October 2017 - keycloak-user - Jboss List Archives

by mcwitters＠winsupplyinc.com

I'm sorry if this has been asked before or is readily available information, but I haven't been able to locate a definitive answer. Under what circumstances must the Keycloak server(s) be restarted for changes to take effect? I spent a lot of time due to new or updated client redirect URIs not taking effect until a restart occurs and not expecting to have to. I've not problem with the necessity of it, but just wanted to know for sure when it is required. Thanks in advance. Mike W. ********************************************************************************************* This email message and any attachments is for use only by the named addressee(s) and may contain confidential, privileged and/or proprietary information. If you have received this message in error, please immediately notify the sender and delete and destroy the message and all copies. All unauthorized direct or indirect use or disclosure of this message is strictly prohibited. No right to confidentiality or privilege is waived or lost by any error in transmission. *********************************************************************************************

7 years, 2 months

2
1
0 / 0

Implementing a non-standard, custom IDP used for identity brokering

by Dominik Guhr

Hi everyone, I've a Problem creating a custom Identity Provider which I want to use for identity Brokering (using kc version 3.2.1) and hope you could help: ** My Scenario: There's a legacy, non-standard, xml-based "SSO" Protocol which I want to broker to enrich it with roles etc. and provide it as an option in my realm beneath ither options such as a brokered IDP using SAML, social login, etc. ** What I've tried so far: Writing a project and provisioning it to the wildfly as a module with following structure: //IDP class public class MyIdentityProvider implements IdentityProvider<MyIdentityProviderConfig> { //overridden methods (not implemented) } //Factory public class MyIdentityProviderFactory implements IdentityProviderFactory<MyIdentityProvider> { //overridden methods (just implemented getId -> "MyIDP" and getName "My IDP" so far) } //config public class MyIdentityProviderConfig extends IdentityProviderModel { //empty so far. } Plus the org.keycloak.broker.provider.IdentityProviderFactory in META-INF pointing to com.my.MyIdentityProviderFactory Outcome is, when I'm publishing this to keycloak, I've got a new field on the identity provider dropdown (which is unclickable, yet, expectedly). **My Problems/Questions: 1. All IDPs I see implemented are using standards such as oauth2, but I am missing a more general architectural advice for custom implementations, such as "you have to override this, that and that method and you definitely need this, that and thus property / process to be compatible to keycloak with your custom SSO So, question: Which methods and interfaces do I definitely have to implement to get my custom idp going? Is there something like an architectural overview? (considering I am on the right track here) 2. I get this warning starting keycloak: WARN [org.keycloak.services] (ServerService Thread Pool -- 50) KC-SERVICES0047: My IDP (com.my.MyIdentityProviderFactory) is implementing the internal SPI identity_provider. This SPI is internal and may change without notice So, this leads me to the second question: Am I missing something? Am I on the wrong track, perhaps? Is there another, better way to implement this? (I am fairly new) And last but not least, a very general question: 3. am I on the right mailinglist for this kind of question, or is this more for the dev-list? Or do u guys have a slackchannel or something like that where I could join? Would be great to hear from you! Best regards, Dominik

7 years, 2 months

3
2
0 / 0

Users with no firstName and lastName?

by "Matthias J. Déjà"

Hello, new user here, so please forgive oversights on my part. After reading the documentation and searching the mailing list, I did not find this question answered. I am creating a user storage SPI implementation that is backed by an external user storage. That external user storage does not have first or last names for users. The only intrinsic information for a user on the external storage is a unique username and the password. The Keycloak user storage SPI that I am about to implement will make the users available in Keycloak, such that they can be displayed, created and edited via Keycloak. Authentication will also be possible. Here is the problem: In Keycloak, first name and last name are intrinsic properties of a user. (I am thinking of AbstractUserAdapterFederatedStorage, which I understand would be a good idea to implement.) This is what I imagine as a realistic solution: - In Keycloak, first and last name are still, in principle, present. But they are always empty. - They cannot be changed. The last point is important, as I do not want data to be split among Keycloak and the external user storage. When a Keycloak user can successfully set the first/last name of a user, this implies that this is a meaningful operation. Therefore, I would like to make those fields empty and non-editable. What would be the best way to achieve this? Do you see another way that would be better? My current working hypothesis would be one of those: A) Override setFirstName and setLastName to throw an exception that the Keycloak UI can deal with. (Which one?) B) Have the storage return an unsuccessful result when attempting to store a user with non-empty values on any of those fields. (How exactly?) C) Before storing a user, simply hardcode an assignment to firstName and lastName with either null or the empty string. (That would mean silently ignore changes to those fields and pretend that storing went okay.) Thanks for your input. Matthias Deja.

7 years, 2 months

2
3
0 / 0

Securing GET/POST/DELETE in different way

by Karol Buler

Hi all, is there any possibility to secure GET/POST/DELETE etc. methods in a different way? e.g. endpoint: /users GET: for Keycloak's role 'user' POST: for Keycloak's role 'users_admin' and so on. Result is that user with 'user' cannot create another user in our system. Regards, Karol [https://www.adbglobal.com/wp-content/uploads/adb.png] adbglobal.com<https://www.adbglobal.com> [https://www.adbglobal.com/wp-content/uploads/linkedin_logo.png]<https://www.linkedin.com/company/adb/> [https://www.adbglobal.com/wp-content/uploads/twitter_logo.png] <https://twitter.com/adb_global> [https://www.adbglobal.com/wp-content/uploads/pinterest_logo.png] <https://pinterest.com/adbglobal/pins/>

7 years, 2 months

4
7
0 / 0

Get roles programatically based on username

by Sajid Chauhan

Dear All, We have tried to fetch the role of a user from UserRepresentation and UserResource but the roles are always null. Is there a way to programatically get the role of the user? Thanks and regards, Sajid

7 years, 2 months

2
1
0 / 0

Keycloak and 3rd party add-ons infrastructure (aka Marketplace)

by Dmitry Telegin

Hi, The more popular Keycloak grows, the more 3rd party add-ons will emerge. There are a lot of demanded features that probably will never land in upstream Keycloak because of the relatively small core team and lack of resources to support them. Off the top of my head, I can name U2F, SCIM, OpenID 2.0, non-US social networks, HRM integration, support for hardware OTP generators, advanced monitoring etc. But even if some of the above gets implemented by a 3rd party, there are no ways to learn about it other than googling or browsing mail list archives. This can affect overall Keycloak popularity in a negative way, since a potential user could reject Keycloak just because it doesn't have feature X, while the feature is actually implemented and supported by a 3rd party. As a 3rd party developer myself, I'd ideally see something like Atlassian Marketplace [2], which is an add-on catalog with searching and categorization, and also a mechanism for simple 1-click install/update/remove from within the application GUI. I remember a related discussion from June [1] that unfortunately ended up nowhere; just wanted to know what's the current stance on this problem? Cheers, Dmitry [1] http://lists.jboss.org/pipermail/keycloak-dev/2017-June/009608.html [2] http://marketplace.atlassian.com

7 years, 2 months

2
1
0 / 0

Help on how to best set up Keycloak authorisation for SaaS

by Martin Malek

Hello, We¹re looking at implementing Keycloak into our organisation. However we¹re not subscribing to RH-SSO so no official support for us. What we¹re looking for is someone with prior experience of setting up Keycloak Authorisation across a micro service architecture SaaS that could point us in the direction of sane decisions. We¹re willing to pay for services by the hour. Any help is greatly appreciated. /Martin Martin Malek Director of Engineering Copenhagen Falcon.io H.C. Andersens Blvd. 27 1553 Copenhagen Budapest Falcon.io Kossuth Lajos utca 7-9 1016 Budapest <https://www.falcon.io/?utm_source=Employee%20emails&utm_medium=email&utm_c ontent=Martin%20Malek&utm_campaign=Mail%20signature> Meet Your Customers

7 years, 2 months

1
0
0 / 0

programmatically delete user Identity Provider Link

by Cristóvão Cordeiro

Hi, is this possible? Either through the API or directly through the UserModel/authentication context? Best regards, *Cristóvão Cordeiro*

7 years, 2 months

1
0
0 / 0

Using Keycloak as IDP for Atlassian

by Rodel Talampas

Hi, Any guidance will be very much welcome. If there is already a resolution for this, sorry that we missed it. We tried to setup an SSO for Atlassian using our Keycloak Server. We were able to redirect to our Keycloak Login but upon login, it throws an error: Error reference: 173b0659-e2e1-40e5-ae28-c08ba5bb3abe. Error reported: The InResponseTo of the Response: null, does not match the ID of the AuthNRequest sent by the SP: ONELOGIN_e5e782f0-dca7-4fbd-a22c-65715e84473f The whole day we are checking where to grab the InReponseTo within the Keycloak UI settings but no luck. Thanks in advance. Regards, Rodel

7 years, 2 months

1
0
0 / 0

external config with servlet deployed as osgi service

by Carlos Villegas

Hi, How do I configure external configuration (or any other config resolver) when I deploy a servlet as OSGi service in JBoss Fuse? There is an example in the documents for classic WAR through a parameter in web.xml but how about for a OSGi service which uses a blueprint.xml descriptor. The docs say that in this case, the web.xml is not needed since everything is configured through blueprint. An example for this case is needed. Thanks, Carlos

7 years, 2 months

1
0
0 / 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

keycloak-user October 2017