keycloak-dev March 2016

keycloak-dev@lists.jboss.org

23 participants
42 discussions

by Jorge M.

Hi, I'm not being able to add custom locales in version 1.9.0.final. In previous versions I used to add custom locales files under base/login/messages folder. This behavior has changed in the new version ? I can see that there is an issue related with that for this version https://issues.jboss.org/browse/KEYCLOAK-2237 but I'm not getting there. Any help? Thank you

8 years, 1 month

2
2
0 / 0

Blacklisting/document broken protocols

by Bruno Oliveira

Ahoy, today I was reading about this "new" vulnerability on TLS ( http://blog.cryptographyengineering.com/2016/03/attack-of-week-drown.html). And was wondering if we should blacklist or document broken protocols. Preventing people to deploy Keycloak in non secure environments. Something like was already suggested for Poodle here: http://www.oracle.com/technetwork/java/javase/documentation/cve-2014-3566... Snippet: SSLSocket sslSocket = sslSocketFactory.createSocket(...); // Strip "SSLv3" from the current enabled protocols. String[] protocols = sslSocket.getEnabledProtocols(); Set<String> set = new HashSet<>(); for (String s : protocols) { if (s.equals("SSLv3") || s.equals("SSLv2Hello")) { continue; } set.add(s); } sslSocket.setEnabledProtocols(set.toArray(new String[0])); Should we document? Blacklist? Or leave it as is?

8 years, 1 month

3
3
0 / 0

← Newer
1
2
3
4
5
Older →

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

keycloak-dev March 2016