April 2019 - keycloak-dev - Jboss List Archives

Themes: Browser cache not used for static resources (img, css, js)

by the john

4 years, 1 month

1
0
0 / 0

Setup Eclipse and workspace for Keycloak development

by Chris Smith

I have a new JEE Eclipse 2019-06 with Redhat and Spring installed from the marketplace I check out from Github into a new workspace I have a large list of errors 46 JPA problem errors 36 JSP problem errors 68 Java build path errors 42 Java errors 426 Maven Problems I thought Maven was supposed to prevent this? I could not find any directions to setup Eclipse and the workspace. Did I miss it? How do the Redhat developers have their IDE and workspace setup?

4 years, 1 month

1
0
0 / 0

Javascript adapter: cordova implementation is broken

by Alan Balbo

Hi, I found an issue in the javascript adapter ( *adapters/oidc/js/src/main/resources/keycloak.js*) : the "*cordova*" implementation is broken, and is also inconsistent with the other implementations provided (both "*default*" and "*cordova-native*"): 1) The *register* method (l. *1324*) does not take an "*options*" parameter, even though it uses it two lines below. It causes the execution to stop and throw an error, breaking the authentication process. This is an error induced by commit *f6125a25* (KEYCLOAK-6655) 2) If we look at other implementations of the same method (l. *1171* and l. *1389*), both return a promise. But the cordova implementation does not, resulting in an inconsistency that I find weird. This is a big issue when writing typescript services on top of it (e.g. keycloak-angular). I would suggest a fix for those issues, as it makes the cordova implementation unusable. First and foremost it should take an "options " parameter and the function could be rewritten to be consistent with the other implementations, i.e. making it return a promise and parsing the callback properly. Let me know what you think. Maybe it should be two distinct issues (one for the bug and one for the promise). Regards, Alan

4 years, 1 month

2
1
0 / 0

X.509 User Identity Extractor - multiple values

by Sven-Torben Janus

Hey all! I am currently facing a situation with a customer who wants to implement mutual SSL / client cert authentication. As I understand from the UserIdentityExtractor[1] implementations, currently only returning a single value is allowed, because the UserIdentityToModelMapper[2] calls toString on the actual userIdentity object. Now my customer uses the serial number from the certificate to identify users. However, this is only unique in combination with the issuer of the certificate, since my customer supports multiple CAs. The combination of both exists in their LDAP as a single attribute where both parts are separated by a special separator character. In addition to that, the whole certificate of the user is also available in another LDAP attribute. I currently see the following options to implement a solution for this: 1) Writing a custom Authenticator to handle that specific situation. This one would look very similar to the ootb X509 authenticator, but implements either a) or b) (see below) 2) Making a contribution to Keycloak and extend the list of available UserIdentitiyExtractors. For both approaches two different implementations come to my mind: a) Adding an additional UserIdentitiyExtractor which combines the issuer and the serial number into a single string and use that as an identity. b) Adding an additional UserIdentitiyExtractor which returns the whole certificate as the user's identity. We would prefer contributing to Keycloak, if such a contribution is welcome and meaningful. Do you have any advice on which way to go here? [1]https://github.com/keycloak/keycloak/blob/master/services/src/main/java... [2]https://github.com/keycloak/keycloak/blob/master/services/src/main/java... Regards Sven-Torben

4 years, 1 month

4
12
0 / 0

Custom account provider not working after upgrading to 4.8.3.Final

by abhishek raghav

Hi - We have implemented a custom account provider which implements AccountProviderFactory and the implementation class extends FreeMarkerAccountProvider. It is packaged and deployed as a provider with a service definition file. This used to be work in keycloak 3.4.3.Final but not after we upgrade to keycloak 4.8.3.Final. We also identified that the provider is not even registering/initialized during boot time of keycloak. Could somebody please tell - whether keycloak has removed support of extending Account provider SPI. Or there is any other way to extend the account provider in keycloak 4.8.3.Final. Any help is greatly appreciated. Thanks -Abhishek

4 years, 1 month

2
2
0 / 0

JavaScript client adapter - minValidity

by Sergio Livi

Hello, I've had a little issue while using the updateToken function[1]. In particular, I was accidentally passing a string not containing a number as minValidity. Totally my fault, but the result is that no error is thrown and everything seems to work, but the token will be never renewed. This is the end of the function isTokenExpired, called from updateToken: if (minValidity) { expiresIn -= minValidity; // expiresIn becomes NaN, as minValidity is not "cast-able" to a number } return expiresIn < 0; // NaN < 0 is false, so the token will be never refreshed I think there should be a check somewhere to either: - throw an error, or - display a warning on the console, ignore the buggy minValidity and carry on. If you wish, I could prepare a PR with a fix for this, just tell me which option you prefer. Thanks! [1] this one: < https://github.com/keycloak/keycloak/blob/e7deb77725a1c777902096e1880911c... >

4 years, 1 month

2
2
0 / 0

F2F Van from Brno to Vienna?

by Stan Silvert

It sounds like several of us will be flying in and out of Vienna for the F2F. It's really not very convenient to take the bus on Thursday evening to Vienna. We would need to wrap up a little early at the office and then make the trip down to the bus stop. Would it make sense to hire a van to take us all to the hotel at the Vienna airport on Thursday night? Then we could leave directly from the office whenever we want. Is that practical and how many would be interested? Stan

4 years, 1 month

1
1
0 / 0

Few Admin events not getting raised

by Shiva Prasad Thagadur Prakash

Hi Guys, We see that few admin events are not getting logged to syslog/logfile. Creating scope, Creating New policy for a client and Creating new permission for a client. COuld anyone please help us? Steps to reproduce: New permisson event 1. Create new client f.i. in master realm 2. Set "Authorization Enabled" 3. Go to clients->clientName->Authorization ->Permissions - Scope based 4. Create New permission Failed Symptoms: No any events generated. 1. Create new client f.i. in master realm 2. Set "Authorization Enabled" Go to clients->clientName->Authorization ->Policies - Create POlicy -> Role 3. Create New policy Failed Symptoms: No any events generated. 1. Create new client f.i. in master realm 2. Set "Authorization Enabled" 3. Go to clients->clientName->Authorization ->Authorization Scopes 4. Create New scope event_scope Failed Symptoms: No any events generated. Thanks & regards, Shiva

4 years, 1 month

2
1
0 / 0

Connect Keycloak to Galera cluster with Docker

by Anthony Durot

Hi everyone, I need to connect a Keycloak container to a MariaDB Galera cluster for a project. Currently, with the Docker image you can set up environment variables such as DB_VENDOR, DB_ADDR, DB_PORT, and so on..., and these environment variables will be added to the connection string of mariaDB. This is done in [1]: /subsystem=datasources/data-source=KeycloakDS: add(jndi-name=java:jboss/datasources/KeycloakDS,enabled=true,use-java-context=true,use-ccm=true, connection-url=jdbc:mariadb://*${env.DB_ADDR:mariadb}*:*${env.DB_PORT:3306}* /*${env.DB_DATABASE:keycloak}${env.JDBC_PARAMS:*}, driver-name=mariadb) As you can see, we put environment variables for the address, port, database, and so on... But what if I want to connect Keycloak to a cluster for exemple ? MariaDB provides a JDBC with this connection string : jdbc:(mysql|mariadb):[replication:|failover:|sequential:|aurora:]//<hostDescription>[,<hostDescription>...]/[database][?<key1>=<value1>[&<key2>=<value2>] As you can see, we need to put multiple hostDescription, and currently it's impossible because we only have a single env.DB_ADDR. Moreover, when you want to be connected to a cluster, you need to specify *[replication:|failover:|sequential:|aurora:] *and it's also currently impossible to do it. I suggest that maybe we can change [1] ... /subsystem=datasources/data-source=KeycloakDS:add(jndi-name=java:jboss/datasources/KeycloakDS,enabled=true,use-java-context=true,use-ccm=true, connection-url=jdbc:mariadb://*${env.DB_ADDR:mariadb}*:*${env.DB_PORT:3306}*/*${env.DB_DATABASE:keycloak}${env.JDBC_PARAMS:*}, driver-name=mariadb) to: ... /subsystem=datasources/data-source=KeycloakDS:add(jndi-name=java:jboss/datasources/KeycloakDS,enabled=true,use-java-context=true,use-ccm=true, connection-url=jdbc:mariadb:*${env.DB_CONNECTION_TYPE:}*//${env.DB_ADDR:mariadb}:${env.DB_PORT:3306}/${env.DB_DATABASE:keycloak}${env.JDBC_PARAMS:}, driver-name=mariadb) As for the list of host connection, I admit that I don't have any clever ideas, do you have any suggestion ? Thank you all for your time Best regards, Anthony [1] https://github.com/jboss-dockerfiles/keycloak/tree/master/server/tools/cl...

4 years, 1 month

1
0
0 / 0

TCP for JGroups and bind options

by Sebastian Laskawiec

Hey, I've been working on JGroups bind settings for Keycloak Container Image recently and we had a discussion with Stian about changing both binding options and transport for JGroups. As you probably know, we use standalone-ha.xml as a default configuration for our image. This means, that Infinispan boots up in clustered mode. At the moment, we use the default transport from the configuration, which is UDP (with PING as discovery). Even though UDP transport is a bit faster for larger clusters, it often doesn't work out of the box in cloud environments (like AWS for the instance). Of course, the JGroups stack can easily be changed by using the `-Djboss.default.jgroups.stack=tcp` switch. I'm planning to revise this piece and change the default transport to TCP (probably by adding `-Djboss.default.jgroups.stack=tcp` switch to the default options). I also proposed, and would like to ask you to try it out, changing the bind parameters to match IPv4 [1]. Previously, JGroups tried to bind to wrong interfaces, including `fe80::5003:8eff:fefa:3e53%tap0` exposed by Podman. Please have a look at the Pull Request [1], check if it works for you and let me know what you think about using TCP as default transport for JGroups. Thanks, Sebastian [1] https://github.com/jboss-dockerfiles/keycloak/pull/186

4 years, 1 month

2
2
0 / 0

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

keycloak-dev April 2019