May 2018 - keycloak-user - Jboss List Archives

by iain.clarke＠empala.com

I'm looking for help with implementing Keycloak on my AWS environment. Is there a list of implementation partners who are Keycloak experts? I want a simple setup for a PoC and then moving to a clustered Docker / ECS setup for Production if PoC is successful. Thanks, Iain

8 years

1
0
0 / 0

Re: [keycloak-user] SAML signing AuthnRequest results in invalid_signature (SigAlg was null)

by Luis Rodríguez Fernández

Hello Pierre, mmm, for a production use I would go for https://www.keycloak.org/archive/downloads-3.4.3.html. Hope it helps, Luis 2018-05-28 16:26 GMT+02:00 Pierre Dupont <pierredupontdal(a)gmail.com>: > Hello Luis, > > I checked the XML file, the requestBinding is POST, but that was a good > hint : > Keycloak is waiting for a SigAlg parameter as an HTTP parameter. I had a > parameter (embed_sign) in my SP config which was embedding these parameters > in the AuthnRequest instead of passing them as HTTP parameters. > > However, I got another error, which is an NullPointerException. > I think it is the same as this one : https://issues.jboss.org/ > browse/KEYCLOAK-7032 > It seems the only solution is to use an older version of Keycloak, unless > you have a better solution. > > In any case, thank you for your help and your time. > > Best regards, > Pierre > > > > On Mon, May 28, 2018 at 12:17 PM, Luis Rodríguez Fernández < > uo67113(a)gmail.com> wrote: > >> Hello Pierre, >> >> It looks correct to me, or at least very similar to mine: >> https://gist.github.com/lurodrig/0c26b2000a725946b3ecc7994543d918 >> >> I do think that the problem is that your IdP is expecting a GET for the >> authnRequest and what your SP is doing is a POST. What is the value of your >> IDP.SingleSignOnService.requestBinding in your keycloak.xml? Me I have >> something like this: >> >> <IDP entityID="idp" >> signatureAlgorithm="RSA_SHA256" >> signatureCanonicalizationMethod="http://www.w3.org/2001/10/ >> xml-exc-c14n#"> >> <SingleSignOnService signRequest="true" >> validateResponseSignature="true" >> validateAssertionSignature="false" >> requestBinding="POST" >> >> Hope it helps, >> >> Luis >> >> >> >> >> >> 2018-05-28 10:32 GMT+02:00 Pierre Dupont <pierredupontdal(a)gmail.com>: >> >>> Hi Luis, >>> >>> Thank you for your answer. I tried your suggestion, following the >>> provided >>> example. >>> My SAML request has changed, but I still get the same error, i.e SigAlg >>> was >>> null. >>> My guess is that Keycloak doesn't manage to read the value in the SAML >>> request. >>> >>> Here is my SAML request (retrieved with SAML Tracer on Firefox) : >>> <samlp:AuthnRequest AssertionConsumerServiceURL="..." Destination="..." >>> ID= >>> "_5c3e604e-7dad-443e-9b10-5cbe2d685081" IssueInstant="2018-05-28T07:26 >>> :17Z" >>> Version="2.0" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" >>> xmlns:samlp >>> ="urn:oasis:names:tc:SAML:2.0:protocol" > >>> <saml:Issuer>...</saml:Issuer> >>> <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"> >>> <ds:SignedInfo> >>> <ds:CanonicalizationMethod Algorithm=" >>> http://www.w3.org/2001/10/xml-exc-c14n#" /> >>> <ds:SignatureMethod Algorithm="http://www.w3.org/2 >>> 000/09/xmldsig#rsa-sha1" >>> /> >>> <ds:Reference URI="#_5c3e604e-7dad-443e-9b10-5cbe2d685081"> >>> <ds:Transforms> >>> <ds:Transform Algorithm=" >>> http://www.w3.org/2000/09/xmldsig#enveloped-signature" /> >>> <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"> >>> <ec:InclusiveNamespaces PrefixList="#default samlp saml ds xs xsi md" >>> xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#" /> >>> </ds:Transform> >>> </ds:Transforms> >>> <ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /> >>> <ds:DigestValue>...</ds:DigestValue> >>> </ds:Reference> >>> </ds:SignedInfo> >>> <ds:SignatureValue>...</ds:SignatureValue> >>> <ds:KeyInfo> >>> <ds:X509Data> >>> <ds:X509Certificate>...</ds:X509Certificate> >>> </ds:X509Data> >>> </ds:KeyInfo> >>> </ds:Signature> >>> <samlp:NameIDPolicy AllowCreate="true" Format= >>> "urn:oasis:names:tc:SAML:2.0:nameid-format:persistent" /> >>> </samlp:AuthnRequest> >>> >>> As expected, I have the correct values for SignatureMethod and >>> DigestMethod. I'm short of ideas. >>> >>> Thanks in advance, >>> >>> Pierre >>> >>> Date: Fri, 25 May 2018 14:39:03 +0200 >>> From: Luis Rodr?guez Fern?ndez <uo67113(a)gmail.com> >>> Subject: Re: [keycloak-user] SAML signing AuthnRequest results in >>> invalid_signature (SigAlg was null) >>> To: keycloak-user(a)lists.jboss.org >>> Message-ID: >>> <CACp70MkD1nWyy600hw-y-ZX8gKqv5RB-gpU_UFE7VAW0_nL2VA(a)mail.gm >>> ail.com> >>> Content-Type: text/plain; charset="UTF-8" >>> >>> Hello Pierre, >>> >>> mmm, If I am not wrong, usually for signature methods SAML uses the URI >>> identifier [1]. E.g. my IdP (ADFS) likes " >>> http://www.w3.org/2000/09/xmldsig#rsa-sha1". You can have look at this >>> example: https://gist.github.com/lurodrig/34fa5092da4cef85d1f3cfaa2ac >>> 3025a >>> >>> Hope it helps, >>> >>> Luis >>> >>> [1] https://www.w3.org/TR/xmlsec-algorithms/ >>> [2] >>> _______________________________________________ >>> keycloak-user mailing list >>> keycloak-user(a)lists.jboss.org >>> https://lists.jboss.org/mailman/listinfo/keycloak-user >>> >> >> >> >> -- >> >> "Ever tried. Ever failed. No matter. Try Again. Fail again. Fail better." >> >> - Samuel Beckett >> > > -- "Ever tried. Ever failed. No matter. Try Again. Fail again. Fail better." - Samuel Beckett

8 years

1
0
0 / 0

login error email in keycloak

by Laurent LATOUR

Hi, Using keycloak v2.5.5, when a user enters an invalid password on login (using rest api), an email is sent to him saying “A failed login attempt was detected to your account on <date> from <ip address>. If this was not you, please contact an admin.” After upgrading to keycloak v3.4.3, this email isn’t sent anymore. So my question is: is it possible to configure this email sending on login error somewhere ? Thanks. Laurent

8 years

2
1
0 / 0

SAML signing AuthnRequest results in invalid_signature (SigAlg was null)

by Pierre Dupont

Hi Luis, Thank you for your answer. I tried your suggestion, following the provided example. My SAML request has changed, but I still get the same error, i.e SigAlg was null. My guess is that Keycloak doesn't manage to read the value in the SAML request. Here is my SAML request (retrieved with SAML Tracer on Firefox) : <samlp:AuthnRequest AssertionConsumerServiceURL="..." Destination="..." ID= "_5c3e604e-7dad-443e-9b10-5cbe2d685081" IssueInstant="2018-05-28T07:26:17Z" Version="2.0" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:samlp ="urn:oasis:names:tc:SAML:2.0:protocol" > <saml:Issuer>...</saml:Issuer> <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"> <ds:SignedInfo> <ds:CanonicalizationMethod Algorithm=" http://www.w3.org/2001/10/xml-exc-c14n#" /> <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /> <ds:Reference URI="#_5c3e604e-7dad-443e-9b10-5cbe2d685081"> <ds:Transforms> <ds:Transform Algorithm=" http://www.w3.org/2000/09/xmldsig#enveloped-signature" /> <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"> <ec:InclusiveNamespaces PrefixList="#default samlp saml ds xs xsi md" xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#" /> </ds:Transform> </ds:Transforms> <ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /> <ds:DigestValue>...</ds:DigestValue> </ds:Reference> </ds:SignedInfo> <ds:SignatureValue>...</ds:SignatureValue> <ds:KeyInfo> <ds:X509Data> <ds:X509Certificate>...</ds:X509Certificate> </ds:X509Data> </ds:KeyInfo> </ds:Signature> <samlp:NameIDPolicy AllowCreate="true" Format= "urn:oasis:names:tc:SAML:2.0:nameid-format:persistent" /> </samlp:AuthnRequest> As expected, I have the correct values for SignatureMethod and DigestMethod. I'm short of ideas. Thanks in advance, Pierre Date: Fri, 25 May 2018 14:39:03 +0200 From: Luis Rodr?guez Fern?ndez <uo67113(a)gmail.com> Subject: Re: [keycloak-user] SAML signing AuthnRequest results in invalid_signature (SigAlg was null) To: keycloak-user(a)lists.jboss.org Message-ID: <CACp70MkD1nWyy600hw-y-ZX8gKqv5RB-gpU_UFE7VAW0_nL2VA(a)mail.gmail.com> Content-Type: text/plain; charset="UTF-8" Hello Pierre, mmm, If I am not wrong, usually for signature methods SAML uses the URI identifier [1]. E.g. my IdP (ADFS) likes " http://www.w3.org/2000/09/xmldsig#rsa-sha1". You can have look at this example: https://gist.github.com/lurodrig/34fa5092da4cef85d1f3cfaa2ac3025a Hope it helps, Luis [1] https://www.w3.org/TR/xmlsec-algorithms/ [2]

8 years

1
0
0 / 0

Running keycloak on OpenShift Origin, can't login to admin console

by Marc Boorshtein

I'm trying to get kc running on OpenShift Origin 3.9. The latest container for dockerhub (https://hub.docker.com/r/jboss/keycloak-openshift/) looks to be on 4.0.0.beta2. Here are the steps i took: 1. created a deployment using the container image 2. added environment variables to use mysql 3. added environment variables for a keycloak admin username and password 4. set the command to "start-keycloak.sh -b=0.0.0.0" 5. Service for 8080 was created by openshift, added a route When I try to login to the admin console, I get an invalid redirect_url error: 16:13:19,624 WARN [org.keycloak.events] (default task-6) type=LOGIN_ERROR, realmId=master, clientId=security-admin-console, userId=null, ipAddress=10.128.0.1, error=invalid_redirect_uri, redirect_uri=https://kc-demo.domain.com/auth/admin/master/console/ am i missing a config? Thanks

8 years

1
1
0 / 0

can I use these versions in production

by Christophe Lehingue

Hello, Can 4.0.0.1 or 4.0.0.2 or 4.0.0.3 be used for production ? Thanks

8 years

1
0
0 / 0

Example for xamarin/keycloak

by Christophe Lehingue

Hello, Would anyone have an example of using keycloak with xamarin (for IOS and Android platforms) Thank you in advance. Regards, Titoff002

8 years

1
0
0 / 0

Enforce username not editable

by Nhut Thai Le

Hello, I have "Email as username" on, "Edit username" off in my realm login config. So i assume the user cannot change email but I just test login to the self service portal *http://localhost:8180/auth/realms/myrealm/account/ <http://localhost:8180/auth/realms/bigrealm/account/>* and change my email, the result is that both my email and username got changed. I'm using 4.0 beta2. Is this a bug? Thai -- Castor Technologies Inc 460 rue St-Catherine St Ouest, Suite 613 Montréal, Québec H3B-1A7 (514) 360-7208 o (514) 798-2044 f ntle(a)castortech.com www.castortech.com CONFIDENTIALITY NOTICE: The information contained in this e-mail is confidential and may be proprietary information intended only for the use of the individual or entity to whom it is addressed. If the reader of this message is not the intended recipient, you are hereby notified that any viewing, dissemination, distribution, disclosure, copy or use of the information contained in this e-mail message is strictly prohibited. If you have received and/or are viewing this e-mail in error, please immediately notify the sender by reply e-mail, and delete it from your system without reading, forwarding, copying or saving in any manner. Thank you. AVIS DE CONFIDENTIALITE: L’information contenue dans ce message est confidentiel, peut être protégé par le secret professionnel et est réservé à l'usage exclusif du destinataire. Toute autre personne est par les présentes avisée qu'il lui est strictement interdit de diffuser, distribuer ou reproduire ce message. Si vous avez reçu cette communication par erreur, veuillez la détruire immédiatement et en aviser l'expéditeur. Merci.

8 years

1
0
0 / 0

Keycloak Security Proxy forbidden & no logout

by Pierre Nowak

Hello, I tried to setup a simple keycloak + KSP to secure some simple http server I created: - 1 client (test_role) - 1 role (test_role) - 1 user - 1 role mapping of this user on the role created before - 1 KSP with this config: "resource": "test_role" ... "pattern":"/*", "roles-allowed":["test_role" ] When I login to KSP It works, but if I logout the session in the admin console, it doesnt logout. Is there a way to create a logout button on the simple http server based on the KSP headers or the session cookie? So that auth is managed by KSP but still with a logout button availalbe on my http server behind it. Furthermore If I remove the role mapping and try to login, I do get an http forbidden request at the client url, but no login error message at the keycloak url that says that I dont have the rights to login to this client Is this normal behaviour or did I miss something ?

8 years

1
0
0 / 0

Patterns in Resource URI's

by Juan José Vázquez Delgado

Hello everyone. I'm currently assessing KC Authz services and I stumbled across a use case that I'm not sure how to solve. I've found previous similar discussions but I couldn't find the answer that might apply directly to it. Basically, I have a web service that acts as resource server, following the UMA terminology, and I want to protect it using KC. This ws publishes several endpoints that follow a multi-tenant arrangement. Something like this: /{org_id}/products /{org_id}/product/{id} ... etc The ID Token obtained through the authentication OIDC flow carries the `org_id` data so I could provide this as additional claim to the token endpoint in order to get a proper RPT. However, I would like not to have to create a different resource per organization and uri, but just the same patterns as in the endpoints: /{org_id}/products /{org_id}/product/{id} I haven't found any information about whether it's possible to define a pattern also in the resource uri so that I can use it from the Evaluation API during the RPT issuance. I'm sure I'm missing something relevant here, but so far I couldn't find other solution than creating as many resources as organizations exist and that could be a maintanance burden in the future. Maybe it's just as simple as parsing the resource name, in JS or Drools Rules, in order to retrieve the `org_id` from the resource name. Any help would be appreciated. Thanks!.

8 years

2
5
0 / 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

keycloak-user May 2018