November 2017 - keycloak-user - Jboss List Archives

Keycloak adapter hijacks all URL's ending in /saml

by Chris Brandhorst

We are having a problem with the Keycloak SAML Jetty adapter (8.1). We have an application which currently does its own SAML handling, for which we want to migrate all the authentication logic to Keycloak. So we have an existing SAML endpoint to which a large number of third-party applications connect. This endpoint is placed at /sso/saml. It seems that the Keycloak adapter hijacks all request coming to any URL ending in /saml, breaking the existing endpoint, which needs to be kept functional for a while (for future migration). How can we make sure this existing endpoint is not affected by the adapter? Thanks, Chris Brandhorst

7 years, 2 months

1
0
0 / 0

Keycloak with Snowflake DB

by Matthew Koken

Has anybody tried using Snowflake DB as a datasource for Keycloak? I'm attempting to set this up using Snowflake's snowflake-jdbc jar but I'm having trouble adding the module following the guide in http://www.keycloak.org/docs/latest/server_installation/index.html#_ rdbms-setup-checklist

7 years, 2 months

1
0
0 / 0

JWS Client Assertion On Client Authentication

by 乗松隆志 / NORIMATSU，TAKASHI

Hello. I'm interested in Client Authentication in JWS Client Assertion. It seems that keycloak only support this using private key signing of which "private_key_jwt" method in http://openid.net/specs/openid-connect-core-1_0.html#ClientAuthentication . I've expected that keycloak has also supported "client_secret_jwt" method in http://openid.net/specs/openid-connect-core-1_0.html#ClientAuthentication . In org.keycloak.protocol.oidc.OIDCLoginProtocol // Client authentication methods public static final String CLIENT_SECRET_BASIC = "client_secret_basic"; public static final String CLIENT_SECRET_POST = "client_secret_post"; public static final String CLIENT_SECRET_JWT = "client_secret_jwt"; public static final String PRIVATE_KEY_JWT = "private_key_jwt"; PRIVATE_KEY_JWT is referred from org.keycloak.authentication.authenticators.client.JWTClientAuthenticator::getProtocolAuthenticatorMethods(). Only PRIVATE_KEY_JWT are added for authentication method, while CLIENT_SECRET_JWT is referred from no classes. Does somebody know why keycloak does not support "client_secret_jwt" method in http://openid.net/specs/openid-connect-core-1_0.html#ClientAuthentication ? (ex. security concerns, etc ...) And, does someone know whether there is any plan to implement this "client_secret_jwt" method for Client Authentication in JWS Client Assertion? Best Regards Takashi Norimatsu Hitachi, Ltd.

7 years, 2 months

2
2
0 / 0

Fuse Keycloak Adapter not performing Log out

by Pana

Hi We are using JBOSS Fuse Keycloak adapter 2.5.5-final-redhat. We observed that at each authorization request the adapter creates sessions on the Keycloak Server which are not released. As a result the number of sessions is ever increasing impacting the performance on Keycloak Server. In looking in the code, we saw that in many cases, the authorization flow requests a token from the Keycloak Server but eventually it does not call log out or does not cache the token in the deployment in order not to call again. For example: KeycloakAdapterPolicyEnforcer::requestAuthorizationToken. if configuration is User Managed Access, it will create a token with this statement: authzClient.protection().permission().forResource(permissionRequest); At the end, it will not call log out and session will remain in the SSO Server Cache. -- Sent from: http://keycloak-user.88327.x6.nabble.com/

7 years, 2 months

1
0
0 / 0

Keycloak 3.4.0.CR1 released

by Stian Thorgersen

We've just released Keycloak 3.4.0.CR1. To download the release go to the Keycloak homepage <http://www.keycloak.org/downloads>. HighlightsToken exchange The token exchange service allows clients to exchange tokens for different tokens. There's quite a few options available so check out the docs <http://www.keycloak.org/docs/latest/securing_apps/index.html#_token-exchange> for more details. Fine-grained permissions for admin endpoints By leveraging our authorization services we've made it possible to control permissions in the admin endpoints almost exactly how you want. For more details check the docs <http://www.keycloak.org/docs/latest/server_admin/index.html#_fine_grain_p...> . Cross DC A lot more work has gone into this release around cross DC support. Docs are still not ready and there's still some minor polish left. This will come soon. Upgraded to WildFly 11 Final We've upgraded the underlying container to WildFly 11 Final. Support MySQL and PostgreSQL in main Keycloak Docker image We used to have separate Docker images for MySQL and PostgreSQL, but now we have one that supports them all. AsciiDoctor Our docs used to be built and hosted on GitBook. We've recently moved to using pure AsciiDoctor to build the docs. The main reason behind this move was to closer align with how we build documentation for the productized version of Keycloak (RH-SSO). Loads more.. - Script based protocol mapper for OIDC - thanks to thomasdarimont <https://github.com/thomasdarimont> - Blacklisted password policy- thanks to thomasdarimont <https://github.com/thomasdarimont> - Login with PayPal - thanks to petlys <https://github.com/petlys> - Almost 200 - we almost resolved 200 issues for this one (197!) The full list of resolved issues is available in JIRA <https://issues.jboss.org/issues/?jql=project%20%3D%20keycloak%20and%20fix...> . Upgrading Before you upgrade remember to backup your database and check the upgrade guide <http://www.keycloak.org/docs/latest/upgrading/index.html> for anything that may have changed. Release candidates are not recommended in production and we do not support upgrading from release candidates.

7 years, 2 months

1
0
0 / 0

Keycloak via reverse proxy: Mixed Mode errors.

by Dominik Guhr

Hey all, I've tried to set up keycloak to work behind a reverse proxy (via a kong route on openshift 3) today , but sadly I can't get it to work after trying many things. Here's a stackoverflow-post I've created with the exact problem definition: https://stackoverflow.com/questions/47181821/using-keycloak-behind-a-reve... It would be absolutely great if someone could help me out here, because I am out of ideas for now. Best regards, Dominik

7 years, 2 months

1
0
0 / 0

Access Token getting truncated when apache HTTPD is in front

by Pharande Rahul

Hello Team, I'm facing issue of "Access Token getting truncated when apache HTTPD is in front". Though this issue is not directly associated/related to Keycloak but in combination with Apache HTTPD + Keycloak, I would like to take help from experts here :) Below are more details on same. Environnent : o Server : Keycloak v3.x o Proxy server : Apache HTTPD 2.4.x o Client: Angular2 application using OIDC library. Issue Description / Steps to reproduce: * Create realm in Keycloak * Create client for realm along with redirect url etc. * Create ~70 role/permissions for client with longer names ~25 characters in permission name. * Create user and assign all above permissions for newly created client. * Access Angular2 application running in browser, and for protected resources Keycloak login page displayed where redirect_uri parameter is given/supplied. * After entering valid user credentials, keycloak redirects to Application's redirect URL * However error shown on browser console that, "failed at_hash". o This is because incomplete/truncated token returned and OIDC client library in Angular application tries to validate token received. Important point here: * Defect mentioned only occurs when Apache is in front and used as proxy/load balancer server. My analysis: * As per my analysis, I see Keycloak returns access_token information in response header during redirect * Apache has restriction of handling response header or cookies of size upto 8k * Even after setting, various parameters in Apache HTTPD like - "LimitRequestFieldSize", "LimitRequestLine" we are still getting this error. Please let me know if anyone already experienced such issue OR has any alternative on using/configuring Keycloak to redirect using part response.. Thanks and Regards. Rahul Pharande

7 years, 2 months

1
0
0 / 0

SAML IdP and ADFS trust

by Ben Redahan

Hi all, I'm configuring a SAML Identity Provider in Keycloak to allow single sign on with a customer ADFS server. I'm following this guide: http://blog.keycloak.org/2017/03/how-to-setup-ms-ad-fs-30-as-brokered.html I'm working in a development environment with a test ADFS server using a self-signed Service Communications certificate (I had to install and configure this myself so I could have gone wrong here). Keycloak is running on an AWS instance behind a load balancer, incoming https is handled by that. I've configured the Relying Party Trust on ADFS and the FederationMetadata.xml in the Keycloak identity provider. During testing I deployed a Keycloak image without a truststore or Service Communications certificate, but the redirect still works. When I click the SSO button from the Keycloak login page I am redirected to the ADFS login page, though from my understanding the outbound https request to the ADFS endpoint should fail, since Keycloak doesn't trust the ADFS server. Shouldn't the first redirect fail if there's no truststore or SSL certificate? I'm a novice at this so there's almost certainly a gap in my understanding, but I've searched through all the documentation I can find and can't make sense of it. Can anyone help? Thanks, Ben -- *Ben Redahan | Software Engineer* *Phone **+353 1 539 8744 <%2B353%201%20539%208744>* *TRIMBLE RAILWAY ASSET SOLUTIONS | NEXALA* *www.trimble.com/rail-assets* <http://www.trimble.com/rail-assets>*| * *www.nexala.com* <http://www.nexala.com/>* | **www.trimble.com/rail* <http://www.trimble.com/rail> *Newsletter Sign Up* <http://infogeospatial.trimble.com/rail-asset-newsletter-signup.html>* | **Request Demo* <http://infogeospatial.trimble.com/rail-asset-newsletter-signup.html>* | **LinkedIn <https://www.linkedin.com/company/trimble-railway-solutions>*

7 years, 2 months

1
0
0 / 0

create admin user to control other users, but at the same time making him/her unable to change his/her own permissions

by pavlos kaimakis

Hi there, Is there any way we can configure a user that will have the rights to view/edit/delete/assign other users' roles, but will NOT be able to change the setting for him/herself. Reason asking is I want a user as admin to deal with the rest of the users, but at the same time i don't want that user to be able to grant permissions to him/herself to access some other clients. The default 'admin' role gives him/her this option. Waiting for your response BRs Lefteris

7 years, 2 months

2
1
0 / 0

Set CreatedTimestamp

by zitrone＠gmx-topmail.de

Hi, i'm currently trying to migrate users from an old system to keycloak (3.1.0). Im using the java implementation of the keycloak admin api to create the accounts, building a UserRepresentation and sending it to realm.users().create(). Now i have the problem, that i want to migrate the creation date of the accounts from the old system. Although i can set the createdTimestamp for the userRepresentation, it will not be stored in keycloak. Instead the current time is set for the createdTimestamp. Is there a way to modify the createdTimestamp? I understand that this is something you usually dont want to happen, but during migration of already existing accounts, it would be kind of handy. If there is no other way i have to use a custom attribute, storing the old creation date, but that means additional code to retrieve it. Second question: What is the best way to iterate over all accounts in keycloak? Currently i'm using something like this: Integer userCount = keyCloakClient.realm(realmname).users().count(); int processed = 0; List<String> userIds = new ArrayList<>(); int fetchsize = 100; while (processed < userCount) { keyCloakClient .realm(realmname) .users() .search("", processed, fetchsize) .stream() //some filters .forEach(user -> userIds.add(user.getId())); processed += fetchsize; } If i put the fetchsize to big, i get problems processing the json response. But i'm worried that the result from the empty search will not be stable and i'll miss accounts. regards zitrone

7 years, 2 months

1
0
0 / 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

keycloak-user November 2017