<div dir="ltr">So I'm also in a similar situation here where our front-end team will not even consider looking into FTL theme engine that was used in keycloak. They will reject keycloak as a good solution unless we can reimplement the login screen in an entirely different technology. I'm still trying to convince people that using the current theming engine is a better choice but I don't think we'll even be able to get there unless I can help them do a comparison of the two implementations. We don't currently care about registration, social auth, password reset, etc... through the login screen. Most of this will be done through the keycloak admin client by an administrator in our cases. This means I need a way to actually use the Login SPI to able to redirect to a login page hosted on a different server. Are there any suggestions of places where I could start looking at in order to implement a custom Login page hosted on a different server. The reason I specify different server (same tld domain) is I'm also a bit worried about CORS issues (hopefully we'll be fine).<div><br></div><div><br></div><div>Thanks,</div><div>Jesse<br><div class="gmail_extra"><br><div class="gmail_quote">On Fri, Feb 12, 2016 at 1:43 AM, <span dir="ltr"><<a href="mailto:keycloak-user-request@lists.jboss.org" target="_blank">keycloak-user-request@lists.jboss.org</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Send keycloak-user mailing list submissions to<br>
<a href="mailto:keycloak-user@lists.jboss.org">keycloak-user@lists.jboss.org</a><br>
<br>
To subscribe or unsubscribe via the World Wide Web, visit<br>
<a href="https://lists.jboss.org/mailman/listinfo/keycloak-user" rel="noreferrer" target="_blank">https://lists.jboss.org/mailman/listinfo/keycloak-user</a><br>
or, via email, send a message with subject or body 'help' to<br>
<a href="mailto:keycloak-user-request@lists.jboss.org">keycloak-user-request@lists.jboss.org</a><br>
<br>
You can reach the person managing the list at<br>
<a href="mailto:keycloak-user-owner@lists.jboss.org">keycloak-user-owner@lists.jboss.org</a><br>
<br>
When replying, please edit your Subject line so it is more specific<br>
than "Re: Contents of keycloak-user digest..."<br>
<br>
<br>
Today's Topics:<br>
<br>
1. Re: Extending Themes via SPI (Stian Thorgersen)<br>
2. Re: Failed to make identity provider oauth callback:<br>
javax.net.ssl.SSLHandshakeException (Marko Strukelj)<br>
3. Re: Failed to make identity provider oauth callback:<br>
javax.net.ssl.SSLHandshakeException (Stian Thorgersen)<br>
<br>
<br>
----------------------------------------------------------------------<br>
<br>
Message: 1<br>
Date: Fri, 12 Feb 2016 09:53:56 +0100<br>
From: Stian Thorgersen <<a href="mailto:sthorger@redhat.com">sthorger@redhat.com</a>><br>
Subject: Re: [keycloak-user] Extending Themes via SPI<br>
To: Sarp Kaya <<a href="mailto:akaya@expedia.com">akaya@expedia.com</a>><br>
Cc: "<a href="mailto:keycloak-user@lists.jboss.org">keycloak-user@lists.jboss.org</a>" <<a href="mailto:keycloak-user@lists.jboss.org">keycloak-user@lists.jboss.org</a>><br>
Message-ID:<br>
<<a href="mailto:CAJgngAfBrCv2B_A81Yc3sbBQbWz8O6JrXEa6SUWh8xG91EDDPg@mail.gmail.com">CAJgngAfBrCv2B_A81Yc3sbBQbWz8O6JrXEa6SUWh8xG91EDDPg@mail.gmail.com</a>><br>
Content-Type: text/plain; charset="utf-8"<br>
<br>
No, you can create a theme that contains stylesheets and freemarker<br>
templates (if you need to change those) and deploy it to Keycloak. Please<br>
read<br>
<a href="http://keycloak.github.io/docs/userguide/keycloak-server/html/themes.html" rel="noreferrer" target="_blank">http://keycloak.github.io/docs/userguide/keycloak-server/html/themes.html</a><br>
and take a look at the themes examples in our examples download.<br>
<br>
On 12 February 2016 at 09:47, Sarp Kaya <<a href="mailto:akaya@expedia.com">akaya@expedia.com</a>> wrote:<br>
<br>
> Okay but what you are saying is done directly on the Keycloak source code<br>
> which is then built and deployed, rather than extending classes and then<br>
> deploying directly to a Keycloak instance?<br>
><br>
> From: Stian Thorgersen <<a href="mailto:sthorger@redhat.com">sthorger@redhat.com</a>><br>
> Reply-To: "<a href="mailto:stian@redhat.com">stian@redhat.com</a>" <<a href="mailto:stian@redhat.com">stian@redhat.com</a>><br>
> Date: Friday, February 12, 2016 at 6:29 PM<br>
><br>
> To: Abdullah Sarp Kaya <<a href="mailto:akaya@expedia.com">akaya@expedia.com</a>><br>
> Cc: "<a href="mailto:keycloak-user@lists.jboss.org">keycloak-user@lists.jboss.org</a>" <<a href="mailto:keycloak-user@lists.jboss.org">keycloak-user@lists.jboss.org</a>><br>
> Subject: Re: [keycloak-user] Extending Themes via SPI<br>
><br>
> There's a lot more to the login on Keycloak than a simple JSP page used<br>
> for JEE form-based authentication. We have user registration, password<br>
> recovery, OTP support, remember me, etc, etc..<br>
><br>
> Take the look and feel (stylesheet) of your JSP login screen and apply it<br>
> to Keycloak with a custom theme. That's the simplest, quickest and best<br>
> option.<br>
><br>
> On 12 February 2016 at 09:15, Sarp Kaya <<a href="mailto:akaya@expedia.com">akaya@expedia.com</a>> wrote:<br>
><br>
>><br>
>> We have internal front end libraries that works with JSP only. From the<br>
>> sounds of SPI, I thought that I could use JSP and our internal libraries<br>
>> instead of FreeMarker templates. Also because our JSP login screen is<br>
>> almost ready it wouldn?t take much time to just deploy it (that?s what I<br>
>> thought).<br>
>><br>
>> From: Stian Thorgersen <<a href="mailto:sthorger@redhat.com">sthorger@redhat.com</a>><br>
>> Reply-To: "<a href="mailto:stian@redhat.com">stian@redhat.com</a>" <<a href="mailto:stian@redhat.com">stian@redhat.com</a>><br>
>> Date: Friday, February 12, 2016 at 5:54 PM<br>
>> To: Abdullah Sarp Kaya <<a href="mailto:akaya@expedia.com">akaya@expedia.com</a>><br>
>> Cc: "<a href="mailto:keycloak-user@lists.jboss.org">keycloak-user@lists.jboss.org</a>" <<a href="mailto:keycloak-user@lists.jboss.org">keycloak-user@lists.jboss.org</a>><br>
>> Subject: Re: [keycloak-user] Extending Themes via SPI<br>
>><br>
>> What are you actually trying to achieve? We mainly support modifying the<br>
>> FreeMarker templates and stylesheets. Beyond that you may in theory be able<br>
>> to re-implement it all to replace FreeMarker with something else, but I<br>
>> don't see why you would want to and it would be a significant amount of<br>
>> work, and also maintenance.<br>
>><br>
>> On 12 February 2016 at 07:08, Sarp Kaya <<a href="mailto:akaya@expedia.com">akaya@expedia.com</a>> wrote:<br>
>><br>
>>> Hi all,<br>
>>><br>
>>> In regards to Extending Themes via SPI all I found is this documentation:<br>
>>><br>
>>> <a href="http://keycloak.github.io/docs/userguide/keycloak-server/html/providers.html" rel="noreferrer" target="_blank">http://keycloak.github.io/docs/userguide/keycloak-server/html/providers.html</a><br>
>>> and<br>
>>><br>
>>> <<a href="http://keycloak.github.io/docs/userguide/keycloak-server/html/themes.html#d4e2450" rel="noreferrer" target="_blank">http://keycloak.github.io/docs/userguide/keycloak-server/html/themes.html#d4e2450</a>><br>
>>><br>
>>> <a href="http://keycloak.github.io/docs/userguide/keycloak-server/html/themes.html#d4e2450" rel="noreferrer" target="_blank">http://keycloak.github.io/docs/userguide/keycloak-server/html/themes.html#d4e2450</a><br>
>>> I found it a little less describing.<br>
>>><br>
>>> When I implement those two classes, where do I put the new implemented<br>
>>> classes? How do I deploy them?<br>
>>> Can I also use Spring mvc and JSP and few maven dependencies instead of<br>
>>> freemarker?<br>
>>><br>
>>> I also tried to find an example to extend theme using SPI but there<br>
>>> seems to be none. It would be really nice if you could provide a sample<br>
>>> hello world.<br>
>>><br>
>>> Thank you very much,<br>
>>> Sarp Kaya<br>
>>><br>
>>> _______________________________________________<br>
>>> keycloak-user mailing list<br>
>>> <a href="mailto:keycloak-user@lists.jboss.org">keycloak-user@lists.jboss.org</a><br>
>>> <a href="https://lists.jboss.org/mailman/listinfo/keycloak-user" rel="noreferrer" target="_blank">https://lists.jboss.org/mailman/listinfo/keycloak-user</a><br>
>>><br>
>><br>
>><br>
>> _______________________________________________<br>
>> keycloak-user mailing list<br>
>> <a href="mailto:keycloak-user@lists.jboss.org">keycloak-user@lists.jboss.org</a><br>
>> <a href="https://lists.jboss.org/mailman/listinfo/keycloak-user" rel="noreferrer" target="_blank">https://lists.jboss.org/mailman/listinfo/keycloak-user</a><br>
>><br>
><br>
><br>
-------------- next part --------------<br>
An HTML attachment was scrubbed...<br>
URL: <a href="http://lists.jboss.org/pipermail/keycloak-user/attachments/20160212/dd16d2fc/attachment-0001.html" rel="noreferrer" target="_blank">http://lists.jboss.org/pipermail/keycloak-user/attachments/20160212/dd16d2fc/attachment-0001.html</a><br>
<br>
------------------------------<br>
<br>
Message: 2<br>
Date: Fri, 12 Feb 2016 10:04:04 +0100<br>
From: Marko Strukelj <<a href="mailto:mstrukel@redhat.com">mstrukel@redhat.com</a>><br>
Subject: Re: [keycloak-user] Failed to make identity provider oauth<br>
callback: javax.net.ssl.SSLHandshakeException<br>
To: Marek Posolda <<a href="mailto:mposolda@redhat.com">mposolda@redhat.com</a>><br>
Cc: "<a href="mailto:keycloak-user@lists.jboss.org">keycloak-user@lists.jboss.org</a>" <<a href="mailto:keycloak-user@lists.jboss.org">keycloak-user@lists.jboss.org</a>>,<br>
LEONARDO NUNES <<a href="mailto:leo.nunes@gjccorp.com.br">leo.nunes@gjccorp.com.br</a>><br>
Message-ID:<br>
<<a href="mailto:CA%2B1OW%2BgXfMSC%2BCiLo3vCSvxt0M5Gt9Qp_9TV7AiWcsfBW%2BDA9Q@mail.gmail.com">CA+1OW+gXfMSC+CiLo3vCSvxt0M5Gt9Qp_9TV7AiWcsfBW+DA9Q@mail.gmail.com</a>><br>
Content-Type: text/plain; charset=UTF-8<br>
<br>
When using 'truststore' provider it is up to you to make sure to<br>
include all the certificates you trust. Configuration via<br>
-Djavax.net.ssl.trustStore works the same - no automatic inclusion of<br>
cacerts. But it sounds like a good usability feature to add a flag<br>
that would automatically include cacerts as well. The problem is - it<br>
happens occasionally that some CAs turn out not to be trustworthy, and<br>
blindly importing all cacerts exposes you to that risk.<br>
<br>
One detail to emphasize, with third party not-self-signed certificates<br>
it's important to include the CA certificate used to create the<br>
specific server certificate, rather than the server certificate<br>
itself. Facebook servers use different short-lived server certificates<br>
- and with two consecutive requests you may be presented with two<br>
different server certificates - but they are all issued by the same<br>
long-lived trusted CA.<br>
<br>
<br>
On Fri, Feb 12, 2016 at 8:07 AM, Marek Posolda <<a href="mailto:mposolda@redhat.com">mposolda@redhat.com</a>> wrote:<br>
> Facebook certificate should be signed by trusted authority, so it works with<br>
> default JDK truststore. At least for me it always works.<br>
><br>
> Shouldn't truststore SPI use both provided file + default JDK truststore by<br>
> default? We may have flag to disable default JDK truststore, but not sure if<br>
> it's ever needed. Also shouldn't we rewrite SimpleHTTP to use Apache HTTP<br>
> client provided by HttpClientProvider SPI?<br>
><br>
> Marek<br>
><br>
><br>
> On 11/02/16 15:23, Stian Thorgersen wrote:<br>
><br>
> Does it work if you don't specify the truststore? That will use the default<br>
> truststore provided by the JDK.<br>
><br>
> Also, does your truststore contain the required CA certs? For Facebook to<br>
> work it'll have to contain the required CA's for their certs<br>
><br>
> On 11 February 2016 at 14:09, LEONARDO NUNES <<a href="mailto:leo.nunes@gjccorp.com.br">leo.nunes@gjccorp.com.br</a>><br>
> wrote:<br>
>><br>
>> Hi, i'm getting the error below when I try to login with Facebook.<br>
>> I've followed the instructions at<br>
>> <a href="http://keycloak.github.io/docs/userguide/keycloak-server/html/server-installation.html#truststore" rel="noreferrer" target="_blank">http://keycloak.github.io/docs/userguide/keycloak-server/html/server-installation.html#truststore</a><br>
>> and<br>
>> <a href="http://keycloak.github.io/docs/userguide/keycloak-server/html/server-installation.html#d4e337" rel="noreferrer" target="_blank">http://keycloak.github.io/docs/userguide/keycloak-server/html/server-installation.html#d4e337</a><br>
>><br>
>> I was able to login with Facebook when trying at localhost. But at our<br>
>> development server we are getting this error.<br>
>><br>
>> We are using EAP in domain mode.<br>
>><br>
>> The truststore I placed inside of keycloak-server.json<br>
>> "truststore": {<br>
>> "file": {<br>
>> "file": "/home/soa/jboss/ssl/keycloak.jks",<br>
>> "password": "keycloak123",<br>
>> "hostname-verification-policy": "ANY",<br>
>> "disabled": false<br>
>> }<br>
>> }<br>
>><br>
>><br>
>> #######<br>
>><br>
>> ERRO:<br>
>><br>
>><br>
>> 2016-02-11 10:44:53,927 ERROR<br>
>> [org.keycloak.broker.oidc.AbstractOAuth2IdentityProvider]<br>
>> (ajp-/192.168.162.73:8008-1) Failed to make identity provider oauth<br>
>> callback: javax.net.ssl.SSLHandshakeException:<br>
>> sun.security.validator.ValidatorException: PKIX path building failed:<br>
>> sun.security.provider.certpath.SunCertPathBuilderException: unable to find<br>
>> valid certification path to requested target<br>
>> at sun.security.ssl.Alerts.getSSLException(Alerts.java:192)<br>
>> [jsse.jar:1.8.0_45]<br>
>> at sun.security.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1937)<br>
>> [jsse.jar:1.8.0_45]<br>
>> at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:302)<br>
>> [jsse.jar:1.8.0_45]<br>
>> at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:296)<br>
>> [jsse.jar:1.8.0_45]<br>
>> at<br>
>> sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1478)<br>
>> [jsse.jar:1.8.0_45]<br>
>> at<br>
>> sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:212)<br>
>> [jsse.jar:1.8.0_45]<br>
>> at sun.security.ssl.Handshaker.processLoop(Handshaker.java:969)<br>
>> [jsse.jar:1.8.0_45]<br>
>> at sun.security.ssl.Handshaker.process_record(Handshaker.java:904)<br>
>> [jsse.jar:1.8.0_45]<br>
>> at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1050)<br>
>> [jsse.jar:1.8.0_45]<br>
>> at<br>
>> sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1363)<br>
>> [jsse.jar:1.8.0_45]<br>
>> at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1391)<br>
>> [jsse.jar:1.8.0_45]<br>
>> at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1375)<br>
>> [jsse.jar:1.8.0_45]<br>
>> at<br>
>> sun.net.www.protocol.https.HttpsClient.afterConnect(HttpsClient.java:563)<br>
>> [rt.jar:1.8.0_45]<br>
>> at<br>
>> sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java:185)<br>
>> [rt.jar:1.8.0_45]<br>
>> at<br>
>> sun.net.www.protocol.http.HttpURLConnection.getOutputStream0(HttpURLConnection.java:1282)<br>
>> [rt.jar:1.8.0_45]<br>
>> at<br>
>> sun.net.www.protocol.http.HttpURLConnection.getOutputStream(HttpURLConnection.java:1257)<br>
>> [rt.jar:1.8.0_45]<br>
>> at<br>
>> sun.net.www.protocol.https.HttpsURLConnectionImpl.getOutputStream(HttpsURLConnectionImpl.java:250)<br>
>> [rt.jar:1.8.0_45]<br>
>> at<br>
>> org.keycloak.broker.provider.util.SimpleHttp.asString(SimpleHttp.java:124)<br>
>> at<br>
>> org.keycloak.broker.oidc.AbstractOAuth2IdentityProvider$Endpoint.authResponse(AbstractOAuth2IdentityProvider.java:228)<br>
>> at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)<br>
>> [rt.jar:1.8.0_45]<br>
>> at<br>
>> sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)<br>
>> [rt.jar:1.8.0_45]<br>
>> at<br>
>> sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)<br>
>> [rt.jar:1.8.0_45]<br>
>> at java.lang.reflect.Method.invoke(Method.java:497) [rt.jar:1.8.0_45]<br>
>> at<br>
>> org.jboss.resteasy.core.MethodInjectorImpl.invoke(MethodInjectorImpl.java:167)<br>
>> [resteasy-jaxrs-2.3.8.SP4-redhat-2.jar:]<br>
>> at<br>
>> org.jboss.resteasy.core.ResourceMethod.invokeOnTarget(ResourceMethod.java:269)<br>
>> [resteasy-jaxrs-2.3.8.SP4-redhat-2.jar:]<br>
>> at org.jboss.resteasy.core.ResourceMethod.invoke(ResourceMethod.java:227)<br>
>> [resteasy-jaxrs-2.3.8.SP4-redhat-2.jar:]<br>
>> at<br>
>> org.jboss.resteasy.core.ResourceLocator.invokeOnTargetObject(ResourceLocator.java:159)<br>
>> [resteasy-jaxrs-2.3.8.SP4-redhat-2.jar:]<br>
>> at<br>
>> org.jboss.resteasy.core.ResourceLocator.invoke(ResourceLocator.java:107)<br>
>> [resteasy-jaxrs-2.3.8.SP4-redhat-2.jar:]<br>
>> at<br>
>> org.jboss.resteasy.core.ResourceLocator.invokeOnTargetObject(ResourceLocator.java:154)<br>
>> [resteasy-jaxrs-2.3.8.SP4-redhat-2.jar:]<br>
>> at org.jboss.resteasy.core.ResourceLocator.invoke(ResourceLocator.java:92)<br>
>> [resteasy-jaxrs-2.3.8.SP4-redhat-2.jar:]<br>
>> at<br>
>> org.jboss.resteasy.core.SynchronousDispatcher.getResponse(SynchronousDispatcher.java:542)<br>
>> [resteasy-jaxrs-2.3.8.SP4-redhat-2.jar:]<br>
>> at<br>
>> org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:524)<br>
>> [resteasy-jaxrs-2.3.8.SP4-redhat-2.jar:]<br>
>> at<br>
>> org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:126)<br>
>> [resteasy-jaxrs-2.3.8.SP4-redhat-2.jar:]<br>
>> at<br>
>> org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.service(ServletContainerDispatcher.java:208)<br>
>> [resteasy-jaxrs-2.3.8.SP4-redhat-2.jar:]<br>
>> at<br>
>> org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:55)<br>
>> [resteasy-jaxrs-2.3.8.SP4-redhat-2.jar:]<br>
>> at<br>
>> org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:50)<br>
>> [resteasy-jaxrs-2.3.8.SP4-redhat-2.jar:]<br>
>> at javax.servlet.http.HttpServlet.service(HttpServlet.java:847)<br>
>> [jboss-servlet-api_3.0_spec-1.0.2.Final-redhat-1.jar:1.0.2.Final-redhat-1]<br>
>> at<br>
>> org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:295)<br>
>> [jbossweb-7.4.10.Final-redhat-1.jar:7.4.10.Final-redhat-1]<br>
>> at<br>
>> org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:214)<br>
>> [jbossweb-7.4.10.Final-redhat-1.jar:7.4.10.Final-redhat-1]<br>
>> at<br>
>> org.keycloak.services.filters.KeycloakSessionServletFilter.doFilter(KeycloakSessionServletFilter.java:61)<br>
>> [keycloak-services-1.8.1.Final.jar:1.8.1.Final]<br>
>> at<br>
>> org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:246)<br>
>> [jbossweb-7.4.10.Final-redhat-1.jar:7.4.10.Final-redhat-1]<br>
>> at<br>
>> org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:214)<br>
>> [jbossweb-7.4.10.Final-redhat-1.jar:7.4.10.Final-redhat-1]<br>
>> at<br>
>> org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:231)<br>
>> [jbossweb-7.4.10.Final-redhat-1.jar:7.4.10.Final-redhat-1]<br>
>> at<br>
>> org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:149)<br>
>> [jbossweb-7.4.10.Final-redhat-1.jar:7.4.10.Final-redhat-1]<br>
>> at<br>
>> org.jboss.modcluster.container.jbossweb.JBossWebContext$RequestListenerValve.event(JBossWebContext.java:91)<br>
>> at<br>
>> org.jboss.modcluster.container.jbossweb.JBossWebContext$RequestListenerValve.invoke(JBossWebContext.java:72)<br>
>> at<br>
>> org.jboss.as.web.security.SecurityContextAssociationValve.invoke(SecurityContextAssociationValve.java:169)<br>
>> [jboss-as-web-7.4.3.Final-redhat-2.jar:7.4.3.Final-redhat-2]<br>
>> at<br>
>> org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:145)<br>
>> [jbossweb-7.4.10.Final-redhat-1.jar:7.4.10.Final-redhat-1]<br>
>> at<br>
>> org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:97)<br>
>> [jbossweb-7.4.10.Final-redhat-1.jar:7.4.10.Final-redhat-1]<br>
>> at<br>
>> org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:102)<br>
>> [jbossweb-7.4.10.Final-redhat-1.jar:7.4.10.Final-redhat-1]<br>
>> at<br>
>> org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:344)<br>
>> [jbossweb-7.4.10.Final-redhat-1.jar:7.4.10.Final-redhat-1]<br>
>> at org.apache.coyote.ajp.AjpProcessor.process(AjpProcessor.java:490)<br>
>> [jbossweb-7.4.10.Final-redhat-1.jar:7.4.10.Final-redhat-1]<br>
>> at<br>
>> org.apache.coyote.ajp.AjpProtocol$AjpConnectionHandler.process(AjpProtocol.java:420)<br>
>> [jbossweb-7.4.10.Final-redhat-1.jar:7.4.10.Final-redhat-1]<br>
>> at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:926)<br>
>> [jbossweb-7.4.10.Final-redhat-1.jar:7.4.10.Final-redhat-1]<br>
>> at java.lang.Thread.run(Thread.java:745) [rt.jar:1.8.0_45]<br>
>> Caused by: sun.security.validator.ValidatorException: PKIX path building<br>
>> failed: sun.security.provider.certpath.SunCertPathBuilderException: unable<br>
>> to find valid certification path to requested target<br>
>> at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:387)<br>
>> [rt.jar:1.8.0_45]<br>
>> at<br>
>> sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:292)<br>
>> [rt.jar:1.8.0_45]<br>
>> at sun.security.validator.Validator.validate(Validator.java:260)<br>
>> [rt.jar:1.8.0_45]<br>
>> at<br>
>> sun.security.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:324)<br>
>> [jsse.jar:1.8.0_45]<br>
>> at<br>
>> sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:229)<br>
>> [jsse.jar:1.8.0_45]<br>
>> at<br>
>> sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:124)<br>
>> [jsse.jar:1.8.0_45]<br>
>> at<br>
>> sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1460)<br>
>> [jsse.jar:1.8.0_45]<br>
>> ... 50 more<br>
>> Caused by: sun.security.provider.certpath.SunCertPathBuilderException:<br>
>> unable to find valid certification path to requested target<br>
>> at<br>
>> sun.security.provider.certpath.SunCertPathBuilder.build(SunCertPathBuilder.java:145)<br>
>> [rt.jar:1.8.0_45]<br>
>> at<br>
>> sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:131)<br>
>> [rt.jar:1.8.0_45]<br>
>> at java.security.cert.CertPathBuilder.build(CertPathBuilder.java:280)<br>
>> [rt.jar:1.8.0_45]<br>
>> at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:382)<br>
>> [rt.jar:1.8.0_45]<br>
>> ... 56 more<br>
>><br>
>><br>
>><br>
>><br>
>><br>
>> --<br>
>> Leonardo Nunes<br>
>> ________________________________<br>
>> Esta mensagem pode conter informa??o confidencial e/ou privilegiada. Se<br>
>> voc? n?o for o destinat?rio ou a pessoa autorizada a receber esta mensagem,<br>
>> n?o poder? usar, copiar ou divulgar as informa??es nela contidas ou tomar<br>
>> qualquer a??o baseada nessas informa??es. Se voc? recebeu esta mensagem por<br>
>> engano, por favor avise imediatamente o remetente, respondendo o e-mail e em<br>
>> seguida apague-o. Agradecemos sua coopera??o.<br>
>><br>
>> This message may contain confidential and/or privileged information. If<br>
>> you are not the addressee or authorized to receive this for the addressee,<br>
>> you must not use, copy, disclose or take any action based on this message or<br>
>> any information herein. If you have received this message in error, please<br>
>> advise the sender immediately by reply e-mail and delete this message. Thank<br>
>> you for your cooperation<br>
>><br>
>> _______________________________________________<br>
>> keycloak-user mailing list<br>
>> <a href="mailto:keycloak-user@lists.jboss.org">keycloak-user@lists.jboss.org</a><br>
>> <a href="https://lists.jboss.org/mailman/listinfo/keycloak-user" rel="noreferrer" target="_blank">https://lists.jboss.org/mailman/listinfo/keycloak-user</a><br>
><br>
><br>
><br>
><br>
> _______________________________________________<br>
> keycloak-user mailing list<br>
> <a href="mailto:keycloak-user@lists.jboss.org">keycloak-user@lists.jboss.org</a><br>
> <a href="https://lists.jboss.org/mailman/listinfo/keycloak-user" rel="noreferrer" target="_blank">https://lists.jboss.org/mailman/listinfo/keycloak-user</a><br>
><br>
><br>
><br>
> _______________________________________________<br>
> keycloak-user mailing list<br>
> <a href="mailto:keycloak-user@lists.jboss.org">keycloak-user@lists.jboss.org</a><br>
> <a href="https://lists.jboss.org/mailman/listinfo/keycloak-user" rel="noreferrer" target="_blank">https://lists.jboss.org/mailman/listinfo/keycloak-user</a><br>
<br>
<br>
<br>
------------------------------<br>
<br>
Message: 3<br>
Date: Fri, 12 Feb 2016 10:43:18 +0100<br>
From: Stian Thorgersen <<a href="mailto:sthorger@redhat.com">sthorger@redhat.com</a>><br>
Subject: Re: [keycloak-user] Failed to make identity provider oauth<br>
callback: javax.net.ssl.SSLHandshakeException<br>
To: Marko Strukelj <<a href="mailto:mstrukel@redhat.com">mstrukel@redhat.com</a>><br>
Cc: "<a href="mailto:keycloak-user@lists.jboss.org">keycloak-user@lists.jboss.org</a>" <<a href="mailto:keycloak-user@lists.jboss.org">keycloak-user@lists.jboss.org</a>>,<br>
LEONARDO NUNES <<a href="mailto:leo.nunes@gjccorp.com.br">leo.nunes@gjccorp.com.br</a>><br>
Message-ID:<br>
<<a href="mailto:CAJgngAf4-aAyu_aONLOiYC9Ap0LmAur7U-yn2pP7H4o2LKHsrw@mail.gmail.com">CAJgngAf4-aAyu_aONLOiYC9Ap0LmAur7U-yn2pP7H4o2LKHsrw@mail.gmail.com</a>><br>
Content-Type: text/plain; charset="utf-8"<br>
<br>
On 12 February 2016 at 10:04, Marko Strukelj <<a href="mailto:mstrukel@redhat.com">mstrukel@redhat.com</a>> wrote:<br>
<br>
> When using 'truststore' provider it is up to you to make sure to<br>
> include all the certificates you trust. Configuration via<br>
> -Djavax.net.ssl.trustStore works the same - no automatic inclusion of<br>
> cacerts. But it sounds like a good usability feature to add a flag<br>
> that would automatically include cacerts as well. The problem is - it<br>
> happens occasionally that some CAs turn out not to be trustworthy, and<br>
> blindly importing all cacerts exposes you to that risk.<br>
><br>
<br>
How about having a flag that is enabled by default that includes cacerts<br>
from Java? I'd actually think that update from CA certs are more likely<br>
going to happen by updating Java rather than manually maintaining a<br>
truststore.<br>
<br>
<br>
> One detail to emphasize, with third party not-self-signed certificates<br>
> it's important to include the CA certificate used to create the<br>
> specific server certificate, rather than the server certificate<br>
> itself. Facebook servers use different short-lived server certificates<br>
> - and with two consecutive requests you may be presented with two<br>
> different server certificates - but they are all issued by the same<br>
> long-lived trusted CA.<br>
<br>
<br>
><br>
> On Fri, Feb 12, 2016 at 8:07 AM, Marek Posolda <<a href="mailto:mposolda@redhat.com">mposolda@redhat.com</a>><br>
> wrote:<br>
> > Facebook certificate should be signed by trusted authority, so it works<br>
> with<br>
> > default JDK truststore. At least for me it always works.<br>
> ><br>
> > Shouldn't truststore SPI use both provided file + default JDK truststore<br>
> by<br>
> > default? We may have flag to disable default JDK truststore, but not<br>
> sure if<br>
> > it's ever needed. Also shouldn't we rewrite SimpleHTTP to use Apache HTTP<br>
> > client provided by HttpClientProvider SPI?<br>
> ><br>
> > Marek<br>
> ><br>
> ><br>
> > On 11/02/16 15:23, Stian Thorgersen wrote:<br>
> ><br>
> > Does it work if you don't specify the truststore? That will use the<br>
> default<br>
> > truststore provided by the JDK.<br>
> ><br>
> > Also, does your truststore contain the required CA certs? For Facebook to<br>
> > work it'll have to contain the required CA's for their certs<br>
> ><br>
> > On 11 February 2016 at 14:09, LEONARDO NUNES <<a href="mailto:leo.nunes@gjccorp.com.br">leo.nunes@gjccorp.com.br</a>><br>
> > wrote:<br>
> >><br>
> >> Hi, i'm getting the error below when I try to login with Facebook.<br>
> >> I've followed the instructions at<br>
> >><br>
> <a href="http://keycloak.github.io/docs/userguide/keycloak-server/html/server-installation.html#truststore" rel="noreferrer" target="_blank">http://keycloak.github.io/docs/userguide/keycloak-server/html/server-installation.html#truststore</a><br>
> >> and<br>
> >><br>
> <a href="http://keycloak.github.io/docs/userguide/keycloak-server/html/server-installation.html#d4e337" rel="noreferrer" target="_blank">http://keycloak.github.io/docs/userguide/keycloak-server/html/server-installation.html#d4e337</a><br>
> >><br>
> >> I was able to login with Facebook when trying at localhost. But at our<br>
> >> development server we are getting this error.<br>
> >><br>
> >> We are using EAP in domain mode.<br>
> >><br>
> >> The truststore I placed inside of keycloak-server.json<br>
> >> "truststore": {<br>
> >> "file": {<br>
> >> "file": "/home/soa/jboss/ssl/keycloak.jks",<br>
> >> "password": "keycloak123",<br>
> >> "hostname-verification-policy": "ANY",<br>
> >> "disabled": false<br>
> >> }<br>
> >> }<br>
> >><br>
> >><br>
> >> #######<br>
> >><br>
> >> ERRO:<br>
> >><br>
> >><br>
> >> 2016-02-11 10:44:53,927 ERROR<br>
> >> [org.keycloak.broker.oidc.AbstractOAuth2IdentityProvider]<br>
> >> (ajp-/192.168.162.73:8008-1) Failed to make identity provider oauth<br>
> >> callback: javax.net.ssl.SSLHandshakeException:<br>
> >> sun.security.validator.ValidatorException: PKIX path building failed:<br>
> >> sun.security.provider.certpath.SunCertPathBuilderException: unable to<br>
> find<br>
> >> valid certification path to requested target<br>
> >> at sun.security.ssl.Alerts.getSSLException(Alerts.java:192)<br>
> >> [jsse.jar:1.8.0_45]<br>
> >> at sun.security.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1937)<br>
> >> [jsse.jar:1.8.0_45]<br>
> >> at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:302)<br>
> >> [jsse.jar:1.8.0_45]<br>
> >> at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:296)<br>
> >> [jsse.jar:1.8.0_45]<br>
> >> at<br>
> >><br>
> sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1478)<br>
> >> [jsse.jar:1.8.0_45]<br>
> >> at<br>
> >><br>
> sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:212)<br>
> >> [jsse.jar:1.8.0_45]<br>
> >> at sun.security.ssl.Handshaker.processLoop(Handshaker.java:969)<br>
> >> [jsse.jar:1.8.0_45]<br>
> >> at sun.security.ssl.Handshaker.process_record(Handshaker.java:904)<br>
> >> [jsse.jar:1.8.0_45]<br>
> >> at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1050)<br>
> >> [jsse.jar:1.8.0_45]<br>
> >> at<br>
> >><br>
> sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1363)<br>
> >> [jsse.jar:1.8.0_45]<br>
> >> at<br>
> sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1391)<br>
> >> [jsse.jar:1.8.0_45]<br>
> >> at<br>
> sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1375)<br>
> >> [jsse.jar:1.8.0_45]<br>
> >> at<br>
> >><br>
> sun.net.www.protocol.https.HttpsClient.afterConnect(HttpsClient.java:563)<br>
> >> [rt.jar:1.8.0_45]<br>
> >> at<br>
> >><br>
> sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java:185)<br>
> >> [rt.jar:1.8.0_45]<br>
> >> at<br>
> >><br>
> sun.net.www.protocol.http.HttpURLConnection.getOutputStream0(HttpURLConnection.java:1282)<br>
> >> [rt.jar:1.8.0_45]<br>
> >> at<br>
> >><br>
> sun.net.www.protocol.http.HttpURLConnection.getOutputStream(HttpURLConnection.java:1257)<br>
> >> [rt.jar:1.8.0_45]<br>
> >> at<br>
> >><br>
> sun.net.www.protocol.https.HttpsURLConnectionImpl.getOutputStream(HttpsURLConnectionImpl.java:250)<br>
> >> [rt.jar:1.8.0_45]<br>
> >> at<br>
> >><br>
> org.keycloak.broker.provider.util.SimpleHttp.asString(SimpleHttp.java:124)<br>
> >> at<br>
> >><br>
> org.keycloak.broker.oidc.AbstractOAuth2IdentityProvider$Endpoint.authResponse(AbstractOAuth2IdentityProvider.java:228)<br>
> >> at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)<br>
> >> [rt.jar:1.8.0_45]<br>
> >> at<br>
> >><br>
> sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)<br>
> >> [rt.jar:1.8.0_45]<br>
> >> at<br>
> >><br>
> sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)<br>
> >> [rt.jar:1.8.0_45]<br>
> >> at java.lang.reflect.Method.invoke(Method.java:497) [rt.jar:1.8.0_45]<br>
> >> at<br>
> >><br>
> org.jboss.resteasy.core.MethodInjectorImpl.invoke(MethodInjectorImpl.java:167)<br>
> >> [resteasy-jaxrs-2.3.8.SP4-redhat-2.jar:]<br>
> >> at<br>
> >><br>
> org.jboss.resteasy.core.ResourceMethod.invokeOnTarget(ResourceMethod.java:269)<br>
> >> [resteasy-jaxrs-2.3.8.SP4-redhat-2.jar:]<br>
> >> at<br>
> org.jboss.resteasy.core.ResourceMethod.invoke(ResourceMethod.java:227)<br>
> >> [resteasy-jaxrs-2.3.8.SP4-redhat-2.jar:]<br>
> >> at<br>
> >><br>
> org.jboss.resteasy.core.ResourceLocator.invokeOnTargetObject(ResourceLocator.java:159)<br>
> >> [resteasy-jaxrs-2.3.8.SP4-redhat-2.jar:]<br>
> >> at<br>
> >> org.jboss.resteasy.core.ResourceLocator.invoke(ResourceLocator.java:107)<br>
> >> [resteasy-jaxrs-2.3.8.SP4-redhat-2.jar:]<br>
> >> at<br>
> >><br>
> org.jboss.resteasy.core.ResourceLocator.invokeOnTargetObject(ResourceLocator.java:154)<br>
> >> [resteasy-jaxrs-2.3.8.SP4-redhat-2.jar:]<br>
> >> at<br>
> org.jboss.resteasy.core.ResourceLocator.invoke(ResourceLocator.java:92)<br>
> >> [resteasy-jaxrs-2.3.8.SP4-redhat-2.jar:]<br>
> >> at<br>
> >><br>
> org.jboss.resteasy.core.SynchronousDispatcher.getResponse(SynchronousDispatcher.java:542)<br>
> >> [resteasy-jaxrs-2.3.8.SP4-redhat-2.jar:]<br>
> >> at<br>
> >><br>
> org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:524)<br>
> >> [resteasy-jaxrs-2.3.8.SP4-redhat-2.jar:]<br>
> >> at<br>
> >><br>
> org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:126)<br>
> >> [resteasy-jaxrs-2.3.8.SP4-redhat-2.jar:]<br>
> >> at<br>
> >><br>
> org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.service(ServletContainerDispatcher.java:208)<br>
> >> [resteasy-jaxrs-2.3.8.SP4-redhat-2.jar:]<br>
> >> at<br>
> >><br>
> org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:55)<br>
> >> [resteasy-jaxrs-2.3.8.SP4-redhat-2.jar:]<br>
> >> at<br>
> >><br>
> org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:50)<br>
> >> [resteasy-jaxrs-2.3.8.SP4-redhat-2.jar:]<br>
> >> at javax.servlet.http.HttpServlet.service(HttpServlet.java:847)<br>
> >><br>
> [jboss-servlet-api_3.0_spec-1.0.2.Final-redhat-1.jar:1.0.2.Final-redhat-1]<br>
> >> at<br>
> >><br>
> org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:295)<br>
> >> [jbossweb-7.4.10.Final-redhat-1.jar:7.4.10.Final-redhat-1]<br>
> >> at<br>
> >><br>
> org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:214)<br>
> >> [jbossweb-7.4.10.Final-redhat-1.jar:7.4.10.Final-redhat-1]<br>
> >> at<br>
> >><br>
> org.keycloak.services.filters.KeycloakSessionServletFilter.doFilter(KeycloakSessionServletFilter.java:61)<br>
> >> [keycloak-services-1.8.1.Final.jar:1.8.1.Final]<br>
> >> at<br>
> >><br>
> org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:246)<br>
> >> [jbossweb-7.4.10.Final-redhat-1.jar:7.4.10.Final-redhat-1]<br>
> >> at<br>
> >><br>
> org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:214)<br>
> >> [jbossweb-7.4.10.Final-redhat-1.jar:7.4.10.Final-redhat-1]<br>
> >> at<br>
> >><br>
> org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:231)<br>
> >> [jbossweb-7.4.10.Final-redhat-1.jar:7.4.10.Final-redhat-1]<br>
> >> at<br>
> >><br>
> org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:149)<br>
> >> [jbossweb-7.4.10.Final-redhat-1.jar:7.4.10.Final-redhat-1]<br>
> >> at<br>
> >><br>
> org.jboss.modcluster.container.jbossweb.JBossWebContext$RequestListenerValve.event(JBossWebContext.java:91)<br>
> >> at<br>
> >><br>
> org.jboss.modcluster.container.jbossweb.JBossWebContext$RequestListenerValve.invoke(JBossWebContext.java:72)<br>
> >> at<br>
> >><br>
> org.jboss.as.web.security.SecurityContextAssociationValve.invoke(SecurityContextAssociationValve.java:169)<br>
> >> [jboss-as-web-7.4.3.Final-redhat-2.jar:7.4.3.Final-redhat-2]<br>
> >> at<br>
> >><br>
> org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:145)<br>
> >> [jbossweb-7.4.10.Final-redhat-1.jar:7.4.10.Final-redhat-1]<br>
> >> at<br>
> >><br>
> org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:97)<br>
> >> [jbossweb-7.4.10.Final-redhat-1.jar:7.4.10.Final-redhat-1]<br>
> >> at<br>
> >><br>
> org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:102)<br>
> >> [jbossweb-7.4.10.Final-redhat-1.jar:7.4.10.Final-redhat-1]<br>
> >> at<br>
> >><br>
> org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:344)<br>
> >> [jbossweb-7.4.10.Final-redhat-1.jar:7.4.10.Final-redhat-1]<br>
> >> at org.apache.coyote.ajp.AjpProcessor.process(AjpProcessor.java:490)<br>
> >> [jbossweb-7.4.10.Final-redhat-1.jar:7.4.10.Final-redhat-1]<br>
> >> at<br>
> >><br>
> org.apache.coyote.ajp.AjpProtocol$AjpConnectionHandler.process(AjpProtocol.java:420)<br>
> >> [jbossweb-7.4.10.Final-redhat-1.jar:7.4.10.Final-redhat-1]<br>
> >> at<br>
> org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:926)<br>
> >> [jbossweb-7.4.10.Final-redhat-1.jar:7.4.10.Final-redhat-1]<br>
> >> at java.lang.Thread.run(Thread.java:745) [rt.jar:1.8.0_45]<br>
> >> Caused by: sun.security.validator.ValidatorException: PKIX path building<br>
> >> failed: sun.security.provider.certpath.SunCertPathBuilderException:<br>
> unable<br>
> >> to find valid certification path to requested target<br>
> >> at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:387)<br>
> >> [rt.jar:1.8.0_45]<br>
> >> at<br>
> >><br>
> sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:292)<br>
> >> [rt.jar:1.8.0_45]<br>
> >> at sun.security.validator.Validator.validate(Validator.java:260)<br>
> >> [rt.jar:1.8.0_45]<br>
> >> at<br>
> >><br>
> sun.security.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:324)<br>
> >> [jsse.jar:1.8.0_45]<br>
> >> at<br>
> >><br>
> sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:229)<br>
> >> [jsse.jar:1.8.0_45]<br>
> >> at<br>
> >><br>
> sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:124)<br>
> >> [jsse.jar:1.8.0_45]<br>
> >> at<br>
> >><br>
> sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1460)<br>
> >> [jsse.jar:1.8.0_45]<br>
> >> ... 50 more<br>
> >> Caused by: sun.security.provider.certpath.SunCertPathBuilderException:<br>
> >> unable to find valid certification path to requested target<br>
> >> at<br>
> >><br>
> sun.security.provider.certpath.SunCertPathBuilder.build(SunCertPathBuilder.java:145)<br>
> >> [rt.jar:1.8.0_45]<br>
> >> at<br>
> >><br>
> sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:131)<br>
> >> [rt.jar:1.8.0_45]<br>
> >> at java.security.cert.CertPathBuilder.build(CertPathBuilder.java:280)<br>
> >> [rt.jar:1.8.0_45]<br>
> >> at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:382)<br>
> >> [rt.jar:1.8.0_45]<br>
> >> ... 56 more<br>
> >><br>
> >><br>
> >><br>
> >><br>
> >><br>
> >> --<br>
> >> Leonardo Nunes<br>
> >> ________________________________<br>
> >> Esta mensagem pode conter informa??o confidencial e/ou privilegiada. Se<br>
> >> voc? n?o for o destinat?rio ou a pessoa autorizada a receber esta<br>
> mensagem,<br>
> >> n?o poder? usar, copiar ou divulgar as informa??es nela contidas ou<br>
> tomar<br>
> >> qualquer a??o baseada nessas informa??es. Se voc? recebeu esta mensagem<br>
> por<br>
> >> engano, por favor avise imediatamente o remetente, respondendo o e-mail<br>
> e em<br>
> >> seguida apague-o. Agradecemos sua coopera??o.<br>
> >><br>
> >> This message may contain confidential and/or privileged information. If<br>
> >> you are not the addressee or authorized to receive this for the<br>
> addressee,<br>
> >> you must not use, copy, disclose or take any action based on this<br>
> message or<br>
> >> any information herein. If you have received this message in error,<br>
> please<br>
> >> advise the sender immediately by reply e-mail and delete this message.<br>
> Thank<br>
> >> you for your cooperation<br>
> >><br>
> >> _______________________________________________<br>
> >> keycloak-user mailing list<br>
> >> <a href="mailto:keycloak-user@lists.jboss.org">keycloak-user@lists.jboss.org</a><br>
> >> <a href="https://lists.jboss.org/mailman/listinfo/keycloak-user" rel="noreferrer" target="_blank">https://lists.jboss.org/mailman/listinfo/keycloak-user</a><br>
> ><br>
> ><br>
> ><br>
> ><br>
> > _______________________________________________<br>
> > keycloak-user mailing list<br>
> > <a href="mailto:keycloak-user@lists.jboss.org">keycloak-user@lists.jboss.org</a><br>
> > <a href="https://lists.jboss.org/mailman/listinfo/keycloak-user" rel="noreferrer" target="_blank">https://lists.jboss.org/mailman/listinfo/keycloak-user</a><br>
> ><br>
> ><br>
> ><br>
> > _______________________________________________<br>
> > keycloak-user mailing list<br>
> > <a href="mailto:keycloak-user@lists.jboss.org">keycloak-user@lists.jboss.org</a><br>
> > <a href="https://lists.jboss.org/mailman/listinfo/keycloak-user" rel="noreferrer" target="_blank">https://lists.jboss.org/mailman/listinfo/keycloak-user</a><br>
><br>
-------------- next part --------------<br>
An HTML attachment was scrubbed...<br>
URL: <a href="http://lists.jboss.org/pipermail/keycloak-user/attachments/20160212/cf9f6d0b/attachment.html" rel="noreferrer" target="_blank">http://lists.jboss.org/pipermail/keycloak-user/attachments/20160212/cf9f6d0b/attachment.html</a><br>
<br>
------------------------------<br>
<br>
_______________________________________________<br>
keycloak-user mailing list<br>
<a href="mailto:keycloak-user@lists.jboss.org">keycloak-user@lists.jboss.org</a><br>
<a href="https://lists.jboss.org/mailman/listinfo/keycloak-user" rel="noreferrer" target="_blank">https://lists.jboss.org/mailman/listinfo/keycloak-user</a><br>
<br>
End of keycloak-user Digest, Vol 26, Issue 66<br>
*********************************************<br>
</blockquote></div><br></div></div></div>