May 2019 - keycloak-dev - Jboss List Archives

by Stian Thorgersen

Currently we recommend encrypting credentials at the database layer, but this is not well documented. It is also not a trivial thing to achieve and may have performance implications. With that in mind we are planning to introduce a secure credentials store. It's very early days, but one thing is certain and that is we will introduce a Vault SPI to allow plug-ability. To join the discussion read the initial notes around the subject here https://github.com/keycloak/keycloak-community/blob/master/design/secure-...

7 years

2
2
0 / 0

Keycloak Demo

by Bowen, Daniel (Excite)

Hello, We have a customer who would like to implement redhat keycloak single sign on authentication system, however they would to evaluate the following functionalities * Demo functionality of RedHat KeyCloak single sign-on authentication system. * How to define a role for each user and enrol users to the security policies inside KeyCloak * How users are able to use nominated application using the KeyCloak deployed security policies. Unfortunately we don't have the skills and are seeking out for someone to help us demonstrate this. We are based out of Sydney and are willing to pay for the services. We have already setup the server and installed the application however it is not yet linked to any services to demonstrate it's functionality. We will appreciate if someone form the community can assist us with this request. Thank you, Daniel Bowen| Service Desk Support Engineer [cid:image003.jpg@01CF6EA1.EE2C3BA0][cid:image008.png@01D33C4C.E5E92800] Excite IT Pty Ltd | www.exciteit.com.au<http://www.exciteit.com.au/> 75C Carnarvon Street, Silverwater NSW 2128 Australia Phone: 1300 666 708 Email: daniel.bowen(a)exciteit.com.au<mailto:daniel.bowen@exciteit.com.au> [facebook-transparent-logo-png-0 rrrr]<https://www.facebook.com/exciteitaus/> [LinkedIn_Logodgfdsf] <https://www.linkedin.com/company/excite-it> [in] <https://www.instagram.com/excite_it/>

7 years

2
1
0 / 0

jdk7 for tomcat modules

by Vlasta Ramik

Hey guys, I'm working on https://issues.jboss.org/browse/KEYCLOAK-9596 Remove Apache Tomcat 6.0.x adapter, as a side affect I plan to update jdk version for compiler from 1.6 to 1.7 for all modules related to tomcat adapter. Does anyone have any objections? Thanks, V.

7 years

3
2
0 / 0

Providing idpHint in JavaScript Adapter JSON configuration

by Marc Ewert

Hi, we would like to create a very small PR for the JavaScript Adapter (keycloak.js). This change would allow one to provide the idpHint via the JSON configuration which could of course then be dynamically served by a backend. By this everyone could generate a JSON of the following format: { realm: "production", auth-server-url: "https://customer-a.example.com/auth"<https://customer-a.example.com/auth>, bearer-only: false, resource: "frontend-client", idp-hint: "customer-a", } The consumption of the idp-hint parameter could be done as an one-liner in keycloak.js. Would it be okay, if we create a PR with the needed change for letting that happen, or are there other as simple solutions, that we are missing? Best Marc Ewert -- ________________________________________________ Marc Ewert | Senior Engineering Manager Leverton GmbH | Schöneberger Str. 15 | 10963 Berlin | Germany P +49 30 868 711 059 E marc.ewert(a)leverton.ai<mailto:marc.ewert@leverton.ai> https://www.leverton.ai/ | LinkedIn<https://www.linkedin.com/company/leverton> District Court Berlin-Charlottenburg HRB 140028 Managing Directors: Florian Kuhlmann, Abhinav Somani

7 years

2
2
0 / 0

Adding a Kerberos ticket as a Claim (not SPNEGO)

by Chris Smith

I can get the Kerberos ticket I need when the KerberosUsernamePasswordAuthenticator performs a User/Password validation. I have validated that the ticket can be used for IBM EIM(Enterprise Identity Mapping) public Subject authenticateSubject(String username, String password) throws LoginException { String principal = getKerberosPrincipal(username); logger.debug("Validating password of principal: " + principal); loginContext = new LoginContext("does-not-matter", null, createJaasCallbackHandler(principal, password), createJaasConfiguration()); loginContext.login(); logger.debug("Principal " + principal + " authenticated succesfully"); Subject subject = loginContext.getSubject(); serializeKerberosTicket(subject); return subject; } private void serializeKerberosTicket(Subject subject) { Optional<KerberosTicket> kerbTicket = subject.getPrivateCredentials(KerberosTicket.class).stream().findFirst(); if (kerbTicket.isPresent()) { try { ByteArrayOutputStream bos = new ByteArrayOutputStream(); ObjectOutputStream oos = new ObjectOutputStream(bos); oos.writeObject(kerbTicket.get()); String serializedKerberosTicket = Base64.encodeBytes(bos.toByteArray()); // TODO add as a claim } catch (IOException e) { logger.debug("Kerberos Ticket Serialize failed", e); } } else { logger.debug("Kerberos Ticket was not found in Subject"); } } I tried to follow the SPNEGOAuthenticator but I got lost. Is there an easy place to put the String serializedKerberosTicket so it will be added as a claim?

7 years

1
0
0 / 0

keycloak quick start example Uma Photoz: authorization request to resource owner not working

by Olivier Rivat

Hi, I am using Keycloak 6.0.1 wildfly 16 chrome 74 https://github.com/keycloak/keycloak-quickstarts/tree/latest/app-authz-um... Done the test several time 1)just unzip keycloak 2) and uploded phothoz-realm.json 3) create alice vacation album with greece view permission for joe 4) log as Joe, but cannot sent delete request I always obtain: You can not access or perform the requested operation on this resource. instead of Sent authorization request to resource owner, please, wait for approval. Is is a misconfiguration of mine (I have been through the example several times) or might it be a bug ? Regards, Olivier Rivat -- <http://www.janua.fr/images/logo-big-sans.png><http://www.janua.fr/images/LogoSignature.gif> <http://www.janua.fr/images/6g_top.gif> Olivier Rivat CTO orivat(a)janua.fr <mailto:dchikhaoui@janua.fr> Gsm: +33(0)682 801 609 Tél: +33(0)489 829 238 Fax: +33(0)955 260 370 http://www.janua.fr <http://www.janua.fr/> <http://www.janua.fr/images/6g_top.gif>

7 years

1
0
0 / 0

configure longer access tokens / permanent access tokens

by Federico Michele Facca

Dear All, to better support IoT devices, we are looking to support longer expiration for specific tokens (when using a specific scope - in a similar way to offline_access scope). We have been looking into: https://github.com/looorent/keycloak-configurable-token-api The issue is that, while using this plugin it is possible to extend the life of a token, the underlying session will anyhow expire based on the max duration of token lifespan, so if you validate the token after the session expiration, the validation will say that the token is not active. What could be a non intrusive way to support extending the life of specific sessions associated to such tokens? (i.e. without making changes to the core code). We thought about changing the started value in the session an put it in the future, but this is not actually possible. Only getStarted is available on UserSessions. An other alternative would be to set a very long token lifespan for the client , but the all tokens will have such long life (which is not what we aim for). Any feedback / idea is welcome :) Cheers, Federico

7 years

2
4
0 / 0

Users and Realms

by Pedro Igor Silva

Hi, As you know, currently users belong to a realm and as such, you can't share them across different realms. We always had people looking for alternatives about how to solve this problem where all the available options have their pros and cons. I would like to see what you think about decoupling users from realms in a way that user federation and management are completely decoupled from realms so that users (or group of users) can be *associated* with realms. As an example, here is how you would configure users and realms in Keycloak: 1) Configure your identity stores/user federation from where users will be fetched. Or create users in Keycloak. 2) Assign to your users a label or a logical group. This assignment could be done manually or even automatically depending on: a) default group where all users are in b) the identity store from where users are fetched c) based on the user's email (domain) d) anything else that makes sense 3) Create a realm and specify which users should belong to a realm based on these labels or groups. A realm should be able to have users with different labels/groups. The realm definition/configuration would not change much as it stands today. Each of them would still have their own way of managing realm specific groups and roles. Regards. Pedro Igor

7 years, 1 month

5
10
0 / 0

Review request: Arabic translation

by Stian Thorgersen

I need help from the community to review $sub: https://github.com/keycloak/keycloak/pull/5962

7 years, 1 month

1
0
0 / 0

Request for review: Chinese translation of email verification page

by Stian Thorgersen

I need help from the community to review: https://github.com/keycloak/keycloak/pull/5778

7 years, 1 month

1
0
0 / 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

keycloak-dev May 2019