[keycloak-user] Keycloak 3.4.x client-url and SSO questions

[PEETERS.THOMAS (ICT)]

Hey all,

While implementing a Keycloak based secure application set (3 internal web applications) with Spring-Security, I’ve come upon some details that I can’t seem to find an adequate answer to.

Our environment and implementations:
The security layer is implemented on the front-end only (for now).

JBoss EAP 6.4, JSF 2.1 Mojarra with RichFaces 4, Spring 3.2.18, Spring-security 3.2.10, Keycloak-spring-security-adapter 3.4.1 (same as the Keycloak server being used).

What we’ve got working:
2 applications with SSL and SSO.  Both redirect to the Keycloak login page.  When we log in to app1 we’re also logged in in app2, so that’s good.

What we want but can’t seem to achieve:


·         Log out of app1 --> refresh of app2 should redirect to the Keycloak login page.

At this point it seems that the user credentials remain active as long as the browser session remains active.



·         After successful login from the Keycloak login page always redirect to the application welcome page (index.xhtml for instance).

Use case:  A user is working in one of our secured applications, has its browser session ended and clicks on some kind of link.  The application correctly redirects this user to the Keycloak login page.  The user correctly logs in and gets taken back to where he/she was.  However, when this is an AJAX kind-of request the user sees plain XML when taken back the application.  To avoid this I would like to always redirect to the welcome page of the application when the user logs in through the Keycloak login page.  I can’t seem to find a way to do this.



·         Logout doesn’t always work well.  Sometimes the Spring AntPathRequestMatcher doesn’t correctly match our logout pattern (/sso/logout**).  Therefore we’ve provided an alternative that we’ve found in the documentation in the form of:

“https://<keycloak-url-with-port>/auth/realms/<realmName>/protocol/openid-connect/logout?redirect_uri=<Application-base-URL>
      However  this doesn’t always work either.  There are situations, depending on invalid rights for certain application parts where this never logs out a user.


We’ve got a Spring-security application context in XML that is roughly the same as the one found in the documentation.  And a keycloak.json file that looks like this:


{
  "realm": "<realmName>",
  "auth-server-url": "<keycloak-url-with-port>/auth",
  "ssl-required": "all",
  "truststore": "<working-truststore>",
  "truststore-password":"<a-working-pwd>",
  "resource": "<App1-name>",
  "public-client": true,
  "always-refresh-token": true
}

Due to the large number of Keycloak releases and accompanied configuration changes it’s really hard for us to find relevant information.  When we first started by creating a POC we used the most recent Keycloak version (3.4.1-Final).  A lot of information that is not old appears to be outdated.  Just an observation.


Thanks for reading.


Klik hier<https://www.hvw.fgov.be/nl/mail-disclaimer> voor onze disclaimer
Cliquez ici<https://www.hvw.fgov.be/fr/mail-disclaimer> pour notre disclaimer
Klicken Sie hier<https://www.hvw.fgov.be/de/mail-disclaimer> für unseren Disclaimer