October 2019 - keycloak-dev - Jboss List Archives

Events not deleted on realm deletion and missing indexes

by Schuster Sebastian (INST-CSS/BSV-OS2)

Hi everybody, I noticed that neither Admin Events nor Login Events are deleted in the database when a realm is deleted. Is this by intention (e..g for auditing purposes) or a bug? I also saw that with a lots of events (10 Mio+) queries to the events endpoints typically time out since they filter by realm_id but there is not index for this leading to full table scans. I would assume index on realm_id and/or realm_id+timestamp would be necessary. WDYT? Best regards, Sebastian Mit freundlichen Grüßen / Best regards Dr.-Ing. Sebastian Schuster Open Source Services (INST-CSS/BSV-OS2) Bosch Software Innovations GmbH | Ullsteinstr. 128 | 12109 Berlin | GERMANY | www.bosch-si.com Tel. +49 30 726112-485 | Mobil +49 152 02177668 | Telefax +49 30 726112-100 | Sebastian.Schuster(a)bosch-si.com<mailto:Sebastian.Schuster@bosch-si.com> Sitz: Berlin, Registergericht: Amtsgericht Charlottenburg; HRB 148411 B Aufsichtsratsvorsitzender: Dr.-Ing. Thorsten Lücke; Geschäftsführung: Dr. Stefan Ferber, Michael Hahn, Dr. Aleksandar Mitrovic

6 years, 2 months

2
2
0 / 0

Gatekeeper: Incorrect validation of access token in lieu of ID token

by Patrik Sletmo

Hi! I'd like to raise the issue that the token validation present in Keycloak Gatekeeper is incorrectly implemented. Currently, the access token is validated *as if it were an ID token*, if it is defined in the reply to /oauth/callback. This behavior is the result of substituting the ID token with the access token, if present [1], and then validating it [2]. The OpenID Connect specification require that several fields (such as iss, sub and aud) are present in the ID token [3]. Therefore, the presence of these fields should be validated for the ID token [4], and NOT for the access token [5]. Since the wrong access token is validated in Gatekeeper, OpenID Connect providers that do not supply the mandatory ID token fields in the access token are rejected, making them incompatible with Gatekeeper. What are your opinion on this matter? I would like this issue resolved so that more OpenID Connect providers can be used together with Gatekeeper in the future. [1] https://github.com/keycloak/keycloak-gatekeeper/blob/master/handlers.go#L156 [2] https://github.com/keycloak/keycloak-gatekeeper/blob/master/handlers.go#L163 [3] https://openid.net/specs/openid-connect-core-1_0.html#IDToken [4] https://openid.net/specs/openid-connect-core-1_0.html#IDTokenValidation [5] https://openid.net/specs/openid-connect-core-1_0.html#CodeFlowTokenValida... Regards, Patrik Sletmo

6 years, 2 months

1
0
0 / 0

What Data Does Keycloak Collect on Users?

by Andrew Munro

We need to document this. Stian has added a few thoughts to the related Jira. Can you add others? https://issues.jboss.org/browse/KEYCLOAK-8949 -- *Andrew Munro* Senior Technical Writer Cell: 978-844-0637 Red Hat <https://www.redhat.com> <https://www.redhat.com>

6 years, 2 months

1
1
0 / 0

Callbacks when I rotate my keys or revoke my JWT tokens

by Daniel Souza

Hi, In my implementation, I am validating the JWT tokens locally, keeping the public keys in a local cache to avoid making multiple calls to the Keycloak server. I won't know when a key in the server is no longer enabled or valid, therefore I could end up validating an invalid JWT token locally. I would like to know if Keycloak has a way to configure callbacks when I rotate my keys. Does it have? Then I can update my keys in the cache… In the case of JWT token revocation, can tokens be individually revoked in Keycloak? Is this feature available? Are there callbacks implemented in case I have JWT tokens revoked? Thank you in advance. Regards, Daniel.

6 years, 2 months

1
0
0 / 0

How to implement a SPI

by David Ernesto Ureña

Hi, This is a very simple question, but I can't manage to find the answer. I am trying to take advantage of the tomcat-adapter-spi as in order to take advantage of the [KEYCLOAK-7147]. In order for my adapter to use this, what should I do, compile the class and iadd it in my WEB-INF/classes, make a jar of these few classes, download the latest source code for the whole adapter, replace the files with these ones and compile them into a jar? Simple question but I am not used to this type of project. Thanks David

6 years, 2 months

1
0
0 / 0

Create a PR for handling username/password with whitespace in keycloak-containers

by Erik Lindskog

Hello! I found out that the current docker-entrypoint.sh doesn't handle if you try to set a password that contains whitespace. So the plan is just to create a PR out of this if it is ok? https://github.com/cartmanume/keycloak-containers/commit/4b09e830a2151ccb... Regards /Erik

6 years, 2 months

2
5
0 / 0

New Information Architecture proposal for Admin Console

by Stian Thorgersen

We are planning a re-design of the admin console in the future to make it easier to use and more consistent throughout. As a first step the team behind the design work has created a proposal for a new information architecture here: https://github.com/keycloak/keycloak-community/blob/master/design/admin-c... We would love feedback on the proposal.

6 years, 2 months

1
0
0 / 0

Mapping Tivoli groups and roles, 7.0.0

by Julio Sardella

I'm having trouble to link user's roles to groups in Tivoli. The association in my environment is users <-> groups <-> roles with uniquemember attribute (not memberOf). I just can't find a way to link roles and groups in this Tivoli configuration. I already mapped groups and also roles but when I ask to my ldap the list of roles from a specific user it don’t answer me any real. I also have an Active Directory and I could federate it because all users and groups have memberOf attribute and keycloak link them perfectly. I hope you can help me with some docs explaining how to do this. Thanks -- Julio Sardella +55 21 98750-3761

6 years, 2 months

1
0
0 / 0

[Keycloak Operator] Keycloak and KeycloakRealm CRDs

by Sebastian Laskawiec

Hey, Keycloak Operator in its initial approach will handle two types of resources - Keycloak and KeycloakRealm CRDs. The first one is responsible for spinning up a Keycloak instance, whereas the second one contains a Realm definition. There are many ways of combining all things together, so we’d like to bring everyone on the same page with our latest proposal: The idea is for theKeycloak Operator to watch a single namespace for Keycloak CRs and multiple namespaces for KeycloakRealm CRs. Once a Keycloak CR is created in the same namespace as the Operator, the Operator will create a Keycloak installation. At the same time, we’d like to let users in different namespaces create Realms. This means, that a KeycloakRealm CRs need to point to a specific Keycloak CR. This mapping will be achieved by using Label Selectors: the Keycloak CR specifies one or more set based selectors that allow to express which labels have to be present on a KeycloakRealm in order to be selected by the Operator. A simple example could look like this: *Keycloak CR:* realmLabelSelector: matchLabels: app: keycloak The Operator would then only import Keycloak Realms that have a label app with the value keycloak. This approach enables the following use cases: - Keycloak cluster administrators can be easily separated by Realm administrators using Namespaces. In our example, User 1 and 2 don’t have access to the Keycloak installation itself. The Operator creates Realms on their behalf. - Users won’t be able to break other’s Realms. In our example, User 1 and 2 don’t have access to Namespace “test2”, and therefore, can not break Realm “test2”. - It is perfectly fine to put everything in a single namespace (Keycloak and KeycloakRealm CRs). This type of installation might be used by smaller organizations. - We will allow only 1 Keycloak installation per Namespace. It is possible to use multiple installations per Namespace but we couldn’t come up with a logical use case for that. We decided to discourage users from this type of installations and they might complicate things in the future. - Multiple keycloak operators could be running in a cluster. The selectors on the KeycloakRealm determine which Keycloak instance the realm is created in. Please do not hesitate to ask any questions and if you have any thoughts in your mind, please let us know. Thanks, David, Peter, Bruno and Sebastian

6 years, 2 months

3
4
0 / 0

User Profile design proposal (also known as Profile SPI and user validation)

by Stian Thorgersen

https://github.com/keycloak/keycloak-community/blob/master/design/user-pr...

6 years, 2 months

2
2
0 / 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

keycloak-dev October 2019