November 2018 - keycloak-dev - Jboss List Archives

by Guillaume Vincent

Hello, this mail is an email to give my feedback on Keycloak Javascript Adapter. The feedback is not good. If you are not open to criticism, do not read this email. TLDR: The Javascript code is a 1500+ line of code, untested, with 10 levels of indentations, no abstraction, difficult to read, difficult to maintain, include in an web application and not following semver. # loc maintain and fix 1500 line of code is not easy at all. The javascript adapter should be split in small javascript functions/modules/class and respect some basic clean code. SRP, no duplication, etc. # tests No single test on the javascript adapter? really. We should introduce some basic tests and API test to avoid breaking the interface. Basically decrypting a JWT, parsing the url, initialisation could be tested easily. # semver In javascript world, the common convention regarding the version number is semver[1]. So when the API change, the major version should be incremented. Not the minor one. We could avoid like that fixing the version number in package.json [2] to avoid those kind of bug [3] # integration in existing app nobody today create real professional frontend application using the plain javascript file. The frontend world is compose of small piece assemble together. We use bundler like webpack, browserify, rollup etc to create our application. Basically we don't do this: ``` <script src="keycloak.js"></script> <script> var keycloak = Keycloak(); keycloak.init() </script> ``` we do this ``` const Keycloack = require("keycloack"); var keycloak = Keycloak(); keycloak.init(); ``` yes like in node # modules the keycloak library should use modules or be decomposed into modules. Decoupled in small piece and use rollup or webpack to bundle the application. It will help for example bundler to do tree shacking for example and reduce the bundle size of the library. So instead of try to reinvent the wheel and introduce some insecure code[4]. We should use javascript module, well tested like this one[5] and do something like const uuidv4 = require('uuid/v4'); function createUUID() { return uuidv4(); } # hashtag redirectURL doesn't work if it contains a hashtag. Popular framework AngularJS, VueJS use hastag technique for routing. # cookies, iframe This make our work as developer trully hard. Basically the simplest javascript adpater, should be Instantiate a keycloak singleton load existing jwt in localstorage if present load url params to see if jwt in the url if jwt is present, save in local storage update the singleton # cordova adapter I don't look at this code, but I'm just asking myself, why a javascript adapter need a special code for cordova application? # keycloak promise Oo https://www.keycloak.org/docs/latest/upgrading/index.html#javascipt-adapt... A promise is standardized in javascript, so you should avoid using this term in the code if you don't return a promise. callback is a better term. A promise should return a unfulfilled method with then and catch methods attach to it. In French we have a proverb: "Criticism is easy, art is difficult". So I will definitely create a smaller javascript adapter that does not suffer from the problems listed above. And I would come and show the code here. Thanks for reading me [1] https://semver.org/ [2] https://github.com/redhat-cip/dci-ui/commit/e4d0208128afa05c33e72abe606cd... [3] https://issues.jboss.org/browse/KEYCLOAK-8839 [4] https://github.com/keycloak/keycloak/blob/master/adapters/oidc/js/src/mai... [5] https://github.com/kelektiv/node-uuid -- Guillaume Vincent Senior FrontEnd Engineer gvincent(a)redhat.com <https://red.ht/sig> TRIED. TESTED. TRUSTED. <https://redhat.com/trusted>

5 years, 5 months

3
5
0 / 0

Re: [keycloak-dev] [keycloak-user] Extend keycloak notifications

by David Monichi

Hi Dmitry, To don't bother normal users I changed to the dev group mailing list. thx a lot for your detailed feedback. Considering that you are probably right, that this feature will never be integrated to keycloak, I'll have to think about my next steps. Guess I'll follow your advise and catch internal keycloak events for notifications. Currently it seems like the best solutions. As soon as we start with this component I'll let you know. Planning to make it open source but unfortunately can't promise yet. Thx for all in the meantime /david On 13.11.18 00:20, Dmitry Telegin wrote: > Hello David, > > Just FYI, you can reach Keycloak developers via keycloak-dev mailing list; this one is more like a community of independent Keycloak experts. Being a proud member thereof, I'll put in my two cents with great pleasure :) see answers inline. > > TL;DR: the feature seems interesting, but I highly doubt it will be ever made a part of Keycloak. However, you can implement everything as a Keycloak extension (and that's what we love about Keycloak). > > On Mon, 2018-11-12 at 22:55 +0100, David Monichi wrote: >> Hi, >> >> I'm considering to create a new application and for sure I'll use >> keycloak as user backend. It's really cool stuff what you guys created. >> >> I thought about various solutions for notifications of my application >> and was wondering if you guys already thought about to extend your >> e-mail notification to a more general and flexible system. So that not >> only keycloak e-mails will be sent over keycloak but also other >> applications e-mails and even more notifications can be send over >> keycloak (I'm thinking here of SMS, etc.). Therefore applications would >> need to upload any kind of templates to keycloak and somehow be able to >> manage them. There are 2 reasons for such a step. First of all keycloak >> already provides such basic functionality to sent notifications and so >> extending it could be done with lower overhead. Second, keycloak already >> owns the recipient data, if applications manage users over keycloak. > I'd also add that Keycloak already integrates the Freemarker template engine, which is used to generate emails (along with login forms and the account UI). > >> As additional feature of course a proper monitoring should be placed in >> such a feature, since notifications are really vital to modern applications. > Could you please elaborate what exactly you need to monitor? > >> We would be able to provide programming resources for such a feature but >> of course working together, specially for the design phase, with you guys. >> >> The alternative would be to provide a different notification system and >> forward keycloak e-mails to that service (actually the event to sent a >> notification). Don't know if this actually is the way to go ... >> >> >> My motivation for such a feature is, that a single application should be >> responsible for sending notifications of any kind and not be widespread >> over various applications. >> >> Any ideas welcome ;) Eventually I overlooked something in my design ... > My experience says that features like that rarely get incorporated into mainline Keycloak; the necessary (but not sufficient) condition is that you should be able to maintain this feature in the future. > > However, you can use Keycloak extension points (called Providers [1] in Keycloak's terms) to implement what you want. > > Here's my take on the outline of the solution: > - implement EntityProvider [2] (custom JPA entity + DB table) to store templates; > - implement RealmResourceProvider [3] (custom REST resource) for CRUD-style template management by the applications; > - implement another one to trigger notification (and potentially track its status); > - implement the actual notification code, i.e. retrieving the template, processing it with Freemarker and queueing it for delivery; > - most likely, you will need a persistent queue to store pending notifications. For that, you can employ Keycloak's built-in ActiveMQ Artemis message broker; > - optionally, integrate your system with Keycloak internal events, so that the latter could trigger your application-managed notifications. > > For the reference, I'd recommend the official keycloak examples [4] and my own BeerCloak project [5]. > > Good luck, and feel free to ask any questions :) > > Dmitry Telegin > CTO, Acutus s.r.o. > Keycloak Consulting and Training > > Pod lipami street 339/52, 130 00 Prague 3, Czech Republic > +42 (022) 888-30-71 > E-mail:info@acutus.pro > > [1]https://www.keycloak.org/docs/latest/server_development/index.html#_pro... > [2]https://www.keycloak.org/docs/latest/server_development/index.html#_ext... > [3]https://www.keycloak.org/docs/latest/server_development/index.html#_ext... > [4]https://github.com/keycloak/keycloak/tree/master/examples/providers > [5]https://github.com/dteleguin/beercloak > >> Thx in advance for all your thoughts & all the best >> >> /david >> >> _______________________________________________ >> keycloak-user mailing list >> keycloak-user(a)lists.jboss.org >> https://lists.jboss.org/mailman/listinfo/keycloak-user

5 years, 5 months

1
0
0 / 0

Service account permissions missing from JSON exports

by Ian Duffy

Hi all, When doing a JSON export of a client or full realm via the UI or via the instructions at [1] I've noticed if a client has a service account with different client permissions assigned they are excluded from the export. Any workaround to fix this or any guidance on where I should start looking to contribute a fix for keycloak 4.7.0? Thanks, Ian. [1] https://www.keycloak.org/docs/2.5/server_admin/topics/export-import.html

5 years, 5 months

2
5
0 / 0

Re: [keycloak-dev] [keycloak-user] Keycloak 4.6.0.Final released

by Cédric Couralet

Le 2018-11-16 18:49, Geoffrey Cleaves a écrit : > I'm unable to get 4.6.0.Final or 4.7.0.Snapshot Docker images to work > properly. The Admin Console throws an error with every action. I've > added new info to this ticket > https://issues.jboss.org/browse/KEYCLOAK-8832 [3] including this > screen cast to prove I'm not loco: > https://www.youtube.com/watch?v=prEO19-UQsk [4] > > Geoff > Hello, I manage to get those error by using DEBUG Log level and using chrome to access admin console. I think the problem is here : https://github.com/keycloak/keycloak/blob/e5bb25dd2f8460bfa818a1cbed0b26c... in the debug message allowedOrigins..toArray() is called even when null. But I don't understand the difference between Firefox and Chrome on this. I think a simple fix is to configure the log level as INFO. Cédric Couralet

5 years, 5 months

1
2
0 / 0

Avatars/User pictures in keycloak

by Ian Duffy

Hi All, Does anyone have a good method for storing avatars/user pictures with Keycloak? I've seen some issues mentioning it but haven't come across any approaches: - https://issues.jboss.org/browse/KEYCLOAK-1044 - https://issues.jboss.org/browse/KEYCLOAK-598 I was thinking something along the lines of an additional user attribute that is a URL to an image. Unsure how to go about getting the user to upload that image, ideally it would be an experience that integrates into the account management screens. Thanks, Ian.

5 years, 5 months

3
4
0 / 0

Placing external libs for provider

by marco.scheuermann＠daimler.com

Hi community, I created a provider implementation and placed it under /providers. The provider has dependencies to other libs, e.g. an azure jar for accessing azure queues. Where do I have to put this lib so that the classloader will find it. I placed it also under /providers but the classes are not loaded.... Thank you, Marco If you are not the addressee, please inform us immediately that you have received this e-mail by mistake, and delete it. We thank you for your support.

5 years, 5 months

2
2
0 / 0

Offline sessions preloading PR

by Marek Posolda

I sent PR https://github.com/keycloak/keycloak/pull/5716 for fixes and performance improvements about the preloading of offline sessions. With this, the preloading of offline sessions at startup is still required, however it is highly optimized. Without this, preloading of 500K sessions on my laptop took 16 minutes (some customers reported 40 minutes in real environment). Now it is 18 seconds on my laptop. Moreover the preloading time was previously exponentially dependent to the total count of sessions, now it is lineary dependent. I know it will be even better to remove a need for preloading entirely, but there are few kinks around it. Hopefully in the future, we can delegate persistence of userSessions to infinispan entirely. The summary of changes in the PR: - It is not required anymore to lookup User at the startup when the UserSession is preloaded. In case that user is not available anymore at the time of preloading (which can happen especially with 3rd party UserStorage providers, for example when user was directly deleted from LDAP), then UserSession will be removed anyway later from both infinispan and DB due the fact that it will become expired as user doesn't exists and it won't be possible to refresh token. - The pagination SQL queries are based on "seeking" rather then classic pagination based on offset. See https://www.eversql.com/faster-pagination-in-mysql-why-order-by-with-limi... and https://use-the-index-luke.com/sql/partial-results/fetch-next-page for details. This proved to have much better performance (at least for MySQL, but probably for the other DBs too) - DB Index added for column LAST_SESSION_REFRESH of table OFFLINE_USER_SESSION for the seeking above - Sessions are put to infinispan through the "cache.putAll" instead of many separate calls of "cache.put" . This is important especially for cluster and cross-dc, as when you call "cache.put" 100 times, you may have around 100 network calls, when with "cache.putAll" it is 1 bigger network call. - When some offline sessions are refreshed, there is bulk update of lastSessionRefresh times to DB every minute. So there is no DB write for each token refresh, but bulk update similarly like we have for cross-dc. This allows more proper tracking of expired sessions from both DB and Infinispan and there is no need for a workaround to automatically update all sessions at startup to the current time (which was problematic for environments with often restarts as offline sessions were defacto never expired). JIRA with the details is https://issues.jboss.org/browse/KEYCLOAK-5479 . A side-effect is, that UserSessionInitializerTest seems to be fixed now - https://issues.jboss.org/browse/KEYCLOAK-8723 . TBH I am not sure about exact cause why it is failing on master, however with latest master, it failed for me after 50 runs when running this test in a loop on my laptop. Similar behaviour was seen by Sebastian as well on his laptop. With this PR, I had more than 300 runs without any failure. Marek

5 years, 5 months

2
2
0 / 0

Keycloak 4.6.0.Final released

by Stian Thorgersen

http://blog.keycloak.org/2018/11/keycloak-460final-released.html

5 years, 5 months

1
0
0 / 0

Cron jobs for the quickstarts

by Bruno Oliveira

Good morning, while I was fixing the quickstarts build I was thinking about having a daily cron job to build master. The reason why I would like to do this is to get breaking changes from Keycloak server early. The way how we do today is counterproductive from my point of view, because we only know that things are broken when someone submits a PR. Thoughts? -- - abstractj

5 years, 5 months

5
5
0 / 0

KEYCLOAK-598 Support for uploading profile images via account pages

by Thomas Darimont

Hello Keycloak Team, a few days ago there was a discussion on the mailing list about Avatar profile pictures which mentioned some existing JIRA issues [3], [4]. I have created a small example extension [1] that allows you to upload profile pictures with a custom realm "AccountResource" via the account page. This extension supports an "AvatarStorageProvider SPI" which allows exchangeable storage mechanisms for avatars. I have kept the "account" page simple, but I also have an example which supports dynamic cropping of the avatar image with "cropperjs" [2], which needs some polishing. Currently the extension is installed as "ear" but could also be integrated directly into Keycloak. What do you think about a direct integration into Keycloak? Best regards, Thomas [1] https://github.com/thomasdarimont/keycloak-avatar-minio-extension [2] https://github.com/fengyuanchen/cropperjs [3] https://issues.jboss.org/browse/KEYCLOAK-598 [4] https://issues.jboss.org/browse/KEYCLOAK-1044

5 years, 5 months

1
0
0 / 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

keycloak-dev November 2018