(no subject)
by Thomas Darimont
Hello,
how can I add a new dependency to the keycloak modules/system/layers/base
when building
a server-distribution?
I need to add org.apache.commons:commons-collections4 for the PatriciaTrie
which I need for
my BlacklistPasswordPolicyProvider: [0]
I tried adding a dependency to keycloak/dependencies/server-all/pom.xml but
I still get
CNFEs if I try to run the server from the dist-build.
Caused by: java.lang.ClassNotFoundException:
org.apache.commons.collections4.trie.PatriciaTrie from [Module
"org.keycloak.keycloak-server-spi-private" from local module loader
@282ba1e (finder: local module finder @13b6d03 (roots:
/home/tom/dev/playground/keycloak/keycloak-3.3.0.CR1-SNAPSHOT/modules,/home/tom/dev/playground/keycloak/keycloak-3.3.0.CR1-SNAPSHOT/modules/system/layers/keycloak,/home/tom/dev/playground/keycloak/keycloak-3.3.0.CR1-SNAPSHOT/modules/system/layers/base))]
Cheers,
Thomas
[0]
https://github.com/thomasdarimont/keycloak/commit/59a84df2f70623f11bd4d78...
6 years, 8 months
How to add a dependency to keycloak server distribution build?
by Thomas Darimont
Hello,
(sorry hit send to fast...)
how can I add a new dependency to the keycloak modules/system/layers/base
when building
a server-distribution?
I need to add org.apache.commons:commons-collections4 for the PatriciaTrie
which I need for
my BlacklistPasswordPolicyProvider: [0]
I tried adding a dependency to keycloak/dependencies/server-all/pom.xml but
I still get
CNFEs if I try to run the server from the dist-build.
Caused by: java.lang.ClassNotFoundException:
org.apache.commons.collections4.trie.PatriciaTrie
from [Module "org.keycloak.keycloak-server-spi-private" from local module
loader @282ba1e (finder: local module finder @13b6d03 (roots:
/home/tom/dev/playground/keycloak/keycloak-3.3.0.CR1-
SNAPSHOT/modules,/home/tom/dev/playground/keycloak/
keycloak-3.3.0.CR1-SNAPSHOT/modules/system/layers/keycloak,/home/tom/dev/
playground/keycloak/keycloak-3.3.0.CR1-SNAPSHOT/modules/
system/layers/base))]
Cheers,
Thomas
[0] https://github.com/thomasdarimont/keycloak/commit/
59a84df2f70623f11bd4d78771a4b91422fa0286
6 years, 8 months
UserSessions support for cross-dc
by Marek Posolda
I've sent PR https://github.com/keycloak/keycloak/pull/4357 for subject.
It adds cross-dc support for userSessions, so that if you write
userSession "abc" in DC1, you will be able to read it in DC2 and viceversa.
Among cross-dc, it also provides the solution for lost updates (write
skew) issues where 2 threads on different cluster nodes (or in different
data-centers) updates same userSession. They both read the userSession
in same state and then both update it, but 2nd update will overwrite the
1st one, which was committed first. I've used the pattern based on
tracking changes (events) and infinispan atomic-replace operation
described in the earlier mail:
http://lists.jboss.org/pipermail/keycloak-dev/2017-May/009347.html
So there was some refactoring of InfinispanUserSessionProvider to
support the event-based approach. One difference from the previous
proposal was, that events are not sent between data-centers but instead
userSession entities are directly written to remoteCache itself -
however the writes are still protected to avoid write skew issues. The
reason is, that with multiple datacenters, it can happen that
datacenters lost the network connection between each other (split
brain). Infinispan has some ways to restore from this state and sync the
entities after network connection is fixed. With the entities directly
in the cache, this should be easier to achieve then the case when the
remoteCache is used just as an event bus to send "changes" among
datacenters.
There is still lots of work for the cross-dc support, but hopefully it's
another step forward :)
Marek
6 years, 8 months
OTP string based secrets
by Dobbels, Andy
Hi,
We are adopting Keycloak and are trying to move our OTP tokens over to Keycloak. However, Keycloak can only use secrets that are alphanumeric strings whereas our existing implementation and most hard and software tokens we have used use the full range of binary values when generating secrets.
2 questions:
1: Is the lower entropy of the secrets generated by Keycloak a concern?
2: If we provided a PR that migrated the existing data by re-encoding all existing secrets as Base32 and updated the code to assume Base32 instead of string be acceptable?
This would be a non breaking change but allow anyone using existing OTP tokens to migrate their secrets which I don't think they can at the moment.
Thanks,
Andy
6 years, 8 months
Keycloak, Elytron and WildFly 11
by Pedro Igor Silva
Hi,
Just want to let you know that tests using Elytron 1.1.0.CR3 (just
released) and WildFly/Core upstream are passing. Next version of Elytron is
Final and until there we should not have anymore changes that may impact
our side, including Elytron subsystem changes.
We also have some initial changes to the adapter subsystem. These changes
are important in order to allow users to secure WildFly/EAP Console (HAL),
CLI and Management Interface with Keycloak. More work will be done in order
to make even more easier to protect these resources.
For more details, check https://issues.jboss.org/browse/KEYCLOAK-5015.
Regards.
Pedro Igor
6 years, 8 months
PermissionsTest failures
by Stan Silvert
Lots of failures in Travis. Anybody know off hand what this is about?
Running org.keycloak.testsuite.admin.PermissionsTest
--------- org.keycloak.testsuite.admin.PermissionsTest output start ---------
PermissionsTest ++ [31m14:38:01,920 ERROR [org.jboss.resteasy.resteasy_jaxrs.i18n] (default task-8) RESTEASY002005: Failed executing GET /admin/realms/permissions-test/clients-initial-access: org.keycloak.services.ForbiddenException
PermissionsTest ++ at org.keycloak.services.resources.admin.permissions.ClientPermissions.requireView(ClientPermissions.java:259)
PermissionsTest ++ at org.keycloak.services.resources.admin.ClientInitialAccessResource.list(ClientInitialAccessResource.java:102)
PermissionsTest ++ at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
PermissionsTest ++ at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
6 years, 9 months
