July 2018 - keycloak-dev - Jboss List Archives

by Jamie McDowell

Hi, I am trying to add a client protocol-mapper however when i try and run this i get a HTTP error - 500 Internal Server Error opt/jboss/keycloak/bin/kcadm.sh create \clients/<id>/protocol-mappers/models \-r demorealm \-s protocol=openid-connect \-s protocolMapper=oidc-usermodel-realm-mapper \-s consentRequired=false \-s config.claim.name=group_membership \-s config.jsonType.label=String \-s config.id.token.claim=true \-s config.access.token.claim=true \-s config.userinfo.token.claim=true \-s config.multivalued=true \-s name=Realm \ I can confirm that kcadm works as i have been able to create groups, LDAP mappers, realms etc... In the server.log i can see the below error when i run the above ERROR [org.keycloak.services.error.KeycloakErrorHandler] (default task-109) Uncaught server error: com.fasterxml.jackson.databind.JsonMappingException: Can notat [Source: io.undertow.servlet.spec.ServletInputStreamImpl@55dee6f8; line: 1, column: 119] (through reference chain: org.keycloak.representations.idm.ProtocolMapperRepresentation["co at com.fasterxml.jackson.databind.JsonMappingException.from(JsonMappingException.java:270) at com.fasterxml.jackson.databind.DeserializationContext.reportMappingException(DeserializationContext.java:1234) at com.fasterxml.jackson.databind.DeserializationContext.handleUnexpectedToken(DeserializationContext.java:1122) at com.fasterxml.jackson.databind.DeserializationContext.handleUnexpectedToken(DeserializationContext.java:1075) at com.fasterxml.jackson.databind.deser.std.StringDeserializer.deserialize(StringDeserializer.java:60) Appreciate if anyone can advise on this (keycloak version is 3.4.3) Thanks Jamie

5 years, 8 months

1
0
0 / 0

Cookie support for Jax-RS filter

by Lukasz Lech

Hello, I'm rewriting my Java app secured 'classically' using session-stored credentials to Keycloak. My app is AJAX client with REST channel implemented using JAX-RS, so I've picked up keycloak-jaxrs-oauth-client and JaxrsBearerTokenFilterImpl. However, I have one place which I can't (or I don't see the way to do this) secure using that way: those are URLs that produce binary resources, available as direct downloads ( window.open ) and images (within img tag). I can't instruct browser to add Authorization token in that place, however, the classical cookie approach would work. I can't find a way to use Cookies with given filter, but I ses that BearerTokenRequestAuthenticator is already made extensible (it has QueryParam implementation), however the JaxrsBearerTokenFilterImpl doesn't five a way to choose implementation. Are there any approaches for (optional) cookie based approach made? If the change was made to the bearerAuthentication method to replace BearerTokenRequestAuthenticator authenticator = new BearerTokenRequestAuthenticator(resolvedDeployment); With BearerTokenRequestAuthenticator authenticator = createBearerTokenRequestAuthenticator(resolvedDeployment); I could be free to change the implementation of that method in my custom class with the strategy of my choice (either pure cookie-based strategy, or use cookie only when no Authorization header is present. Is such change-request a reasonable approach, that could be accepted for the community code base? Best regards, Lukasz Lech

5 years, 8 months

1
0
0 / 0

Possible Bug when listing users with fine-grained permissions

by Schuster Sebastian (INST/ESY1)

Hello, we are currently experiencing issues with the "View all users" functionality of the Keycloak Admin Console and the respective API call to /auth/admin/realms/{realm}/users when using the permissions based on the authorization services. In our case, we have users separated into groups and some users are able to view these by means of having the realm-management.query-users role and the group.view-members scope by means of a permission/policy. When such a user tries to view all the users he can see, he only gets a subset or even none. The reason is that in UsersResource, first a paginated subset of users is retrieved that is than filtered by checking visibility for each user. In general, this will return less users than the page and the admin UI will not offer to go to the next page. Even if it did, with many users where you can see only a small subset having to skip over lots of empty pages won’t be feasible. Since we really like to use this feature, we discussed several options to fix it: 1. Keycloak should query for users until it reaches the number of requested viewable users or until it has evaluated all available users (-> can lead to performance issues with an increasing number of users, in the worst case Keycloak needs to pull all users out of the database just to find out the current user might see none) 2. Do the same thing but in the admin console (-> no changes in Keycloak but lots of request, probably even worse idea) 3. Since groups are the resources a user needs to have view-members scope to see users, retrieve all groups from the database, filter out groups without view-members scope and then do a join by group membership and limit the result by paging. (-> less generalized approach, probably better performance as long as there are not too many groups) All of these seem to be far less than ideal. Any thoughts? Best regards, Sebastian Mit freundlichen Grüßen / Best regards Dr.-Ing. Sebastian Schuster Engineering and Support (INST/ESY1) Bosch Software Innovations GmbH | Ullsteinstr. 128 | 12109 Berlin | GERMANY | www.bosch-si.com<http://www.bosch-si.com> Tel. +49 30 726112-485 | Fax +49 30 726112-100 | Sebastian.Schuster(a)bosch-si.com<mailto:Sebastian.Schuster@bosch-si.com> Sitz: Berlin, Registergericht: Amtsgericht Charlottenburg; HRB 148411 B Aufsichtsratsvorsitzender: Dr.-Ing. Thorsten Lücke; Geschäftsführung: Dr. Stefan Ferber, Michael Hahn

5 years, 8 months

2
4
0 / 0

OAuth 2.0 Mutual TLS Client Authentication

by 乗松隆志 / NORIMATSU，TAKASHI

Hello, As for mentioned in https://issues.jboss.org/browse/KEYCLOAK-7512 and https://issues.jboss.org/browse/KEYCLOAK-7635, Is there anyone who currently implements OAuth 2.0 Mutual TLS Client Authentication defined in https://tools.ietf.org/html/draft-ietf-oauth-mtls-07#section-2 ? If no one does it, I would like to try to implement this feature. What do you think about it ? Also, In https://tools.ietf.org/html/draft-ietf-oauth-mtls-07#section-2, two types of OAuth 2.0 Mutual TLS Client Authentication are defined, for PKI and for Self-Signed Certificate. I would be happy if you who are interested in this feature tell me which you like better. Best regards, Takashi Norimatsu Hitachi Ltd.,

5 years, 8 months

2
1
0 / 0

haveibeenpwned.com password policy provider

by Thomas Darimont

Hello Keycloak Team, yesterday I implemented a password policy provider [0] for Keycloak which checks if a given password is contained in the password breach database haveibeenpwned.com. The policy provider uses their range based password search API [1] which uses a "k-Anonymity model" [2] which allows a password to be looked up by partial hash. The real password is never revealed to the service, only the first few bytes of the SHA-1 hash is used for the search which then returns a list of password hashes with the given prefix. Those hashes are then checked by the provider to see if the actual password was contained in the database and how often it occurred. Do you guys think that this could be something interesting to add to Keycloak? Cheers, Thomas [0] https://github.com/thomasdarimont/keycloak/tree/issue/KEYCLOAK-XXX-haveib... [1] https://haveibeenpwned.com/API/v2#SearchingPwnedPasswordsByRange [2] https://en.wikipedia.org/wiki/K-anonymity

5 years, 8 months

3
2
0 / 0

Introduce role attributes

by Lösch, Sebastian

Hi developers, we are currently setting up a project using keycloak and need to model: - representative roles, i.e. roles that are given temporarily from one user to another e.g. in holiday times - roles contain entitlements on business objects The current role object in keycloak is not sufficent for our use cases. Searching for a solution I stumbled over https://issues.jboss.org/browse/KEYCLOAK-961 Introducing role attributes would solve my challenges. Also this fits well in the keycloak data model, as there are already user attributes, group attributes, realm attributes. So I would like to add role attributes to keycloak in the style of group attributes. What do you think? Best regards, Sebastian

5 years, 8 months

4
3
0 / 0

html encoded url in form actions - bug or feature?

by Felix Meißner

Hi all, I just discovered that the action url of the login-form seems to get HTML encoded and I woundered, if thats a bug or a feature. In https://github.com/keycloak/keycloak/blob/4.1.0.Final/themes/src/main/res... you can see the following line: <form id="kc-form-login" onsubmit="login.disabled = true; return true;" action="${url.loginAction}" method="post"> On my instance, this resolves to something similar to this: <form id="kc-form-login" onsubmit="login.disabled = true; return true;" action=" https://xx.xx.xx.xx:8443/auth/realms/master/login-actions/authenticate?se..." method="post"> All "&" are encoded as &. This became an issue for me, when I tried to call the url via JavaScripts fetch method. With the same URL, I got a sevrer error. When changing the URL to: fetch("${url.loginAction?no_esc}", ...) it finally worked. Shouldn't all form-urls and href-urls not be escacped? What makes me wonder is, that the same URL just works for regular post requests! For documentation on escaping you can find more information here: https://freemarker.apache.org/docs/dgui_quickstart_template.html#dgui_qui... Greetings, Felix -- Ein Produkt der Cap3 GmbH, Ringstr. 19, 24114 Kiel, Deutschland Registergericht: Amtsgericht Kiel, HRB 13257 Geschäftsführung: Felix Magedanz, Nicolas Günther, Bettual Richter, Sören Fenner

5 years, 9 months

3
4
0 / 0

Support for updating user with credentials in admin endpoints

by Hiroyuki Wada

Hello, Currently the Admin REST API ignores credentials when updating the user. I found the similar issue & discussion in the following links. It was accepted but it only supports creating method. https://issues.jboss.org/browse/KEYCLOAK-5026 http://lists.jboss.org/pipermail/keycloak-dev/2017-June/009552.html In our case, we'd like to update users profile including any credentials from an external ID system. Could I send a pull request for supporting it? Best Regards -- Hiroyuki Wada Nomura Research Institute, Ltd. h2-wada(a)nri.co.jp -------------------------------------------------------------------- PLEASE READ:This e-mail is confidential and intended for the named recipient only. If you are not an intended recipient, please notify the sender and delete this e-mail. --------------------------------------------------------------------

5 years, 9 months

3
4
0 / 0

Exception on logout

by Eivind Larsen

Hi Keycloak Devs! We are running Keycloak 3.4.3.Final in a 3 node cluster. A few times per hour we see this exception in the logs: java.lang.NullPointerException at org.keycloak.services.DefaultKeycloakSession.getProvider(DefaultKeycloakSession.java:171) 5 lines skipped for [sun., com.sun, org.jboss, java.lang.reflect.Method] at org.keycloak.services.managers.AuthenticationManager.finishBrowserLogout(AuthenticationManager.java:518) at org.keycloak.services.managers.AuthenticationManager.browserLogout(AuthenticationManager.java:484) at org.keycloak.protocol.oidc.endpoints.LogoutEndpoint.logout(LogoutEndpoint.java:137) 16 lines skipped for [javax.servlet, sun., org.jboss, java.lang.reflect.Method] at io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:85) at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:129) at org.keycloak.services.filters.KeycloakSessionServletFilter.doFilter(KeycloakSessionServletFilter.java:90) at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61) at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131) at io.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.java:84) at io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:62) at io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36) at org.wildfly.extension.undertow.security.SecurityContextAssociationHandler.handleRequest(SecurityContextAssociationHandler.java:78) at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) at io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:131) at io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:57) at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) at io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:46) at io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64) at io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:60) at io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:77) at io.undertow.security.handlers.NotificationReceiverHandler.handleRequest(NotificationReceiverHandler.java:50) at io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43) at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) at org.wildfly.extension.undertow.security.jacc.JACCContextIdHandler.handleRequest(JACCContextIdHandler.java:61) at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) at org.wildfly.extension.undertow.deployment.GlobalRequestControllerHandler.handleRequest(GlobalRequestControllerHandler.java:68) at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) at io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:292) at io.undertow.servlet.handlers.ServletInitialHandler.access$100(ServletInitialHandler.java:81) at io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:138) at io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:135) at io.undertow.servlet.core.ServletRequestContextThreadSetupAction$1.call(ServletRequestContextThreadSetupAction.java:48) at io.undertow.servlet.core.ContextClassLoaderSetupAction$1.call(ContextClassLoaderSetupAction.java:43) at org.wildfly.extension.undertow.security.SecurityContextThreadSetupAction.lambda$create$0(SecurityContextThreadSetupAction.java:105) at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1508) at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1508) at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1508) at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1508) at io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:272) at io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:81) at io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:104) at io.undertow.server.Connectors.executeRootHandler(Connectors.java:326) at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:812) at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) at java.lang.Thread.run(Thread.java:748) It looks like a bug as the session provider probably should not be null, and it breaks the logout flow for the user. Is this a known issue? - Eivind

5 years, 9 months

1
0
0 / 0

https://issues.jboss.org/browse/KEYCLOAK-4251

by Wim Vandenhaute

I had the same issue as described in issue https://issues.jboss.org/browse/KEYCLOAK-4251 and would like to ask for the argument of having different behavior for this use case happening from the browser vs via direct access grants. I can understand the argument in not wanting to leak too much information to possible attackers regarding user account status, but at least then this behavior should be aligned in both situations which is not the case here so in my opinion the issue is valid. Either the login form should change or the direct access grant should change imo Browser: Username already exists Direct access grant: "Invalid user credentials" Thoughts?

5 years, 9 months

1
0
0 / 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

keycloak-dev July 2018