April 2019 - keycloak-dev - Jboss List Archives

Is CVE-2019-3868 affecting regular Keycloak distributions?

by Michael Furman

Hi, Is CVE-2019-3868 affecting regular Keycloak distributions? https://access.redhat.com/security/cve/cve-2019-3868 if yes, when it will be fixed? Or maybe it is fixed already? Thank you in advance for your help, Best regards, Michael

4 years, 1 month

3
2
0 / 0

Keycloak 6.0.1 released

by Stian Thorgersen

https://www.keycloak.org/2019/04/keycloak-601-released.html

4 years, 1 month

1
0
0 / 0

Keycloak Cluster Setup And Configuration

by 张立强

Hi there, Due to the mail size and attachment limits, I post the details to a github repo. https://github.com/zhangliqiang/keycloak-cluster-setup-and-configuration FYI. 张立强 FIT2CLOUD

4 years, 1 month

3
4
0 / 0

Themes: Browser cache not used for static resources (img, css, js)

by jo0815

Hello, I've been deveoping custom keycloak themes which is pretty straight forward thanks to the provided documentation. I am using version 4.8.3.Final. Regarding caching I only see options for freemarker templates caching in standalon.xml, theme section. Opening the network view in Firefox I notice that no caching headers are uses for statice resouces (img, css, js). Thus every visit of the login page reloads all linked static resources from the server. So my question is: How can I provide client side caching of static resources (perhaps by etags with file content hash)? Thanks Jonathan Strampp

4 years, 1 month

3
3
0 / 0

W3C Web Authentication - Two-Factor, implementing JIRAs

by Doswald Alistair

Hello, I've been following the thread about the implementation of WebAuthn in Keycloak, and saw that there are some related JIRAs in the following design document https://github.com/keycloak/keycloak-community/blob/master/design/web-aut.... Is anyone already working on JIRAs https://issues.jboss.org/browse/KEYCLOAK-9693 and https://issues.jboss.org/browse/KEYCLOAK-9694 for managing multiple 2nd factor authenticators? If not, with my colleagues we could implement them relatively quickly as we have use cases for these functionalities. Best regards, Alistair Doswald

4 years, 1 month

2
7
0 / 0

JWE support

by Guillaume HOUDMON

Hi, We are currently studying how to encrypt tokens with JWE. There is the JIRA KEYCLOAK-6768 that addresses this topic. But it does not seem that there was any work to start on it. A beginning of support has already been done to encrypt the code (see KEYCLOAK-5288). Inspired by what is done for the signature, I plan to add a section in the client page "Encryption Tokens Configuration" to select the algorithms by types of tokens, and set the encryption key (paste or jwks url). We would add 2 SPIs: jwe-key-encryption and jwe-content-encryption. With my colleagues, we would complete the algorithms (RSA-OAEP, RSA-OAEP-256 and A128GCM, A192GCM, A256GCM). In a second step, we could also contribute for the support in Java adapters. Does this approach seem relevant to you? Should we go through a design proposal? Regards, Guillaume Houdmon

4 years, 1 month

2
1
0 / 0

Versioning Scheme for Keycloak

by Schuster Sebastian (INST-CSS/BSV-OS2)

Hi everybody, I noticed the versioning scheme was changed lately. There are no more x.Final versions anymore. Also, after releasing 5.0.0 the next version was switched to 6.0.0-Snapshot. Are these changes purely cosmetical? Will there be no more minor/patch releases according to semantic versioning? Is there a relation to a changed release schedule for Red Hat SSO? Can anybody shed some light on what these changes mean? Thanks and best regards, Sebastian Mit freundlichen Grüßen / Best regards Dr.-Ing. Sebastian Schuster Open Source Services (INST-CSS/BSV-OS2) Bosch Software Innovations GmbH | Ullsteinstr. 128 | 12109 Berlin | GERMANY | www.bosch-si.com<http://www.bosch-si.com> Tel. +49 30 726112-485 | Mobil +49 152 02177668 | Fax +49 30 726112-100 | Sebastian.Schuster(a)bosch-si.com<mailto:Sebastian.Schuster@bosch-si.com> Sitz: Berlin, Registergericht: Amtsgericht Charlottenburg; HRB 148411 B Aufsichtsratsvorsitzender: Dr.-Ing. Thorsten Lücke; Geschäftsführung: Dr. Stefan Ferber, Michael Hahn, Dr. Aleksandar Mitrovic

4 years, 1 month

2
1
0 / 0

Keycloak Cluster Setup And Configuration

by 张立强

Hi there, I am writing this mail just for knowledge sharing, through lots of efforts we achieved keycloak cluster setting in some scenes, maybe you guys have done this by some solutions but hope this can help you anyway. We are using 4.8.3.Final docker image in our deployment, using this version because RH-SSO 7.3.0.GA is derived from 4.8.3.Final(please refer to https://www.keycloak.org/support.html) and we believe this is a rather stable build. Also we did some extensions(custom theme, custom user federation, but the two cli script files is the most important matter for this mail, attached you can find the two files) base on the official docker image <https://hub.docker.com/r/jboss/keycloak/>. [image: QQ20190424-151432 (1).jpg] First of all we have to know that for a keycloak cluster, all keycloak instances should use same database and this is very simple, another thing is about cache(generally there are two kinds of cache in keycloak, 1st is persistent data cache read from database aim to improve performance like realm/client/user, 2nd is the non-persistent data cache like sessions/clientSessions, the 2nd is very important for a cluster) which is a little bit complex to configure, we have to make sure the consistent of cache data in a cluster view. Totally we have 3 solutions for clustering, and all of the solutions are base on the discovery protocols of JGroups <http://jgroups.org/>, as keycloak use a distributed cache called Infinispan <http://infinispan.org/> and the Infinispan use JGroups to discover nodes. 1. PING PING <http://jgroups.org/manual/#PING> is the default enabled clustering solution of keycloak using UDP protocol, and you don't need to do any configuration for this. But this solution is only available when multicast network is enabled and port 55200 should be exposed, e.g. bare metals, VMs, docker containers in same host. [image: image.png] We tested this by two keycloak containers in same host. [image: QQ20190424-150949 (1).jpg] As you see from logs, after started the two keycloak instances discovered each other and clustered. 2. TCPPING TCPPING <http://jgroups.org/manual/#TCPPING_Prot> use TCP protocol and 7600 port should be exposed. This solution can be used when multicast is not available, e.g. deployments cross DC, containers cross host. We tested this by two keycloak containers cross host. [image: image.png] And for our own solution we need to set three below environment variables for containers. *#IP address of this host* *JGROUPS_DISCOVERY_EXTERNAL_IP=172.21.48.39* *#protocol* *JGROUPS_DISCOVERY_PROTOCOL=TCPPING* *#IP and Port of all host* *JGROUPS_DISCOVERY_PROPERTIES=initial_hosts="172.21.48.4[7600],172.21.48.39[7600]"* After started we can see the keycloak instances discovered each other and clustered. [image: QQ20190424-150720 (1).jpg] 3. JDBC_PING JDBC_PING <http://jgroups.org/manual/#_jdbc_ping> use TCP protocol and 7600 port should be expose which is similar as TCPPING, but the difference between them is, TCPPING require you configure the IP and port of all instances, for JDBC_PING you just need to configure the IP and port of current instance, this is because in JDBC_PING solution each instance insert its own information into database and the instances discover peers by the ping data which is from database. We tested this by two keycloak containers cross host. [image: image.png] And for our own solution we need to set two below environment variables for containers. *#IP address of this host* *JGROUPS_DISCOVERY_EXTERNAL_IP=172.21.48.39* *#protocol* *JGROUPS_DISCOVERY_PROTOCOL=JDBC_PING* After started the ping data of all instances haven been saved in database, and from logs we can see the keycloak instances discovered each other and clustered. [image: image.png] [image: QQ20190424-151128 (1).jpg] ----- I believe the above solutions is available for most scenes, but for some scene this is enough, e.g. kubernetes. In kubernetes, multicast is available only for the containers in same node, for the pods cross node multicast is not working, furthermore for a pod there is no static ip that you can use to configure TCPPING or JDBC_PING. But that's ok because we can use KUBE_PING <http://jgroups.org/manual/#_kube_ping> in kubernetes. And also don't worry, KUBE_PING is not the only choice, actually JDBC_PING is another option. In the attached JDBC_PING.cli we have handled this, if you don't set the JGROUPS_DISCOVERY_EXTERNAL_IP environment variable, the pod ip will be used, that means in kubernetes you can just set JGROUPS_DISCOVERY_PROTOCOL=JDBC_PING then your keycloak cluster is ok. ----MAIL END---- 张立强研发小头目, FIT2CLOUD 中国领先的云管理平台及服务提供商，助力企业管好云 · 用好云 · 控好云

4 years, 1 month

1
0
0 / 0

Keycloak 6.0.0 docker image

by Cédric Couralet

Hi all, I saw the 6.0.0 was released on your website, but I don't see the tag on dockerhub or quay.io. Is there an estimated time for it to be available? Regards, Cédric Couralet

4 years, 1 month

3
2
0 / 0

Keycloak at JavaZone'2019

by Dmitry Telegin

Hi all, I'm planning to do a talk at JavaZone'2019 in Oslo. Just wanted to know if anybody from the team/community is also going to participate, and, if so, to make sure our topics do not clash. I'm about to submit a talk tentatively titled "Mastering Keycloak-fu", in which I'd like to summarize a dozen of interesting and non-standard cases from my own practice. I'll be also applying for a workshop, in which we'll be either securing a sample application, or developing a Keycloak extension, depending on the audience's interest and demand. Just FYI: call for speakers remains open until April 22nd. Cheers, Dmitry

4 years, 1 month

2
1
0 / 0

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

keycloak-dev April 2019