4:27 p.m.
Hello,
We’ve been using version 3.4.3 for a while now and are attempting to upgrade to 4.8 and
we’ve run into some issues.
Summary: We have created our own providers with the same PROVIDER_ID as some of the built
in providers. For example, PasswordCredentialProvider has a provider id of
“keycloak-password” and we created our own with the same id that gets loaded after the
native one. This worked because in 3.4.3 providers that were using the same id would still
have their factories added to the factory map.
See this link here for 3.4.3 changes:
https://github.com/keycloak/keycloak/blob/3.4.3.Final/services/src/main/j...
These are the 4.8 changes
https://github.com/keycloak/keycloak/blob/4.8.3.Final/services/src/main/j...
In 4.8, the fully qualified class name (FQCN) is not longer used. Instead it uses the
provider id and the spi name. I can no longer use the same PROVIDER_ID as the native
providers to ‘override’ them, but sometimes there is code that gets the provider
specifically by id. For example, in the UpdatePassword required action we have this:
PasswordCredentialProvider passwordProvider =
(PasswordCredentialProvider)context.getSession().getProvider(CredentialProvider.class,
PasswordCredentialProviderFactory.PROVIDER_ID);
In 3.4.3 because our provider was loaded we were able to inject into code that normally
isn’t overridable. We did the same for the OIDCLoginProtocolFactory to alter some token
endpoint behavior even the UpdatePassword required action itself rather than making a
brand new required action that is a “second rate” because it isn’t native to Keycloak.
Is there a solution for this in 4.8.3? I see this change was made in 4.0.0.Beta1 according
to some of the history.
J
Jerry Saravia
Software Engineer
T(516) 603-6914
M516-603-6914
virginpulse.com
|virginpulse.com/global-challenge
492 Old Connecticut Path, Framingham, MA 01701, USA
Australia | Bosnia and Herzegovina | Brazil | Canada | Singapore | Switzerland | United
Kingdom | USA
Confidentiality Notice: The information contained in this e-mail, including any
attachment(s), is intended solely for use by the designated recipient(s). Unauthorized
use, dissemination, distribution, or reproduction of this message by anyone other than the
intended recipient(s), or a person designated as responsible for delivering such messages
to the intended recipient, is strictly prohibited and may be unlawful. This e-mail may
contain proprietary, confidential or privileged information. Any views or opinions
expressed are solely those of the author and do not necessarily represent those of Virgin
Pulse, Inc. If you have received this message in error, or are not the named recipient(s),
please immediately notify the sender and delete this e-mail message.
v2.48
5:23 p.m.
Hello Jerry,
I encountered a similar problem with Keycloak 4.x when I needed to
implement my own SamlProtocolFactory to customize the SAML Message handling.
See: http://lists.jboss.org/pipermail/keycloak-dev/2019-February/011745.html
The only way I could get this to work was to add my custom extension jar to
the module.xml of the keycloak-services module,
see the link for details.
It's by far not the best solution, but at least it works.
Cheers,
Thomas
On Wed, 27 Mar 2019 at 22:28, Jerry Saravia <jerry.saravia(a)virginpulse.com>
wrote:
Hello,
We’ve been using version 3.4.3 for a while now and are attempting to
upgrade to 4.8 and we’ve run into some issues.
Summary: We have created our own providers with the same PROVIDER_ID as
some of the built in providers. For example, PasswordCredentialProvider has
a provider id of “keycloak-password” and we created our own with the same
id that gets loaded after the native one. This worked because in 3.4.3
providers that were using the same id would still have their factories
added to the factory map.
See this link here for 3.4.3 changes:
https://github.com/keycloak/keycloak/blob/3.4.3.Final/services/src/main/j...
These are the 4.8 changes
https://github.com/keycloak/keycloak/blob/4.8.3.Final/services/src/main/j...
In 4.8, the fully qualified class name (FQCN) is not longer used. Instead
it uses the provider id and the spi name. I can no longer use the same
PROVIDER_ID as the native providers to ‘override’ them, but sometimes there
is code that gets the provider specifically by id. For example, in the
UpdatePassword required action we have this:
PasswordCredentialProvider passwordProvider =
(PasswordCredentialProvider)context.getSession().getProvider(CredentialProvider.class,
PasswordCredentialProviderFactory.PROVIDER_ID);
In 3.4.3 because our provider was loaded we were able to inject into code
that normally isn’t overridable. We did the same for the
OIDCLoginProtocolFactory to alter some token endpoint behavior even the
UpdatePassword required action itself rather than making a brand new
required action that is a “second rate” because it isn’t native to Keycloak.
Is there a solution for this in 4.8.3? I see this change was made in
4.0.0.Beta1 according to some of the history.
J
Jerry Saravia
Software Engineer
T(516) 603-6914
M516-603-6914
virginpulse.com
|virginpulse.com/global-challenge
492 Old Connecticut Path, Framingham, MA 01701, USA
Australia | Bosnia and Herzegovina | Brazil | Canada | Singapore |
Switzerland | United Kingdom | USA
Confidentiality Notice: The information contained in this e-mail,
including any attachment(s), is intended solely for use by the designated
recipient(s). Unauthorized use, dissemination, distribution, or
reproduction of this message by anyone other than the intended
recipient(s), or a person designated as responsible for delivering such
messages to the intended recipient, is strictly prohibited and may be
unlawful. This e-mail may contain proprietary, confidential or privileged
information. Any views or opinions expressed are solely those of the author
and do not necessarily represent those of Virgin Pulse, Inc. If you have
received this message in error, or are not the named recipient(s), please
immediately notify the sender and delete this e-mail message.
v2.48
_______________________________________________
keycloak-dev mailing list
keycloak-dev(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-dev
7:35 p.m.
Instead of trying to deploy a custom provider with the same id as the
default provider you can change the default provider for an SPI. In
standalone.xml just set the default-provider for the SPI to your own. This
will work when Keycloak doesn't specify directly what provider to get.
It was never supported to load a custom provider with same ID as the
built-in providers. I believe that was a side-effect made possible when we
introduced the ability to hot deploy providers.
On Wed, 27 Mar 2019 at 23:27, Thomas Darimont <
thomas.darimont(a)googlemail.com> wrote:
Hello Jerry,
I encountered a similar problem with Keycloak 4.x when I needed to
implement my own SamlProtocolFactory to customize the SAML Message
handling.
See:
http://lists.jboss.org/pipermail/keycloak-dev/2019-February/011745.html
The only way I could get this to work was to add my custom extension jar to
the module.xml of the keycloak-services module,
see the link for details.
It's by far not the best solution, but at least it works.
Cheers,
Thomas
On Wed, 27 Mar 2019 at 22:28, Jerry Saravia <jerry.saravia(a)virginpulse.com
>
wrote:
> Hello,
>
>
>
> We’ve been using version 3.4.3 for a while now and are attempting to
> upgrade to 4.8 and we’ve run into some issues.
>
>
>
> Summary: We have created our own providers with the same PROVIDER_ID as
> some of the built in providers. For example, PasswordCredentialProvider
has
> a provider id of “keycloak-password” and we created our own with the same
> id that gets loaded after the native one. This worked because in 3.4.3
> providers that were using the same id would still have their factories
> added to the factory map.
>
>
>
> See this link here for 3.4.3 changes:
>
>
>
https://github.com/keycloak/keycloak/blob/3.4.3.Final/services/src/main/j...
>
>
>
> These are the 4.8 changes
>
>
>
https://github.com/keycloak/keycloak/blob/4.8.3.Final/services/src/main/j...
>
>
>
> In 4.8, the fully qualified class name (FQCN) is not longer used. Instead
> it uses the provider id and the spi name. I can no longer use the same
> PROVIDER_ID as the native providers to ‘override’ them, but sometimes
there
> is code that gets the provider specifically by id. For example, in the
> UpdatePassword required action we have this:
>
>
>
> PasswordCredentialProvider passwordProvider =
>
(PasswordCredentialProvider)context.getSession().getProvider(CredentialProvider.class,
> PasswordCredentialProviderFactory.PROVIDER_ID);
>
>
>
> In 3.4.3 because our provider was loaded we were able to inject into code
> that normally isn’t overridable. We did the same for the
> OIDCLoginProtocolFactory to alter some token endpoint behavior even the
> UpdatePassword required action itself rather than making a brand new
> required action that is a “second rate” because it isn’t native to
Keycloak.
>
>
>
> Is there a solution for this in 4.8.3? I see this change was made in
> 4.0.0.Beta1 according to some of the history.
>
>
>
> J
>
>
> Jerry Saravia
> Software Engineer
> T(516) 603-6914
> M516-603-6914
> virginpulse.com
> |virginpulse.com/global-challenge
> 492 Old Connecticut Path, Framingham, MA 01701, USA
> Australia | Bosnia and Herzegovina | Brazil | Canada | Singapore |
> Switzerland | United Kingdom | USA
> Confidentiality Notice: The information contained in this e-mail,
> including any attachment(s), is intended solely for use by the designated
> recipient(s). Unauthorized use, dissemination, distribution, or
> reproduction of this message by anyone other than the intended
> recipient(s), or a person designated as responsible for delivering such
> messages to the intended recipient, is strictly prohibited and may be
> unlawful. This e-mail may contain proprietary, confidential or privileged
> information. Any views or opinions expressed are solely those of the
author
> and do not necessarily represent those of Virgin Pulse, Inc. If you have
> received this message in error, or are not the named recipient(s), please
> immediately notify the sender and delete this e-mail message.
> v2.48
> _______________________________________________
> keycloak-dev mailing list
> keycloak-dev(a)lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-dev
_______________________________________________
keycloak-dev mailing list
keycloak-dev(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-dev
7:53 a.m.
Hey guys,
Thank you for commenting.
@Stian, the default-provider option works well enough for times where native keycloak code
doesn’t use a specific ID to request the provider.
However, for cases like the SAML provider as Thomas highlighted, it doesn’t work. I too
had to change some of the SAML behavior such as the template that is used for errors and
the way that some of the errors are handled.
I’ll be trying Thomas’ approach for now since it seems like it’ll help.
Jerry Saravia
Software Engineer
T(516) 603-6914
M516-603-6914
virginpulse.com
|virginpulse.com/global-challenge
492 Old Connecticut Path, Framingham, MA 01701, USA
Australia | Bosnia and Herzegovina | Brazil | Canada | Singapore | Switzerland | United
Kingdom | USA
Confidentiality Notice: The information contained in this e-mail, including any
attachment(s), is intended solely for use by the designated recipient(s). Unauthorized
use, dissemination, distribution, or reproduction of this message by anyone other than the
intended recipient(s), or a person designated as responsible for delivering such messages
to the intended recipient, is strictly prohibited and may be unlawful. This e-mail may
contain proprietary, confidential or privileged information. Any views or opinions
expressed are solely those of the author and do not necessarily represent those of Virgin
Pulse, Inc. If you have received this message in error, or are not the named recipient(s),
please immediately notify the sender and delete this e-mail message.
v2.50
From: Stian Thorgersen <sthorger(a)redhat.com>
Reply-To: "stian(a)redhat.com" <stian(a)redhat.com>
Date: Wednesday, March 27, 2019 at 20:35
To: Thomas Darimont <thomas.darimont(a)googlemail.com>
Cc: Jerry Saravia <jerry.saravia(a)virginpulse.com>,
"keycloak-dev(a)lists.jboss.org" <keycloak-dev(a)lists.jboss.org>
Subject: Re: [keycloak-dev] Override "native" Keycloak providers
This email originates outside Virgin Pulse.
Instead of trying to deploy a custom provider with the same id as the default provider you
can change the default provider for an SPI. In standalone.xml just set the
default-provider for the SPI to your own. This will work when Keycloak doesn't specify
directly what provider to get.
It was never supported to load a custom provider with same ID as the built-in providers. I
believe that was a side-effect made possible when we introduced the ability to hot deploy
providers.
On Wed, 27 Mar 2019 at 23:27, Thomas Darimont
<thomas.darimont@googlemail.com<mailto:thomas.darimont@googlemail.com>>
wrote:
Hello Jerry,
I encountered a similar problem with Keycloak 4.x when I needed to
implement my own SamlProtocolFactory to customize the SAML Message handling.
See:
http://lists.jboss.org/pipermail/keycloak-dev/2019-February/011745.html&l...
The only way I could get this to work was to add my custom extension jar to
the module.xml of the keycloak-services module,
see the link for details.
It's by far not the best solution, but at least it works.
Cheers,
Thomas
On Wed, 27 Mar 2019 at 22:28, Jerry Saravia
<jerry.saravia@virginpulse.com<mailto:jerry.saravia@virginpulse.com>>
wrote:
Hello,
We’ve been using version 3.4.3 for a while now and are attempting to
upgrade to 4.8 and we’ve run into some issues.
Summary: We have created our own providers with the same PROVIDER_ID as
some of the built in providers. For example, PasswordCredentialProvider has
a provider id of “keycloak-password” and we created our own with the same
id that gets loaded after the native one. This worked because in 3.4.3
providers that were using the same id would still have their factories
added to the factory map.
See this link here for 3.4.3 changes:
https://github.com/keycloak/keycloak/blob/3.4.3.Final/services/src/main/j...
These are the 4.8 changes
https://github.com/keycloak/keycloak/blob/4.8.3.Final/services/src/main/j...
In 4.8, the fully qualified class name (FQCN) is not longer used. Instead
it uses the provider id and the spi name. I can no longer use the same
PROVIDER_ID as the native providers to ‘override’ them, but sometimes there
is code that gets the provider specifically by id. For example, in the
UpdatePassword required action we have this:
PasswordCredentialProvider passwordProvider =
(PasswordCredentialProvider)context.getSession().getProvider(CredentialProvider.class,
PasswordCredentialProviderFactory.PROVIDER_ID);
In 3.4.3 because our provider was loaded we were able to inject into code
that normally isn’t overridable. We did the same for the
OIDCLoginProtocolFactory to alter some token endpoint behavior even the
UpdatePassword required action itself rather than making a brand new
required action that is a “second rate” because it isn’t native to Keycloak.
Is there a solution for this in 4.8.3? I see this change was made in
4.0.0.Beta1 according to some of the history.
J
Jerry Saravia
Software Engineer
T(516) 603-6914
M516-603-6914
virginpulse.com<https://nam02.safelinks.protection.outlook.com/?url=ht...
|virginpulse.com/global-challenge<https://nam02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fvirginpulse.com%2Fglobal-challenge&data=02%7C01%7Cjerry.saravia%40virginpulse.com%7C29bb3f9e3749470e566e08d6b3154a33%7Cb123a16e892b4cf6a55a6f8c7606a035%7C0%7C0%7C636893301423013114&sdata=Vx2gyBFI0DaPSoAjof7PQmwqX59pnQ54jelBdf5sljU%3D&reserved=0>
492 Old Connecticut Path, Framingham, MA 01701, USA
Australia | Bosnia and Herzegovina | Brazil | Canada | Singapore |
Switzerland | United Kingdom | USA
Confidentiality Notice: The information contained in this e-mail,
including any attachment(s), is intended solely for use by the designated
recipient(s). Unauthorized use, dissemination, distribution, or
reproduction of this message by anyone other than the intended
recipient(s), or a person designated as responsible for delivering such
messages to the intended recipient, is strictly prohibited and may be
unlawful. This e-mail may contain proprietary, confidential or privileged
information. Any views or opinions expressed are solely those of the author
and do not necessarily represent those of Virgin Pulse, Inc. If you have
received this message in error, or are not the named recipient(s), please
immediately notify the sender and delete this e-mail message.
v2.48
_______________________________________________
keycloak-dev mailing list
keycloak-dev@lists.jboss.org<mailto:keycloak-dev@lists.jboss.org>
https://lists.jboss.org/mailman/listinfo/keycloak-dev<https://nam02.sa...
_______________________________________________
keycloak-dev mailing list
keycloak-dev@lists.jboss.org<mailto:keycloak-dev@lists.jboss.org>
https://lists.jboss.org/mailman/listinfo/keycloak-dev<https://nam02.sa...
8:12 a.m.
Thanks Thomas,
This worked!!!
Jerry Saravia
Software Engineer
T(516) 603-6914
M516-603-6914
virginpulse.com
|virginpulse.com/global-challenge
492 Old Connecticut Path, Framingham, MA 01701, USA
Australia | Bosnia and Herzegovina | Brazil | Canada | Singapore | Switzerland | United
Kingdom | USA
Confidentiality Notice: The information contained in this e-mail, including any
attachment(s), is intended solely for use by the designated recipient(s). Unauthorized
use, dissemination, distribution, or reproduction of this message by anyone other than the
intended recipient(s), or a person designated as responsible for delivering such messages
to the intended recipient, is strictly prohibited and may be unlawful. This e-mail may
contain proprietary, confidential or privileged information. Any views or opinions
expressed are solely those of the author and do not necessarily represent those of Virgin
Pulse, Inc. If you have received this message in error, or are not the named recipient(s),
please immediately notify the sender and delete this e-mail message.
v2.52
From: Thomas Darimont <thomas.darimont(a)googlemail.com>
Date: Wednesday, March 27, 2019 at 18:23
To: Jerry Saravia <jerry.saravia(a)virginpulse.com>
Cc: "keycloak-dev(a)lists.jboss.org" <keycloak-dev(a)lists.jboss.org>
Subject: Re: [keycloak-dev] Override "native" Keycloak providers
This email originates outside Virgin Pulse.
Hello Jerry,
I encountered a similar problem with Keycloak 4.x when I needed to implement my own
SamlProtocolFactory to customize the SAML Message handling.
See:
http://lists.jboss.org/pipermail/keycloak-dev/2019-February/011745.html&l...
The only way I could get this to work was to add my custom extension jar to the module.xml
of the keycloak-services module,
see the link for details.
It's by far not the best solution, but at least it works.
Cheers,
Thomas
On Wed, 27 Mar 2019 at 22:28, Jerry Saravia
<jerry.saravia@virginpulse.com<mailto:jerry.saravia@virginpulse.com>> wrote:
Hello,
We’ve been using version 3.4.3 for a while now and are attempting to upgrade to 4.8 and
we’ve run into some issues.
Summary: We have created our own providers with the same PROVIDER_ID as some of the built
in providers. For example, PasswordCredentialProvider has a provider id of
“keycloak-password” and we created our own with the same id that gets loaded after the
native one. This worked because in 3.4.3 providers that were using the same id would still
have their factories added to the factory map.
See this link here for 3.4.3 changes:
https://github.com/keycloak/keycloak/blob/3.4.3.Final/services/src/main/j...
These are the 4.8 changes
https://github.com/keycloak/keycloak/blob/4.8.3.Final/services/src/main/j...
In 4.8, the fully qualified class name (FQCN) is not longer used. Instead it uses the
provider id and the spi name. I can no longer use the same PROVIDER_ID as the native
providers to ‘override’ them, but sometimes there is code that gets the provider
specifically by id. For example, in the UpdatePassword required action we have this:
PasswordCredentialProvider passwordProvider =
(PasswordCredentialProvider)context.getSession().getProvider(CredentialProvider.class,
PasswordCredentialProviderFactory.PROVIDER_ID);
In 3.4.3 because our provider was loaded we were able to inject into code that normally
isn’t overridable. We did the same for the OIDCLoginProtocolFactory to alter some token
endpoint behavior even the UpdatePassword required action itself rather than making a
brand new required action that is a “second rate” because it isn’t native to Keycloak.
Is there a solution for this in 4.8.3? I see this change was made in 4.0.0.Beta1 according
to some of the history.
J
Jerry Saravia
Software Engineer
T(516) 603-6914
M516-603-6914
virginpulse.com<https://nam02.safelinks.protection.outlook.com/?url=ht...
|virginpulse.com/global-challenge<https://nam02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fvirginpulse.com%2Fglobal-challenge&data=02%7C01%7Cjerry.saravia%40virginpulse.com%7C40d6fd71af6b4998c21a08d6b302ceed%7Cb123a16e892b4cf6a55a6f8c7606a035%7C0%7C0%7C636893221988698793&sdata=2LvPxrCOKkzZnCzkNOLGCHj4Jpq74Z70Iy4CNDJCbRw%3D&reserved=0>
492 Old Connecticut Path, Framingham, MA 01701, USA
Australia | Bosnia and Herzegovina | Brazil | Canada | Singapore | Switzerland | United
Kingdom | USA
Confidentiality Notice: The information contained in this e-mail, including any
attachment(s), is intended solely for use by the designated recipient(s). Unauthorized
use, dissemination, distribution, or reproduction of this message by anyone other than the
intended recipient(s), or a person designated as responsible for delivering such messages
to the intended recipient, is strictly prohibited and may be unlawful. This e-mail may
contain proprietary, confidential or privileged information. Any views or opinions
expressed are solely those of the author and do not necessarily represent those of Virgin
Pulse, Inc. If you have received this message in error, or are not the named recipient(s),
please immediately notify the sender and delete this e-mail message.
v2.48
_______________________________________________
keycloak-dev mailing list
keycloak-dev@lists.jboss.org<mailto:keycloak-dev@lists.jboss.org>
https://lists.jboss.org/mailman/listinfo/keycloak-dev<https://nam02.sa...
5:26 a.m.
Hi,
I also wanted to override the default SAMLProtocolFactory with my class with the same
provider id as Thomas mentioned.
In my case, it has been successful in replacing the native provider with the same provider
id by using the Keycloak Deployer [1]. I confirmed it works with keycloak version
4.3.0.Final, 4.8.3.Final and 6.0.1.
The deployment approach is as follows. I think it's a straightforward way than
deployment as a module. +Bonus: Hot deployment works !!
- Create "jboss-deployment-structure.xml" and place under the
"META-INF" directory in your JAR or EAR which contains your classes.
- Deploy JAR or EAR by placing it in the
"$KEYCLOAK_HOME/standalone/deployments/" directory.
[1]
https://www.keycloak.org/docs/latest/server_development/index.html#using-...
--
Hiroyuki Wada
Nomura Research Institute, Ltd.
h2-wada(a)nri.co.jp
--------------------------------------------------------------------
このメールには、本来の宛先の方のみに限定された機密情報が含まれている
場合がございます。お心あたりのない場合は、送信者にご連絡のうえ、
このメールを削除してくださいますようお願い申し上げます。
PLEASE READ:This e-mail is confidential and intended for
the named recipient only. If you are not an intended recipient,
please notify the sender and delete this e-mail.
--------------------------------------------------------------------
________________________________________
差出人: keycloak-dev-bounces(a)lists.jboss.org <keycloak-dev-bounces(a)lists.jboss.org> が
Jerry Saravia <jerry.saravia(a)virginpulse.com> の代理で送信
送信日時: 2019年4月15日 22:12
宛先: Thomas Darimont
CC: keycloak-dev(a)lists.jboss.org
件名: Re: [keycloak-dev] Override "native" Keycloak providers
Thanks Thomas,
This worked!!!
Jerry Saravia
Software Engineer
T(516) 603-6914
M516-603-6914
virginpulse.com
|virginpulse.com/global-challenge
492 Old Connecticut Path, Framingham, MA 01701, USA
Australia | Bosnia and Herzegovina | Brazil | Canada | Singapore | Switzerland | United
Kingdom | USA
Confidentiality Notice: The information contained in this e-mail, including any
attachment(s), is intended solely for use by the designated recipient(s). Unauthorized
use, dissemination, distribution, or reproduction of this message by anyone other than the
intended recipient(s), or a person designated as responsible for delivering such messages
to the intended recipient, is strictly prohibited and may be unlawful. This e-mail may
contain proprietary, confidential or privileged information. Any views or opinions
expressed are solely those of the author and do not necessarily represent those of Virgin
Pulse, Inc. If you have received this message in error, or are not the named recipient(s),
please immediately notify the sender and delete this e-mail message.
v2.52
From: Thomas Darimont <thomas.darimont(a)googlemail.com>
Date: Wednesday, March 27, 2019 at 18:23
To: Jerry Saravia <jerry.saravia(a)virginpulse.com>
Cc: "keycloak-dev(a)lists.jboss.org" <keycloak-dev(a)lists.jboss.org>
Subject: Re: [keycloak-dev] Override "native" Keycloak providers
This email originates outside Virgin Pulse.
Hello Jerry,
I encountered a similar problem with Keycloak 4.x when I needed to implement my own
SamlProtocolFactory to customize the SAML Message handling.
See:
http://lists.jboss.org/pipermail/keycloak-dev/2019-February/011745.html&l...
The only way I could get this to work was to add my custom extension jar to the module.xml
of the keycloak-services module,
see the link for details.
It's by far not the best solution, but at least it works.
Cheers,
Thomas
On Wed, 27 Mar 2019 at 22:28, Jerry Saravia
<jerry.saravia@virginpulse.com<mailto:jerry.saravia@virginpulse.com>> wrote:
Hello,
We’ve been using version 3.4.3 for a while now and are attempting to upgrade to 4.8 and
we’ve run into some issues.
Summary: We have created our own providers with the same PROVIDER_ID as some of the built
in providers. For example, PasswordCredentialProvider has a provider id of
“keycloak-password” and we created our own with the same id that gets loaded after the
native one. This worked because in 3.4.3 providers that were using the same id would still
have their factories added to the factory map.
See this link here for 3.4.3 changes:
https://github.com/keycloak/keycloak/blob/3.4.3.Final/services/src/main/j...
These are the 4.8 changes
https://github.com/keycloak/keycloak/blob/4.8.3.Final/services/src/main/j...
In 4.8, the fully qualified class name (FQCN) is not longer used. Instead it uses the
provider id and the spi name. I can no longer use the same PROVIDER_ID as the native
providers to ‘override’ them, but sometimes there is code that gets the provider
specifically by id. For example, in the UpdatePassword required action we have this:
PasswordCredentialProvider passwordProvider =
(PasswordCredentialProvider)context.getSession().getProvider(CredentialProvider.class,
PasswordCredentialProviderFactory.PROVIDER_ID);
In 3.4.3 because our provider was loaded we were able to inject into code that normally
isn’t overridable. We did the same for the OIDCLoginProtocolFactory to alter some token
endpoint behavior even the UpdatePassword required action itself rather than making a
brand new required action that is a “second rate” because it isn’t native to Keycloak.
Is there a solution for this in 4.8.3? I see this change was made in 4.0.0.Beta1 according
to some of the history.
J
Jerry Saravia
Software Engineer
T(516) 603-6914
M516-603-6914
virginpulse.com<https://nam02.safelinks.protection.outlook.com/?url=ht...
|virginpulse.com/global-challenge<https://nam02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fvirginpulse.com%2Fglobal-challenge&data=02%7C01%7Cjerry.saravia%40virginpulse.com%7C40d6fd71af6b4998c21a08d6b302ceed%7Cb123a16e892b4cf6a55a6f8c7606a035%7C0%7C0%7C636893221988698793&sdata=2LvPxrCOKkzZnCzkNOLGCHj4Jpq74Z70Iy4CNDJCbRw%3D&reserved=0>
492 Old Connecticut Path, Framingham, MA 01701, USA
Australia | Bosnia and Herzegovina | Brazil | Canada | Singapore | Switzerland | United
Kingdom | USA
Confidentiality Notice: The information contained in this e-mail, including any
attachment(s), is intended solely for use by the designated recipient(s). Unauthorized
use, dissemination, distribution, or reproduction of this message by anyone other than the
intended recipient(s), or a person designated as responsible for delivering such messages
to the intended recipient, is strictly prohibited and may be unlawful. This e-mail may
contain proprietary, confidential or privileged information. Any views or opinions
expressed are solely those of the author and do not necessarily represent those of Virgin
Pulse, Inc. If you have received this message in error, or are not the named recipient(s),
please immediately notify the sender and delete this e-mail message.
v2.48
_______________________________________________
keycloak-dev mailing list
keycloak-dev@lists.jboss.org<mailto:keycloak-dev@lists.jboss.org>
https://lists.jboss.org/mailman/listinfo/keycloak-dev<https://nam02.sa...
2027
days inactive
2097
days old
5 comments
4 participants
participants (4)
-
h2-wada -
Jerry Saravia -
Stian Thorgersen -
Thomas Darimont