January 2015 - keycloak-user - Jboss List Archives

Call javascript function before session timeout

by Christoph Machnik

Hi all, I have a keycloak web-application in that objects can be created and changed. This objects are saved in a databse. When someone logged in at the application and open one of this objects to change it. this object gets markes as locked in the database, so no other user can make changes to this object wihle someone else is editing it. Th problem, i have, is that, when someone is editig one of this objects and then runs in a session timeout the object has to marked as unlocked. So i have a javascript-method in the application that sends a ajax-request to a servlet to trigger a function that unlock this object. But i have to call this method BEFORE the timeout loggs the user out. What is the best practice in this case and how i can be sure the method is performed before the user comes to the login screen again ?

10 years, 10 months

1
0
0 / 0

Keycloak Clustering Issues

by prab rrrr

Anyone noticed any issues with Infinispan? I saw a weird issue. After setting up a cluster with two nodes, made some changes on node-1 (created a user and changed the first name). While the user appeared on node-2, the change to the first name didn't make it. Restarting the node-2 didn't help either. Wondering if Infinispan is preventing all the changes to be picked up from database. If so, what settings would ensure that the data is consistent between the nodes? Thanks,Raghu

10 years, 10 months

3
6
0 / 0

User rights after logout

by Christoph Machnik

Hi all, I have a web-application with keycloak. When a user have to log in this user becomes the rights to see the following pages or not. When this user loggs out an a other user loggs in with other rights to see the following pages or not, he becomes the same rights as the first user that logged in. In the example i log in with support and just can see the support page in the application, when i logg out an log in with admin i just can see the support page and not the admin page, even though i have the admin role. When i restart the server and first log in as admin i can see the admin- and the support page. When i log out and now log in with support i have the support rule, but nevertheless i can see the admin- and support page. Is there any mistake in int web.xml file ? (following): <?xml version="1.0" encoding="UTF-8"?> <web-app xmlns="http://java.sun.com/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xml" version="3.0"> <module-name>TestWebApp</module-name> <security-constraint> <web-resource-collection> <web-resource-name>Admins</web-resource-name> <url-pattern>/views/admin/*</url-pattern> </web-resource-collection> <auth-constraint> <role-name>admin</role-name> </auth-constraint> </security-constraint> <security-constraint> <web-resource-collection> <web-resource-name>Support</web-resource-name> <url-pattern>/views/support/*</url-pattern> </web-resource-collection> <auth-constraint> <role-name>admin</role-name> <role-name>support</role-name> </auth-constraint> </security-constraint> <login-config> <auth-method>KEYCLOAK</auth-method> <realm-name>test</realm-name> </login-config> <security-role> <role-name>admin</role-name> </security-role> <security-role> <role-name>support</role-name> </security-role> </web-app>

10 years, 10 months

2
2
0 / 0

CORS Problem

by Brem, Robert

Hy @ll, For my current project I use Docker and run each service in a own container, and spread the services over multiple servers. All connected via REST. For the security I found Keycloak, and I think it's a really cool tool. But I never was the best friend of security... JASS/Spring Security... My problem is, I try to use the cors example (https://github.com/keycloak/keycloak/tree/master/examples/cors). I also use AngularJS for the frontend that consumes multiple REST Services. But I don't get it to work. I always get the following error: XMLHttpRequest cannot load http://162.244.28.89:8080/BrandService/resources/brands/. No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://162.244.28.89' is therefore not allowed access. The response had HTTP status code 403. Google Chrome give me the following output for the http request: Remote Address:162.244.28.89:8080 Request URL:http://162.244.28.89:8080/BrandService/resources/brands/ Request Method:GET Status Code:403 Forbidden Request Headersview source Accept:application/json, text/plain, */* Accept-Encoding:gzip, deflate, sdch Accept-Language:de-DE,de;q=0.8,en-US;q=0.6,en;q=0.4 Authorization:Bearer eyJhbGciOiJSUzI1NiJ9....ay2Sr-GP0CYfSDV7O2Q8sNyx91RgHdhy2S600NYEHUFG2VoF5cRCDBJpkuPbcXVtz2liMy-80S3KY9lfII Connection:keep-alive Host:162.244.28.89:8080 Origin:http://162.244.28.89 Referer:http://162.244.28.89/ User-Agent:Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.99 Safari/537.36 Response Headersview source Cache-Control:no-cache, no-store, must-revalidate Connection:keep-alive Content-Length:68 Content-Type:text/html;charset=UTF-8 Date:Fri, 23 Jan 2015 19:23:33 GMT Expires:0 Pragma:no-cache Server:WildFly/8 X-Powered-By:Undertow/1 ConsoleSearchEmulationRendering What I don't get is the response header. Shouldn't there be the following header settings: Access-Control-Allow-Credentials:true Access-Control-Allow-Headers:origin,accept,content-type Access-Control-Allow-Methods:GET, POST, PUT, DELETE, OPTIONS, HEAD Access-Control-Allow-Origin:* Access-Control-Max-Age:151200 Allow:HEAD, POST, GET, OPTIONS, PUT My keycloak.json looks like that: { "realm": "openPixx", "realm-public-key": "...bmwCckE..gWjLQIDAQAB", "ssl-required": "external", "resource": "BrandService", "bearer-only": true, "cors-max-age" : 1000, "enable-cors": true, "cors-allowed-methods" : "POST, PUT, DELETE, GET" } In Keycloak I've defined the BrandFrontend: Enabled: true Client Protocol: openid-connect Access Type: public Redirect URL: http://162.244.28.89/* Web Origin: http://162.244.28.89 For the AngularJS part I've used the authinterceptor from the example. If you have read until here. Thank you very much and sorry for my bad English :) Greets Rob

10 years, 10 months

2
1
0 / 0

Re: [keycloak-user] Authentication throw a proxy on Undertow

by Davide Ungari

Hi Bill, I see you have pushed some changes. Tell me as soon as you need me to test it. Thank you, Davide. > Weird... I'm actually screwing around with writing a security proxy > right now. I just started like an hour or so ago so I'm not exactly > sure...but I don't think you can implement this with the current > codebase. You need a Undertow only (no servlet) authentication > mechanism and to set up the security handler chain correctly. (See the > BasicAuthServer example in Undertow). > I should have something working in master by the end of the week. > On 11/19/2014 6:33 PM, Davide Ungari wrote: > >* Hi everybody, > *>* this is the big picture: > *>* a. frontend application with Undertow > *>* b. backend application with Undertow and Resteasy for REST API > *> > >* Both are using Keycloak as SSO. > *> > >* I'm trying to configure a proxy from A to B in order to expose backend > *>* API without CORS problems to the frontend. > *> > >* I asked support also to Undertow guys but the issue seems around the > *>* integration of Keycloack in Undertow. My proxy is implemented like: > *> > >* final ProxyClient proxyClient = new > *>* SimpleProxyClientProvider(new URI("http://localhost:8181 <http://localhost:8181/> > *>* <http://localhost:8181/ <http://localhost:8181/>>")); > *>* final ProxyHandler proxyHandler = new > *>* ProxyHandler(proxyClient, servletHandler); > *>* proxyHandler.addRequestHeader(new > *>* HttpString("Authorization"), new ExchangeAttribute() { > *>* @Override > *>* public String readAttribute(HttpServerExchange > *>* exchange) { > *>* exchange. > *>* RefreshableKeycloakSecurityContext context = > *>* (RefreshableKeycloakSecurityContext) exchange.getSecurityContext(); > *>* return "Bearer " + context.getTokenString(); > *>* } > *> > >* @Override > *>* public void writeAttribute(HttpServerExchange > *>* exchange, String newValue) throws ReadOnlyAttributeException { > *>* // TODO Auto-generated method stub > *>* } > *>* }); > *> > >* The problem is that the exchange.getSecurityContext() is always null. > *>* Any ideas? > *> > >* Thanks > *> > > > > > >* -- > *>* Davide > *> > > > >* _______________________________________________ > *>* keycloak-user mailing list > *>* keycloak-user at lists.jboss.org <https://lists.jboss.org/mailman/listinfo/keycloak-user> > *>* https://lists.jboss.org/mailman/listinfo/keycloak-user <https://lists.jboss.org/mailman/listinfo/keycloak-user> > *> > -- > Bill Burke > JBoss, a division of Red Hat > http://bill.burkecentral.com

10 years, 10 months

3
3
0 / 0

User Registration Form Field length validation

by Pablo N

Hello, I would like to know which is the best approach to validate username, First Name and Last Name length in the registration Form. Currently only not empty and email pattern is validated. I dont know If there is any possibility to perform this validation as part of a customized theme or if it is necessary to modify Validation.java class. Thank you very much for your help.

10 years, 11 months

2
1
0 / 0

Deploying auth-server.war on Jetty 8

by Simon Temple

Would it be possible to deploy the server WAR under Jetty 8? Has anyone done this already? I know I’d have to create a datasource and drop the auth-server.war in the jetty deploy folder… but what about the configuration folder content? Any help would be much appreciated. I tried adding the jetty 8 adapter jars to the jetty /lib and deploying the war but I got a couple of WARNS: 2015-01-26 15:48:55,389 WARN [auth-server.war] (WrapperSimpleAppMain) unavailable (ContextHandler.java:1957) javax.servlet.UnavailableException: org.jboss.resteasy.plugins.server.servlet.HttpServlet30Dispatcher at org.eclipse.jetty.servlet.Holder.doStart(Holder.java:99) and 2015-01-26 15:48:55,395 WARN [auth-server.war] (WrapperSimpleAppMain) unavailable (ContextHandler.java:1957) java.lang.NullPointerException at org.eclipse.jetty.servlet.ServletContextHandler$Context.createServlet(ServletContextHandler.java:975) at org.eclipse.jetty.servlet.ServletHolder.newInstance(ServletHolder.java:832) at org.eclipse.jetty.servlet.ServletHolder.initServlet(ServletHolder.java:482) TIA Simon

10 years, 11 months

2
1
0 / 0

Sending the user to the login page without the realm

by Juraci Paixão Kröhling

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 All, I think I've seen something similar here on the list, but I can't find the thread. So, I apologize in advance. I'm doing the integration with an application that is multi tenant, so, before sending the user to Keycloak for the authentication, I present a screen to the user to select his realm on the single-page HTML5 application. This is obviously not optimal for several reasons :-) I was then wondering if it would possible/desirable to have Keycloak to determine the realm of the user based on his login/email address. When doing the redirect to the single-page app, Keycloak would then also send, for instance, the URL for the application to load the keycloak.json file for that realm. Is this something that would be worth pursuing? - - Juca. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQEcBAEBAgAGBQJUwoyCAAoJEDnJtskdmzLMHhYH/3hii2OFSZsq4CXCL/Vo6+hp dR1p/UvoeNVquu0L1Lv4JZ34+tP/0r7Zh24kBFCglPJjxMdjozP5PCNAz9gW9vCW wr2HnUlwMmLT22mWF9YXsFgt0TPwl/ztDQOWFWnQgzqZRILG6rSC/RqeF1tN/VRU aIZGXUH+9t2nIe5g0jsYj9FdzkJy0iDVlPhSgUqR6mbsSCOSyb+r91VoVXXS62vh dSezepypdstIzxuf/+2PmVxi63+X7kFVO9jy+SNgIMsih8zqsokGuIik5s+jbaZP HhW2oR0NbiM2ch9C32V6M4/dDqhHlYpZkizHkjFZ2jZi4VBS28bfPG/9k7V3xG0= =UCsV -----END PGP SIGNATURE-----

10 years, 11 months

2
1
0 / 0

Service Provider Metadata - Keycloak 1.2 Snapshot

by Raghu Prabhala

Hi Dev team, Can you let me know how I can get the Service Provider meta data (SAML) from Keycloak 1.2 Snapshot version (I built it today from master). I am trying to test out the new SP functionality against an external IDP. Apologies for not waiting for a release and asking the question. ThanksRaghu

10 years, 11 months

1
0
0 / 0

Keycloak Redirection when "invalid redirect_uri"

by Pablo N

Hello, I would like to know if there is any way to redirect the user to the welcome page when User tries to access to an invalid redirect Uri and not leave the user in the Keycloak “invalid redirect_uri” screen. Thank you very much for your help.

10 years, 11 months

2
1
0 / 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

keycloak-user January 2015