/>

Back end server with ssl is https://backend.com<https://backend.com/>

Keycloak proxy forward is true

Front end server(node server on 9000) <-> NGINX <-> Keycloak (running on 8180)

nginx file sample

upstream keycloak_server {
  server localhost:8180;
}

upstream node_server {
  server localhost:9000;
}

location /auth/ {
  proxy_pass http://keycloak_server;
  proxy_http_version 1.1;
  proxy_set_header Host              $host;
  proxy_set_header X-Real-IP         $remote_addr;
  proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
  proxy_set_header X-Forwarded-Proto $scheme;
}
location / {
  proxy_pass http://node_server;
  proxy_http_version 1.1;
  proxy_set_header Host              $host;
  proxy_set_header X-Real-IP         $remote_addr;
  proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
  proxy_set_header X-Forwarded-Proto $scheme;
}

Front end server calls a backend api using Angular. REST api calls looks like https://backend.com/callTest

Backend server(running on tomcat) <-> NGINX <-> Spring Boot(with keycloak)

nginx sample

location / {
  proxy_pass http://127.0.0.1:8080/dt-1.0/;
  proxy_http_version 1.1;
  proxy_set_header Host               $host;
  proxy_set_header X-Real-IP          $remote_addr;
  proxy_set_header X-Forwarded-For    $proxy_add_x_forwarded_for;
  proxy_set_header X-Forwarded-Proto  $scheme;
}

in angular keycloak.json looks like

{
  "realm": "demo",
  "auth-server-url": "https://frontend.com/auth",
  "ssl-required": "none",
  "resource": "tutorial-frontend",
  "public-client": true
}

in spring boot keycloak properties look like

  keycloak.auth-server-url=https://frontend.com/auth
  keycloak.realm=demo
  keycloak.resource=1040nra-client
  keycloak.public-client=true
  keycloak.bearer-only = true
  keycloak.cors = true
  keycloak.security-constraints[0].authRoles[0]=user
  keycloak.security-constraints[0].securityCollections[0].patterns[0]=/*

Please let me know how to correct this. I would really appreciate it.


From mhajas at redhat.com  Tue Jan 30 04:01:27 2018
From: mhajas at redhat.com (Michal Hajas)
Date: Tue, 30 Jan 2018 09:01:27 +0000
Subject: [keycloak-user] WebLogic and KeycloakOIDCFilter
In-Reply-To: <VI1PR0402MB3536BF4FBEBD288A11C32401EAE00@VI1PR0402MB3536.eurprd04.prod.outlook.com>
References: <VI1PR0402MB3536BF4FBEBD288A11C32401EAE00@VI1PR0402MB3536.eurprd04.prod.outlook.com>
Message-ID: <CACv4bCQVRwcWWDMUDz_wTdLyEfjCNXY7bmO_5YM-Rihz9rBjrw@mail.gmail.com>

Hi Thomas,

I plan to work on PR for those tests at the end of this week or beginning
of next week.

Anyway I had the same problem and I fixed it by setting this value in admin
console (it is only for saml clients):

Assertion Consumer Service POST Binding URL to http://my-application/saml

Michal

On Fri, Jan 26, 2018 at 10:32 AM Thomas Isaksen <thomas.isaksen at sysco.no>
wrote:

> Does anyone have a working example of this setup on WebLogic? I am still
> having problems with the infinite loop after authentication. I don't know
> if my Client config might be wrong.
>
> ./t
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>

From john.ocallaghan at accenture.com  Tue Jan 30 04:10:36 2018
From: john.ocallaghan at accenture.com (O'Callaghan, John)
Date: Tue, 30 Jan 2018 09:10:36 +0000
Subject: [keycloak-user] [External] Re:  Offline tokens
In-Reply-To: <bdb30ac3-7f0d-e027-d7b3-cd95768c0cbc@redhat.com>
References: <8FC1021C-0012-4E05-82FA-0903C1A167E5@contoso.com>
	<bdb30ac3-7f0d-e027-d7b3-cd95768c0cbc@redhat.com>
Message-ID: <ED026D52-536C-4CC2-B431-90DF8DC389B4@accenture.com>



Hi Marek

Thanks for that info the token exchange feature looks interesting and might be a way for me to solve my requirement. I didn?t see anything in the docs saying that I could use it to get an offline token but it's worth a shot. Has anyone out there used this to get offline tokens? 

If this is possible then it would be the preferable option for me. The service accounts option is a bit fiddly as I would need a separate service account for each user (at least that?s how I think that would work). Unless it were possible to fully automate the creation of these service accounts on demand, associate them with a specific user and then grab their offline token. 

I'll look further into option 1 and get back to you with how I get on.
Thanks again
John


Accenture Global Solutions Limited, 3 Grand Canal Plaza, Grand Canal Street Upper, Dublin 4
This e-mail and any files transmitted with it are confidential and are intended solely for the use of the individual or entity to which they are addressed. If you have received this e-mail in error, please notify the sender immediately and delete the original. Communications with Accenture or any of its group companies (?Accenture?), including telephone calls and e-mails, may be monitored by our systems for quality control and/or evidential purposes. Accenture does not accept service by e-mail of court proceedings, other processes or formal notices of any kind. Private company limited by shares registered in Ireland, Number 554978
?On 29/01/2018, 16:13, "Marek Posolda" <mposolda at redhat.com> wrote:

    Not sure we have direct support for this. What we have is:
    - Token Exchange service -- The new thing added in Keycloak 3.4 (I 
    think). It's available in Keycloak 3.4.3 for sure. It can be possibly 
    used to exchange the token of authenticated admin for the token of user 
    (Impersonation of tokens). Not 100% sure if it's possible. It's new 
    thing and I am still not too familiar with it. You can take a look at 
    docs and see...
    
    - Service accounts -- Authenticate on behalf of some client and issue 
    token assigned to client, not to concrete user. Not sure if it suits 
    your needs, just pointing this if you're not aware of that possibility.
    
    - If none of previous things can be used, you can create your own custom 
    Authenticator and setup it as Direct Access Grant Flow. The 
    authenticator will somehow allow you to authenticate as any user if you 
    prove your admin identity.  Also you can create your own REST endpoint 
    for exchange admin token for the offline token of user (That's also 
    workaround). These possibilities will 100% work, but it's workaround and 
    it's also complicated to do (You would need to code the new 
    authenticator implementation). So would use it just as last fallback.
    
    Marek
    
    On 29/01/18 12:31, O'Callaghan, John wrote:
    > Hi
    >
    > I?m hoping someone can help with a question I have around offline tokens. I would like to be able to generate offline tokens for users of my system. At the moment the only way I can see to be able to create an offline token is to POST to ?/realms/<name>/protocol/openid-connect/token? with a scope : ?offline_access? and pass in their  username/password.
    >
    > This works fine if I am asking users to create their own offline tokens, but what I would like to be able to do is allow an admin user to create these offline tokens for users on request (without knowing their password).  Is this possible? I have had a look in the REST api and didn?t see anything there but maybe its not documented?
    >
    > Many thanks!
    > John
    >
    >
    >
    >
    > Accenture Global Solutions Limited, 3 Grand Canal Plaza, Grand Canal Street Upper, Dublin 4
    > This e-mail and any files transmitted with it are confidential and are intended solely for the use of the individual or entity to which they are addressed. If you have received this e-mail in error, please notify the sender immediately and delete the original. Communications with Accenture or any of its group companies (?Accenture?), including telephone calls and e-mails, may be monitored by our systems for quality control and/or evidential purposes. Accenture does not accept service by e-mail of court proceedings, other processes or formal notices of any kind. Private company limited by shares registered in Ireland, Number 554978
    >
    > ________________________________
    >
    > This message is for the designated recipient only and may contain privileged, proprietary, or otherwise confidential information. If you have received it in error, please notify the sender immediately and delete the original. Any other use of the e-mail by you is prohibited. Where allowed by local law, electronic communications with Accenture and its affiliates, including e-mail and instant messaging (including content), may be scanned by our systems for the purposes of information security and assessment of internal compliance with Accenture policy.
    > ______________________________________________________________________________________
    >
    > www.accenture.com
    > _______________________________________________
    > keycloak-user mailing list
    > keycloak-user at lists.jboss.org
    > https://urldefense.proofpoint.com/v2/url?u=https-3A__lists.jboss.org_mailman_listinfo_keycloak-2Duser&d=DwIDaQ&c=eIGjsITfXP_y-DLLX0uEHXJvU8nOHrUK8IrwNKOtkVU&r=MU_KJXJNiVzpKH9iO2oEENGKvd9j8rpJfiPNXLOJNiY&m=et3QLj8cMKR_IqLgyUwo_QE1VNS-qYk1DVge0DqMSOk&s=bnvYFqzDnG9qQQfVKsMhhCEnIgJyqn-jOWFvS9Rtsp8&e=
    
    
    



From noircc at gmail.com  Tue Jan 30 05:07:19 2018
From: noircc at gmail.com (SW)
Date: Tue, 30 Jan 2018 03:07:19 -0700 (MST)
Subject: [keycloak-user] Is it possible to impersonate a user from a
	different realm?
Message-ID: <1517306839695-0.post@n6.nabble.com>

Let's say you have an admin realm (which is not a master realm) and a
customer-realm. Is it possible to impersonate a user in the customer-realm,
when logged in to the admin realm? 

And if yes, how is it possible? 

If no, is there a way to archieve this programmatically, to give the admin
realm, when impersonating "master-rights"?



--
Sent from: http://keycloak-user.88327.x6.nabble.com/

From hasebullah.ansari at syntlogo.de  Tue Jan 30 06:14:29 2018
From: hasebullah.ansari at syntlogo.de (ansarihaseb)
Date: Tue, 30 Jan 2018 04:14:29 -0700 (MST)
Subject: [keycloak-user] No state cookie returned from the keycloak
 adapter
In-Reply-To: <2b3bbd76-c493-c4d8-281b-9861af02f976@redhat.com>
References: <DA104EED-02C9-447C-8FBD-8B99904FD186@expedia.com>
	<2b3bbd76-c493-c4d8-281b-9861af02f976@redhat.com>
Message-ID: <1517310869220-0.post@n6.nabble.com>

What happens if I want to go directly to the registration page of Keycloak
with this URL 

http://localhost:8080/auth/realms/syntlogo/protocol/openid-connect/registrations?client_id=ORION&redirect_uri=something&response_type=code&scope=openid 

How can I do the registration with this ?



--
Sent from: http://keycloak-user.88327.x6.nabble.com/

From thomas.isaksen at sysco.no  Tue Jan 30 06:40:05 2018
From: thomas.isaksen at sysco.no (Thomas Isaksen)
Date: Tue, 30 Jan 2018 11:40:05 +0000
Subject: [keycloak-user] WebLogic and KeycloakOIDCFilter
In-Reply-To: <CACv4bCQVRwcWWDMUDz_wTdLyEfjCNXY7bmO_5YM-Rihz9rBjrw@mail.gmail.com>
References: <VI1PR0402MB3536BF4FBEBD288A11C32401EAE00@VI1PR0402MB3536.eurprd04.prod.outlook.com>
	<CACv4bCQVRwcWWDMUDz_wTdLyEfjCNXY7bmO_5YM-Rihz9rBjrw@mail.gmail.com>
Message-ID: <AM6PR0402MB35256F0F27193F0A01124C87EAE40@AM6PR0402MB3525.eurprd04.prod.outlook.com>

Hi Michal

Great, I am looking forward to it. Unfortunately I am not using SAML so I can?t use your workaround.

./t

From: Michal Hajas [mailto:mhajas at redhat.com]
Sent: tirsdag 30. januar 2018 10.01
To: Thomas Isaksen <thomas.isaksen at sysco.no>
Cc: keycloak-user at lists.jboss.org
Subject: Re: [keycloak-user] WebLogic and KeycloakOIDCFilter

Hi Thomas,

I plan to work on PR for those tests at the end of this week or beginning of next week.

Anyway I had the same problem and I fixed it by setting this value in admin console (it is only for saml clients):

Assertion Consumer Service POST Binding URL to http://my-application/saml

Michal

On Fri, Jan 26, 2018 at 10:32 AM Thomas Isaksen <thomas.isaksen at sysco.no<mailto:thomas.isaksen at sysco.no>> wrote:
Does anyone have a working example of this setup on WebLogic? I am still having problems with the infinite loop after authentication. I don't know if my Client config might be wrong.

./t
_______________________________________________
keycloak-user mailing list
keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>
https://lists.jboss.org/mailman/listinfo/keycloak-user

From pinguwien at gmail.com  Tue Jan 30 08:52:56 2018
From: pinguwien at gmail.com (Dominik Guhr)
Date: Tue, 30 Jan 2018 14:52:56 +0100
Subject: [keycloak-user] Why is the KEYCLOAK_LOCALE cookie httponly? And is
 there a way to get the locale on first call of page?
Message-ID: <37118e37-2d91-ed77-5735-cb7f6513e8c9@gmail.com>

Hi everyone,

so I tried to theme the loginpage here, which worked out pretty well at 
first, but when internationalization was a thing (I had to change the 
provided internationalization to a selectbox) I tried to get the 
KEYCLOAK_LOCALE cookie at page load to set the selected option by this 
cookie.

sadly, document.cookie doesn't have the KEYCLOAK_LOCALE cookie inside, 
because it seems to be set to httponly=true which doesn't make it 
accessible via js.

So, this was a problem because when you first(!) call the loginpage, 
there is no queryparam kc_locale=... set and I had to figure out which 
language is used and thus how to set the dropdowns selected option 
accordingly.

My custom dropdown code just looks like this:

<#if realm.internationalizationEnabled>
	<select name="languages" id="locale_dropdown">
         	<#list locale.supported as l>
		<option value="${l.url}"><a href="${l.url}"><${l.label}></a></option>
		</#list>
	</select>
</#if>

now when changing the login to english, not logging in, on next call of 
a protected page and redirect to the loginpage, I can't check in js 
which locale is set, for no querystring is set and the cookie is not 
accessible.

So, 3 concrete questions:
a) why is it httponly? xss attack prevention?
b) Would it be possible to always get the locale in the querystring of 
login/pw form redirect?
c) alternatively, is it possible to get the current locale in jsf by 
accessing locale.?

Thanks in advance!

Best regards,
Dominik

From mposolda at redhat.com  Tue Jan 30 10:06:58 2018
From: mposolda at redhat.com (Marek Posolda)
Date: Tue, 30 Jan 2018 16:06:58 +0100
Subject: [keycloak-user] [External] Re:  Offline tokens
In-Reply-To: <ED026D52-536C-4CC2-B431-90DF8DC389B4@accenture.com>
References: <8FC1021C-0012-4E05-82FA-0903C1A167E5@contoso.com>
	<bdb30ac3-7f0d-e027-d7b3-cd95768c0cbc@redhat.com>
	<ED026D52-536C-4CC2-B431-90DF8DC389B4@accenture.com>
Message-ID: <b9a21a8d-9a1f-06e2-cb79-529ca8ead949@redhat.com>

On 30/01/18 10:10, O'Callaghan, John wrote:
>
> Hi Marek
>
> Thanks for that info the token exchange feature looks interesting and might be a way for me to solve my requirement. I didn?t see anything in the docs saying that I could use it to get an offline token but it's worth a shot. Has anyone out there used this to get offline tokens?
>
> If this is possible then it would be the preferable option for me. The service accounts option is a bit fiddly as I would need a separate service account for each user (at least that?s how I think that would work). Unless it were possible to fully automate the creation of these service accounts on demand, associate them with a specific user and then grab their offline token.
Nope, service accounts are used for the case, when you want to 
authenticate on behalf of "client" application, not as any concrete 
user. In some cases, it may be useful to use those service accounts to 
perform some tasks not tight to any concrete user (EG. periodic tasks 
etc). Just mentioned this for the case if it suits your usecase, but I 
guess it doesn't...

Marek
>
> I'll look further into option 1 and get back to you with how I get on.
> Thanks again
> John
>
>
> Accenture Global Solutions Limited, 3 Grand Canal Plaza, Grand Canal Street Upper, Dublin 4
> This e-mail and any files transmitted with it are confidential and are intended solely for the use of the individual or entity to which they are addressed. If you have received this e-mail in error, please notify the sender immediately and delete the original. Communications with Accenture or any of its group companies (?Accenture?), including telephone calls and e-mails, may be monitored by our systems for quality control and/or evidential purposes. Accenture does not accept service by e-mail of court proceedings, other processes or formal notices of any kind. Private company limited by shares registered in Ireland, Number 554978
> ?On 29/01/2018, 16:13, "Marek Posolda" <mposolda at redhat.com> wrote:
>
>      Not sure we have direct support for this. What we have is:
>      - Token Exchange service -- The new thing added in Keycloak 3.4 (I
>      think). It's available in Keycloak 3.4.3 for sure. It can be possibly
>      used to exchange the token of authenticated admin for the token of user
>      (Impersonation of tokens). Not 100% sure if it's possible. It's new
>      thing and I am still not too familiar with it. You can take a look at
>      docs and see...
>      
>      - Service accounts -- Authenticate on behalf of some client and issue
>      token assigned to client, not to concrete user. Not sure if it suits
>      your needs, just pointing this if you're not aware of that possibility.
>      
>      - If none of previous things can be used, you can create your own custom
>      Authenticator and setup it as Direct Access Grant Flow. The
>      authenticator will somehow allow you to authenticate as any user if you
>      prove your admin identity.  Also you can create your own REST endpoint
>      for exchange admin token for the offline token of user (That's also
>      workaround). These possibilities will 100% work, but it's workaround and
>      it's also complicated to do (You would need to code the new
>      authenticator implementation). So would use it just as last fallback.
>      
>      Marek
>      
>      On 29/01/18 12:31, O'Callaghan, John wrote:
>      > Hi
>      >
>      > I?m hoping someone can help with a question I have around offline tokens. I would like to be able to generate offline tokens for users of my system. At the moment the only way I can see to be able to create an offline token is to POST to ?/realms/<name>/protocol/openid-connect/token? with a scope : ?offline_access? and pass in their  username/password.
>      >
>      > This works fine if I am asking users to create their own offline tokens, but what I would like to be able to do is allow an admin user to create these offline tokens for users on request (without knowing their password).  Is this possible? I have had a look in the REST api and didn?t see anything there but maybe its not documented?
>      >
>      > Many thanks!
>      > John
>      >
>      >
>      >
>      >
>      > Accenture Global Solutions Limited, 3 Grand Canal Plaza, Grand Canal Street Upper, Dublin 4
>      > This e-mail and any files transmitted with it are confidential and are intended solely for the use of the individual or entity to which they are addressed. If you have received this e-mail in error, please notify the sender immediately and delete the original. Communications with Accenture or any of its group companies (?Accenture?), including telephone calls and e-mails, may be monitored by our systems for quality control and/or evidential purposes. Accenture does not accept service by e-mail of court proceedings, other processes or formal notices of any kind. Private company limited by shares registered in Ireland, Number 554978
>      >
>      > ________________________________
>      >
>      > This message is for the designated recipient only and may contain privileged, proprietary, or otherwise confidential information. If you have received it in error, please notify the sender immediately and delete the original. Any other use of the e-mail by you is prohibited. Where allowed by local law, electronic communications with Accenture and its affiliates, including e-mail and instant messaging (including content), may be scanned by our systems for the purposes of information security and assessment of internal compliance with Accenture policy.
>      > ______________________________________________________________________________________
>      >
>      > www.accenture.com
>      > _______________________________________________
>      > keycloak-user mailing list
>      > keycloak-user at lists.jboss.org
>      > https://urldefense.proofpoint.com/v2/url?u=https-3A__lists.jboss.org_mailman_listinfo_keycloak-2Duser&d=DwIDaQ&c=eIGjsITfXP_y-DLLX0uEHXJvU8nOHrUK8IrwNKOtkVU&r=MU_KJXJNiVzpKH9iO2oEENGKvd9j8rpJfiPNXLOJNiY&m=et3QLj8cMKR_IqLgyUwo_QE1VNS-qYk1DVge0DqMSOk&s=bnvYFqzDnG9qQQfVKsMhhCEnIgJyqn-jOWFvS9Rtsp8&e=
>      
>      
>      
>


From karan.s1992 at outlook.com  Tue Jan 30 17:55:15 2018
From: karan.s1992 at outlook.com (karan shah)
Date: Tue, 30 Jan 2018 22:55:15 +0000
Subject: [keycloak-user] Keycloak with NGINX proxy server not
 authenticating	rest api
In-Reply-To: <CY4PR1301MB2134B7A56B9F89AE806E5A10F5E40@CY4PR1301MB2134.namprd13.prod.outlook.com>
References: <CY4PR1301MB2134B7A56B9F89AE806E5A10F5E40@CY4PR1301MB2134.namprd13.prod.outlook.com>
Message-ID: <CY4PR1301MB2134B8F69AFAB96FDDC84D71F5E40@CY4PR1301MB2134.namprd13.prod.outlook.com>

anyone? I need to push this into production asap !
________________________________
From: keycloak-user-bounces at lists.jboss.org <keycloak-user-bounces at lists.jboss.org> on behalf of karan shah <karan.s1992 at outlook.com>
Sent: Tuesday, January 30, 2018 12:26 PM
To: keycloak-user at lists.jboss.org
Subject: [keycloak-user] Keycloak with NGINX proxy server not authenticating rest api

I have a sample app which correctly secures the rest api locally. Now when I put this in production behind a nginx proxy it does not work. No errors. It allows all request.

Front end serer with ssl is https://frontend.com<https://frontend.com/>

Back end server with ssl is https://backend.com<https://backend.com/>

Keycloak proxy forward is true

Front end server(node server on 9000) <-> NGINX <-> Keycloak (running on 8180)

nginx file sample

upstream keycloak_server {
  server localhost:8180;
}

upstream node_server {
  server localhost:9000;
}

location /auth/ {
  proxy_pass http://keycloak_server;
  proxy_http_version 1.1;
  proxy_set_header Host              $host;
  proxy_set_header X-Real-IP         $remote_addr;
  proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
  proxy_set_header X-Forwarded-Proto $scheme;
}
location / {
  proxy_pass http://node_server;
  proxy_http_version 1.1;
  proxy_set_header Host              $host;
  proxy_set_header X-Real-IP         $remote_addr;
  proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
  proxy_set_header X-Forwarded-Proto $scheme;
}

Front end server calls a backend api using Angular. REST api calls looks like https://backend.com/callTest

Backend server(running on tomcat) <-> NGINX <-> Spring Boot(with keycloak)

nginx sample

location / {
  proxy_pass http://127.0.0.1:8080/dt-1.0/;
  proxy_http_version 1.1;
  proxy_set_header Host               $host;
  proxy_set_header X-Real-IP          $remote_addr;
  proxy_set_header X-Forwarded-For    $proxy_add_x_forwarded_for;
  proxy_set_header X-Forwarded-Proto  $scheme;
}

in angular keycloak.json looks like

{
  "realm": "demo",
  "auth-server-url": "https://frontend.com/auth",
  "ssl-required": "none",
  "resource": "tutorial-frontend",
  "public-client": true
}

in spring boot keycloak properties look like

  keycloak.auth-server-url=https://frontend.com/auth
  keycloak.realm=demo
  keycloak.resource=1040nra-client
  keycloak.public-client=true
  keycloak.bearer-only = true
  keycloak.cors = true
  keycloak.security-constraints[0].authRoles[0]=user
  keycloak.security-constraints[0].securityCollections[0].patterns[0]=/*

Please let me know how to correct this. I would really appreciate it.

_______________________________________________
keycloak-user mailing list
keycloak-user at lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user

From scott.baugher at kaseware.com  Tue Jan 30 19:48:32 2018
From: scott.baugher at kaseware.com (Scott Baugher)
Date: Tue, 30 Jan 2018 17:48:32 -0700
Subject: [keycloak-user] Keycloak Open Network Sockets Keep Growing
Message-ID: <CANe4mev+4Y1eqcnxBYV+d8dwsa-iew_6O5=nECcPOYT-UPjsWQ@mail.gmail.com>

Bottom line up-front:  Keycloak's open socket connections (file handles)
keep growing.

I'm running Keycloak 3.2.1 Final in production on MS Azure using Ubuntu
16.04 LTS.

All clients interact with Keycloak using the Javascript adapter.

I have two Keycloak servers configured in HA mode.  I have tried running
the servers behind an Azure load balancer, and directly exposed to the
Internet (to eliminate the load balancer as an issue), with no difference.

I have also kept the servers in HA mode, but pulled one out of the load
balancer pool.  The server no longer in the pool does not see its
connections grow.

Monitored over a period of several days, the Java process associated with
Keycloak starts around 400 file handles when the server is started, and
keeps climbing by 30 - 80 handles per hour until it reaches the maximum, at
which point keycloak stops functioning.

If I do an "lsof -p [keycloak-pid]", it has hundreds to thousands of
network socket connections open to real customer IP addresses (far more
than would ever be expected based on the number of users).  The number of
connections never goes down (until the server is rebooted).

I looked through all of issues resolved in every release since 3.2.1, but
see nothing related to this.  Does anyone have any idea what could possibly
be going on?

From danielcharczynski at o2.pl  Wed Jan 31 06:34:06 2018
From: danielcharczynski at o2.pl (=?UTF-8?Q?Daniel_Charczy=C5=84ski?=)
Date: Wed, 31 Jan 2018 12:34:06 +0100
Subject: [keycloak-user] how retrievie access token only with roles for
 specific target service(keycloak client)?
In-Reply-To: <CALk=OEAc=GZmXqHfj4OnbH9ojndZ0J-=+FTsi2xVKOzNugTM_A@mail.gmail.com>
References: <CALk=OECgEsp3o3O5dBk2NT6ByJ6BtVAbvfyJ-0ELJ2hOH5bPhw@mail.gmail.com>
	<CALk=OEC5w8QZminyXePoAfD2g=aMjRzRhGb9pJX2AiBfNKJgHQ@mail.gmail.com>
	<CALk=OEAc=GZmXqHfj4OnbH9ojndZ0J-=+FTsi2xVKOzNugTM_A@mail.gmail.com>
Message-ID: <CALk=OEDPGV7Ru=-85bfKPkM0pUeSouuoiup8scOBPE0yfTO6Nw@mail.gmail.com>

Here are more details about use case


backgroud:
we are using bearer access tokens in case of authorization between services
this is JWT  signed by keycloak and contains all roles assignet to this
specific client
we are using "service account" in case of authorization service to service


eg:
if we have following screnario

service A   --->  service B
    |
    |-------------  > service C

service A receives JWT with roles to service B and C

If Service A comunicates with B, B is able to reuse this token and
communicate with C as service A
Token that B receives from A is valid and there is possibility to reuse it
That is CRITICAL security issue in my oppinion.

Out plan is to use Roles that requires scope parameter and it is OK for us
but at the moment there is only possibility to query for specific Role but
there is NO possibility to ask keycloak for JWT in with all roles but only
in service B context.

Of course we can use composite roles but this is workaround that requeires
extra maintanence - we do not want to do that in that way

We just need support scope parameter like

*scope = serviceB/**


Regards
Daniel Charczy?ski

From noircc at gmail.com  Wed Jan 31 09:51:00 2018
From: noircc at gmail.com (SW)
Date: Wed, 31 Jan 2018 07:51:00 -0700 (MST)
Subject: [keycloak-user] Created my own rest-service - CORS-Problem
Message-ID: <1517410260656-0.post@n6.nabble.com>

I have my own rest-service in Keyclok. I does nothing exception for returning
a string. 

When I am calling it from my javascript-app, I see that there are no
access-control-headers set. 

How do I modify my rest-service, to get the access-control-headers to be
set, besides of setting them myself?



--
Sent from: http://keycloak-user.88327.x6.nabble.com/

From K.Buler at adbglobal.com  Wed Jan 31 10:10:11 2018
From: K.Buler at adbglobal.com (Karol Buler)
Date: Wed, 31 Jan 2018 16:10:11 +0100
Subject: [keycloak-user] Created my own rest-service - CORS-Problem
In-Reply-To: <1517410260656-0.post@n6.nabble.com>
References: <1517410260656-0.post@n6.nabble.com>
Message-ID: <b52c225e-d3da-3b03-dd9e-bcffcd2e7f9e@adbglobal.com>

You need to add this:

keycloak.cors=true

to your rest service config, and add WebOrigins in Keycloak's client configuration.

On 31.01.2018 15:51, SW wrote:

I have my own rest-service in Keyclok. I does nothing exception for returning
a string.

When I am calling it from my javascript-app, I see that there are no
access-control-headers set.

How do I modify my rest-service, to get the access-control-headers to be
set, besides of setting them myself?



--
Sent from: http://keycloak-user.88327.x6.nabble.com/
_______________________________________________
keycloak-user mailing list
keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>
https://lists.jboss.org/mailman/listinfo/keycloak-user


[https://www.adbglobal.com/wp-content/uploads/adb.png]
adbglobal.com<https://www.adbglobal.com>

From jpperata at gmail.com  Wed Jan 31 10:20:06 2018
From: jpperata at gmail.com (Juan Pablo Perata)
Date: Wed, 31 Jan 2018 15:20:06 +0000
Subject: [keycloak-user] User session logout in Keycloak Console seems not
 to work if using User Federation Provider
Message-ID: <CA+BZ0jjtSXAjZwf33ySc9hzSvyDzowpDPdkEvJHbpaZFTq+jYg@mail.gmail.com>

Hello,

This issue seems application specific, but I could not reach to the root
yet.

I would like to know if someone faced this in Keycloak Admin Console or
some tips you could give me to see what is going on.

*Environment*
Web application running on Wildfly 10.1.0.Final and secured with Keycloak.
Keycloak 3.4.3.Final server running in <IP>:<PORT1>
Wildfly 10.1.0.Final server running in <IP>:<PORT2>
*Description*
Found that session logout from Keycloak admin does not have effect for
federated users in my web application.
Steps:
- develop your own user federation provider to connect to internal database
(implements interfaces _UserStorageProvider, CredentialInputValidator,
UserLookupProvider, OnUserCache_)
- properly configured user federation provider in keycloak realm
- configure and deploy a JSF based web OIDC client application in Wildfly
secured by Keycloak
- Go to: _<IP>:<PORT2>/<web-application_uri>_ and authenticate using
federation provider
Authentication succeeded
- Go to Keycloak Console -> Realm -> Sessions -> (select web application
client) -> Show sessions. Then select <user-authenticated> from displayed
table -> "Sessions" tab
- Click "Logout all sessions" or "Logout" the specific session. A success
message is displayed and session disappears from table.
- Go to _<IP>:<PORT2>/<web-application_uri>_ and check that session is
still alive and user is authenticated.
- Checked in a Filter in web application that
"org.keycloak.KeycloakSecurityContext" security context is present with
information from logged in user.

*To note:*
- (correct behaviour) If logout is performed from web application, single
sign on session is logged out properly (HttpRequest.logout()).
- (correct behaviour) Tested behaviour with [product-portal sample |
https://github.com/keycloak/keycloak/tree/master/examples/demo-template/product-app]
application and *it works ok as expected*.
Tested with users loaded in "demo" json and also using my own user
federation provider and works well.

Thanks in advance,
Juan

From cmoullia at redhat.com  Wed Jan 31 12:47:47 2018
From: cmoullia at redhat.com (Charles Moulliard)
Date: Wed, 31 Jan 2018 18:47:47 +0100
Subject: [keycloak-user] Keycloak OpenShift Template part of the openshift
	library project
Message-ID: <CAPb1sStKEWazaY0+6nuOW_60OP9s0h=0F2mp-_Kfwm-buFL7JQ@mail.gmail.com>

Hi,

The only Openshift Keycloak Template available (i think so) is part of the
xpaas project and can be deployed according to this doc [1] on Openshift
with the xpaas templates (A-MQ, ....)

Is there any plans to have an openshift keycloak template available from
the openshift library project [2]

Without such info part of the library, then we can't install keycloak as it
will not appear when you will browse the openshift catalog of your
openshift cluster instance (running using minishift, ....)

[1]
https://access.redhat.com/documentation/en-us/red_hat_jboss_middleware_for_openshift/3/html-single/red_hat_jboss_sso_for_openshift/
[2] https://github.com/openshift/library

Regards,

Charles

From neo11078016 at gmail.com  Wed Jan 31 14:50:29 2018
From: neo11078016 at gmail.com (Min Han Lee)
Date: Wed, 31 Jan 2018 19:50:29 +0000
Subject: [keycloak-user] User registration flow - Can UID mapped into SN and
	CN ?
Message-ID: <CAHKN4LMAru8Gp5m5ETq0p1nNUEJY4DvF+vCVpKm+tHgZSNBz9Q@mail.gmail.com>

Hello guys,,

Our LDAP environment have a schema which required sn and cn to be stated
when creating a new user, therefore the User Registration in the KC will
not work as the KC can only use UID as the main attribute to register a new
user,

I'm thinking if anyone able to work this around by changing the UID to
another attribute?

Kind Regards

From csalazar at devsu.com  Wed Jan 31 16:16:28 2018
From: csalazar at devsu.com (Cesar Salazar)
Date: Wed, 31 Jan 2018 16:16:28 -0500
Subject: [keycloak-user] Keycloak Middleware for node with support for
	multiple realms
Message-ID: <CAJzRJ5Jm1n3w_t=P9onioR3EWWWsT=fyPKCkC2SNnP3Jhov0sA@mail.gmail.com>

Hi,

I was needing a node middleware to connect my app to keycloak. I was trying
to use the official adapter, but it has the limitation that it works only
for one realm. For my use case I need my app to work with any realm in my
keycloak server.

So, I created a module that allows multiple realms. I shared it on github:
https://github.com/devsu/keycloak-nodejs-multirealm and uploaded to npm:
keycloak-connect-multirealm.

I'm sharing in this list for anyone that might need it, and to receive
feedback. Feedback is always appreciated.

Thanks!

-- 
*Cesar Salazar*
Development Manager
DEVSU | www.devsu.com
skype: cesarsalazar007
P: (213)-291-0752
M: +593 9 2917 160 (Ecuador)

From karan.s1992 at outlook.com  Wed Jan 31 19:32:59 2018
From: karan.s1992 at outlook.com (karan shah)
Date: Thu, 1 Feb 2018 00:32:59 +0000
Subject: [keycloak-user] Fw: Keycloak with NGINX proxy server not
 authenticating	rest api
In-Reply-To: <CY4PR1301MB2134B8F69AFAB96FDDC84D71F5E40@CY4PR1301MB2134.namprd13.prod.outlook.com>
References: <CY4PR1301MB2134B7A56B9F89AE806E5A10F5E40@CY4PR1301MB2134.namprd13.prod.outlook.com>,
	<CY4PR1301MB2134B8F69AFAB96FDDC84D71F5E40@CY4PR1301MB2134.namprd13.prod.outlook.com>
Message-ID: <CY4PR1301MB2134E88552206732281A5409F5FA0@CY4PR1301MB2134.namprd13.prod.outlook.com>

anyone got idea?

________________________________
From: keycloak-user-bounces at lists.jboss.org <keycloak-user-bounces at lists.jboss.org> on behalf of karan shah <karan.s1992 at outlook.com>
Sent: Tuesday, January 30, 2018 12:26 PM
To: keycloak-user at lists.jboss.org
Subject: [keycloak-user] Keycloak with NGINX proxy server not authenticating rest api

I have a sample app which correctly secures the rest api locally. Now when I put this in production behind a nginx proxy it does not work. No errors. It allows all request.

Front end serer with ssl is https://frontend.com<https://frontend.com/>

Back end server with ssl is https://backend.com<https://backend.com/>

Keycloak proxy forward is true

Front end server(node server on 9000) <-> NGINX <-> Keycloak (running on 8180)

nginx file sample

upstream keycloak_server {
  server localhost:8180;
}

upstream node_server {
  server localhost:9000;
}

location /auth/ {
  proxy_pass http://keycloak_server;
  proxy_http_version 1.1;
  proxy_set_header Host              $host;
  proxy_set_header X-Real-IP         $remote_addr;
  proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
  proxy_set_header X-Forwarded-Proto $scheme;
}
location / {
  proxy_pass http://node_server;
  proxy_http_version 1.1;
  proxy_set_header Host              $host;
  proxy_set_header X-Real-IP         $remote_addr;
  proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
  proxy_set_header X-Forwarded-Proto $scheme;
}

Front end server calls a backend api using Angular. REST api calls looks like https://backend.com/callTest

Backend server(running on tomcat) <-> NGINX <-> Spring Boot(with keycloak)

nginx sample

location / {
  proxy_pass http://127.0.0.1:8080/dt-1.0/;
  proxy_http_version 1.1;
  proxy_set_header Host               $host;
  proxy_set_header X-Real-IP          $remote_addr;
  proxy_set_header X-Forwarded-For    $proxy_add_x_forwarded_for;
  proxy_set_header X-Forwarded-Proto  $scheme;
}

in angular keycloak.json looks like

{
  "realm": "demo",
  "auth-server-url": "https://frontend.com/auth",
  "ssl-required": "none",
  "resource": "tutorial-frontend",
  "public-client": true
}

in spring boot keycloak properties look like

  keycloak.auth-server-url=https://frontend.com/auth
  keycloak.realm=demo
  keycloak.resource=1040nra-client
  keycloak.public-client=true
  keycloak.bearer-only = true
  keycloak.cors = true
  keycloak.security-constraints[0].authRoles[0]=user
  keycloak.security-constraints[0].securityCollections[0].patterns[0]=/*

Please let me know how to correct this. I would really appreciate it.

_______________________________________________
keycloak-user mailing list
keycloak-user at lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user
_______________________________________________
keycloak-user mailing list
keycloak-user at lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user

From carreraariel at gmail.com  Thu Jan  4 09:52:28 2018
From: carreraariel at gmail.com (Ariel Carrera)
Date: Thu, 04 Jan 2018 14:52:28 -0000
Subject: [keycloak-user] [keycloak-dev] Trojan in Keycloak Javascript
	Adapter?
In-Reply-To: <CAFzO_6e5DK4b8Mtff85h0AE9KX5mzoj-S7TRxweULgRzQQSejw@mail.gmail.com>
References: <CAFzO_6eDDb+uG67_uPFAZTSq6YRfmfhmmJ0VE5AjdvO37UprVA@mail.gmail.com>
	<CAHYJo18jrXAHDRWBiAbbGkNrGVxyCxNkuW9tJL--7RPdM3okeA@mail.gmail.com>
	<CAFzO_6e5DK4b8Mtff85h0AE9KX5mzoj-S7TRxweULgRzQQSejw@mail.gmail.com>
Message-ID: <CAFzO_6cVzpdLqT4w8cOzMCBCCk3G8apOWYd24px410jqxzmP4w@mail.gmail.com>

Hi, It still happen on my environment.
The problem persists with the new version of today (3.4.3.Final).

Any comments from the dev team? Could you check it?

Maybe it's a false alarm but it could be a serious security problem.

- Screenshot of Keycloak JS Adapter alert:

[image: Im?genes integradas 1]

- Screenshot of Keycloak distribution alert:

[image: Im?genes integradas 2]

- Screenshot of Virus Definitions Version:
[image: Im?genes integradas 3]

- Screenshot of Virus Definition Upgrade:
[image: Im?genes integradas 4]

- Screenshot of Keycloak JS Adapter alert again (with definitions up to
date):
[image: Im?genes integradas 5]

Thanks,

2018-01-03 18:07 GMT-03:00 Ariel Carrera <carreraariel at gmail.com>:

> Thanks Ramunas, I will check My Windows defender?s definition version to
> compare with you. I have Windows 10 (64 bit) updated on December 2017.
>
>
> El El mi?, 3 ene. 2018 a las 17:45, Rumanas <ramunask at gmail.com> escribi?:
>
>> * just downloaded keycloak-js-adapter-dist-3.4.2.Final.zip file
>> * extracted and scanned "keycloak-js-adapter-dist-3.4.2.Final" folder
>> with Windows Defender on Windows 10 - no issues found
>> * checked for Windows updates. New update "Definition Update for Windows
>> Defender Antivirus - KB2267602 (Definition 1.259.1141.0)" was found and
>> installed.
>> * scanned again. No issues found.
>>
>> Ram?nas
>>
> --
> Ariel Carrera
>



-- 
Ariel Carrera
-------------- next part --------------
A non-text attachment was scrubbed...
Name: DefinitionsUpToDate.png
Type: image/png
Size: 32133 bytes
Desc: not available
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20180104/d69afbdc/attachment-0005.png 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: VirusKeycloakJSAdapter.png
Type: image/png
Size: 45050 bytes
Desc: not available
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20180104/d69afbdc/attachment-0006.png 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: DefinitionsVersion.png
Type: image/png
Size: 32035 bytes
Desc: not available
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20180104/d69afbdc/attachment-0007.png 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: VirusKeycloakModuleJsAdapter.png
Type: image/png
Size: 53101 bytes
Desc: not available
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20180104/d69afbdc/attachment-0008.png 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: VirusKeycloakJSAdapter(definitions up to date).png
Type: image/png
Size: 54012 bytes
Desc: not available
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20180104/d69afbdc/attachment-0009.png 

From carreraariel at gmail.com  Tue Jan  9 15:24:18 2018
From: carreraariel at gmail.com (Ariel Carrera)
Date: Tue, 09 Jan 2018 20:24:18 -0000
Subject: [keycloak-user] [keycloak-dev] Trojan in Keycloak Javascript
	Adapter?
In-Reply-To: <CAJgngAfkBP5ADe+B9yJ-ADsheGXDKqnvEg4b7wmBPV=Xo68U+A@mail.gmail.com>
References: <CAFzO_6eDDb+uG67_uPFAZTSq6YRfmfhmmJ0VE5AjdvO37UprVA@mail.gmail.com>
	<CAHYJo18jrXAHDRWBiAbbGkNrGVxyCxNkuW9tJL--7RPdM3okeA@mail.gmail.com>
	<CAFzO_6cNfJxsi_OKQwryUpgFh4XzVfVbpcOgd=7VbKMSj6pgVg@mail.gmail.com>
	<CAFzO_6e0BK6a=wzoJaM=6vW0sx=zMn-OyjPdDw3G9nm-u7BE7w@mail.gmail.com>
	<CAFzO_6frz9+1+uQ-fju-TBH0+KjbHeN7ShQmuV8DLPfb9ibGtQ@mail.gmail.com>
	<CAJgngAepgq8NuWDwPcU4r9LN_9ixKrBqhUDska6YEofpUPXNmA@mail.gmail.com>
	<CAM5SUC7vvp62sq8LT7sDvVb8MGgDvbU1P2K155FhCWpBVypwYQ@mail.gmail.com>
	<CAFzO_6c2U8v_WjeFPqYgNRdzNU7UgnVNf50noCGn5S7YNfyLcA@mail.gmail.com>
	<CAM5SUC5JK1AfBV=t2Y4gPpd=20hQGGmtQboMvHJ7Ff339fSuFA@mail.gmail.com>
	<CAJgngAfkBP5ADe+B9yJ-ADsheGXDKqnvEg4b7wmBPV=Xo68U+A@mail.gmail.com>
Message-ID: <CAFzO_6dMiWq0KhKP=TY4oSDTybV=6e=QmUczBjF_o4LeyBEPPg@mail.gmail.com>

Ok, It's solved now. After submit multiple times the file to Microsoft
Windows Defender (from UI and Web Page), it is solved.
The file appears to be clean now for MS.

I updated virus definition to last version and I could checked that file is
OK now.

[image: Im?genes integradas 1]

[image: Im?genes integradas 2]

Thanks.

2018-01-09 16:20 GMT-03:00 Stian Thorgersen <sthorger at redhat.com>:

> I'm going to reject the issue. Unless someone else reports it there's
> nothing we can do. Thanks for reporting.
>
> On 9 January 2018 at 20:10, Bruno Oliveira <bruno at abstractj.org> wrote:
>
>> Yes, everything is up to date. Like mentioned in my previous e-mail, I'm
>> running Windows 10 VM from https://developer.microso
>> ft.com/en-us/microsoft-edge/tools/vms/.
>>
>> I strongly recommend you to do the same. It's always better to test
>> things in a clean environment.
>>
>>
>> On Tue, Jan 9, 2018 at 1:47 PM Ariel Carrera <carreraariel at gmail.com>
>> wrote:
>>
>>> I don't know why we have differents Windows Defender results... but it's
>>> Microsoft...
>>>
>>> Bruno, Is your Windows (inside VM) updated? What version is? Do you
>>> updated virus definitions too?
>>>
>>> I updated definitions but problem persists... Here is another screenshot:
>>> [image: image.png]
>>>
>>>
>>> [image: image.png]
>>>
>>>
>>> You can check my windows version in second screenshot. It is version
>>> 10.0.16299.192 (and it was tested in another machine with version (
>>> 10.0.16299.125)).
>>>
>>> Recently, It was tested again with a third machine (at home) in another
>>> network / location / and installation. Same problem, virus detected.
>>>
>>> Maybe Microsoft has differents versions by location... I don't know...
>>> after update to last version, Windows Defender asked me to send the file to
>>> improve detection (I had not asked for this before).
>>>
>>>
>>>
>>> 2018-01-09 11:50 GMT-03:00 Bruno Oliveira <bruno at abstractj.org>:
>>>
>>>> So I don't have Windows 10, but I managed to run a VM from
>>>> https://developer.microsoft.com/en-us/microsoft-edge/tools/vms/.
>>>>
>>>> After that I cloned the whole Keycloak repository https://github.com/
>>>> keycloak/keycloak-js-bower. Nothing was found, please see the
>>>> screenshot: https://i.imgur.com/1NbFGrn.png.
>>>>
>>>> On Tue, Jan 9, 2018 at 10:46 AM Stian Thorgersen <sthorger at redhat.com>
>>>> wrote:
>>>>
>>>>> Please create an issue with the details. We'll need to figure out how
>>>>> to
>>>>> reproduce the issue though. Seemed like Ramunas had tried, but that
>>>>> Defender wasn't reporting anything for him.
>>>>>
>>>>> On 8 January 2018 at 21:18, Ariel Carrera <carreraariel at gmail.com>
>>>>> wrote:
>>>>>
>>>>> > "when your somebody get's a keycloak's distribution to be
>>>>> installed"  read
>>>>> > like: "when someone gets Keycloak to be installed" xD
>>>>> >
>>>>> > 2018-01-08 16:56 GMT-03:00 Ariel Carrera <carreraariel at gmail.com>:
>>>>> >
>>>>> >> Hi Stian, I checked differences in keycloak.min.js comparing version
>>>>> >> 3.4.1 to 3.4.2.
>>>>> >> I can't see a problem at first sight... but It's still a problem to
>>>>> see
>>>>> >> your antivirus alerting for a threat when your browser access to a
>>>>> page
>>>>> >> that uses "keycloak.min.js" or when your somebody get's a keycloak's
>>>>> >> distribution to be installed.
>>>>> >>
>>>>> >> Maybe this issue must to be in Jira.
>>>>> >>
>>>>> >> Last changes in javascript file can be the problem.
>>>>> >>
>>>>> >> Maybe function "processInit()" needs some changes.
>>>>> >>
>>>>> >> Regards,
>>>>> >>
>>>>> >> 2018-01-08 16:26 GMT-03:00 Ariel Carrera <carreraariel at gmail.com>:
>>>>> >>
>>>>> >>> Checked with other computer (windows 10 + windows defender).
>>>>> >>>
>>>>> >>> keycloak-min.js is detected as virus from  version 3.4.2 to 3.4.3
>>>>> >>>
>>>>> >>>
>>>>> >>> 2018-01-03 17:44 GMT-03:00 Ramunas <ramunask at gmail.com>:
>>>>> >>>
>>>>> >>>> * just downloaded keycloak-js-adapter-dist-3.4.2.Final.zip file
>>>>> >>>> * extracted and scanned "keycloak-js-adapter-dist-3.4.2.Final"
>>>>> folder
>>>>> >>>> with Windows Defender on Windows 10 - no issues found
>>>>> >>>> * checked for Windows updates. New update "Definition Update for
>>>>> >>>> Windows Defender Antivirus - KB2267602 (Definition 1.259.1141.0)"
>>>>> was found
>>>>> >>>> and installed.
>>>>> >>>> * scanned again. No issues found.
>>>>> >>>>
>>>>> >>>> Ram?nas
>>>>> >>>>
>>>>> >>>
>>>>> >>>
>>>>> >>>
>>>>> >>> --
>>>>> >>> Ariel Carrera
>>>>> >>>
>>>>> >>
>>>>> >>
>>>>> >>
>>>>> >> --
>>>>> >> Ariel Carrera
>>>>> >>
>>>>> >
>>>>> >
>>>>> >
>>>>> > --
>>>>> > Ariel Carrera
>>>>> >
>>>>> _______________________________________________
>>>>> keycloak-user mailing list
>>>>> keycloak-user at lists.jboss.org
>>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>>
>>>>
>>>
>>>
>>> --
>>> Ariel Carrera
>>>
>>
>


-- 
Ariel Carrera
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image.png
Type: image/png
Size: 112492 bytes
Desc: not available
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20180109/29a80c0a/attachment-0004.png 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image.png
Type: image/png
Size: 39616 bytes
Desc: not available
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20180109/29a80c0a/attachment-0005.png 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image.png
Type: image/png
Size: 26763 bytes
Desc: not available
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20180109/29a80c0a/attachment-0006.png 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image.png
Type: image/png
Size: 43775 bytes
Desc: not available
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20180109/29a80c0a/attachment-0007.png