May 2018 - keycloak-dev - Jboss List Archives

JWS signatures using PS256 or ES256 algorithms for signing

by 乗松隆志 / NORIMATSU，TAKASHI

I'd like to use more secure JWS signature algorithm in the environment where the high security level is required such as the financial industry. According to the following RFCs, RSASSA-PSS to which PS256 follows is recommended on behalf of RSASSA-PKCS1-v1_5 to which RS256 follows. https://tools.ietf.org/html/rfc3447#section-8 However, according to the following RFC, ES256 is "Recommended+" while PS256 is "Optional". https://tools.ietf.org/html/rfc7518#section-3.1 Moreover, it is said that Elliptic Curve based algorithms have an advantage against RSA base algorithms in volume of its computation. Therefore, I've tried to make keycloak support ES256 JWS signature along with existing RS256 one. I've found that it seemed to be relatively easy to implement software components for ES256 JWS signature such as Signature Provider and Key Provider. However, it seemed to be difficult to implement codes actually calling these providers. The reasons is as follows. * a lot of places have called these singing and verifying providers. * such the places have been hard-coded in RSA algorithm specific. To deal with them, the following ideas have hit on me 1. replace RSA algorithm specific codes with signature algorithm independent codes. 2. re-design JWS signing and verifying scheme on high level. I'm not familiar with keycloak internals, so I've implemented ES256 JWS signature support on #1 basis experimentally. I'm not sure whether this way is appropriate or not. I'm very happy if keycloak specialists consider #2 or review my implementation based on #1. I've issued PR as WIP. Please refer to the following in detail. https://github.com/keycloak/keycloak/pull/5225 Best regards, Takashi Norimatsu Hitachi Ltd.,

5 years, 11 months

2
1
0 / 0

Re: [keycloak-dev] [keycloak-user] Keycloak 4.0.0.Final released

by Stian Thorgersen

It should be around 3 weeks after Beta3 On 25 May 2018 at 05:08, Subodh Joshi <subodhcjoshi82(a)gmail.com> wrote: > Any idea when Final release will happen? > > On Thu, May 24, 2018 at 11:06 PM Stian Thorgersen <sthorger(a)redhat.com> > wrote: > >> It's indeed Beta3 that was released and not Final. Final will be next >> though! >> >> On 24 May 2018 at 19:24, Thomas Darimont <thomas.darimont(a)googlemail.com> >> wrote: >> >> > Congrats! >> > >> > The blog says 4.0.0.Beta3 is this now the final 4.0.0 version? >> > >> > Cheers, >> > Thomas >> > >> > Stian Thorgersen <sthorger(a)redhat.com> schrieb am Do., 24. Mai 2018, >> > 19:18: >> > >> >> To download the release go to the Keycloak homepage >> >> <http://www.keycloak.org/downloads>. >> >> Highlights >> >> Fuse 7 Adapter >> >> >> >> There's now support for Fuse 7. >> >> Cordova options in JavaScript adapter >> >> >> >> It's now possible to pass Cordova specific options to login and other >> >> methods in the JavaScript adapter. Thanks to loorent >> >> <https://github.com/looorent> for the contribution. >> >> Search by user id on admin console >> >> >> >> If you wanted to search by a user by id in the admin console you had to >> >> edit the URL. It's now possible to do it directly in the user search >> >> field. >> >> More... >> >> >> >> The full list of resolved issues is available in JIRA >> >> <https://issues.jboss.org/issues/?jql=project%20%3D% >> >> 20keycloak%20and%20fixVersion%20%3D%204.0.0.Beta3> >> >> . >> >> Upgrading >> >> >> >> Before you upgrade remember to backup your database and check the >> upgrade >> >> guide <http://www.keycloak.org/docs/latest/upgrading/index.html> for >> >> anything that may have changed. >> >> _______________________________________________ >> >> keycloak-dev mailing list >> >> keycloak-dev(a)lists.jboss.org >> >> https://lists.jboss.org/mailman/listinfo/keycloak-dev >> >> >> > >> _______________________________________________ >> keycloak-user mailing list >> keycloak-user(a)lists.jboss.org >> https://lists.jboss.org/mailman/listinfo/keycloak-user >> > > > -- > Subodh Chandra Joshi > subodh1_joshi82(a)yahoo.co.in > http://www.trendsinnews.com >

5 years, 11 months

3
4
0 / 0

Re: [keycloak-dev] [keycloak-user] Keycloak 4.0.0.Final released

by Subodh Joshi

Any idea when Final release will happen? On Fri, May 25, 2018 at 8:38 AM Subodh Joshi <subodhcjoshi82(a)gmail.com> wrote: > Any idea when Final release will happen? > > On Thu, May 24, 2018 at 11:06 PM Stian Thorgersen <sthorger(a)redhat.com> > wrote: > >> It's indeed Beta3 that was released and not Final. Final will be next >> though! >> >> On 24 May 2018 at 19:24, Thomas Darimont <thomas.darimont(a)googlemail.com> >> wrote: >> >> > Congrats! >> > >> > The blog says 4.0.0.Beta3 is this now the final 4.0.0 version? >> > >> > Cheers, >> > Thomas >> > >> > Stian Thorgersen <sthorger(a)redhat.com> schrieb am Do., 24. Mai 2018, >> > 19:18: >> > >> >> To download the release go to the Keycloak homepage >> >> <http://www.keycloak.org/downloads>. >> >> Highlights >> >> Fuse 7 Adapter >> >> >> >> There's now support for Fuse 7. >> >> Cordova options in JavaScript adapter >> >> >> >> It's now possible to pass Cordova specific options to login and other >> >> methods in the JavaScript adapter. Thanks to loorent >> >> <https://github.com/looorent> for the contribution. >> >> Search by user id on admin console >> >> >> >> If you wanted to search by a user by id in the admin console you had to >> >> edit the URL. It's now possible to do it directly in the user search >> >> field. >> >> More... >> >> >> >> The full list of resolved issues is available in JIRA >> >> <https://issues.jboss.org/issues/?jql=project%20%3D% >> >> 20keycloak%20and%20fixVersion%20%3D%204.0.0.Beta3> >> >> . >> >> Upgrading >> >> >> >> Before you upgrade remember to backup your database and check the >> upgrade >> >> guide <http://www.keycloak.org/docs/latest/upgrading/index.html> for >> >> anything that may have changed. >> >> _______________________________________________ >> >> keycloak-dev mailing list >> >> keycloak-dev(a)lists.jboss.org >> >> https://lists.jboss.org/mailman/listinfo/keycloak-dev >> >> >> > >> _______________________________________________ >> keycloak-user mailing list >> keycloak-user(a)lists.jboss.org >> https://lists.jboss.org/mailman/listinfo/keycloak-user >> > > > -- > Subodh Chandra Joshi > subodh1_joshi82(a)yahoo.co.in > http://www.trendsinnews.com > -- Subodh Chandra Joshi subodh1_joshi82(a)yahoo.co.in http://www.trendsinnews.com

5 years, 11 months

1
0
0 / 0

Keycloak 4.0.0.Final released

by Stian Thorgersen

To download the release go to the Keycloak homepage <http://www.keycloak.org/downloads>. Highlights Fuse 7 Adapter There's now support for Fuse 7. Cordova options in JavaScript adapter It's now possible to pass Cordova specific options to login and other methods in the JavaScript adapter. Thanks to loorent <https://github.com/looorent> for the contribution. Search by user id on admin console If you wanted to search by a user by id in the admin console you had to edit the URL. It's now possible to do it directly in the user search field. More... The full list of resolved issues is available in JIRA <https://issues.jboss.org/issues/?jql=project%20%3D%20keycloak%20and%20fix...> . Upgrading Before you upgrade remember to backup your database and check the upgrade guide <http://www.keycloak.org/docs/latest/upgrading/index.html> for anything that may have changed.

5 years, 11 months

2
2
0 / 0

Few Questions on usage

by gambol

Hiya Apologizes for the wide range questions .. but figured a number for be useful for the user base. - Using the current scripted authentication in Authentication Flows would it possible to use script to say if clientid == x and user have role x, permitted else not. Also do you have a repo with some examples of scripts? similar to https://github.com/auth0/rules - Will the scripting always be global level, or is there any plan to make it per client? or perhaps a better question would be will authentication flow always be at the realm level. - Assuming a realm with multiple identity providers, is there any means by which a client and enforce that a use came in via a specific identity provider? or if i come in via provider x they need to use MFA (would this be done with a Post Login Flow on the provider perhaps?). - Is the any plans to make Groups per client and under the client ui? as for realms which have many disassociated applications but common user bases it makes it easier for them to manage. - Are the any plans to expose metrics (or perhaps they are already exposed)? via jmx, stats, prometheus etc .. around logins, successful, failed etc, any latency measures on identity providers, infinispan / database operations etc - Is there any way to turn off the internal passwords and force via identity provider? .. i guess this is where scripting becomes useful .. i.e if client = y get the provider name and deny if not y etc Rohith

5 years, 11 months

4
5
0 / 0

Fwd: An ability to evaluate/transform the template variables during the SAML/OpenID protocol mappers processing

by Serhii Shymkiv

No luck with Users list, trying the Devs one ... ---------- Forwarded message ---------- From: Serhii Shymkiv <sergey(a)shimkiv.com> Date: Sat, Apr 21, 2018 at 9:11 PM Subject: An ability to evaluate/transform the template variables during the SAML/OpenID protocol mappers processing To: keycloak-user(a)lists.jboss.org Hello Guys, current email thread is inspired by the https://github.com/keycloak/ keycloak/pull/5042 and the question for the community is: - what do you think if the Keycloak will have an ability to evaluate/transform the template variables during the SAML/OpenID protocol mappers processing ? Examples (please refer to the attached "snapshot-1.png" and "snapshot-2.png"): 1. "snapshot-1.png": ${firstName} ${lastName} => the simplest expression, the template variables will be evaluated into the real values of the user (in this case) properties => e.g.: "Serhii Shymkiv" (without quotes, of course) 2. "snapshot-2.png": Welcome back, #(${firstName} ${lastName}) ?: ${email} => almost the same expression but with additional logic which means that the value of the #(...) block will be used only if it is not blank (null or space symbols only) otherwise the expression to the right of the ?: operator will be evaluated => e.g.: "Welcome back, Serhii Shymkiv" e.g.: "Welcome back, sergey(a)shimkiv.com" Thank you for you time. -- Best regards, Serhii Shymkiv. -- Best regards, Serhii Shymkiv.

5 years, 11 months

2
2
0 / 0

POST method for OIDC Authorization End Point

by Muein Muzamil

Hi all, I have a quick question, does Keycloak support POST method for OIDC Authorization Request? I was trying to integration Keycloak with an SP, which is using POST for Auth request and Keycloak rejects the request with "405 Method Not Allowed" Error. I looked at the OIDC Specs and accordingly, to that both GET and POST should be supported for Authorization Request. Maybe I am missing something, can someone please shed some light on this. This also makes me wonder, is the Keycloak fully compliant with OIDC Specs? did we run any compliance tests to confirm this? Best regards, Muein

5 years, 11 months

3
3
0 / 0

Current usage of mvn-golang-wrapper not compatible with product builds

by Alex Szczuczko

Hi, I found a productization issue that was introduced to master after 7.2.x was split off, so it's an issue for 7.3 and continuous prod. Specifically, mvn-golang-wrapper depends on storage.googleapis.com and github.com. See KEYCLOAK-7362 for more details [1]. Bill, I'm CC'ing you, since you introduced this plugin in commit 681e3d. Fortunately we don't actually run the test suite as part of the product build itself, so I've filed a PR to skip this plugin in the product build. This should be good enough for now, but we'll need a better solution, as I elaborate on in this[3] comment on JIRA. Alex [1] https://issues.jboss.org/browse/KEYCLOAK-7362 [2] https://github.com/keycloak/keycloak/pull/5208 [3] https://issues.jboss.org/browse/KEYCLOAK-7362?focusedCommentId=13577836#c...

5 years, 11 months

2
6
0 / 0

Configuring session timeouts on the Keycloak Security Proxy

by Rory Hart

Hi folks I'd like to be able to control how long a session takes to timeout in the keycloak security proxy, the default 30 minutes (via the Undertow InMemorySessionManager) isn't enough for our usage. I am happy to put a PR together for this if it is a feature that will be accepted? Thanks Rory Hart

5 years, 11 months

1
0
0 / 0

Error loading KeycloakHotRodMarshallerFactory

by Adrien DESBIAUX

Hello, I am facing an issue in regards to launching Keycloak 3.4 in Domain mode with an external Infinispan cluster. I following error is thrown: Caused by: java.lang.ClassNotFoundException: org.keycloak.cluster.infinispan.KeycloakHotRodMarshallerFactory from [Module "org.wildfly.clustering.service" from local module loader @7a0ac6e3 (finder: local module finder @71be98f5 (roots: /opt/jboss/keycloak-3.4.3.Final/modules,/opt/jboss/keycloak-3.4.3.Final/modules/system/layers/keycloak,/opt/jboss/keycloak-3.4.3.Final/modules/system/layers/base))] I don't get this error when using the standalone-ha mode. Did you test the Multi datacenter configurationh with the domain mode already? https://www.keycloak.org/docs/latest/server_installation/index.html#_doma... Guide Overview - Keycloak<https://www.keycloak.org/docs/latest/server_installation/index.html#_doma...> www.keycloak.org The purpose of this guide is to walk through the steps that need to be completed prior to booting up the Keycloak server for the first time. If you just want to test drive Keycloak, it pretty much runs out of the box with its own embedded and local-only database. Why would be the class KeycloakHotRodMarshallerFactory not correctly loaded in domain mode? I will keep searching but would be happy if some of you would have time to share their opinion on this. Thank you in advance for your direction.

5 years, 11 months

2
3
0 / 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

keycloak-dev May 2018