<div dir="ltr"><div>Thanks for the quick response :)</div><div><br></div>Well, one example would be the applications listing in the self-service account UI:<div><br></div><div>* I want to control the order of application items in the list</div><div>* I want to show whether the application can be currently accessed or not (at least I want to give a hint)</div><div>* I want to group certain applications (HR, Finance, Customers) etc. based on tags</div><div><br></div><div>Other areas would be a mobile app that presents the "service-portfolio" with the apps currently available for a user.</div><div>(this would be provided by a intermediate service though but the data would be read from client attributes).</div><div><br></div><div>Cheers,</div><div>Thomas</div><div><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">2016-02-25 10:26 GMT+01:00 Stian Thorgersen <span dir="ltr"><<a href="mailto:sthorger@redhat.com" target="_blank">sthorger@redhat.com</a>></span>:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">I can see those details are things that you may want to add to a client, but I don't see how you're going to utilize that information?</div><div class="HOEnZb"><div class="h5"><div class="gmail_extra"><br><div class="gmail_quote">On 25 February 2016 at 09:55, Thomas Darimont <span dir="ltr"><<a href="mailto:thomas.darimont@googlemail.com" target="_blank">thomas.darimont@googlemail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">FYI, back to the original question of allowing edit of client attributes from admin console...<div><br></div><div>Some use cases where client attributes would be very handy:</div><div>* additional metadata for applications</div><div>* display-order for application listing</div><div>* icon name in application listing (more flexible than deriving from client id)</div><div>* tagging of clients as internal, public etc.</div><div>* application version</div><div>* url for checking application status (health check endpoint) - ok, maintenance, offline</div><div><br></div><div>Would be happy to send a PR for editing of client attributes in the admin console.</div><div><br></div><div>Cheers,</div><div>Thomas</div></div><div><div><div class="gmail_extra"><br><div class="gmail_quote">2016-02-22 13:58 GMT+01:00 Bystrik Horvath <span dir="ltr"><<a href="mailto:bystrik.horvath@gmail.com" target="_blank">bystrik.horvath@gmail.com</a>></span>:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Thank you guys for the answers, I think you & Stian directed me to the right way, so it should solve my requirements.<div><br></div><div>Best regards,</div><div>Bystrik<br><div><br></div><div><br></div></div></div><div><div><div class="gmail_extra"><br><div class="gmail_quote">On Mon, Feb 22, 2016 at 1:48 PM, Thomas Darimont <span dir="ltr"><<a href="mailto:thomas.darimont@googlemail.com" target="_blank">thomas.darimont@googlemail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><p dir="ltr">You could define the set of secret questions on the authenticator - you could either hardcode them or make them configurable by implementing ConfiguredProvider see [0].<br>Then you could store a reference to the selected secret question and the answer as a custom user-attribute.</p><p dir="ltr">Cheers,<br></p><p>Thomas</p><p dir="ltr">[0] - <a href="https://github.com/keycloak/keycloak/blob/60f9f73c4ca2ddf4ad49ff53a03a63dca8148ea9/server-spi/src/main/java/org/keycloak/provider/ConfiguredProvider.java#L26" target="_blank">https://github.com/keycloak/keycloak/blob/60f9f73c4ca2ddf4ad49ff53a03a63dca8148ea9/server-spi/src/main/java/org/keycloak/provider/ConfiguredProvider.java#L26</a></p>
<br><div class="gmail_quote"><div dir="ltr">Stian Thorgersen <<a href="mailto:sthorger@redhat.com" target="_blank">sthorger@redhat.com</a>> schrieb am Mo., 22. Feb. 2016, 13:40:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div dir="ltr">I thought the example did allow configuring the security question on the authenticator, but you can create your own that does it. Then the security questions are configured on the authenticator itself. </div><div class="gmail_extra"><br><div class="gmail_quote">On 22 February 2016 at 13:24, Bystrik Horvath <span dir="ltr"><<a href="mailto:bystrik.horvath@gmail.com" target="_blank">bystrik.horvath@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div dir="ltr">Hi,<div><br></div><div>I went through the example (<a href="https://github.com/keycloak/keycloak/tree/master/examples/providers/authenticator" style="font-size:12.8px" target="_blank">https://github.com/keycloak/keycloak/tree/master/examples/providers/authenticator</a>). The security questions are written in secret-question.ftl and secret-question-config.ftl files. From my point of view, the security questions are know in advance and they can be "hardcoded" in ftl files. My case is that security questions are defined during the runtime (preferably via admin REST API). The admin REST API does not provide the functionality to store attributes on realm level. I agree that security questions belongs to realm, but how to provision them - *.ftl files are not an option for me.</div><div><br></div><div>Best regards,</div><div>Bystrik</div></div><div><div><div class="gmail_extra"><br><div class="gmail_quote">On Mon, Feb 22, 2016 at 12:55 PM, Stian Thorgersen <span dir="ltr"><<a href="mailto:sthorger@redhat.com" target="_blank">sthorger@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div dir="ltr">If you look at our security questions example it stores the configuration on the authenticator itself.</div><div class="gmail_extra"><br><div class="gmail_quote">On 22 February 2016 at 12:46, Bystrik Horvath <span dir="ltr"><<a href="mailto:bystrik.horvath@gmail.com" target="_blank">bystrik.horvath@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div dir="ltr">Hi,<div><br></div><div>what would be a recommended way to provision a security question on realm base if the question is not known in advance? May be it is an misuse of client representation for provisioning that.</div><div><br></div><div>Best regards,</div><div>Bystrik</div></div><div><div><div class="gmail_extra"><br><div class="gmail_quote">On Mon, Feb 22, 2016 at 12:28 PM, Stian Thorgersen <span dir="ltr"><<a href="mailto:sthorger@redhat.com" target="_blank">sthorger@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div dir="ltr"><div>I don't understand how you can have security questions that are particular to a client. A user logs-in to a realm, not a client.<br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On 22 February 2016 at 10:20, Juraj Janosik <span dir="ltr"><<a href="mailto:juraj.janosik77@gmail.com" target="_blank">juraj.janosik77@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div dir="ltr"><div><div><div><div>@ Stian:<br>generally said, I did not find any description, that the client attributes are for internal use only.<br></div>Parameter "attributes" is propagated in ClientRepresentation in the REST Admin API,<br></div>therefore should be used for CRUD admin operations.<br></div>We plan to attach Security Answers to the user (Security questions are common for particular client).<br><br></div><div>Best Regards,<br></div><div>Juraj<br></div></div><div><div><div class="gmail_extra"><br><div class="gmail_quote">2016-02-22 10:18 GMT+01:00 Bystrik Horvath <span dir="ltr"><<a href="mailto:bystrik.horvath@gmail.com" target="_blank">bystrik.horvath@gmail.com</a>></span>:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div dir="ltr">Hi,<div><br></div><div>I think the case here is to provision the text of security question to the client attributes when it is not known in advance.</div><div><br></div><div>Best regards,</div><div>Bystrik</div></div><div><div><div class="gmail_extra"><br><div class="gmail_quote">On Mon, Feb 22, 2016 at 10:06 AM, Thomas Darimont <span dir="ltr"><<a href="mailto:thomas.darimont@googlemail.com" target="_blank">thomas.darimont@googlemail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div dir="ltr">Interesting - do you need client specific security questions?<div><br></div><div>The keycloak examples contain a custom provider for user specific security questions - perhaps this would suit your needs better.</div><div><a href="https://github.com/keycloak/keycloak/tree/master/examples/providers/authenticator" target="_blank">https://github.com/keycloak/keycloak/tree/master/examples/providers/authenticator</a><br></div><div><br></div><div>Cheers,</div><div>Thomas</div></div><div class="gmail_extra"><br><div class="gmail_quote">2016-02-22 10:02 GMT+01:00 Juraj Janosik <span dir="ltr"><<a href="mailto:juraj.janosik77@gmail.com" target="_blank">juraj.janosik77@gmail.com</a>></span>:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div dir="ltr"><div><div><div><div>Hi Thomas,<br><br></div>for example security questions.... :-)<br></div><div></div><br></div>Best Regards,<br></div>Juraj<br><div><div><div><div><br><br></div></div></div></div></div><div><div><div class="gmail_extra"><br><div class="gmail_quote">2016-02-22 9:12 GMT+01:00 Thomas Darimont <span dir="ltr"><<a href="mailto:thomas.darimont@googlemail.com" target="_blank">thomas.darimont@googlemail.com</a>></span>:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div dir="ltr">Hello Juraj,<div><br></div><div>I wondered about that too a while ago - may I ask what client attributes you are planning to store?</div><div><br></div><div>Cheers,</div><div>Thomas</div></div><div><div><div class="gmail_extra"><br><div class="gmail_quote">2016-02-22 8:17 GMT+01:00 Juraj Janosik <span dir="ltr"><<a href="mailto:juraj.janosik77@gmail.com" target="_blank">juraj.janosik77@gmail.com</a>></span>:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div dir="ltr"><div><div><div><div><div><div>The user configuration has the possibility to Create/Read/Update/Delete of "custom" attributes in the Admin Console.<br>(/auth/admin/master/console/#/realms/demo/users/{uid}/user-attributes)<br></div>The client does not. I think, the logic and the focus is the same for both.<br></div><br></div></div></div>Best regards,<br></div>Juraj<br><div><div><div><div><div><div><br></div></div></div></div></div></div></div><div><div><div class="gmail_extra"><br><div class="gmail_quote">2016-02-19 15:40 GMT+01:00 Stian Thorgersen <span dir="ltr"><<a href="mailto:sthorger@redhat.com" target="_blank">sthorger@redhat.com</a>></span>:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><p dir="ltr">We don't. Why would we add it though?</p>
<div class="gmail_quote"><div><div>On 18 Feb 2016 12:43, "Juraj Janosik" <<a href="mailto:juraj.janosik77@gmail.com" target="_blank">juraj.janosik77@gmail.com</a>> wrote:<br type="attribution"></div></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div><div><div dir="ltr"><div><div>Hi,<br><br></div>is there any plan to support for displaying of "attributes" from Client Representation<br>(like users configuration) in Admin Console?<br><br></div><div>Thanks.<br><br></div><div>Best Regards,<br></div><div>Juraj<br></div></div>
<br></div></div>_______________________________________________<br>
keycloak-user mailing list<br>
<a href="mailto:keycloak-user@lists.jboss.org" target="_blank">keycloak-user@lists.jboss.org</a><br>
<a href="https://lists.jboss.org/mailman/listinfo/keycloak-user" rel="noreferrer" target="_blank">https://lists.jboss.org/mailman/listinfo/keycloak-user</a><br></blockquote></div>
</blockquote></div><br></div>
</div></div><br>_______________________________________________<br>
keycloak-user mailing list<br>
<a href="mailto:keycloak-user@lists.jboss.org" target="_blank">keycloak-user@lists.jboss.org</a><br>
<a href="https://lists.jboss.org/mailman/listinfo/keycloak-user" rel="noreferrer" target="_blank">https://lists.jboss.org/mailman/listinfo/keycloak-user</a><br></blockquote></div><br></div>
</div></div></blockquote></div><br></div>
</div></div></blockquote></div><br></div>
<br>_______________________________________________<br>
keycloak-user mailing list<br>
<a href="mailto:keycloak-user@lists.jboss.org" target="_blank">keycloak-user@lists.jboss.org</a><br>
<a href="https://lists.jboss.org/mailman/listinfo/keycloak-user" rel="noreferrer" target="_blank">https://lists.jboss.org/mailman/listinfo/keycloak-user</a><br></blockquote></div><br></div>
</div></div></blockquote></div><br></div>
</div></div></blockquote></div><br></div>
</blockquote></div><br></div>
</div></div></blockquote></div><br></div>
</blockquote></div><br></div>
</div></div></blockquote></div><br></div>
_______________________________________________<br>
keycloak-user mailing list<br>
<a href="mailto:keycloak-user@lists.jboss.org" target="_blank">keycloak-user@lists.jboss.org</a><br>
<a href="https://lists.jboss.org/mailman/listinfo/keycloak-user" rel="noreferrer" target="_blank">https://lists.jboss.org/mailman/listinfo/keycloak-user</a></blockquote></div></div>
</blockquote></div><br></div>
</div></div></blockquote></div><br></div>
</div></div></blockquote></div><br></div>
</div></div></blockquote></div><br></div>