<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
</head>
<body dir="ltr">
<div id="divtagdefaultwrapper" style="font-size:12pt;color:#000000;background-color:#FFFFFF;font-family:Calibri,Arial,Helvetica,sans-serif;">
<p>We're looking to use Keycloak in an enterprise environment that reinforces tight web restrictions. There are network guys combing over every url, and dev ops guys doing other things with urls, and software developers integrating Keycloak. </p>
<p>Customized theming is a big selling point because business people can change up the look without worrying about most web attacks. But operations people dislike tying urls to your release cycle, especially when there are hot fixes.</p>
Your Freemaker template is a little strange too because it rewrites resource links as absolute urls, and make it behave strange behind reverse proxies.
<div><br>
</div>
<div>I understand your reasons for defaults, but allowing another flag for prefixing custom theme web resources would integrate more easily with other environments.</div>
<div><br>
</div>
<div>--Doug<br>
<br>
<div style="color: rgb(0, 0, 0);">
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>From:</b> Stian Thorgersen <sthorger@redhat.com><br>
<b>Sent:</b> Tuesday, December 1, 2015 20:27<br>
<b>To:</b> Doug Szeto<br>
<b>Cc:</b> Bill Burke; keycloak-user@lists.jboss.org<br>
<b>Subject:</b> Re: [keycloak-user] Theme Resources Urls</font>
<div> </div>
</div>
<div>
<div dir="ltr">Query param is an alternative practice. There's pros and cons with both approaches.
<div><br>
</div>
<div>The idea of customized themes is so you can customize the themes. To change the look and feel, add a logo, add an extra field to the forms, etc..</div>
<div><br>
</div>
<div>Can you elaborate on exactly why you need to change the URL?</div>
</div>
<div class="gmail_extra"><br>
<div class="gmail_quote">On 1 December 2015 at 13:21, Doug Szeto <span dir="ltr">
<<a href="mailto:DSzeto@investlab.com" target="_blank">DSzeto@investlab.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex; border-left:1px #ccc solid; padding-left:1ex">
If you want to bust the cache on a version update, a better practice is to stick the version id as a query parameter at the end of resources, see:<br>
<a href="https://css-tricks.com/strategies-for-cache-busting-css/" rel="noreferrer" target="_blank">https://css-tricks.com/strategies-for-cache-busting-css/</a><br>
<br>
ie <a href="http://localhost:8080/auth/resources/themes/login/keycloak/css/login.css?v=1.6.1.final" rel="noreferrer" target="_blank">
http://localhost:8080/auth/resources/themes/login/keycloak/css/login.css?v=1.6.1.final</a><br>
<br>
I thought the point of customized themes were to allow developers better control over the web resources being served without modifying the security source code. But if we can't control the url of our content, it limits our options on web optimization strategies.<br>
<br>
I guess overriding the freemaker template is the only way to go.<br>
<br>
--Doug<br>
<br>
________________________________________<br>
From: <a href="mailto:keycloak-user-bounces@lists.jboss.org">keycloak-user-bounces@lists.jboss.org</a> <<a href="mailto:keycloak-user-bounces@lists.jboss.org">keycloak-user-bounces@lists.jboss.org</a>> on behalf of Bill Burke <<a href="mailto:bburke@redhat.com">bburke@redhat.com</a>><br>
Sent: Monday, November 30, 2015 23:07<br>
To: <a href="mailto:keycloak-user@lists.jboss.org">keycloak-user@lists.jboss.org</a><br>
Subject: Re: [keycloak-user] Theme Resources Urls<br>
<div class="HOEnZb">
<div class="h5"><br>
Browser caching is turned on for themed resources (admin console,<br>
login, etc.) This is obviously for performance reasons.<br>
<br>
IN the past we received a HUGE amount of false bug reports of "Admin<br>
console doesn't work", "my theme changes aren't showing", etc. after<br>
upgrading Keycloak. All because people didn't clear their browser<br>
caches. Hence, the version id.<br>
<br>
You should not be externally linking to themed endpoints. You can use a<br>
different URL to ping the server for "is alive" i.e.<br>
/<root>/realms/{realm-name}<br>
<br>
<br>
On 11/30/2015 9:56 AM, Doug Szeto wrote:<br>
> What do you mean by 'You can't customize the url format'?<br>
><br>
> Is there a design decision reason why it is more secure to have your<br>
> keycloak version exposed in the middle of your theme resource urls?<br>
><br>
> Or would it be easier if you had a pull request?<br>
><br>
> --Doug<br>
><br>
><br>
><br>
> ------------------------------------------------------------------------<br>
> *From:* Stian Thorgersen <<a href="mailto:sthorger@redhat.com">sthorger@redhat.com</a>><br>
> *Sent:* Monday, November 30, 2015 15:35<br>
> *To:* Doug Szeto<br>
> *Cc:* <a href="mailto:keycloak-user@lists.jboss.org">keycloak-user@lists.jboss.org</a><br>
> *Subject:* Re: [keycloak-user] Theme Resources Urls<br>
> You can't customize the url format. Not sure how it would help during<br>
> upgrades? I'd say the opposite as you end up with cached versions for<br>
> the old release not being updated.<br>
><br>
> On 28 November 2015 at 03:54, Doug Szeto <<a href="mailto:DSzeto@investlab.com">DSzeto@investlab.com</a><br>
> <mailto:<a href="mailto:DSzeto@investlab.com">DSzeto@investlab.com</a>>> wrote:<br>
><br>
><br>
> Hi,<br>
> I have created a custom theme as specific in your docs here:<br>
> <a href="http://keycloak.github.io/docs/userguide/keycloak-server/html/themes.html" rel="noreferrer" target="_blank">http://keycloak.github.io/docs/userguide/keycloak-server/html/themes.html</a><br>
> It functions in the browser, in that these configs tell you where<br>
> the theme customization resources are stored locally, but the end<br>
> result is the resources are served from the url format pattern of:<br>
><br>
> <a href="http://localhost:8080/auth/resources/1.6.1.final/login/keycloak/css/login.css" rel="noreferrer" target="_blank">http://localhost:8080/auth/resources/1.6.1.final/login/keycloak/css/login.css</a><br>
><br>
> Is there a way to customize the theme url format to scrub the<br>
> version number off the css/image/js resources? This will help out in<br>
> monitoring and upgrades.<br>
><br>
> Thanks,<br>
> --Doug<br>
> _______________________________________________<br>
> keycloak-user mailing list<br>
> <a href="mailto:keycloak-user@lists.jboss.org">keycloak-user@lists.jboss.org</a> <mailto:<a href="mailto:keycloak-user@lists.jboss.org">keycloak-user@lists.jboss.org</a>><br>
> <a href="https://lists.jboss.org/mailman/listinfo/keycloak-user" rel="noreferrer" target="_blank">https://lists.jboss.org/mailman/listinfo/keycloak-user</a><br>
><br>
><br>
><br>
><br>
> _______________________________________________<br>
> keycloak-user mailing list<br>
> <a href="mailto:keycloak-user@lists.jboss.org">keycloak-user@lists.jboss.org</a><br>
> <a href="https://lists.jboss.org/mailman/listinfo/keycloak-user" rel="noreferrer" target="_blank">
https://lists.jboss.org/mailman/listinfo/keycloak-user</a><br>
><br>
<br>
--<br>
Bill Burke<br>
JBoss, a division of Red Hat<br>
<a href="http://bill.burkecentral.com" rel="noreferrer" target="_blank">http://bill.burkecentral.com</a><br>
_______________________________________________<br>
keycloak-user mailing list<br>
<a href="mailto:keycloak-user@lists.jboss.org">keycloak-user@lists.jboss.org</a><br>
<a href="https://lists.jboss.org/mailman/listinfo/keycloak-user" rel="noreferrer" target="_blank">https://lists.jboss.org/mailman/listinfo/keycloak-user</a><br>
_______________________________________________<br>
keycloak-user mailing list<br>
<a href="mailto:keycloak-user@lists.jboss.org">keycloak-user@lists.jboss.org</a><br>
<a href="https://lists.jboss.org/mailman/listinfo/keycloak-user" rel="noreferrer" target="_blank">https://lists.jboss.org/mailman/listinfo/keycloak-user</a><br>
</div>
</div>
</blockquote>
</div>
<br>
</div>
</div>
</div>
</div>
</div>
</body>
</html>