SSO with multiple domains
by Ushanas Shastri
Hello,
We have 4 different applications, hosted on 3 unique servers. All
applications are protected by KeyCloak. All apps are built on AngularJS.
In cases where we have multiple tabs open (one for each application) in
Chrome.
When users logout from one Tab, the other tabs don't always logout. Post
this, applications that we login to keep getting unauthorized, and I assume
that the tokens have been invalidated.
I've tried version 3.0 and 3.2.1.
I'm looking for any guidance and best practices to handle such cases.
Regards, Ushanas.
8 years
Client (App) - Keycloak (Server) binding
by Leandro Rebosio
Hey there, I didn't find any documentation about this particular topic, let
me explain a bit. How can I bind my application to a Keycloak server
instance and be sure that this binding is immutable?
I know about certs and public key but if someone changes the key on my app
it would be able to use a different Keycloak instance to authenticate,
isn'it?
Thanks for your clarification and I apologize if this is not the right way
to use the mailing list.
8 years
one issue in keycloak
by prashant kumar
Hi,
We are using keycloak for identiy provider and have got following
requirement,
- We need to show user email
- If the user is of key cloak then showing password text otherwise
showing list of other identity provider.
We couldn't divide username and password without changing the core keycloak
class namely
org.keycloak.authentication.DefaultAuthenticationFlow and then class
doesn't support extension without changing the entire hierarchy of objects
in new.
We can only add provider using SPI for subsequent flow.
So we have taken following approach
1) Changing the core class itself but then keycloak release update will
happen only with this change incorporated.
2) Created our own rest API which is using keycloak utilities and services
as object but entire flow is in the rest API.
Please provide your take on this along with if there is any way we can
inject our own object using spring injection or some other injection
mechanism.
Thanks,
Prashant
>
8 years
Multiple AUTH_SESSION_IDs
by priti guleria
Does keycloak create one AUTH_SESSION_ID per owner session node when in
cluster? I have a cluster with two owners for sessions and with every
successful login there are two AUTH_SESSION_IDs returned.
Also, I tried to remove route information from AUTH_SESSION_ID by following
the below link. However, route information was dropped only for
authentication session and was retained for user session. Is there anything
more to be done here?
https://github.com/keycloak/keycloak-documentation/blob/master/server_ins...
To overcome some of the above problems, I am configuring jboss.node.name to
same value say “mycookie” in every node in the cluster and then add routing
information in load balancer. Will this cause any issue? I have not noticed
any issue so far.
Thanks,
Priti
8 years
Keycloak configurations
by vandana thota
Hello
1)Is there any puppet module for keycloak 4.1. final , any puppet module
for keycloak-SAML adapter ?
2) What is the good practice haveing one keycloak for all wildfly server
which QA non prod , one for Dev non -prod, one for test non prod
wildfly server ?
3) having one keycloak server for whole prod environment ?
Thanks
8 years
Reset Admin Password through database
by Vikas Kumar
Hello,
I have a task to export data (mysqldump) from one keycloak server and
restore (mysqlrestore) it to another.
I am looking to change the admin password through the database i.e. before
starting the new keycloak server. I know I can do it using API but want to
do it before the keycloak is up.
I've tried but could not find anything online :(
Regards,
Vikas
8 years
Returned mail: Data format error
by Bounced mail
The message was not delivered due to the following reason:
Your message was not delivered because the destination server was
not reachable within the allowed queue period. The amount of time
a message is queued before it is returned depends on local configura-
tion parameters.
Most likely there is a network problem that prevented delivery, but
it is also possible that the computer is turned off, or does not
have a mail system running right now.
Your message was not delivered within 5 days:
Mail server 137.123.118.28 is not responding.
The following recipients did not receive this message:
<keycloak-user(a)lists.jboss.org>
Please reply to postmaster(a)lists.jboss.org
if you feel this message to be in error.
8 years
Implicit Flow - Invalid grant_type
by Jonas Schönenberger
Hi everyone
I would like to use the implicit flow with some of my services that use
Keycloak as their Identity-Provider. According to the documentation a token
can be obtained from the token endpoint with the implicit flow:
/realms/{realm-name}/protocol/openid-connect/token
> This is the URL endpoint for obtaining a temporary code in the
> Authorization Code Flow or for obtaining tokens via the Implicit Flow,
> Direct Grants, or Client Grants.
In the well-known config "implicit" is listed as a valid grant_type:
"grant_types_supported": [
> "authorization_code",
> "implicit",
> "refresh_token",
> "password",
> "client_credentials"
> ]
However calls to the above mentioned token endpoint fail with an "Invalid
grant_type" error when I set the "grant_type" to "implicit" and try to
fetch a token. Besides the implicit grant_type I handover the client_id of
my client, its redirect url, "id_token token" as "response_type" and as
"scope" "openid". Implicit flow is enabled on the clients I want to use
that flow with.
I had a look at the source code and it seems that the implicit grant_type
is not one of the accepted grant types:
https://github.com/keycloak/keycloak/blob/8b6979ac18b19eb47e618e05ccffdde...
Does someone know how to obtain a token with the implicit flow from
Keycloak and whether it is possible through the above mentioned API at all?
Thank you for your support and Best Regards
Jonas
8 years
Returned mail: Data format error
by MAILER-DAEMON
The original message was received at Fri, 27 Jul 2018 08:15:04 +0800
from 39.161.52.19
----- The following addresses had permanent fatal errors -----
<keycloak-user(a)lists.jboss.org>
----- Transcript of session follows -----
... while talking to lists.jboss.org.:
>>> DATA
<<< 400-aturner; %MAIL-E-OPENOUT, error opening !AS as output
<<< 400-aturner; -SYSTEM-F-EXDISKQUOTA, disk quota exceeded
<<< 400
8 years
