Re: [Apiman-user] external Keycloak server
by enrico
Hi all,
thanks for the responses.
@Mark: yes, I know that is a release candidate but looks like the
final version is near and, being on a new project, I wanted start with
the very last versions :)
A part from this, I have tried with 1.7.0.Final too, but I have the
same problem:
User gets a "Forbidden" page and Keycloak server logs say:
WARN [org.keycloak.events]:
type=CODE_TO_TOKEN_ERROR,
realmId=352d562a-f3e5-4b7a-99ad-4331cdfdf085, clientId=apimanui,
userId=null, ipAddress=127.0.0.1, error=invalid_client_credentials,
grant_type=authorization_code
Thanks a lot for the help, best regards,
Enrico
On Wed, Jan 27, 2016 at 5:49 PM, Marc Savy <marc.savy(a)redhat.com> wrote:
> Hi Enrico,
>
> We haven't tested with Keycloak 1.8, as this is only a candidate release
> at the moment (CR == RC).
>
> I can give it a try, though and will report back.
>
> Regards,
> Marc
>
--
Enrico Comiti
8 years, 11 months
Plugins page stack trace - APIMan 1.2.1 on PostgreSQL 9.5
by Guy Davis
Good day,
I was hoping to follow the recently published steps
<http://www.apiman.io/blog/gateway/security/oauth2/keycloak/authentication...>
for using Keycloak to OAuth protect an API with APIMan. I already have the
backend API (war file) protected by Keycloak directly.
When I click on the 'Manage Plugins' link:
[image: Inline image 1]
I receive the error shown (full trace attached):
[image: Inline image 2]
Any tips on which Postgres table/column is the problem?
At a higher level, I'm not sure I understand the blog post however. I've
already protecting the various apiman *war files and their endpoints with
Keycloak's authentication behavior (default is OpenID Connect). So if the
APIMan endpoints are protected already, what does the OAuth policy provide
further? Any clarification on the integration points between Keycloak and
APIMan would be appreciated.
Thanks much,
Guy
8 years, 11 months
ApiMan and ActiveMQ
by Anton Hughes
Hello
I have seen that Apiman is provided as part of Fabric8, Very nice!
I am wondering, does apiman currently, or is it planned to, provide the
same features that it currently does to web services? So, policies could
also be applied to activemq queues and topics?
Thanks
--
Anton Hughes
8 years, 11 months
How to update backend implementation URL for published Service without changing the version
by Sanjay Melinamani
Hi All,
I am using APIMAN 1.1.9 and for an existing API that I have published to
consumers, I like to change its backend implementation end point URL
without changing the API service version.
I updated the backend implementation URL in database table
"service_versions". I can see the updated URL from UI but still the gateway
is using the old implementation URL specified.
Does it cache the implementation URL once the service is published ? Is
there anyway I can update the implementation URL for an existing service?
Appreciate your time and help.
Thanks
Sanjay
8 years, 11 months
Authorization policy with Web Service
by Charles Moulliard
Hi,
Could it be possible to use the existing authorization policy to handle WebService where according to the SOAPAction we have to authorize the call to a method or do we have to create a new authorization policy ?
As a WebService is not managed as RESTfull service where the HTTP Operation (= verb) can be used to determine if we will create, read or update something and restrict access for a user based on a role (writer, reader or admin), I try to figure out how we could achieve that authorization (= role based) based on the SOAPAction for webservice without creating a different WebService with only one operation/method to handle the actions to create/delete/read/update ...
Regards,
Charles
8 years, 11 months
1.2.1.Final / Wildfly 9 conflict with production deployment instructions
by Paul Blair
The production guide gives the following guidance about disabling the bundled Keycloak components:
Because you will be using an external/standalone Keycloak server, it is useful to disable the Keycloak components that are bundled with the apiman quickstart. To do that, make the following modification to the standalone-apiman.xml file:
<subsystem xmlns="urn:jboss:domain:keycloak:1.0">
<auth-server name="main-auth-server">
<enabled>false</enabled>
<web-context>auth</web-context>
</auth-server>
</subsystem>
When I start the server after upgrading from 1.2.0.Final, and comparing the standalone-apiman.xml config file with the old one, I get:
20:46:49,393 ERROR [org.jboss.as.server] (Controller Boot Thread) WFLYSRV0055: Caught exception during boot: org.jboss.as.controller.persistence.ConfigurationPersistenceException: WFLYCTL0085: Failed to parse configuration
at org.jboss.as.controller.persistence.XmlConfigurationPersister.load(XmlConfigurationPersister.java:131) [wildfly-controller-1.0.2.Final.jar:1.0.2.Final]
...
Caused by: javax.xml.stream.XMLStreamException: Unknown keycloak-server subsystem tag: auth-server
Any idea what this configuration should look like now?
8 years, 11 months
Announcement: apiman 1.2.x released!
by Eric Wittmann
Greetings, earthlings!
At long last we are happy to announce the release of apiman version
1.2.1.Final. You can read more about this most excellent release here:
http://www.apiman.io/blog/apiman/2016/01/22/release-1.2.html
Thank you very much to everyone in the community for your interest and
support. Hopefully 1.2 provides a bunch of functionality that folks
have been asking for.
Now that the first version of 1.2.x is out the door, expect us to be
going back to our more frequent release schedule!
-Eric
8 years, 11 months
OAuth with non public API
by michele danieli
When considering non public API and applying a OAuth authentication policy,
the application identifier must be provided using the api_key as a header?
If so, does not it means that the user authorized client and the actual api
consumer application have no strict relationship?
Thanks
Michele
8 years, 11 months
