June 2016 - keycloak-user - Jboss List Archives

by Pål Oliver Kristiansen

Hi! We have set up Keycloak as an IDP with a F5 BigIP APM as a SAML SP. Everything works well out of the box, but when we activate encryption of assertions, we get an error on the BigIP side. So in order to investigate the situation, I'm trying to understand the process of SAML assertion response encryption. And I am a bit confused when reading the Keycloak documentation and comparing that to what I see in the Keycloak admin console. Here is what I mean; in the documentation ( https://keycloak.github.io/docs/userguide/keycloak-server/html/saml.html), activating assertion response encryption is described like this: "Encrypt Assertions Encrypt assertions in SAML documents with the realm's private key. The AES algorithm is used with a key size of 128 bits." But in the admin console (under clients) it is described like this in the tooltip: "Encrypt Assertions Should SAML assertions be encrypted with client's public key using AES?" So basically, which key is used for encrypting the assertion response? I have inspected the actual HTTP post and it looks something like this: <samlp:Response> ... <saml:EncryptedAssertion> <xenc:EncryptedData xmlns:xenc="http://www.w3.org/2001/04/xmlenc#" Type="http://www.w3.org/2001/04/xmlenc#Element"> <xenc:EncryptionMethod Algorithm=" http://www.w3.org/2001/04/xmlenc#aes128-cbc"/> <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#"> <xenc:EncryptedKey> <xenc:EncryptionMethod Algorithm=" http://www.w3.org/2001/04/xmlenc#rsa-1_5"/> <xenc:CipherData> <xenc:CipherValue>---[block of cipher text]---</xenc:CipherValue> </xenc:CipherData> </xenc:EncryptedKey> </ds:KeyInfo> <xenc:CipherData> <xenc:CipherValue>---[block of cipher text]---</xenc:CipherValue> </xenc:CipherData> </xenc:EncryptedData> </saml:EncryptedAssertion> </samlp:Response> So it at least looks like the key to decrypt the encrypted response is included. It is encrypted using RSA, but with which key? My understanding was something like this: 1. The encryption of a SAML assertion response is done using AES-128, with some key. 2. The key is added alongside the encrypted assertion response and encrypted using the SP's public key. 3. The SP receives the encrypted assertion response and the encrypted key, decrypts the key using its' private key and uses this decrypted key to decrypt the actual assertion response. Is this generally correct? The error we get from BigIP is this: "failed to process encrypted assertion, error: RSA decrypt" Which leads me to think that maybe the decryption of the included key did not work out. Any ideas or tips to how to approach this? Thanks!

8 years, 5 months

4
5
0 / 0

Re: [keycloak-user] Keycloak single sign on with Keberos(AD)

by Marek Posolda

Hi Raymond, returning keycloak-user list back for tracking purposes. What I can see in the server.log is happening is that: - Keycloak ask browser to send SPNEGO token (by sending 401 with "WWW-Authenticate: Negotiate" header). So far everything as expected - Browser replies with SPNEGO token, however it uses NTLM as the preferred choice ( First OID is 1.3.6.1.4.1.311.2.2.10 ) together with NTLM token. The KRB5 OID ( 1.2.840.113554.1.2.2 ) is in the supported mechanisms too. - Keycloak replies with NegTokenTarg token when it's asking for sending SPNEGO token backed by KRB5 instead of NTLM (as Keycloak doesn't understant NTLM atm. There is related discussion on keycloak-user http://lists.jboss.org/pipermail/keycloak-user/2016-June/006758.html ) - Browser doesn't respond to NegTokenTarg with SPNEGO+KRB5 token anymore Not sure what are your possibilities TBH. Either somehow setup browser to reply to second request with NegTokenTarg and send SPNEGO+KRB5 token. Or re-configure your Windows domain (or client machines + browser) to skip using NTLM. Right now, I don't have any clue how to do that TBH. Marek On 28/06/16 21:58, Zhou, Limin (Ray) wrote: > > Hi Marek > > If you haven’t looked at my previous server.log, then use this one > instead, in this log we were getting an exception > > *GSSException: Defective token detected (Mechanism level: GSSHeader > did not find the right tag)*** > > When we hit the url, maybe this will make things easier > > Please let me know if you need anything more > > Thanks a lot > > Raymond > > *From:*Zhou, Limin (Ray) > *Sent:* Tuesday, June 28, 2016 10:00 AM > *To:* 'Marek Posolda' > *Subject:* RE: [keycloak-user] Keycloak single sign on with Keberos(AD) > > Hi Marek > > I have attached my keycloak server log to you, after adding the two > properties, we can see an exception shows up when I hitting my url, > after the exception, I think the default keycloak login page shows up, > and rest of the log were generated by my manual login > > Hope this can give us some clue > > Thanks a lot > > Raymond > > *From:*Marek Posolda [mailto:mposolda@redhat.com] > *Sent:* Tuesday, June 28, 2016 1:43 AM > *To:* Zhou, Limin (Ray) > *Subject:* Re: [keycloak-user] Keycloak single sign on with Keberos(AD) > > Thanks Raymond, > > is it possible to also enable the system properties > |-Dsun.security.krb5.debug=true| and |-Dsun.security.spnego.debug=true > and see if there are some more details in the log? You can add system > properties either directly to standalone/configuration/standalone.xml > file or by adding them to java opts in bin/standalone.conf| > > |Thanks,| > |Marek| > > On 27/06/16 23:18, Zhou, Limin (Ray) wrote: > > Hello Marek > > Thanks for answering my post, following are the log piece after > hitting the first page, hope this helps. > > Please let me know if you need anything more > > Thank you so much > > Raymond > > 2016-06-27 17:11:13,453 INFO [stdout] (default task-24) Debug is > true storeKey true useTicketCache false useKeyTab true doNotPrompt > true ticketCache is null isInitiator false KeyTab is > C:\FIRMS-domain\kcsso.keytab refreshKrb5Config is false principal > is HTTP/t430-pbdc41e.monad.moneris.com(a)MONAD.MONERIS.COM > <mailto:HTTP/t430-pbdc41e.monad.moneris.com@MONAD.MONERIS.COM> > tryFirstPass is false useFirstPass is false storePass is false > clearPass is false > > 2016-06-27 17:11:13,453 INFO [stdout] (default task-24) principal > is HTTP/t430-pbdc41e.monad.moneris.com(a)MONAD.MONERIS.COM > <mailto:HTTP/t430-pbdc41e.monad.moneris.com@MONAD.MONERIS.COM> > > 2016-06-27 17:11:13,453 INFO [stdout] (default task-24) Will use > keytab > > 2016-06-27 17:11:13,453 INFO [stdout] (default task-24) Commit > Succeeded > > 2016-06-27 17:11:13,453 INFO [stdout] (default task-24) > > 2016-06-27 17:11:13,454 INFO [stdout] (default task-24) > [Krb5LoginModule]: Entering logout > > 2016-06-27 17:11:13,454 INFO [stdout] (default task-24) > [Krb5LoginModule]: logged out Subject > > *From:*Marek Posolda [mailto:mposolda@redhat.com] > *Sent:* Monday, June 27, 2016 5:55 AM > *To:* Zhou, Limin (Ray); keycloak-user(a)lists.jboss.org > <mailto:keycloak-user@lists.jboss.org> > *Subject:* Re: [keycloak-user] Keycloak single sign on with > Keberos(AD) > > It may help if you enable all the possible debug/trace logging and > post the log here. This may give more info what is the issue. See > docs how to enable logging : > https://keycloak.gitbooks.io/server-adminstration-guide/content/v/2.0/top... > > Try to send the log from the point once you trigger the > authentication request (or from the point when you hit your app URL) > > Thanks, > Marek > > On 24/06/16 20:22, Zhou, Limin (Ray) wrote: > > Hello everyone > > I am new to Keycloak and new to here > > Our web application is running on Jboss EAP 7, We have > configured KeyCloak standalone server 1.9.7 running on > different port(same server box) to manage the user > authentication and authorization, behind KeyCloak we have > configured Keberos in User Federation to talk our company AD > server, we are able to login by using our AD account, but not > in single sign on way, each time when we hitting the our app > URL, the Keycloak login page will show up. > > It looks like the TGT or ST hand shake was not successful, is > there any document I can reference it to debug the issue? > > Any comments or suggestion would be very welcome > > thanks in advance > > raymond > > ------------------------------------------------------------------------ > > Moneris Solutions Corporation | 3300 Bloor Street West | > Toronto | Ontario | M8X 2X2 | Canada www.moneris.com > <http://www.moneris.com> 1-866-319-7450 > If you wish to unsubscribe from future updates from Moneris, > please click here > <https://www.moneris.com/en/About-Moneris/Contact-Moneris/Unsubscribe.aspx>. > Please see the Moneris Privacy Policy here > <http://www.moneris.com/Home/Legal/Website-Policies/Privacy-Policy.aspx>. > > > This e-mail may be privileged and/or confidential, and the > sender does not waive any related rights and obligations. Any > distribution, use or copying of this e-mail or the information > it contains by other than an intended recipient is > unauthorized. If you received this e-mail in error, please > advise me (by return e-mail or otherwise) immediately. > > ------------------------------------------------------------------------ > > Corporation Solutions Moneris | 3300, rue Bloor Ouest | > Toronto | Ontario | M8X 2X2 | Canada www.moneris.com > <http://www.moneris.com> 1-866-319-7450 > Si vous désirez enlever votre nom de la liste d’envoi de > Moneris, veuillez cliquer ici > <https://www.moneris.com/about-moneris/contact-moneris/unsubscribe?sc_lang...>. > Veuillez consulter la Politique de confidentialité de Moneris > ici > <http://www.moneris.com/Home/Legal/Website-Policies/Privacy-Policy.aspx?sc...>. > > > Ce courriel peut contenir des renseignements confidentiels ou > privilégiés, et son expéditeur ne renonce à aucun droit ni à > aucune obligation connexe. La distribution, l’utilisation ou > la reproduction du présent courriel ou des renseignements > qu’il contient par une personne autre que son destinataire > prévu sont interdites. Si vous avez reçu ce courriel par > erreur, veuillez m’en aviser immédiatement (par retour de > courriel ou autrement). > > > _______________________________________________ > > keycloak-user mailing list > > keycloak-user(a)lists.jboss.org > <mailto:keycloak-user@lists.jboss.org> > > https://lists.jboss.org/mailman/listinfo/keycloak-user > > ------------------------------------------------------------------------ > > Moneris Solutions Corporation | 3300 Bloor Street West | Toronto | > Ontario | M8X 2X2 | Canada www.moneris.com > <http://www.moneris.com> 1-866-319-7450 > If you wish to unsubscribe from future updates from Moneris, > please click here > <https://www.moneris.com/en/About-Moneris/Contact-Moneris/Unsubscribe.aspx>. > Please see the Moneris Privacy Policy here > <http://www.moneris.com/Home/Legal/Website-Policies/Privacy-Policy.aspx>. > > > This e-mail may be privileged and/or confidential, and the sender > does not waive any related rights and obligations. Any > distribution, use or copying of this e-mail or the information it > contains by other than an intended recipient is unauthorized. If > you received this e-mail in error, please advise me (by return > e-mail or otherwise) immediately. > > ------------------------------------------------------------------------ > > Corporation Solutions Moneris | 3300, rue Bloor Ouest | Toronto | > Ontario | M8X 2X2 | Canada www.moneris.com > <http://www.moneris.com> 1-866-319-7450 > Si vous désirez enlever votre nom de la liste d’envoi de Moneris, > veuillez cliquer ici > <https://www.moneris.com/about-moneris/contact-moneris/unsubscribe?sc_lang...>. > Veuillez consulter la Politique de confidentialité de Moneris ici > <http://www.moneris.com/Home/Legal/Website-Policies/Privacy-Policy.aspx?sc...>. > > > Ce courriel peut contenir des renseignements confidentiels ou > privilégiés, et son expéditeur ne renonce à aucun droit ni à > aucune obligation connexe. La distribution, l’utilisation ou la > reproduction du présent courriel ou des renseignements qu’il > contient par une personne autre que son destinataire prévu sont > interdites. Si vous avez reçu ce courriel par erreur, veuillez > m’en aviser immédiatement (par retour de courriel ou autrement). > > ------------------------------------------------------------------------ > Moneris Solutions Corporation | 3300 Bloor Street West | Toronto | > Ontario | M8X 2X2 | Canada www.moneris.com 1-866-319-7450 > If you wish to unsubscribe from future updates from Moneris, please > click here > <https://www.moneris.com/en/About-Moneris/Contact-Moneris/Unsubscribe.aspx>. > Please see the Moneris Privacy Policy here > <http://www.moneris.com/Home/Legal/Website-Policies/Privacy-Policy.aspx>. > > This e-mail may be privileged and/or confidential, and the sender does > not waive any related rights and obligations. Any distribution, use or > copying of this e-mail or the information it contains by other than an > intended recipient is unauthorized. If you received this e-mail in > error, please advise me (by return e-mail or otherwise) immediately. > ------------------------------------------------------------------------ > Corporation Solutions Moneris | 3300, rue Bloor Ouest | Toronto | > Ontario | M8X 2X2 | Canada www.moneris.com 1-866-319-7450 > Si vous désirez enlever votre nom de la liste d’envoi de Moneris, > veuillez cliquer ici > <https://www.moneris.com/about-moneris/contact-moneris/unsubscribe?sc_lang...>. > Veuillez consulter la Politique de confidentialité de Moneris ici > <http://www.moneris.com/Home/Legal/Website-Policies/Privacy-Policy.aspx?sc...>. > > > Ce courriel peut contenir des renseignements confidentiels ou > privilégiés, et son expéditeur ne renonce à aucun droit ni à aucune > obligation connexe. La distribution, l’utilisation ou la reproduction > du présent courriel ou des renseignements qu’il contient par une > personne autre que son destinataire prévu sont interdites. Si vous > avez reçu ce courriel par erreur, veuillez m’en aviser immédiatement > (par retour de courriel ou autrement).

8 years, 5 months

1
0
0 / 0

Help problem with Bad request

by Gyalai Milán

Hello, I have problem with the Bad request when the user login. I have a simple War with JSP-s. With the following keycloak.json { "realm": "test", "realm-public-key": "...", "auth-server-url": "keycloak-url", "ssl-required": "none", "resource": "dashboard-app", "public-client": true, "use-resource-role-mappings": false, "principal-attribute": "preferred_username" } The wildfly redirects to the keycloak perfectly and adds a status parameter to the URL. After the login we get a 400 Bad request error. In the wildfly log I found these lines. WARN [org.keycloak.adapters.OAuthRequestAuthenticator] (default task-111) state parameter invalid WARN [org.keycloak.adapters.OAuthRequestAuthenticator] (default task-111) cookie: 151/af93b54d-6b04-4d82-9a8b-1fe7203b279e WARN [org.keycloak.adapters.OAuthRequestAuthenticator] (default task-111) queryParam: 150/e946fb78-9902-4449-8c33-687fcaf98d3d What did I configure wrong? The Keycloak version is 1.9.8.Final . Any ideas ? Regards

8 years, 5 months

2
1
0 / 0

Does Keycloak's SPNEGO support include fall-back to NTLM in absence of Kerberos?

by Guy Davis

Good day, For sake of argument, assume that someone has set up a MS Active Directory domain with Kerberos disabled, but NTLM still enabled. In that situation, would a user browsing to a Keycloak-protected application, with LDAP+SPNEGO enabled (against that MS AD system) still allow for Integrated Windows Authentication (auto-login without prompt) to web application? Thanks much, Guy

8 years, 5 months

2
2
0 / 0

Question about the javascript-adapter and the check-sso option with a confidential client

by Tomás García

Hi, I wonder if it's possible to just check the SSO state with a confidential client. My use case is the following one: - I have a website which uses a confidential client to login with Keycloak. - I want to add autologin to this website. - So I use the javascript adapter with the following option object for the init method: { onLoad: 'check-sso' }. The javascript adapter is built without the secret key in its constructor (obviously if I put the secret key in there, there's no point to use a confidential client at all). But Keycloak fails with a "type=CODE_TO_TOKEN_ERROR, error=invalid_client_credentials" error. So I don't know how feasible or secure is to just check that the Keycloak session inside the cookie of the user's browser is still valid. In my case, the browser doesn't need to get the user info, access token, etc, because what I'll do is redirect the user to the Keycloak login page with the confidential client afterwards is the operation is successful. Since the Keycloak session is valid, Keycloak should redirect back with the authentication code without asking credentials to the user. Additional note: the CORS header isn't added to 400 responses in Keycloak, so it was a bit confusing looking at the JS console in the browser, because it complained about CORS but it was just Keycloak giving the 400 response without the allow-origin header. Thanks. -- *Tomás García Pérez * *Software Developer* *Intra**House***

8 years, 5 months

3
7
0 / 0

keycloak access token caching?

by Jannik Hüls

Hi, I use the /auth/realms/{realm}/protocol/openid-connect/token endpoint to create a User Session. The Session is shown inside keycloak and i get the access_token, refresh_token and id_token. When I now call the /auth/realms/{realm}/protocol/openid-connect/token/introspect I get a valid response containing “active”:”true” amongst others. I call it using POST method and providing cient_id, client_secret and token parameter as data. The token parameter contains the access_token value. I now log in to keycloak administrator and logout the User. Now I again call the introspection endpoint but still get a response containing "active":”true”. It seems that keycloak is caching the User Session and after some time I get “active”:”false”. May I be able to disable caching and to immediately get a introspection response that indicates that the User Session does not longer exist? Btw.: The same happens when I call the /auth/realms/{realm}/protocol/openid-connect/logout?redirect_uri= endpoint. I provided the access_token in the header. POST parameters are client_id, client_secret and refresh_token is this case. I use the introspection endpoint in the different RPs I use to validate whether the access_token is revoked in order to introduce single logout. Hence it would be nice to disable the caching to have less inconsistence. Bests Jannik

8 years, 5 months

2
4
0 / 0

Keycloak minimal for integration test

by Charlee Chitsuk

Hi, I would like to test my application via the Arquillian. Does keycloak provide the minimal server for integration test? -- Best Regards, Charlee Ch <https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_camp...> Virus-free. www.avast.com <https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_camp...> <#DDB4FAA8-2DD7-40BB-A1B8-4E2AA1F9FDF2>

8 years, 5 months

4
5
0 / 0

Major Memory Leak/Consumption When Creating Many Users

by Chris Hairfield

Hello, When testing Keycloak 1.9.8 by ingesting a few million users, we find that Keycloak leaks memory until it is rendered unresponsive (see graph). Increasing JVM memory only increases the time it takes to encounter this issue. We have put together a test project here <https://github.com/anaerobic/keycloak-leakage> and opened an issue here <https://issues.jboss.org/browse/KEYCLOAK-3146> as we continue to investigate. As we are relying on Keycloak as a central infrastructural component, any help would be greatly appreciated. We'll update with more information as we find it. Thanks, Chris [image: mem-cpu.png]

8 years, 5 months

3
14
0 / 0

Keycloak Adapter Set/Remove Cookies Depending on Path

by Sarp Kaya

According to this code: <https://github.com/keycloak/keycloak/blob/master/adapters/oidc/adapter-co...><https://github.com/keycloak/keycloak/blob/master/adapters/oidc/adapter-co...>https://github.com/keycloak/keycloak/blob/master/adapters/oidc/adapter-co... The cookie is only reset at the place where the logout path is. For instance: Applications serve at /foo/app and /bar/app And logout path is just /logout In that case that won't work because cookiePath for removeCookie would be /logout. The problem is the user is still logged in within the period of Access Token Lifespan. It doesn't make sense to have different logout URL for each application as such /bar/logout and /foo/logout . Is there a way to just keep single logout which logs out the user for each application? Thanks, Sarp Kaya

8 years, 5 months

2
1
0 / 0

Help - two issues

by James_Saxton＠ao.uscourts.gov

Good Day, Today I was trying to front-end KeyCloak with Apache. Background Keycloak 1.9.5 is installed successfully on linix, I can tuunel to it and log in using admin creds I set up. I installed a webserver and configured SSL for the webserver and Keycloak as outlined in 3.2.6. SSL/HTTPS Requirement/Modes through 3.2.8.2. Configure Wildfly undertow subsystem I restarted the webserver and the keycloak server. The webserver shows the credential pop up stating the site is "strictly private". Creds do not allow me to log in through a webserver, only if I use the SSH tunnel. Not sure were to go - the instruction are pretty simple, I suspect a config issue - not sure where though. Second issue, using the SSH tunnel, I enable require "ALL SSL" as a test knowing full well I could get locked out completely. How can I reset the require ALL SSL without using the console? Thanks in advance. James Saxton Software Infrastructure Division Administrative Office of the U.S. Courts One Columbus Circle, N.E. Washington, DC 20544 (C) 908-910-5566 Teamwork makes the dream work!

8 years, 5 months

2
1
0 / 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

keycloak-user June 2016