September 2019 - keycloak-dev - Jboss List Archives

Cache empty result for client service account user lookup

by Johannes Knutsen

We have a performance issue with the token exchange service in a realm with a large amount of users. The problem seems to be that token exchange uses client permissions to evaluate if a client to client token exchange is allowed. The client permissions evaluator (org.keycloak.services.resources.admin.permissions.ClientPermissions#canExchangeTo) creates a new ClientModelIdentity object which in the constructor also loads the client's service account user model, if one exists. The service account user lookup result for clients without service account enabled, isn't cached. Since the service_account_client_link column in the user_entity database table isn't indexed, this lookup causes a table scan which takes several seconds for each token exchange. One way to solve this, is to cache the empty service account user lookup. I have pushed a proof of concept at https://github.com/keycloak/keycloak/compare/master...knutz3n:cache-empty... Is this something you would consider merging? Do you have suggestions for improvement on this fix? Do you know of other places which must trigger an eviction in addition to org.keycloak.services.managers.ClientManager#enableServiceAccount? - Johannes

4 years, 7 months

4
6
0 / 0

[KEYCLOAK-9880] Make sure the Authorization Header token is only considered when type is Bearer

by Bruno Oliveira

Please see: https://github.com/keycloak/keycloak-gatekeeper/pull/471 If you have any concerns or questions, please comment on the same PR. -- - abstractj

4 years, 7 months

1
0
0 / 0

OTP Form Source

by Stuart

Hi all, I'm looking for the OTP source code, I can't seem to find it on GitHub. I want to override the return when OTP is not configured. (I suspect it does a context.sucess() if its skipping OTP. I want it to fail so the execution flow then picks up one of the other execution alternatives) Thanks, Stuart

4 years, 7 months

1
1
0 / 0

How to customize Realm Admin Menu

by Dave Johnston

Hi, I'd like to customize the realm admin menu. I've been able to use roles to limit the links shown to be: Realm Settings Roles User Federation Authentication I'd like to be able to hide 'Realm Settings, Roles and Authentication' (just showing the User Federation). Is it possible to define new roles that can be used to restrict the links, or could this be done via a theme?

4 years, 7 months

1
0
0 / 0

Race condition in SPI loading on startup

by EXTERNAL Thiele Frank (TNG, INST-CSS/BSV-OS2)

Hi, Summary: When deploying an SPI extension for the identity-provider-mapper (just an example), this wasn't loaded due to that when using the debugger. In most cases this seems to work anyway - I could only reproduce it using a debugger. There seems to be a race condition between org.keycloak.services.DefaultKeycloakSessionFactory.init() and org.keycloak.subsystem.server.extension.KeycloakProviderDeploymentProcessor.deploy(DeploymentPhaseContext). The deploy() function of above is beyond others used for file system imports, e.g. custom extensions as jars (e.g. folder standalone/deployments). It interacts indirectly with the init() function / whole DefaultKeycloakSessionFactory class based on ProviderManagerRegistry.SINGLETON. deploy() alters the singleton to contain preBoot ProviderManager instances. Once these are set (properly...), the init() function takes them into account and loads them during startup, e.g. to load the custom jars. The init() function itself searches for preBoot managers and loads them once they are defined. If they happen to be defined later, then these are not loaded by init(). In a positive case, this would then be handled by deploy() itself which has a handling to use the deployment process of init() (better: its class instance). But this is only working, if the init() function executes ProviderManagerRegistry.SINGLETON.setDeployer(this); before. One can reproduce this by debugging with certain breakpoints: - First here: - public void init() { - serverStartupTimestamp = System.currentTimeMillis(); - - ProviderManager pm = new ProviderManager(KeycloakDeploymentInfo.create().services(), getClass().getClassLoader(), Config.scope().getArray("providers")); - spis.addAll(pm.loadSpis()); - factoriesMap = loadFactories(pm); - >>>> for (ProviderManager manager : ProviderManagerRegistry.SINGLETON.getPreBoot()) { - Map<Class<? extends Provider>, Map<String, ProviderFactory>> factoryMap = loadFactories(manager); - Second here: - public void deploy(ProviderManager pm) { - ProviderManagerDeployer deployer = getDeployer(); - if (deployer == null) { - >>>> preBoot.add(pm); - } else { - deployer.deploy(pm); - } - - } By stepping through the workflow in a certain order, one can see the issue. Idea for fix: Add mutexes / semaphores / compareAndSwap based non-blocking synchronization means Mit freundlichen Grüßen / Best regards Frank Thiele Open Source Services 2 - Product Group Customer Success Services (INST-CSS/BSV-OS2) Bosch Software Innovations GmbH | Ullsteinstr. 128 | 12109 Berlin | GERMANY | www.bosch-si.com<http://www.bosch-si.com> Tel. +49 30 726112-0 | Fax +49 30 726112-100 | external.Frank.Thiele(a)bosch-si.com<mailto:external.Frank.Thiele@bosch-si.com> Sitz: Berlin, Registergericht: Amtsgericht Charlottenburg; HRB 148411 B Aufsichtsratsvorsitzender: Dr.-Ing. Thorsten Lücke; Geschäftsführung: Dr. Stefan Ferber, Michael Hahn, Dr. Aleksandar Mitrovic

4 years, 7 months

2
3
0 / 0

Removal of Domain directive in Gatekeeper

by Bruno Oliveira

We've been discussing the removal of Domain directive for Cookies on Gatekeeper: https://github.com/keycloak/keycloak-gatekeeper/pull/480#issuecomment-524... You're more than welcome to join the discussions. The plan is to get it merged by the end of this week.

4 years, 7 months

1
0
0 / 0

Specifying LDAP/AD domain in login/token endpoint

by Ajinkya Thakare

Hi all, Apologies for sending this in the developer’s mailing list. But I was not getting any reply in the user’s list since few weeks and decided to see if I can get any help from here. I have a multi-tenant SSO use-case where a set of application can be used by multiple organizations with their owns LDAP/AD configurations. I am trying to secure those applications using Keycloak and pretty much successful in doing so by adding individual organization’s LDAP configs in User Federation tab. However, I observed that for authentication from LDAPs, keycloak goes through all the LDAP configs added one by one, either by the order of their addition in Keycloak or by the priorities set in configuration, to check for the user credential until desired username and password matches. This is causing two main issues – 1. If same username is part of two organizations, it causes failure even when correct credentials belonging in a later LDAP are passed to the login/token API. Keycloak finds the same username in the first LDAP and sees the password is different and hence returns failure. 2. Keycloak does not provide failover for LDAPs. Thus, if one of the LDAP servers is down, authentication from all the successive LDAPs will fail. Can we instead have a solution where user can specify his/her organization’s domain along with the username, so that keycloak points directly to that particular LDAP config and not look into other LDAPs. This will solve both of the above problems. For example, we have same username ‘ajinkya.thakare’ in two organization’s domains ‘company1’ and ‘company2’. On the login page, if user can provide ‘ajinkya.thakare@company2’, keycloak should point to the LDAP config for company2 only. Here issue 1 is solved since the credentials for ‘ajinkya.thakare’ in company1’s domain are not checked anytime and hence not causing any failure for correct credentials from company2. Issue 2 is also solved since LDAP server for company 1 may be down sometimes, but we are not concerned with that anymore and hence enabling failover for LDAPs. Please let me know if this can be already achieved by any means. Or if there is any workaround for the same. Regards, Ajinkya Thakare

4 years, 7 months

2
1
0 / 0

Remove built-in themes from themes directory

by Stian Thorgersen

See thread "Shared messages between themes". I propose to remove built-in themes from themes directory and rather load from a module/jar. Reasoning behind this is two fold: a) Support theme resources for sharing messages between themes b) Built-in themes should not be modified Within themes we'd update the README.txt file to provide the location of the built-in themes so users can crack open the jar (zip) to view the built-in themes for reference when they are creating their own custom themes.

4 years, 7 months

4
10
0 / 0

Shared messages between themes

by Stian Thorgersen

We recently had a contribution to enable messages in theme resources [1]. Messages from theme resources are loaded before any messages from themes and are available to all themes. This would make it easy to create a built-in theme resource with shared messages between all themes. Even better we can extract shared messages from the English message bundle. Then other translations can be done later by the community as wanted. Anyone interested in picking this work up? [1] https://issues.jboss.org/browse/KEYCLOAK-8818

4 years, 7 months

2
9
0 / 0

Re: [keycloak-dev] Feedback on PRs

by 乗松隆志 / NORIMATSU，TAKASHI

Hello, I've contributed some features onto keycloak. Besides that, I am also interested in participating in reviewing PRs. Regards, Takashi Norimatsu Hitachi, Ltd. -----Original Message----- From: keycloak-dev-bounces(a)lists.jboss.org <keycloak-dev-bounces(a)lists.jboss.org> On Behalf Of Stian Thorgersen Sent: Tuesday, September 10, 2019 5:26 PM To: keycloak-dev <keycloak-dev(a)lists.jboss.org> Subject: [!][keycloak-dev] Feedback on PRs First of all thanks to everyone that has sent a PR to Keycloak. Without the communities participation Keycloak wouldn't be the same! At the moment we are struggling a bit with keeping up with reviewing PRs so please bear with us. We are discussing in the team how we can improve on the current situation. Suggestions are obviously welcome. We would also love it if people from the community would also participate in reviewing PRs. We highly value your input. _______________________________________________ keycloak-dev mailing list keycloak-dev(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/keycloak-dev

4 years, 7 months

3
10
0 / 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

keycloak-dev September 2019