September 2016 - keycloak-user - Jboss List Archives

Unable to get list of client level roles - available roles

by Jitendra Chouhan

Hi, I am not able to get client level available roles in keycloak using keycloak-admin-client.jar. Please find sample code i am using to get client and then thought of getting available roles under a client. ClientsResource clientsResource = getRealm().clients(); ClientRepresentation> clientsRepresentation = clientsResource. findByClientId(appName); clientRepresentation = clientsRepresentation.get(0); clientRepresentation.getDefaultRoles(); With above code i am only getting default roles under a client but not all available roles as there is no method available in ClientResource class. Thanks, Jitendra Chouhan

8 years, 3 months

2
1
0 / 0

Communication between Keycloak and Spring Security Adapter

by Matt H

Hi, I'm trying to get a better understanding of the communication between Keycloak and spring security client applications. If I'm understanding the authentication/authorization flow, it would be something like: 1. User (or client application) login to application 2. Spring security redirects to Keycloak 3. Keycloak verifies user and creates a JWT 4. Redirects user with JWT back to application 5. Verifies JWT 6. Sends response to client For step #5, verification: Does spring security verify the JWT locally, or is the token sent back to Keycloak for verification? I'm wondering how much "chatter" there is between Spring security and Keycloak for every request. If a user already has a non-expired JWT, does it just do steps 5-6 until it expires? Once it expires, it requests a new JWT from Keycloak? Thanks, Matt

8 years, 3 months

2
1
0 / 0

Token settings understanding

by Milosavljević, Nemanja

Hi, I've searched far and wide and I'm still not clear on the proper token settings setup and other use cases in which different setup could bring. Could someone please give me an example of what should be the keycloak/my-application behavior with the default setup? Thanks, Nemanja _____________________________________________________________ [cid:image001.jpg@01D1488F.FE122420]<http://www.qualitype.de/> Nemanja Milosavljevic | Front-end developer Phone + 49 351 8838 2809 Email n.milosavljevic(a)qualitype.de<mailto:n.milosavljevic@qualitype.de> Qualitype GmbH | Moritzburger Weg 67 | 01109 Dresden | Germany Fax +49 351 8838 2809 | Web www.qualitype.de<http://www.qualitype.de/> Sitz der Gesellschaft: Dresden | Amtsgericht Dresden HRB 31753 Geschäftsführer: Dr. Wilhelm Zörgiebel | Dr. Frank Götz The information in this email and any attachments is confidential and is intended for the addressee only. If you are not the intended recipient, please delete this message and any attachments and advise the sender by return email.

8 years, 3 months

2
1
0 / 0

Users experience multiple emails sent from Keycloak

by Dick Eimers

Hi, We've got report about users who received activation/login-action emails (sent by Keycloak) multiple times. After doing a bit of investigation we found out that emails are sent as a side-effect of pages obtained using a GET request, which could be the cause of sending multiple emails. For example, after registration we hit a page at location: <domain>/auth/realms/<realm>/login-actions/required-action?code=<code> which also sends an email with the activation-link. Reloading this page results in the email being sent again (with a fresh code, invalidating the old one). So maybe users are refreshing the page unintentionally, or their (mobile) browser is. Or they could be using the back-button and again hit this page, which sends the request once again also resulting in a new mail. Is anyone else running into this? Should we create a new JIRA issue to fix/improve this?

8 years, 3 months

2
2
0 / 0

Unable to configure client certificate

by abhishek raghav

Hi Team, I am facing an issue while I am trying to set Client Authenticator as 'Signed JWT'. I am using Keycloak-admin.jar to do it. Here I am trying to automate the complete client creation work through a java program. ClientAttributeCertificateResource cacr =clientResource.getCertficateResource("jwt.credentials"); byte[] mycert=cacr.generateAndGetKeystore(keyStoreConfig); Here keyStoreConfig is the config object which contains all the metadata required to generate the certificate e.g keystore password, format, alias name etc. I could successfully got the certificate generated and got it as a byte array and in the backend it is not configuring for the client. I am still seeing this: Even though value for Client Authenticator is set as Signed Jwt and same is getting updated in keycloak.json (under installation) as well. Code to set the authenticator is : client.setClientAuthenticatorType(client-jwt); Please - Best Regards Abhishek Raghav

8 years, 3 months

2
1
0 / 0

SessionNotOnOrAfter Saml Attribute Support?

by Jared Blashka

Saml spec allows for a SessionNotOnOrAfter attribute inside the AuthnStatement and I see some getters/setters for that attribute in AuthnStatementType.java, but it doesn't look like it gets invoked anywhere, so we can't actually use it. Were there any plans to give us a way to specify a value for this attribute, or just set it to the length of sso session max? I had some clients asking about it. Jared

8 years, 3 months

2
2
0 / 0

API to map from Provider User ID to Keycloak User ID?

by Chris Hairfield

Is there an efficient API for obtaining the Keycloak User given an identity provider ID? For instance, Keycloak user ABC has linked to their Facebook account with provider id 123. Can we efficiently get from 123 to ABC?

8 years, 3 months

2
1
0 / 0

Map group attributes to users

by Uli SE

Hi Is it possible to map group attributes to users of the group to see them in the users tokens? Thanks, Uli

8 years, 3 months

2
1
0 / 0

Retrieving the access token itself from org.keycloak.representations.AccessToken

by Aritz Maeztu

I have implemented my own mapper to add extra info in the transformAccessToken method. However, to fill the extra fields I would like to use the access token itself to access a remote security endpoint which is secured. However, I don't see any way to retrieve the base64 encoded token from the org.keycloak.representations.AccessToken.java object. Currently my workaround is to access the remote endpoint using a service account, but I would like to take advantage of the token I already have. Is it possible? -- Aritz Maeztu Otaño Departamento Desarrollo de Software <https://www.linkedin.com/in/aritz-maeztu-ota%C3%B1o-65891942> <http://www.tesicnor.com> Pol. Ind. Mocholi. C/Rio Elorz, Nave 13E 31110 Noain (Navarra) Telf. Aritz Maeztu: 948 68 03 06 Telf. Secretaría: 948 21 40 40 Antes de imprimir este e-mail piense bien si es necesario hacerlo: El medioambiente es cosa de todos.

8 years, 3 months

2
2
0 / 0

Realm Config Recommendations

by Adam Keily

Hi, I'm new to keycloak and we're investigating using it within our University. In the first instance it would be used as a registration point for external users e.g. prospective students etc. They will either register via the form or using social IdP's in order to access various apps for these types of users. We want to remain open to using Keycloak for our internal (AD / LDAP) users to authenticate to these same apps as well as corporate applications. The tricky part comes where a prospective student (external identity) enrols and becomes a regular student (LDAP user). We would like them to continue to be recognised as a single identity and have their registered identities merged / linked with their new internal id. Hoping someone might be able to provide some guidance on the best way to go. There are a few ideas I've been testing. One is to have a single keycloak realm for user registration and configure LDAP as a user federation source. However this would seem to rule out linking the accounts? Another idea was to configure two realms (internal and external) and have the internal realm act as an IdP for the external realm. Another option is to create three realms, internal, external and combined. The combined realm is used for SSO for all apps and the internal and external realms are configured to be IdP's for the combined realm. I can't help but feel this is starting to get more complicated than is necessary. Any guidance or thoughts would be much appreciated. Regards Adam -- Adam Keily Risk & Security Services The University of Adelaide

8 years, 3 months

2
4
0 / 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

keycloak-user September 2016