June 2017 - keycloak-user - Jboss List Archives

No state cookie returned from the keycloak adapter

by Sarp Kaya

Hello, A use case I have noticed is: 1) User tries to use the web application. Say http://www.app.com 2) The application redirects you to the login page http://www.keycloaklogin.com/auth/realms/realm-name/protocol… 3) Before logging in, user bookmarks this page. 4) User logs in and then gets redirected to http://www.app.com 5) All works fine up till now Now user logs out, closes browser etc. Now user starts the workflow from bookmarked page (http://www.keycloaklogin.com/auth…) 1) User sees a login page 2) User logs in 3) User gets redirected to http://www.app.com?state=… 4) At this point this below code: https://github.com/keycloak/keycloak/blob/master/adapters/oidc/adapter-co... is executed and user sees a 400 page due not having OAuth_Token_Request_State . So far you can argue that, well we didn’t want user not to have OAuth_Token_Request_State in the first place, but the next step that user can do is: 5) User goes to http://www.app.com page and then gets a redirect back to the login page http://www.keycloaklogin.com/auth/realms/realm-name/protocol… 6) Keycloak sees that user is already logged in so redirects back to the same page 7) User now can see http://www.app.com<http://www.app.com/> due to the OAuth_Token_Request_State created in step 5 So to me it seems like this check is obsolete, however I’m curious whether this has a user case or prevents anything. If not, then it might be worth fixing at the step 4 where user actually gets to see the page (or re issue OAuth_Token_Request_State ) instead of showing 400 page. Thanks, Sarp

7 years, 9 months

3
2
0 / 0

JS adapter constantly refreshing page

by sesnor.silva＠sapo.pt

Hello, I'm trying to integrate keycloak's JS adapater into an application. However for some reason the page keeps refreshing (every 5 seconds or so?) after successfully logging in. I managed to reproduce the problem with the following minimal code:  <!DOCTYPE html> <html> <head> <title></title> </head> <body> <script type="text/javascript" src="https://ajax.googleapis.com/ajax/libs/angularjs/1.6.4/angular.min.js"></script> <script type="text/javascript" src="<MY KEYCLOAK SERVER>/auth/js/keycloak.js"></script> <script type="text/javascript"> angular.element(document).ready(function() { var keycloakAuth = Keycloak('keycloak.json'); keycloakAuth.init({ onLoad: 'login-required' }).success(function(authenticated) { keycloakAuth.loadUserInfo().success(function (userInfo) { console.log(userInfo) }); }).error(function() { var error = "There was an error initializing the authentication module."; console.error(error); }); }); </script> </body> </html> I tried searching around but I didn't find too many answers. I tried to base my implementation around: https://github.com/bandrzejczak/keycloak-angular-akka-http/blob/master/cl... and https://github.com/keycloak/keycloak/tree/master/examples/demo-template/a... But I get the same behavior every time: The page just keeps refreshing. It seems to be related to blocking third-party cookies on the browser. I use Firefox 53. Since my Keycloak isn't on the same host as the application, I think the browser rejects the keycloak's cookies. If this is the case, what could be a workaround for this? Is there any option on the adapter's side? I'm worried some browser might block third-party cookies by default (Opera and Brave Browser come to mind). Thank you, My best regards, Silva

7 years, 10 months

3
2
0 / 0

How to display user information from keycloak SAML adapter assertions/session?

by ken edward

Hello, I have configured a tomcat Keycloak SAML adapter with ADFS as my Idp. I created a simple web app with a protected /saml directory. It seems to work. BUT how can I display the logged in user information after the user is authenticated? org.keycloak.adapters.saml.SamlSession : org.keycloak.adapters.saml.SamlSession@13a50bc9 Ken

7 years, 11 months

3
4
0 / 0

Credential Representation TOTP example

by Maximiliano

I'm trying to add a TOTP for an user with Admin Client API. Someone has an CredentialRepresentation setup for TOTP? -- View this message in context: http://keycloak-user.88327.x6.nabble.com/Credential-Representation-TOTP-e... Sent from the keycloak-user mailing list archive at Nabble.com.

7 years, 11 months

2
6
0 / 0

Force token refresh with the Spring Security adapter

by Aritz Maeztu

I'm using keycloak in a java client, configured with the Spring Security adapter. I've got a custom mapper in my keycloak configuration, so when the access token is refreshed, keycloak accesses an endpoint to retrieve some user permissions and they're stored in the token itself. Later on, my client application checks the token without having to perform the access to the permission endpoint itself (increased performance). However, when an admin user changes his own permissions, I would like the keycloak adapter to refresh the token after the permissions are stored, this way the admin user is not required to have its token refreshed or to re-login to load his new permissions. Is there a way to achieve it? Some kind of operation to refresh current session's token? -- Aritz Maeztu Otaño Departamento Desarrollo de Software <https://www.linkedin.com/in/aritz-maeztu-ota%C3%B1o-65891942> <http://www.tesicnor.com> Pol. Ind. Mocholi. C/Rio Elorz, Nave 13E 31110 Noain (Navarra) Telf. Aritz Maeztu: 948 68 03 06 Telf. Secretaría: 948 21 40 40 Antes de imprimir este e-mail piense bien si es necesario hacerlo: El medioambiente es cosa de todos.

8 years, 1 month

2
2
0 / 0

programmatic authentication flow

by Steve Favez

Hi all, I'd like to implement the following use case. I need a Browser authentication flow that will add, after User / Password Form Authenticator, a kind of "access rules" authenticator, that will, according to some request parameters, (for example, ip address, or application) will add dynamically a second factor authenticator in the flow. (Like OTP or SMS). Furthermore, I'd like to be able to provide a choice of 2FA systems to the end user (For example, we provide a set of second factory, and the end user can choose the one he'd like to use). So, if some "strong authentication" criteria are matched during browser authentication process, after providing user and password, user will get a form allowing him to choose the second factory system he'd like to use to authenticate. My goal is to be able to reuse existing authenticator. (So, not to write a big 2fa authenticator with all authenticators duplicated inside). Thanks in advance for your valuable input Cheers St

8 years, 2 months

3
2
0 / 0

Upgrading from Red Hat SSO 7.0 to Keycloak 3.1

by Marcelo Nardelli

Hi, At work, we have an installation of Red Hat SSO 7.0 and we were going to upgrade it to version 7.1. However, I was told that the our Red Hat subscription won't be renewed, so now we want to upgrade to the last Keycloak version. Is this (upgrade from SSO 7.0 to Keycloak 3.1) supported? I've been trying to follow the instructions on the documentation ( https://keycloak.gitbooks.io/documentation/server_admin/topics/MigrationF...), but it's not working. Specifically, when I try to run the migration script (after copying the old standalone.xml and the keycloak-server.json file) jboss-cli.sh --file=migrate-standalone.cli I get this error: Cannot start embedded server: WFLYEMB0021: Cannot start embedded process: Operation failed: WFLYSRV0056: Server boot has failed in an unrecoverable manner; exiting. See previous messages for details. I suppose the Keycloak version used in SSO 7.0 is too old and I will have to do some manual work here, but I wanted to know if there is some specific advice for this case... Thanks, Marcelo Nardelli

8 years, 2 months

2
2
0 / 0

Using Keycloak with Microsoft Azure Active Directory

by Reed Lewis

I am attempting to use Microsoft Azure Active Directory with Keycloak. It is not working correctly. Here is how I have it configured: OpenID Connect V1.0 Enabled: On Store Tokens: On Store Tokens Readable: On Trust Email: On Authorization URL: https://login.microsoftonline.com/common/oauth2/authorize Token URL: https://login.microsoftonline.com/common/oauth2/token Logout URL: <none> Backchannel Logout: Off User Info URL: <blank> First Login Flow: First Broker Login It directs me to the Microsoft page to login correctly, but when it comes back to keycloak, it either only has the first and last name, but no email address. Is there something I have configured incorrectly? I also tried to use the built in Microsoft connector, but that does not work with Azure Active Directory. Thank you, Reed Lewis

8 years, 2 months

4
4
0 / 0

by Federico Navarro Polo - Info.nl

Hello, I’m facing currently a migration scenario where I have a group of users which need to be imported from a different system into Keycloak. For regular users everything works fine, but I wonder what would be the best approach for users which authenticate via external identity providers (eg: facebook) in order to make the transition as transparent as possible for the users (ideally, no interaction at all). From the source system, I have access to the facebook user id and email address, so first I tried to include that as federated identity in the users import: { "realm": "test", "users": [ { "createdTimestamp" : 1476191007295, "username" : "somebody(a)somewhere.com", "enabled" : true, "totp" : false, "emailVerified" : true, "firstName" : "Test", "lastName" : "Test", "email" : "somebody(a)somewhere.com", "credentials" : [ ], "disableableCredentialTypes" : [ ], "requiredActions" : [ ], "federatedIdentities" : [ { "identityProvider" : "facebook", "userId" : "0123456789", "userName" : "somebody(a)somewhere.com", } ], "realmRoles" : [ "offline_access", "uma_authorization" ], "clientRoles" : { "account" : [ "manage-account", "view-profile" ] } } ] } , which imports fine, and I can see the link in the admin console, but when attempting to login using Facebook, Keycloak ignores that data and redirects to the “Account linking” screen (and in that case, if I follow the process, then I get a DB exception due to duplicate key). So it seems the best way is to not import the Facebook details, and when the user tries to login with Facebook, then the standard account linking process will be triggered, which is not ideal in a migration. I suppose there is some extra logic which is not taking place when doing the import as opposed to creating a new account from scratch or creating the identity provider link manually in the admin console, but can’t figure out what is it. Is there any possible way to avoid the account linking step? Met vriendelijke groet, Federico Navarro backend developer federico(a)info.nl<mailto:federico@info.nl> | LinkedIn<https://www.linkedin.com/company/info-nl> | +31 (0)2 05 30 91 61<tel:+31205309161> info.nl<http://www.info.nl/> Sint Antoniesbreestraat 16 | 1011 HB Amsterdam | +31 (0)20 530 9100<tel:+31205309100>

8 years, 3 months

2
2
0 / 0

Fwd: CORS's problem with JavaScript's library

by Sebastien Blanc

(forgot including user list) Are you using keycloak-auth-utils on your frontend application ? Why not the JavaScript library ? Also have you configured the "Web Origins" field of your client in the Keycloak Web Console ? On Wed, Jun 28, 2017 at 3:09 PM, Karol Buler <K.Buler(a)adbglobal.com> wrote: > Hi Everyone, > > We have problem with CORS. We are using this lib: > https://www.npmjs.com/package/keycloak-auth-utils in our JavaScript > application. > > When we try to get AccessToken we are getting this message: > > Fetch API cannot load http://<keycloak_address>/auth > /realms/master/protocol/openid-connect/token. Request header field > x-client is not allowed by Access-Control-Allow-Headers in preflight > response. > > We tried to modify CORS headers in standalone.xml file of Keycloak's > server, but we found that CORS headers are hardcoded and added "in air". > > Best regards, > Karol Buler > > [https://www.adbglobal.com/wp-content/uploads/adb.png] > connecting lives > connecting worlds > _______________________________________________ > keycloak-user mailing list > keycloak-user(a)lists.jboss.org > https://lists.jboss.org/mailman/listinfo/keycloak-user >

8 years, 4 months

3
3
0 / 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

keycloak-user June 2017