September 2018 - keycloak-dev - Jboss List Archives

Wildcard for Valid Redirect URI Hostname

by Josh Cain

Per KEYCLOAK-3585: <https://issues.jboss.org/browse/KEYCLOAK-3585> Currently, valid redirect URI hostnames allow for wildcards at the end like so: http://www.redhat.com/* I'm managing several environments where clients need 'n' number of available redirect URI's with different hostnames, I.E. http://developer1.env.redhat.com http://developer2.env.redhat.com http://developer3.env.redhat.com Would really help to have the ability to wildcard hostnames too, I.E.: http://*.env.redhat.com I've submitted #3241 <https://github.com/keycloak/keycloak/pull/3241> to address this issue, but there seem to be some concerns about allowing wildcards in other parts of the URL. See the PR for a more fleshed out discussion, but wanted to start a thread here on the mailing list. Particularly with respect to: - Does anyone have need of this feature or would find it useful? - Should this kind of wildcard be allowed as a configuration option by Keycloak? Josh Cain | Software Applications Engineer *Identity and Access Management* *Red Hat* +1 256-452-0150

6 years, 10 months

5
13
0 / 0

Keycloak Error : "User with user name XXXX already exists. How do you want to continue"

by Kalidindi, Sai Soma Kala

Hi, We are using 1.9.8 version of keycloak. We have few customers, who has integrated their identity providers like ADFS, OKTA, Ldap ...with our Key cloak and it works. Lately we are seeing this below error message after their successful initial login, this happens to couple of users once in two weeks or so . When they try to login they see the error "User with user name XXXX already exists. How do you want to continue". Initially it used to happens once in few months, at that time, I would go to user_entity table in keycloak and delete the entry with this username and then when user try to log in, it works and entry gets re-created . This is our fix for now, every time any user hits above error, I delete the entry form user_entity tabel. Lately it has been happening once in few days, and we are trying to find permanent fix for this. I would like to understand why this is happening after a series of successful logins by the same user . We are using old version of keycloak, does upgrading to latest version solve this issue? Any recommendation or help on above error is greatly appreciated. Thanks, Sai.

7 years

2
2
0 / 0

Implementation of artifact binding (JIRA KEYCLOAK-831)

by Doswald Alistair

Implementation of artifact binding (JIRA KEYCLOAK-831) Hello, Last week I did a PoC implementation of the SAML artifact binding in a branch off keycloak 4.3.0.Final. The implementation can be seen here at https://github.com/AlistairDoswald/keycloak/tree/projectathon (don't judge me too harshly for the quality of the code if you look at it, I had about 2 days to have a working implementation, which included finding out how that part of the protocol worked). However, I now want to write a "correct" implementation against keycloak/master and if possible I'd like some feedback/advice on my intended implementation. 1. General implementation >From the description in the SAML specification (see here section 3.6, https://docs.oasis-open.org/security/saml/v2.0/saml-bindings-2.0-os.pdf), artifact binding can be used for transmitting the request message, the response message or both. Initially, I intend only to do the implementation for the response messages. If I'm not mistaken, this means only for the Response and LogoutResponse messages. Would this be considered a suitable implementation of the JIRA? 2. User interface When a SP requests an artifact, it can do so by specifying HTTP-Artifact instead of HTTP-POST or HTTP-redirect, and the process is then transparent with regard to the configuration of the client. However, I believe that the client should have a "Force artifact binding" binary slider and also a field to specify an artifact binding address. In this manner, the artifact binding can be used in conjunction with the IdP initiated login method. Importing must also set the artifact binding address if it is present in the SP metadata. 3. IdP metadata IdP metadata must contain at least one ArtifactResolutionService, I intend to have only one, with its index set to 0 and isDefault=true, and the binding set to the same address as the HTTP-POST (as for ECP) 4. Sending an artifact instead of the normal saml message This is the section for which I have the greatest uncertainty with respect to a correct implementation. Broadly this means intercepting the output response, and sending a 302 redirect or a POSTed form with the artifact instead. Considering the length of the artifact, I see no reason to use a form, but should this be an option in the GUI? More practically, this means generating the response, saving it in the cache, and sending the redirect (or form) instead. I believe that the client's cache would be the best place to save this information (through the AuthenticatedClientSessionModel to be precise), but I'm not certain because it's the first time I'm seeking to store some new information in the cache. The key would be the artifact, and the value in my view should be the document, as that way we can create a complete signed/encrypted ArtifactResponse containing the Response or LogoutResponse. For the implementation details I'm not sure if it would be best to make the changes directly in the SamlProtocol class, or to do something similar to the SamlECPProfileService which overrides the methods of the SamlProtocol. For SamlECPProfileService the current implementation makes sense, but for artifact binding I fear there would be significant code duplication (of course, I could also do a mix with some small modifications in the SamlProtocol class and a SamlArtifactProfileService, or something similar). For triggering this artifact workflow, it would either be if the AuthnRequest has a ProtocolBinding set to urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact, or if the client has "force artifact binding" set to true. 5. Receiving an ArtifactResolve message For this part, my current implementation seems correct to me: the soapBinding method in class SamlService is modified to check the contents of the soap message arriving: if it is an ArtifactResolve, the corresponding ArtifactResponse generated earlier is packaged in a soap message and sent as a response. If not, the ECP profile is tried. The key-ArtifactResponse pair is removed from the cache during this operation. I am, however, not sure yet how the cache should handle purging of expired ArtifactResponse messages that are never asked for. 6. Errors, logging and audit Obviously, the error handling should work as described in the protocol, but also be logged as such. I don't think there's any messages to log in INFO, but the DEBUG logs should show the messages and allow an admin to easily put the entire sequence together. Also, I don't think there's any need for any extra information in the audit logs. 7. Tests Obviously, I'll have to add some tests for these functions, which should be: - Standard unit tests for individual functions that can be separated from objects that would otherwise have to be mocked - Tests with arquillian to test the flow with artifact binding (sp initiated and idp initiated), the options available in the GUI (extra field, forced) as well as the error cases (i.e. asking twice for the same artifact, for an artifact that doesn't exist, etc...). If you have any comments (anything missing, things that should be implemented differently in your view, etc...) feel free to let me know. Best regards, Alistair Doswald

7 years

2
2
0 / 0

Improved CSP support

by Johannes Knutsen

Hi, I am currently looking at improvements in the Content Security Policy (CSP) support. In our deployment, we have security requirements stating that a CSP header should be used and inline scripts, styles and resources should be blocked. For example by setting a CSP value like default-src 'self';. Such a policy breaks Keycloak's manipulation of the browser history implemented in the BrowserHistoryHelper, since the JavascriptHistoryReplace injects an inline JavaScript. The simplest workaround is to also inject a nonce value or SHA hash of the script to the existing CSP header. However, while implementing this, I found that a CSP nonce in general would be nice to have available in any template context. This will also make it easier to migrate the default Keycloak theme to support stricter security policies. An example implementation can be found here: https://github.com/knutz3n/keycloak/commit/c6cfb3efa2942d7569066c0e4bd90a... Would you be interested in merging a change like the one above? If not, what is your view on how to allow stricter content security policies? Tests and documentation is currently missing, but I will add both if this is something you would consider merging. As a note, I have also done some work on supporting a strict CSP value for the default theme. But there are some issues with included 3rd party scripts which must/should be resolved. Let me know if you want more details regarding this. Best regards, Johannes Knutsen

7 years

2
4
0 / 0

Latest changes with JGroups discovery in 4.5.0.Final Docker Image

by Schuster Sebastian (INST-CSS/BSV-OS)

Hi everybody, I think there are some minor issues with the changes in the 4.5.0 Docker image. In docker-entrypoint.sh per default if nothing is specified the jboss.bind.address and jboss.bind.address.private are both set to hostname –i and if nothing is specified standalone-ha mode is used. I find that at least questionable, I think running standalone is a safer default compared to opening JGroups communication on a public interface. However, the default works for us in Kubernetes. However, the detection whether a profile was specified (if echo "$@" | egrep -v -- "-c "; then) should be improved, only looking for “-c” does not work as “—server-config” is equally possible. Wildfly will die with an error if both are present… Best regards, Sebastian Mit freundlichen Grüßen / Best regards Dr.-Ing. Sebastian Schuster Open Source Services (INST-CSS/BSV-OS) Bosch Software Innovations GmbH | Ullsteinstr. 128 | 12109 Berlin | GERMANY | www.bosch-si.com<http://www.bosch-si.com> Tel. +49 30 726112-485 | Fax +49 30 726112-100 | Sebastian.Schuster(a)bosch-si.com<mailto:Sebastian.Schuster@bosch-si.com> Sitz: Berlin, Registergericht: Amtsgericht Charlottenburg; HRB 148411 B Aufsichtsratsvorsitzender: Dr.-Ing. Thorsten Lücke; Geschäftsführung: Dr. Stefan Ferber, Michael Hahn

7 years

2
2
0 / 0

Keycloak 4.5.0.Final is out

by Stian Thorgersen

http://blog.keycloak.org/2018/09/keycloak-450final-released.html

7 years, 1 month

2
2
0 / 0

Pagination and search on groups at group membership view

by Suschke Volker (INST-CSS/BSV-OS)

Hi Keycloak team, as already discussed in https://issues.jboss.org/browse/KEYCLOAK-2538 we also have a large number of groups which need to be managed in group membership UI. Current situation is not satisfactory since two lists with possible thousands of groups need to be displayed. Pull request https://github.com/keycloak/keycloak/pull/4710 is already opened for a long time and handles pagination and search for available groups part of this view only. Our plan is to extend REST API to support pagination and search at /groups endpoint on user resource and, as well both parts of group membership UI. What do you think about our plans? Mit freundlichen Grüßen / Best regards Volker Suschke (INST-CSS/BSV-OS) Bosch Software Innovations GmbH | Ullsteinstr. 128 | 12109 Berlin | GERMANY | www.bosch-si.com<http://www.bosch-si.com> Tel. +49 30 726112-157 | Mobil +49 174 2763164 | Fax +49 30 726112-100 | volker.suschke(a)bosch-si.com<mailto:volker.suschke@bosch-si.com> Sitz: Berlin, Registergericht: Amtsgericht Charlottenburg; HRB 148411 B Aufsichtsratsvorsitzender: Dr.-Ing. Thorsten Lücke; Geschäftsführung: Dr. Stefan Ferber, Michael Hahn

7 years, 1 month

1
0
0 / 0

Feature freeze for 4.x

by Stian Thorgersen

We are nearing the completion of 4.x and are entering into a feature freeze. We will try to get through the current backlog of PRs, please be proactive and answer any feedback we give on GitHub. Anyone that wants to contribute additional features and enhancements to 4.x should do so very soon, otherwise we are most likely not able to accept until we start on 5.x. >From November and most likely until end of January the team will focus on bug fixing, automation and improvements to our testsuite. In this period I'm afraid we are not able to accept new features or enhancements, but please do send contributions regardless. We will review and add it to the queue for things to be merged once we can open up the gates again. I'm hoping that in the future with the effort we put in now on automation and testsuite improvements we will not have to have such lengthy yearly features freezes. Next time around we should be talking about weeks not months. As a final note thanks to everyone that has contributed to Keycloak. Be it in the form of code, documentation or simply answering questions on the mailing list. The community is what it is all about and we are very prod to have such a great community around Keycloak.

7 years, 1 month

1
0
0 / 0

Support for disabling account management for brokered identities

by Thomas Darimont

Hello Keycloak Develops, users that are created via Identity Brokering seem to have the account:manage-account role by default, due to the configured default roles. Since those accounts are usually managed by the external IdP it could make sense to disable access to the account app for those users. A simple way to do this is to remove the manage-account role for the account app from those users. It would be great if the IdP configuration would support toggling account management access (on, off). A more generic way to do this would be to have support for disabling the usage of default roles for user created by the IdP whilst allowing explicit role configuration. Do you see any problems with this? Cheers, Thomas

7 years, 1 month

3
5
0 / 0

Support for password-only sync in user federation

by Thomas Darimont

Hello Keycloak Developers, at the end of the recent DevNation Live session [1] A Deep Dive into Keycloak a user asked whether it would be possible to only sync password changes back with a federated user store like LDAP or Kerberos. This would be very useful in integration scenarios where the user directory admins want to keep control over user profiles. I looked at the code and it seems that one needed to add a new UserStorageProvider.EditMode like PASSWORD_ONLY and update the updateCredential [2] Methods accordingly to allow credential updates. Would this be sufficient or am I missing something? Cheers, Thomas [1] https://www.youtube.com/watch?list=PLuWlr4oKSRUZj3ax5zG_t9KE6uwTb_0rU&tim... [2] org.keycloak.storage.ldap.LDAPStorageProvider#updateCredential (and similar methods for other providers)

7 years, 1 month

3
2
0 / 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

keycloak-dev September 2018