July 2015 - keycloak-user - Jboss List Archives

by Hipfinger Martin (BCC.ÖBB.TicketShop.MA)

Hi, we're running keycloak 1.1 with several overlays - in detail: - A new datasource per overlay /opt/keycloak/bin/jboss-cli.sh --commands="connect, data-source add --name=xxxDS --connection-url=jdbc:oracle:thin:@xxxxx:1522:xxxxx --jndi-name=java:jboss/datasources/xxxDS --driver-name=ojdbc --password=xxx --user-name=XXX" - A new auth-server entry /opt/keycloak/bin/jboss-cli.sh --commands="connect, /subsystem=keycloak/auth-server=xxx-server/:add(web-context=xxx, enabled=true)" - An own keycloak-server.json "connectionsJpa": { "default": { "dataSource": "java:jboss/datasources/xxxDS", "databaseSchema": "update" } } "connectionsInfinispan": { "default" : { "cacheContainer" : "java:jboss/infinispan/xxxKeycloak" } /opt/keycloak/bin/jboss-cli.sh --commands="connect, /subsystem=keycloak/auth-server=xxx-server:update-server-config(bytes-to-upload=/opt/keycloak/standalone/configuration/keycloak-server-xxx.json,overwrite=true)" This configuration isn't supported anymore with 1.3.1 - do you have any hint for me, how to achieve a similar config with 1.3.1? br, Martin

10 years, 10 months

2
1
0 / 0

Keycloak 1.3.1 Openshift cartridge

by Maurice Quaedackers

Hello, Is a GitHub repository of Keycloak 1.3.1 available? When I visit https://github.com/keycloak I can find the https://github.com/keycloak/openshift-keycloak-cartridge repository but that there is no 1.3.1 version available Can a 1.3.1 version be added or can you point me into the correct direction. Thank you very much in advance, Best regards Maurice Quaedackers

10 years, 10 months

3
4
0 / 0

When using an IdentityBroker

by Ed Hillmann

Hi, I'm going through the most recent doco, and I'm looking at the IdentityBroker <http://keycloak.github.io/docs/userguide/html/identity-broker.html> section. So, having gone through the walkthrough, can someone tell me if I'm on the right track. So, step #8 states that "Keycloak is going to check if the response from the identity provider is valid. If valid, it will create an user or just skip that if the user already exists". Does that mean that KeyCloak will have a User, against which roles can be mapped? This will be a user that would be, for example, displayed in the admin console just like any locally-defined User? I'm trying to piece this all together, from where we can start assigning roles to these users whose authentication has been performed by an external IdentityProvider. Following on from that, the user would continue to authenticate against the Identity Provider? If they already exist, that's mentioned later on it the same text where the accounts are linked? If I've got this wrong, please let me know. :) Thanks for any help, Ed

10 years, 10 months

2
3
0 / 0

help with bearer + basic auth

by John Casey

Hi, This is my first post to this list, so please excuse me if this question has been asked before. I'm having some trouble finding it via Google if so... I have a REST server with an Angular.js UI. I also access this REST server via "raw" http calls (via curl, other utilities) and via a Java client API that I control. I'm trying to setup Keycloak to protect it, such that the UI does its own authentication via the Keycloak javascript adapter, then sends the bearer token to the REST server. At the same time, I don't want to complicate things for scripts and such that just want to make one or two calls to the server using python's httplib2 or curl or something like that...I'd like those to use BASIC authentication. When I setup my server's keycloak.json, it seems the only thing that will work for granting access via the UI is to have it set to: "bearer-only": true However, this obviously doesn't work for basic auth via curl. I get a 400 Bad Request in the UI try to set the server's keycloak.json to: "enable-basic-auth": true ...but then curl works as expected. I've looked at the example here: https://github.com/keycloak/keycloak/tree/master/examples/basic-auth ...but it doesn't seem to have a javascript UI or anything using bearer tokens to verify that it works that way. My codebase is here: https://github.com/jdcasey/aprox/tree/keycloak-refactor And my keycloak files are here: https://github.com/jdcasey/aprox/tree/keycloak-refactor/subsys/keycloak/s... Any insight / hints would be very much appreciated! Thanks in advance, -john -- John Casey --- GitHub: https://github.com/jdcasey/ Twitter: http://twitter.com/buildchimp

10 years, 10 months

4
9
0 / 0

Login timeout

by Juraci Paixão Kröhling

All, When an user's session is timed out, the usual approach is to issue a logout via the JavaScript adapter, which in turn will redirect the browser to the login page at Keycloak. The problem we are facing is that the user might not be active at this time (the session has already timed out, after all), so, it might take a while for the user to login again. If the user takes too long to login again, Keycloak will display a login error, saying "Login timeout. Please login again". While I understand the technical aspects behind this, I think this is problematic from the UXD perspective. Why should the user enter the same valid login/password again, if the first ones were just fine? As a "temporary" solution for Hawkular, we are *not* issuing a logout via the JS adapter, but doing a "clearToken" and showing a modal with a message like "Your session has timed out, login again", forcing the user to click on a "Login" button, which will then redirect the user to the login page. This is also not optimal from the UXD perspective, but at least won't display an error message to the user. As we can't possibly be the only ones with this (minor) problem, I'm wondering if a set of redirects "in the background" couldn't solve the technical issues, while keeping the login process "error free" from the user's perspective. Or if we should indeed handle this situation on our side. For reference: https://issues.jboss.org/browse/HAWKULAR-444 - Juca.

10 years, 10 months

2
3
0 / 0

Login user action lifespan

by Niko Köbler

Hi, you can set the „login user action lifespan“ in realm settings for the time the link is valid for a user to set a password (or other tasks). This link seems to be valid and working even if the user has clicked on it and has done the tasks. Is it possible to configure this link to be valid only once during its lifespan ? Or at least to be invalid as soon the user has set his password/done the login actions? Otherwise this link could be used to change the password again, after the user has already set his password - possibly from third persons who got known of this link. May be a security issue? Thanks & regards, - Niko

10 years, 10 months

2
8
0 / 0

Unable to log in to master realm with new created users

by Maurice Quaedackers

Hello, I have an issue with a running Keycloak 1.2.0.Final instance. The instance was running all okay but suddenly without changing anything to the installation I am not able to create new users in the Master realm and log in with this new user. Allready existing users can login to Keycloak, also when I change the password for the user. As soon as I create a user (planon in this example) , and try to log in with the given credentials I get Invalid username or password prompted and see the line below in the server.log ^[[0m^[[33m08:44:37,204 WARN [org.keycloak.events] (default task-24) type=LOGIN_ERROR, realmId=master, clientId=security-admin-console, userId=2260992e-a2fb-4503-b5a1-f468526fbc9f, ipAddress=84.233.191.62, error=invalid_user_credentials, auth_method=form, response_type=code, redirect_uri=https://fr-authtest.planoncloud.com/auth/admin/master/console/, code_id=b2a5f41b-568c-420a-bd5d-770080c369ab, username=planon How can I find the rootcause for this issue ? (And a resolution) With kind regards / Met vriendelijke groet, Maurice Quaedackers Planon Cloud Center _____________________ Planon B.V. Postbus 38074 6503 AB Nijmegen Wijchenseweg 8 6537 TL Nijmegen Nederland T: +31 (0) 24 641 3135 F: +31 (0) 24 642 2942 E: maurice.quaedackers(a)planonsoftware.com<mailto:maurice.quaedackers@planonsoftware.com> W: www.planonsoftware.com<http://www.planonsoftware.com/> Deze email en alle bijlagen zijn slechts voor gebruik door de beoogde ontvanger. De email kan intellectueel eigendom en/of vertrouwelijke informatie bevatten. Het mag niet worden gekopieerd, openbaar gemaakt, bewaard of gebruikt worden door anderen dan waarvoor deze bestemd is. Bent u niet de beoogde ontvanger,verwijdert u dan deze email met alle bijlagen en kopieën onmiddellijk en informeer de afzender. This e-mail and any attachment is for authorised use by the intended recipient(s) only. It may contain proprietary material, confidential information and/or be subject to legal privilege. It should not be copied, disclosed to, retained or used by, any other party. If you are not an intended recipient then please promptly delete this e-mail and any attachment and all copies and inform the sender.

10 years, 10 months

2
3
0 / 0

Re: [keycloak-user] Testing JSR-250 annotated EJBs with Keycloak and Arquillian

by Thiago Presa

What I meant was how to write an in-container test for an EJB annotated with @RolesAllowed. How can I programatically log in and create the EJB session with the roles returned from Keycloak?

10 years, 10 months

1
0
0 / 0

Dump user profile data from Social Identity Provider

by Eugene Chow

Hi, i have a Keycloak 1.2.0 installation that authenticates against a custom OpenID Connect provider. I need to see the JSON response from the social provider. The documentation says to set org.keycloak.social.user_profile_dump to DEBUG. I’ve added the following to standalone.xml as such, but I don’t see any JSON output in the log. Is this configuration correct? <profile> <subsystem xmlns="urn:jboss:domain:logging:2.0”> <logger category="org.keycloak.social.user_profile_dump"> <level name="DEBUG"/> </logger> … ... </profile> Thanks! Eugene

10 years, 10 months

2
6
0 / 0

Use case of Deprovisioning a user in Federated IDP

by Kamal Jagadevan

Hello, I would like to know how De-provisioning of user in Federated IDP case being handled in Keycloak.How frequently Keycloak validates the federated user status before reissuing the new access token to the already authenticated user.Is there plans to support SCIM (System for Cross-domain Identity Management) in Keycloak roadmap? Following is our use case 1. There are few processes that will be authenticated with Federated IDP using SAML just after user(A) registration is complete (one time login manually).2. Subsequently SP will issue the token pair to these processes to use as long as Refresh token lifetime is valid.3. Within this refresh token lifetime (if it too long) and in the case user(A) is de-provisioned/removed, how would SP be aware to block this token renewal. Please share your thoughts. BestKamal

10 years, 10 months

2
2
0 / 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

keycloak-user July 2015