September 2017 - keycloak-user - Jboss List Archives

No state cookie returned from the keycloak adapter

by Sarp Kaya

Hello, A use case I have noticed is: 1) User tries to use the web application. Say http://www.app.com 2) The application redirects you to the login page http://www.keycloaklogin.com/auth/realms/realm-name/protocol… 3) Before logging in, user bookmarks this page. 4) User logs in and then gets redirected to http://www.app.com 5) All works fine up till now Now user logs out, closes browser etc. Now user starts the workflow from bookmarked page (http://www.keycloaklogin.com/auth…) 1) User sees a login page 2) User logs in 3) User gets redirected to http://www.app.com?state=… 4) At this point this below code: https://github.com/keycloak/keycloak/blob/master/adapters/oidc/adapter-co... is executed and user sees a 400 page due not having OAuth_Token_Request_State . So far you can argue that, well we didn’t want user not to have OAuth_Token_Request_State in the first place, but the next step that user can do is: 5) User goes to http://www.app.com page and then gets a redirect back to the login page http://www.keycloaklogin.com/auth/realms/realm-name/protocol… 6) Keycloak sees that user is already logged in so redirects back to the same page 7) User now can see http://www.app.com<http://www.app.com/> due to the OAuth_Token_Request_State created in step 5 So to me it seems like this check is obsolete, however I’m curious whether this has a user case or prevents anything. If not, then it might be worth fixing at the step 4 where user actually gets to see the page (or re issue OAuth_Token_Request_State ) instead of showing 400 page. Thanks, Sarp

7 years, 11 months

3
2
0 / 0

Blog post about cross-datacenter replication in Keycloak 3.3.CR1

by Thomas Darimont

Hello, in case you missed it (as I did...), there is an interesting blog post about cross-datacenter replication in Keycloak 3.3.CR1 http://blog.keycloak.org/2017/09/cross-datacenter-support-in-keycloak.html @keycloak-Team Would be great if you could drop a mail to the mailing list for articles like this :) Cheers, Thomas

7 years, 11 months

3
2
0 / 0

JS adapter constantly refreshing page

by sesnor.silva＠sapo.pt

Hello, I'm trying to integrate keycloak's JS adapater into an application. However for some reason the page keeps refreshing (every 5 seconds or so?) after successfully logging in. I managed to reproduce the problem with the following minimal code:  <!DOCTYPE html> <html> <head> <title></title> </head> <body> <script type="text/javascript" src="https://ajax.googleapis.com/ajax/libs/angularjs/1.6.4/angular.min.js"></script> <script type="text/javascript" src="<MY KEYCLOAK SERVER>/auth/js/keycloak.js"></script> <script type="text/javascript"> angular.element(document).ready(function() { var keycloakAuth = Keycloak('keycloak.json'); keycloakAuth.init({ onLoad: 'login-required' }).success(function(authenticated) { keycloakAuth.loadUserInfo().success(function (userInfo) { console.log(userInfo) }); }).error(function() { var error = "There was an error initializing the authentication module."; console.error(error); }); }); </script> </body> </html> I tried searching around but I didn't find too many answers. I tried to base my implementation around: https://github.com/bandrzejczak/keycloak-angular-akka-http/blob/master/cl... and https://github.com/keycloak/keycloak/tree/master/examples/demo-template/a... But I get the same behavior every time: The page just keeps refreshing. It seems to be related to blocking third-party cookies on the browser. I use Firefox 53. Since my Keycloak isn't on the same host as the application, I think the browser rejects the keycloak's cookies. If this is the case, what could be a workaround for this? Is there any option on the adapter's side? I'm worried some browser might block third-party cookies by default (Opera and Brave Browser come to mind). Thank you, My best regards, Silva

8 years

3
2
0 / 0

How to display user information from keycloak SAML adapter assertions/session?

by ken edward

Hello, I have configured a tomcat Keycloak SAML adapter with ADFS as my Idp. I created a simple web app with a protected /saml directory. It seems to work. BUT how can I display the logged in user information after the user is authenticated? org.keycloak.adapters.saml.SamlSession : org.keycloak.adapters.saml.SamlSession@13a50bc9 Ken

8 years

3
4
0 / 0

Credential Representation TOTP example

by Maximiliano

I'm trying to add a TOTP for an user with Admin Client API. Someone has an CredentialRepresentation setup for TOTP? -- View this message in context: http://keycloak-user.88327.x6.nabble.com/Credential-Representation-TOTP-e... Sent from the keycloak-user mailing list archive at Nabble.com.

8 years, 1 month

2
6
0 / 0

OTP Policy updates not reflects in Google Authenticator

by forums.akurathi＠gmail.com

Dear all, We are running into a weird problem i.e., updates to OTP policy does not reflect at google authenticator app. We wonder is there any special instructions needed to get this working. A sequence of steps : 1) create realm, create user 2) enable OTP 3) login with the newly created user 4) system asks you to configure OTP 5) update OTP policy such as number of digits from 6 to 8 6) try login again 7) system asks you to enter OTP but authentication fails We expect the system should route the user to configure OTP page rather than prompting to enter OTP which anyways fails. Your response is highly appreciated !!! Thanks in advance Regards Krishna Kumar Akurathi

8 years, 1 month

2
2
0 / 0

Resolution for 99% of CORS's problems

by Karol Buler

Hi, after huge amounts of hours of investigations I found the resolution for almost all problems with CORS. I decided that maybe I am not alone with it, so here you go: 1. Go to admin console of Keycloak and set 'Web Origins' of your client to address of your application (or just * ). 2. In your application.properties (keycloak.json) set keycloak.cors = true (don't know the name of this property in keycloak.json). 3. Thats it! Only 2 steps resolves almost all my problems with CORS in our applications. Best regards, Karol [https://www.adbglobal.com/wp-content/uploads/adb.png] adbglobal.com<https://www.adbglobal.com> [https://www.adbglobal.com/wp-content/uploads/linkedin_logo.png]<https://www.linkedin.com/company-beta/162280/> [https://www.adbglobal.com/wp-content/uploads/twitter_logo.png] <https://twitter.com/adb_global> [https://www.adbglobal.com/wp-content/uploads/pinterest_logo.png] <https://pinterest.com/adbglobal/pins/> [https://www.adbglobal.com/wp-content/uploads/ComeJoin.jpg]<https://www.adbglobal.com/meet-us-at-ibc2017/>

8 years, 3 months

4
5
0 / 0

can't resolve groups from multiple group mappers

by Tiemen Ruiten

Hello, I'm testing with the following setup: In our Active Directory, which is federated to Keycloak, we have a container with 'access' groups (groups that are used to give access to certain applications, akin to Keycloak roles) and a container for 'user' groups (eg. sales, it, marketing etc.). Users are always only direct members of a user group. The access groups can only have user groups as members, never users. In Keycloak, I have created two LDAP-group-mappers for both containers, but unfortunately, none of the user groups show any members. Is this expected? Using Keycloak 3.2.1 Final. -- Tiemen Ruiten Systems Engineer R&D Media

8 years, 3 months

2
8
0 / 0

OPENID Java Client

by Виталий Ищенко

I was looking at keykloak examples for client credentials flow examples, and it looks like the everything required is located in adapter-core module, especially AdapterRSATokenVerifier and ServerRequest classes. But I wonder if it safe to use this module in terms of API stability and documentation, or I should better stick to some 3rd party OpenID client, that will do all the fancy things with token validation, key retrieval, caching etc. Best Regards, Vitalii

8 years, 3 months

1
1
0 / 0

Improvement required in password policy evaluation

by Shaikh Asrafali Anwarali

Hello, The Keycloak shows PASSWORD construction rule one at a time when it fail to adhere to it. For example : Applied password policy are : 1. specialChars 2. upperCase 3. passwordHistory 4. length 5. digits 6. notUsername 7. lowerCase If I set my password as "abcd" I get error message saying " there has to be special character" then I changed it to abcd@ After that I get message saying, there has to be 1 capital letter ... It goes on and one till all the policy is satisfied There is a requirement that all failure reasons should be displayed at once or at least show the configures password rules somewhere on this screen. On page I have all the data available, like in realm.passwordPolicy - have all the configured password policy data. But not sure how messages can be formulated so that internationalization is also maintained. Is there any way by which it can be achieve? Regards, Asraf Shaikh

8 years, 3 months

2
2
0 / 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

keycloak-user September 2017