On Tue, 4 Feb 2014 18:21:10 +0100 Matthias Wessendorf <matzew(a)apache.org&gt; wrote: > oh, this was a cross-post :-) (adding keycloak) > > > On Tue, Feb 4, 2014 at 6:20 PM, Matthias Wessendorf <matzew(a)apache.org >wrote: > > > > > > > > > On Tue, Feb 4, 2014 at 6:13 PM, Karel Piwko <kpiwko(a)redhat.com&gt; wrote: > > > >> Hey, > >> > >> I've combined Aerogear UPS and Keycloak cartridges together. You can > >> check the > >> results at: > >> > >> https://agpushkeycloak-mobileqa.rhcloud.com/ (admin/password) > >> https://keycloak-mobileqa.rhcloud.com/ (admin/password) > >> > >> > > I think it would be awesome if the keycloak bits would be included into > > the UPS bits, to have something OOTB, instead of pointing to a different > > server (CORS) I've added Keycloak AS7 modules to UPS cart but not admin console. I believe that Keycloak is SaaS, so usage with two different carts reflect reality better. Configuring Keycloak cart once and let all other carts use is seems the right way to me.

> > > > > >> For keycloak, I have used original cart [1]: > >> > >> $ rhc app create -g small --no-git keycloak > >> > >> https://raw.github.com/stianst/openshift-keycloak-cartridge/master/metada... > >> > >> For UPS, I have modified matzew's one stored in my repo [2] and modified > >> UPS > >> [3]: > >> > >> $ rhc app create -g small --no-git agpushkeycloak mysql-5.1 > >> ' > >> http://cartreflect-claytondev.cloud.com/reflect?github=kpiwko/openshift-o... > >> ' > >> > >> There are some gotchas though: > >> > >> * keycloak.json - I'm not sure how this will be addressed by WF subsystem. > > > > > > the public-key needs to be, as far as I can see, included inside of the > > standalone.xml (keycloak subsystem section). > > Which is somewhat a similar issue; I think, if I get it right, that means > > as you plan to support more and more 'realms', you keep editing the > > standalone xml. That is great improvement w.r.t. current situation but does not handle OpenShift cart scenarios. > > > > > >> We > >> still need a way how to pass keycloak.json to UPS cartridge, which is > >> AS7 > >> and we can't ask user to modify standalone.xml anyway. However, we > >> could make > >> a hook on OpenShift - user will add keycloak.json to git repo and it > >> will > >> automagically put at right location. Could we have a hook in Keycloak to > >> load keycloak.json from external location? Or should we rather do some > >> war > >> exploding magic? > >> * AS7-3227 I worked this around by doing parameter injection for > >> SecurityContext in UPS. Nasty. Can we make newer RESTEasy part of > >> Keycloak > >> package for AS7? Any better option? > >> * Ember in UPS is firing AJAX request to REST Endpoints on the same > >> domain. > >> However, as it goes through Keycloak Auth Server, this is considered > >> CORS > >> request. I had to configure Web Origin for UPS application. This is > >> confusing to me, Origin header should be transparent for Keycloak as I'm > >> firing request to the same domain. Note this does not happen in Firefox, > >> which identifies same domain and avoids Origin header. I need some > >> insight > >> here from more skilled people. > >> > > > > hmmmmm .... sounds 'good' :-) :-) > > > > > >> * I wasn't able to keep http->https rewriting valve with Keycloak to > >> avoid UPS > >> usage via http protocol. I'll go deeper into that. > >> > > > > https is enforced on our UPS cartridge RI had to remove this enforcement. I'm just trying to put it back. > > > > > >> * Changes to Web Origin in Keycloak admin UI are not reflected to already > >> logged > >> users. They need to log out first. > >> * Missing logout button in UPS. Related to previous point. > >> > >> Let me know if you want me to convert some of these points to JIRAs in > >> AGPUSH > >> or KEYCLOAK projects. Also, let me please now if I should have configured > >> something differently. > >> > >> Thanks, > >> > >> Karel > >> > >> [1] https://github.com/stianst/openshift-keycloak-cartridge > >> [2] > >> > >> https://github.com/kpiwko/openshift-origin-cartridge-aerogear-push/tree/k... > >> [3] > >> > >> https://github.com/kpiwko/aerogear-unifiedpush-server/tree/keycloak-opens... > >> > >> More detailed steps: > >> > >> 1/ Create Keycloak cart > >> 2/ Add AeroGear-UnifiedPush realm with roles admin, user > >> 3/ Add ag-push app with scopes admin, user, allow Web Origin for UPS cart > >> location > >> 4/ Get keycloak.json > >> 5/ Enable CORS in keycloak.json, modify password > >> 6/ Add keycloak.json to > >> aerogear-unifiedpush-server/src/main/webapp/WEB-INF > >> 7/ Package UPS via 'mvn clean package' > >> 8/ Put war into > >> > >> openshift-origin-cartridge-aerogear-push/versions/0.9.0/standalone/deployments > >> 9/ Push that online > >> 10/ Create UPS cart using reflector cartridge (use commit sha1 if not > >> using > >> master), enable mysql-5.1 gear as well > >> 11/ Create an user with roles admin/user in AeroGear-UnifiedPush realm > >> 12/ Enjoy UPS secured by Keycloak. Have a big cup of coffee. > >> > >> > >> _______________________________________________ > >> aerogear-dev mailing list > >> aerogear-dev(a)lists.jboss.org > >> https://lists.jboss.org/mailman/listinfo/aerogear-dev > >> > > > > > > > > -- > > Matthias Wessendorf > > > > blog: http://matthiaswessendorf.wordpress.com/ > > sessions: http://www.slideshare.net/mwessendorf > > twitter: http://twitter.com/mwessendorf > > > > > _______________________________________________ keycloak-dev mailing list keycloak-dev(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/keycloak-dev

On 2/4/2014 12:38 PM, Matthias Wessendorf wrote: > I've added Keycloak AS7 modules to UPS cart but not admin console. I > believe > that Keycloak is SaaS, so usage with two different carts reflect > reality better. > Configuring Keycloak cart once and let all other carts use is seems > the right > way to me. > > > there is IMO pros and cons in both ways > Originally, Keycloak was going to be a SaaS. One internet service where users could register and create their own Realms....But, we decided that users will probably want to have full control of their security metadata and not share a database with other users. Less we have to worry about from a storage security standpoint. IMO, UPS should support bundling its own keycloak server already preconfigured, or, it should hook into an existing keycloak instance.

I don't know if this would require 2 different cartridges, or if you would have an online "installation" UI to make these types of decisions. -- Bill Burke JBoss, a division of Red Hat http://bill.burkecentral.com _______________________________________________ keycloak-dev mailing list keycloak-dev(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/keycloak-dev