March 2019 - keycloak-user - Jboss List Archives

Retrieving user information through the admin client on springboot

by Vikram

Hi all, Versions in use: Keycloak version : 4.8.2 Springboot adapter version: 4.8.3 FINAL Keycloak admin client 4.8.2 FINAL So I am trying to get all the users that have a role "customer" and belong to a group "group1". I am using the following code. RoleResource roleResource = realmResource.roles().get("customer"); Set<UserRepresentation> customers= roleResource.getRoleUserMembers(); ArrayList<UserRepresentation> groupCustomers = new ArrayList<UserRepresentation>(); for (UserRepresentation user: customers) { if (user.getGroups().contains("group1") { //error System.out.println("group customer: " + user.getUsername()); groupCustomers.add(user); } } However, I get an error when I loop through the user representations to read the group names. I do not get the group and roles information. I get the username, first name and last name though.. Is it a permission issue ? How can I get around it ? Regards, Vikram

5 years, 10 months

1
0
0 / 0

Restricting audience when using service-to-service calls

by Matthias O

Hi, I have a scenario where I want allow a client (let's call it C1) to access a service S1 which in turn needs to call a method in "internal" service S2. So it looks kind of like this: C1 -> S1 -> S2 The way I understand it, I would create a client scope for C1 which adds S1 and S2 as an audience to the access token. However, I don't want C1 to be able to call the S2 services directly. So, the access token for C1 should actually be restricted only to audience S1. Is there any way to accomplish that? The token exchange would probably be one solution, but as it is a technology preview I'm hesistant to use it in production. Thanks, Matthias

5 years, 10 months

2
2
0 / 0

Login success/failure constant time

by DAVIES, Ben (NHS DIGITAL)

Hi! Just joined the list and looking for some answers RE: security features of Keycloak. I had a google about and a read of the docs but I couldn't find and answer to my question. Does Keycloak ensure that failed logins and successful logins take the same amount of time? I've been asked as part of an OWASP questionnaire (section V2.28 "Verify that all authentication challenges, whether successful or failed, should respond in the same average response time"). Does anyone know if this is the case, or ideally point to some documentation of this fact? Cheers! Ben ******************************************************************************************************************** This message may contain confidential information. If you are not the intended recipient please inform the sender that you have received the message in error before deleting it. Please do not disclose, copy or distribute information in this e-mail or take any action in relation to its contents. To do so is strictly prohibited and may be unlawful. Thank you for your co-operation. NHSmail is the secure email and directory service available for all NHS staff in England and Scotland. NHSmail is approved for exchanging patient data and other sensitive information with NHSmail and other accredited email services. For more information and to find out how you can switch, https://portal.nhs.net/help/joiningnhsmail

5 years, 10 months

1
0
0 / 0

Propagate updated password to external systems

by Alessio G. Baroni

Hello, Firstly, I’m sorry if this email is a duplicate of another thread; I didn’t find it. In case, point me to that thread please. I have this scenario (with Keycloak 3.4.3): An user changes its password The password must be propagated in clear text to 2 external systems (they are reachable by a REST interface) How do I do it? I thought to develop a provider, but I don’t know which SPI to use. Thank you very much. Regards, Alessio G. B.

5 years, 10 months

1
0
0 / 0

I have a question about the flow behind the link in the execute-actions-email

by robrecht anrijs

Hi, I've recently upgraded from keycloak 3.2.1 to 3.4.3. I've noticed that there is change in the link that is generated in the email. If such a mail is send with the rest-api execute-actions-email with 'UPDATE_PASSWORD' and with 'VERIFY_EMAIL' A user (in 3.4.3) get's now the info-page, and has to click on the link 'Click here to proceed', instead of going directly to the update-password-screen. I've seen in the sourcecode of ExecuteActionsActionTokenHandler#handleToken that this done on purpose. My questions: - why is this done? is this an oauth rule that I'm missing? - Is it possible to prevent this extra click? -- So yes: how -- So no: What is the correct explanation for this feature? So I can explain this to my customer and he understands this extra page-click. Thx for the answers, Kind regards, Robrecht

5 years, 10 months

1
0
0 / 0

Administering keycloak without a local browser

by Neil Youngman

I am trying to work through the Getting Started Guide and not getting far. The machine I am installing on does not have a local browser. The guide says I can add the initial admin user using the add-user-keycloak.sh script. I have done that, but subsequent steps then assume I can get into the console with a browser. Is it possible to continue the set up from the command line or does almost everything require the web interface? After some digging I found a pointer in the mailing list to https://www.keycloak.org/docs/3.0/server_installation/topics/network/bind.... >From that I saw that I can use ./standalone.sh -b 10.17.3.57, which will allow me to continue with the tutorial, but I would like to know if there is a simple way to limit access to a few other hosts? Neil Youngman

5 years, 10 months

3
2
0 / 0

Re: [keycloak-user] Help problem with Bad request

by Konsulent Thomas Isaksen (TNO)

Hi, I have this exact issue. Did you find the cause? -- Thomas Isaksen

5 years, 10 months

1
0
0 / 0

Token exchange cross realm

by triton oidc

Hi Keycloak masters I've done the token exchange in the same realm, here is a link with my scenario https://www.websequencediagrams.com/?lz=dGl0bGUgRGV0YWlsZWQgdG9rZW4gZXhja... I'm trying to do the same cross realm following this documentation https://www.keycloak.org/docs/latest/securing_apps/index.html#external-to... Here is a link to my draft https://www.websequencediagrams.com/?lz=dGl0bGUgRGV0YWlsZWQgdG9rZW4gZXhja... However i don't know which client credentials put in the query. my app only knows it's own credentials (*app1_clientID* and *app1_clientSecret*) and wants to get an access token on the Realm2 (R2) on the clientID " *secured_R2*" The broker on the IDP2 is using the clientID "*R1_for_R2*" on the IDP1 The alias of the broker is "*R2_for_R1_users*" curl -X POST \ -d "client_id=*app1_clientID*" \ -d "client_secret=*app1_clientSecret*" \ --data-urlencode "grant_type=urn:ietf:params:oauth:grant-type:token-exchange" \ -d "subject_token="*my_token_obtained_using_app1_clientID*" \ -d "subject_issuer=*R2_for_R1_users*" \ --data-urlencode "subject_token_type=urn:ietf:params:oauth:token-type:access_token" \ -d "audience=*secured_R2*" \ http://*IDP2*/auth/realms/*R2*/protocol/openid-connect/token I got an invalid credentials, which makes sense because the IDP2 can't verify the credentials of the App1 linked to the realm1 (IDP1) I know i missed something. If someone could give me a hint Once i understand, i'm willing to propose an update on the documentation Thanks for any help Amaury

5 years, 10 months

3
3
0 / 0

Moving container images to Quay (from Docker Hub)

by Stian Thorgersen

We are planning on moving our container images to Quay.io. The question is do we also need to keep pushing to Docker Hub? If so why?

5 years, 10 months

3
6
0 / 0

Keycloak gatekeeper issue

by Ronald Demneri

Hi all, I am trying to create an idea on Gatekeeper and have a very simple setup consisting of an upstream server with Apache and PHP. I run the keycloak-gatekeeper as follows: ./keycloak-gatekeeper --config keycloak-gatekeeper.json --verbose=true --resources="uri=/*|white-listed=true" The config file is as follows: discovery-url: https://keycloak/auth/realms/master client-id: gatekeeper client-secret: 94779832-40d7-4342-90d6-12ab52eab831 listen: 10.253.6.41:80 enable-refresh-tokens: true enable-logging: true enable-json-logging: true enable-login-handler: true enable-token-header: true enable-metrics: true enable-default-deny: false redirection-url: http://gatekeeper:80 //redirection-url: http://10.253.6.41:3000 encryption-key: AgXa7xRcoClDEU0ZDSH4X0XhL5Qy2Z2j secure-cookie: false upstream-url: http://127.0.0.1:80 resources: - uri: /user/test.php - uri: /admin/*.php roles: - admin In the logs I receive the following upon a successful login: {"level":"error","ts":1550234109.9775908,"caller":"keycloak-gatekeeper/middleware.go:108","msg":"no session found in request, redirecting for authorization","error":"authentication session not found"} {"level":"info","ts":1550234109.9777544,"caller":"keycloak-gatekeeper/middleware.go:90","msg":"client request","latency":0.0002176,"status":307,"bytes":95,"client_ip":"10.253.6.24:60575","method":"GET","path":"/user/test.php"} {"level":"debug","ts":1550234110.0099785,"caller":"keycloak-gatekeeper/handlers.go:88","msg":"incoming authorization request from client address","access_type":"","auth_url":"https://keycloak/auth/realms/master/protocol/openid-connect/auth?client_i...","client_ip":"10.253.6.24:60575"} {"level":"info","ts":1550234110.010026,"caller":"keycloak-gatekeeper/middleware.go:90","msg":"client request","latency":0.0000993,"status":307,"bytes":331,"client_ip":"10.253.6.24:60575","method":"GET","path":"/oauth/authorize"} {"level":"error","ts":1550234127.0692794,"caller":"keycloak-gatekeeper/handlers.go:152","msg":"unable to verify the id token","error":"the access token has expired"} {"level":"info","ts":1550234127.069323,"caller":"keycloak-gatekeeper/middleware.go:90","msg":"client request","latency":0.1995038,"status":403,"bytes":0,"client_ip":"10.253.6.24:60575","method":"GET","path":"/oauth/callback"} And of course, I am not redirected back to the requested URL. I have configured the gatekeeper as a confidential client in Keycloak, and have added the redirect_uri http://gatekeeper:80/oauth/callback Any hints? Thanks in advance, Ronald

5 years, 10 months

3
11
0 / 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

keycloak-user March 2019