March 2019 - keycloak-user - Jboss List Archives

Cannot invoke custom endpoint added to keycloak

by Sachindra Dilhara

Hi all, I want to add a custom endpoint to keycloak and I tried a sample given. Following are the steps I took. 1. *pom.xml* *<project xmlns="http://maven.apache.org/POM/4.0.0 <http://maven.apache.org/POM/4.0.0>" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance <http://www.w3.org/2001/XMLSchema-instance>"* * xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 <http://maven.apache.org/POM/4.0.0> http://maven.apache.org/maven-v4_0_0.xsd <http://maven.apache.org/maven-v4_0_0.xsd>">* * <name>Keycloak Custom REST Endpoint Example</name>* * <description/>* * <modelVersion>4.0.0</modelVersion>* * <artifactId>keycloak-custom-rest-endpoint</artifactId>* * <packaging>jar</packaging>* * <groupId>keycloak.example</groupId>* * <version>1.0.0</version>* * <properties>* * <maven.compiler.source>11</maven.compiler.source>* * <maven.compiler.target>11</maven.compiler.target>* * </properties>* * <dependencies>* * <dependency>* * <groupId>org.keycloak</groupId>* * <artifactId>keycloak-core</artifactId>* * <version>4.8.1.Final</version>* * <scope>provided</scope>* * </dependency>* * <dependency>* * <groupId>org.keycloak</groupId>* * <artifactId>keycloak-server-spi</artifactId>* * <version>4.8.1.Final</version>* * <scope>provided</scope>* * </dependency>* * <dependency>* * <groupId>org.keycloak</groupId>* * <artifactId>keycloak-server-spi-private</artifactId>* * <version>4.8.1.Final</version>* * <scope>provided</scope>* * </dependency>* * <dependency>* * <groupId>org.jboss.spec.javax.ws.rs <http://org.jboss.spec.javax.ws.rs></groupId>* * <artifactId>jboss-jaxrs-api_2.1_spec</artifactId>* * <version>1.0.2.Final</version>* * </dependency>* * </dependencies>* * <build>* * <finalName>hello-rest-example</finalName>* * <plugins>* * <plugin>* * <groupId>org.apache.maven.plugins</groupId>* * <artifactId>maven-compiler-plugin</artifactId>* * <configuration>* * <source>6</source>* * <target>6</target>* * </configuration>* * </plugin>* * </plugins>* * </build>* *</project>* 2. *Provider class* *package org.keycloak.examples.rest;* *import org.keycloak.models.KeycloakSession;* *import org.keycloak.services.resource.RealmResourceProvider;* *import javax.ws.rs.GET;* *import javax.ws.rs.Path;* *import javax.ws.rs.Produces;* */*** * * @author <a href="mailto:sthorger@redhat.com <sthorger(a)redhat.com>">Stian Thorgersen</a>* * */* *public class HelloResourceProvider implements RealmResourceProvider {* * private KeycloakSession session;* * public HelloResourceProvider(KeycloakSession session) {* * this.session = session;* * }* * @Override* * public Object getResource() {* * return this;* * }* * @GET* * @Path("/customMessage1")* * @Produces("text/plain; charset=utf-8")* * public String get1() {* * String name = session.getContext().getRealm().getDisplayName();* * if (name == null) {* * name = session.getContext().getRealm().getName();* * }* * return "Hello " + name;* * }* * @GET* * @Path("/customMessage2")* * @Produces("text/plain; charset=utf-8")* * public String get2() {* * return "Hello custom message 2";* * }* * @Override* * public void close() {* * }* *}* 3. *Provider factory class* *package org.keycloak.examples.rest;* *import org.keycloak.Config.Scope;* *import org.keycloak.models.KeycloakSession;* *import org.keycloak.models.KeycloakSessionFactory;* *import org.keycloak.services.resource.RealmResourceProvider;* *import org.keycloak.services.resource.RealmResourceProviderFactory;* */*** * * @author <a href="mailto:sthorger@redhat.com <sthorger(a)redhat.com>">Stian Thorgersen</a>* * */* *public class HelloResourceProviderFactory implements RealmResourceProviderFactory {* * public static final String ID = "hello";* * @Override* * public String getId() {* * return ID;* * }* * @Override* * public RealmResourceProvider create(KeycloakSession session) {* * return new HelloResourceProvider(session);* * }* * @Override* * public void init(Scope config) {* * }* * @Override* * public void postInit(KeycloakSessionFactory factory) {* * }* * @Override* * public void close() {* * }* *}* 4. Added *META-INF/services/org.keycloak.services.resource.RealmResourceProviderFactory* file with below content. *org.keycloak.examples.rest.HelloResourceProviderFactory* 5. Build a jar and dropped it in the *{$Keycloak_home}/standalone/deployments* folder and started the server. 6. Using the management console I could see that the jar is deployed. ( http://localhost:9990/console/index.html#deployments) 7. Generated a token using *admin-cli* in *master* realm with *admin user* credentials. 8. Used that token to invoke the get endpoints " http://localhost:8080/auth/custommessage1" and " http://localhost:8080/auth/custommessage2". But both the nedpoints returned HTTP 404 Not Found. I want to know the following. 1. Have I created and deployed the custom endpoint correctly? 2. Is the URLs used to invoke endpoints are correct or not? 3. Have I used the correct way to invoke the custom endpoint. (I mean using the token generated from admin user in master) ? -- Sachindra Dilhara

6 years, 7 months

2
1
0 / 0

KeyCloak Server and HTTP OPTIONS (JSF/Primefaces behind KC Adapter)

by Raul Fechete

Hello, I'm trying to build what should be a trivial setup, but I'm having trouble getting to work properly. I have a JSF Application running on JBoss EAP 7.2, secured by the KC Java Adapter. The initial login flow works perfectly fine (browser asks for website, adapter intercepts and redirects to KC, user logs in with KC and is being redirected back to the website). Now, the JSF application often uses POST requests. If the user has been logged out (e.g. in KC directly), clicking anywhere on the website triggers a POST request to the application, which is being intercepted by the KC Adapter and redirected (302) to KC. This would be fine, but the problem is, the browser then performs a HTTP *OPTIONS* call to KC instead of HTTP GET, and the KC just returns 204 without any further information. I also noticed that the KC Server *always* replies with an empty 204 to a HTTP OPTIONS call, even if there is nothing else in the request. Is there any way to configure the handling of the OPTIONS requests in KC? Alternatively, is it possible to configure the adapter to send a 303 and thereby force the browser to perform a GET request? Or am I doing something conceptually wrong? Any help would be appreciated! Thank you very much! Cheers, Raul

6 years, 7 months

2
1
0 / 0

SAML logout request document mapping fails

by Manuel Waltschek

Hello, I am using keycloak for identity brokering with wildfly. There are some Problems I experience with the logout. First: a call to HttpRequest.logout() does not trigger anything. I need to redirect to myurl?GLO=true too to actually do a logout. Maybe the documentation is wrong? The one thing that is even worse is that I can't do IdP initiated logout, since the document-object mapping does not work. It does not decrypt the cipher value and therefore every value is null, resulting in a NPE in org.keycloak.broker.saml.SAMLEndpoint.Binding.logoutRequest(LogoutRequestType, String) line 282. Im using wildfly10 and keycloak 4.8.3.Final. Please do not ignore me again, since this is blocking us for a long time now. I really need someone figuring that one out. Thanks and regards, [Logo] Manuel Waltschek BSc. +43 660 86655 47<tel:+436608665547> manuel.waltschek(a)prisma-solutions.at<mailto:manuel.waltschek@prisma-solutions.at> https://www.prisma-solutions.com PRISMA solutions EDV-Dienstleistungen GmbH Klostergasse 18, 2340 Mödling, Austria Firmenbuch: FN 239449 g, Landesgericht Wiener Neustadt

6 years, 7 months

1
0
0 / 0

Tooltip IdP mapper "Username Template Importer" as example "${ALIAS}.${CLAIM.sub}" but it does not work

by Jean-François HEROUARD

Hi, When configuring an "Username Template Importer" as a mapper of an identity provider, the tooltip says that it could be "${ALIAS}.${CLAIM.sub}" but "sub" is not an accessible claim. AbstractClaimMapper.getClaimValue() only looks into token.getOtherClaims(), so only claims binded by @JsonAnySetter are accessible, not sub iss jti... I patch it : Map<String, Object> jsonObject = token.getOtherClaims(); jsonObject.put("jti", token.getId()); jsonObject.put("sub", token.getSubject()); jsonObject.put("iss", token.getIssuer()); jsonObject.put("azp", token.getIssuedFor()); Because I need to be able to get these attributes. Either the tooltip or the code has a bug ?

6 years, 7 months

1
0
0 / 0

Keycloak server migration backward compatibility

by Abhijeet Deshpande

Hi, I’m migrating keycloak version from 2.2.1.Final to Keycloak 4.4.0.Final, with an option for backward compatibility. i.e. a bearer token generated by UI application on Keycloak 2.2.1.Final, can be authenticated by Service on Keycloak 4.4.0.Final keycloak version Our application has Angular-UI (ssoadmin-ui) & SpringBoot-Services (ssoadmin-service). For my migration POC: 1. Installed Keycloak 4.4.0.Final version on my local, registered both above mentioned clients in new Keycloak version. 2. Modified the key /src/config/keycloak.json file with latest keycloak settings, below is the keycloak.json { "realm": "Demo", "auth-server-url": "http://localhost:8080/auth", "ssl-required": "external", "resource": "ssoadmin-ui", "public-client": true, "use-resource-role-mappings": true, "confidential-port": 0 } 1. With these setting in Angular I’m making call to my service. Service is running on localhost:8082 2. My service still points to old keycloak instance (KeyCloak 2.2.1.Final) Below are application.properties in service for keycloak. ####### Keycloak keycloak.realm=DEV_Ext keycloak.auth-server-url=https://kc-lower.****.com/auth keycloak.ssl-required=external keycloak.resource=ssoadmin-service this fails with below exceptions: o.k.a.BearerTokenRequestAuthenticator - Failed to verify token org.keycloak.common.VerificationException: Invalid token signature Is this the right approach ? and whether this is achievable ? For my application to have one client authenticating with 2.2.1Final version and another client to get this token validated against 4.4.0.Final version. Any pointers will be much appreciated. Please let me know if any clarifications/additional information needed. Also, if I make both of them in same version on keycloak the authentication works. Thanks Abhijeet

6 years, 7 months

2
1
0 / 0

Logging for X509 authentication flow

by Page, Raymond (Techical Solutions )

I'm trying to get keycloak working with Wildfly authenticating clients directly by X.509 and then using the authentication flow in keycloak to translate that to a local user. Unfortunately, it's not working and I'm not getting useful logging out of keycloak to determine what's wrong with my configuration. To debug, I need to know that undertow is passing the certificate successfully to keycloak, that keycloak's X509-form authentication is receiving the proper identity, the identity extracted from the certificate for authentication comparison, what it's being compared to (is the CN or DN being regexed and is it being compared to the keycloak custom attribute that I specified). What I get from enabling debug logging that's not jboss modules loads is: 18:59:38,702 WARN [org.keycloak.events] (default task-1) type=LOGIN_ERROR, realmId=TEST, clientId=https://auth.test.local, userId=null, ipAddress=192.168.0.100, error=client_not_found Can someone provide details on how to get debug logging for undertow and the X509-form-config authentication? -- Raymond Page, CTR (US) Automation Engineer, UoT TIS CTR to Booz | Allen | Hamilton page_raymond(a)ne.bah.com raymond.c.page15.ctr(a)mail.mil C: (321) 549-7243<tel:(321)+549-7243> W: (703) 679-8618<tel:(703)+679-8618>

6 years, 7 months

3
4
0 / 0

User roles deleted after SSO idle session expires

by MEHDi CHAABOUNi

Hi, This is our Keycloak setup: - Keycloak docker container 4.4.0.Final - Azure Active Directory (mapping groups to roles) - Keycloak client protocol: openid-connect - 3 optional client scopes We noticed lately that users using the front-end application (angular) are losing all roles after the SSO idle session expires. This behaviour is also seen in the 4.8.3.Final version. It seems that the Identity Provider Mappers are not triggered for some reason and I can't dig any deeper nothing much is logged in the method IdentityBrokerService.authenticated(BrokeredIdentityContext context). Any ideas? How can I run Keycloak form source?

6 years, 7 months

2
8
0 / 0

Listing the UMA resources accessible by a user

by roxspring＠imapmail.org

Hi folks, UMA seems to be a great solution to model fine grained permissions and allow scenarios such as "Alice shares Folder X with Bob". Keycloak seems to implement this well with APIs for the resource server to ask "Given [User] and [Folder X], can the user do [Scope]?" and provide answers for both Alice and Bob based on some policy. Where I'm struggling is that our application also needs to provide answer "Given [User], which folders can they do [Scope] to?" and I'm not clear how best to achieve this with Keycloak. A. Track which folders a user owns or can access and answer the question directly in the resource server, but that results in the resource server having a rigid model of the authorization rules and loses the benefits of Keycloak's flexible policies (or duplicates the policy which seems just as bad). B. Have the resource server chose some subset of all folders and ask Keycloak to validate each resource, but that becomes very chatty and slow when there are 1000s of resources to validate. C. Just ask Keycloak to validate all resources and just return those the user can access, but that's also potentially slow with 1000s of resources to validate and 100s accessible. a. As above but with additional filtering by resource type to trim the options. b. As above but with additional filtering by attributes (e.g. where property:owner = "Alice") c. As above but with a full blown query language (e.g. "WHERE type=Folder AND (property:owner=Alice OR property:sharedwith contains Alice) D. .? I was expecting some variant of C to be the recommended way forward but I can't find the relevant APIs (even without filtering). What's the best way to model such a (presumably common) scenario? Thanks, Rob

6 years, 7 months

2
4
0 / 0

Authorisation services: resource server managing permissions

by Fabio Berta

Hi I have a couple of questions regarding Keycloak's authorisation services. Premiss: - I don't really need the whole user managed permissions and permission sharing features that UMA gives. All permissions are given by admin users. - My resource server is a NodeJS application, hence I cannot use the pre-made Java adapters - I'm not sending RPT tokens to public clients at the moment, the resource server checks permissions by making a request to Keycloak Let's assume I want to protect the entity "Config". I need to restrict create/delete/update rights for all configs and read rights for every single instance of config. To achieve that, I created the the scopes "config:read", "config:create", "config:delete" and "config:update". I created the resource "config" and attached the scopes "config:create", "config:delete" and "config:update". Because only users with the realm role "admin" should be able to create/update/delete, I created a role based policy specifying the "admin" role and connected it with the resource "config" and the scopes "config:create", "config:delete" and "config:update" in a scope-based permission. So far everything is pretty straightforward and works well. Where it's get more complicated is the read rights for individual configs. What I have in mind is an interface where admins can create configs and manage permissions for them without going through the keycloak admin console. Whenever an admin creates a new config, the resource server creates a corresponding resource (e.g. config/configId) and stores the id of the resource next to the config. I can do that with Protection API (authz/protection/resource_set). What I have not yet figured out is how the resource server can set permissions at this point. Let's assume the admin has specified two users that should be able to access the new config. The resource server should create a new user based policy containing the two users and connect it with the "config/configId" resource and the scope "config:read" in a scope-based permission. From the documentation it looks like the Policy API might be able to handle this. But two things confuse me: - It says "This API is protected by a bearer token that must represent a consent granted by the user to the resource server to manage permissions on his behalf". I don't need to manage on the users behalf, the resource is owned by the resource server and the created permission would also be owned by the resource server. - The examples for the API somehow combine policies and permissions into one? I tried to use this API with a token obtained via the client credentials grant but it failed to create permissions (empty response and nothing got created). I see that the Java Admin Client has the ability to manage permissions but I can't find documentation on the REST endpoints it uses. ( https://www.keycloak.org/docs-api/5.0/rest-api/index.html doesn't contain anything authz related). Would the Admin API be the thing to use here or can I do this with the Policy API? Or maybe my approach is fundamentally flawed and I should approach this from another angle? This message got way to long but I hope I was able to make my questions clear. Grateful for any help I can get! Best regards, Fabio Berta

6 years, 7 months

2
5
0 / 0

Authentication failed: org.jvnet.libpam.PAMException

by mizuki

Hi, We are currently evaluating keycloak as a possible authentication mechanism deployed to our facility. We use kerberos for user authentication with FreeIPA and configured sssd for user federation in keycloak (follow the official document both from keycloak and freeipa.org) One of the requirement we desire is to enable kerboros password for SSH login and enabled 'otp' for HTTP based applications. To do so, 1. We enabled both user-auth-types for the user: - password - password + otp 2. Created HBAC rules in IPA, allowing keycloak server access for following services: (I purposely did not enable 'otp' at this point as I want to verify both 'password' and 'otp' shall work) - keycloak - sshd 3. Confimred sshd worked with both 'password' and 'otp' types via PAM/SSSD, then I went ahead and accessed URL that is protected by keycloak, 'password' works but 'otp' won't, the following ERRORs were seen in keycloak's server.log: ----------- 019-03-04 17:01:20,246 WARN [org.keycloak.events] (default task-22) type=LOGIN_ERROR, realmId=SDCC, clientId=vproxytest03, userId=9900928d-efee-4192-bbc8-7e29cf512d2b, ipAddress=130.199.6.120, error=invalid_user_credentials, auth_method=openid-connect, auth_type=code, redirect_uri=https://www.example.com/secure/ <https://vproxytest03.racf.bnl.gov/secure/>*, code_id=d6c83411-4ca8-4d2b-b942-afd0006e98d2, username=mmstestu 2019-03-04 17:01:43,033 ERROR [org.keycloak.federation.sssd.impl.PAMAuthenticator] (default task-22) Authentication failed: org.jvnet.libpam.PAMException: pam_authenticate failed : Permission denied at org.jvnet.libpam.PAM.check(PAM.java:113) at org.jvnet.libpam.PAM.authenticate(PAM.java:129) at org.keycloak.federation.sssd.impl.PAMAuthenticator.authenticate(PAMAuthenticator.java:53) at org.keycloak.federation.sssd.SSSDFederationProvider.isValid(SSSDFederationProvider.java:180) at org.keycloak.credential.UserCredentialStoreManager.validate(UserCredentialStoreManager.java:143) at org.keycloak.credential.UserCredentialStoreManager.isValid(UserCredentialStoreManager.java:124) at org.keycloak.authentication.authenticators.browser.AbstractUsernameFormAuthenticator.validatePassword(AbstractUsernameFormAuthenticator.java:193) at org.keycloak.authentication.authenticators.browser.AbstractUsernameFormAuthenticator.validateUserAndPassword(AbstractUsernameFormAuthenticator.java:166) at org.keycloak.authentication.authenticators.browser.UsernamePasswordForm.validateForm(UsernamePasswordForm.java:55) at org.keycloak.authentication.authenticators.browser.UsernamePasswordForm.action(UsernamePasswordForm.java:48) at org.keycloak.authentication.DefaultAuthenticationFlow.processAction(DefaultAuthenticationFlow.java:113) at org.keycloak.authentication.DefaultAuthenticationFlow.processAction(DefaultAuthenticationFlow.java:97) at org.keycloak.authentication.AuthenticationProcessor.authenticationAction(AuthenticationProcessor.java:873) at org.keycloak.services.resources.LoginActionsService.processFlow(LoginActionsService.java:292) at org.keycloak.services.resources.LoginActionsService.processAuthentication(LoginActionsService.java:263) at org.keycloak.services.resources.LoginActionsService.authenticate(LoginActionsService.java:259) at org.keycloak.services.resources.LoginActionsService.authenticateForm(LoginActionsService.java:320) at sun.reflect.GeneratedMethodAccessor719.invoke(Unknown Source) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:55) at java.lang.reflect.Method.invoke(Method.java:508) at org.jboss.resteasy.core.MethodInjectorImpl.invoke(MethodInjectorImpl.java:140) at org.jboss.resteasy.core.ResourceMethodInvoker.internalInvokeOnTarget(ResourceMethodInvoker.java:509) at org.jboss.resteasy.core.ResourceMethodInvoker.invokeOnTargetAfterFilter(ResourceMethodInvoker.java:399) at org.jboss.resteasy.core.ResourceMethodInvoker.lambda$invokeOnTarget$0(ResourceMethodInvoker.java:363) at org.jboss.resteasy.core.ResourceMethodInvoker$$Lambda$849.00000000BB8BBB40.get(Unknown Source) at org.jboss.resteasy.core.interception.PreMatchContainerRequestContext.filter(PreMatchContainerRequestContext.java:358) at org.jboss.resteasy.core.ResourceMethodInvoker.invokeOnTarget(ResourceMethodInvoker.java:365) at org.jboss.resteasy.core.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:337) at org.jboss.resteasy.core.ResourceLocatorInvoker.invokeOnTargetObject(ResourceLocatorInvoker.java:137) at org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorInvoker.java:100) at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:443) at org.jboss.resteasy.core.SynchronousDispatcher.lambda$invoke$4(SynchronousDispatcher.java:233) at org.jboss.resteasy.core.SynchronousDispatcher$$Lambda$847.00000000BE026450.run(Unknown Source) at org.jboss.resteasy.core.SynchronousDispatcher.lambda$preprocess$0(SynchronousDispatcher.java:139) at org.jboss.resteasy.core.SynchronousDispatcher$$Lambda$848.00000000BDC48A90.get(Unknown Source) at org.jboss.resteasy.core.interception.PreMatchContainerRequestContext.filter(PreMatchContainerRequestContext.java:358) at org.jboss.resteasy.core.SynchronousDispatcher.preprocess(SynchronousDispatcher.java:142) at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:219) at org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.service(ServletContainerDispatcher.java:227) at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:56) at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:51) at javax.servlet.http.HttpServlet.service(HttpServlet.java:791) at io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:74) at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:129) at org.keycloak.services.filters.KeycloakSessionServletFilter.doFilter(KeycloakSessionServletFilter.java:90) at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61) at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131) at io.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.java:84) at io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:62) at io.undertow.servlet.handlers.ServletChain$1.handleRequest(ServletChain.java:68) at io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36) at org.wildfly.extension.undertow.security.SecurityContextAssociationHandler.handleRequest(SecurityContextAssociationHandler.java:78) at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) at io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:132) at io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:57) at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) at io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:46) at io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64) at io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:60) at io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:77) at io.undertow.security.handlers.NotificationReceiverHandler.handleRequest(NotificationReceiverHandler.java:50) at io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43) at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) at org.wildfly.extension.undertow.security.jacc.JACCContextIdHandler.handleRequest(JACCContextIdHandler.java:61) at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) at org.wildfly.extension.undertow.deployment.GlobalRequestControllerHandler.handleRequest(GlobalRequestControllerHandler.java:68) at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) at io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:292) at io.undertow.servlet.handlers.ServletInitialHandler.access$100(ServletInitialHandler.java:81) at io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:138) at io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:135) at io.undertow.servlet.core.ServletRequestContextThreadSetupAction$1.call(ServletRequestContextThreadSetupAction.java:48) at io.undertow.servlet.core.ContextClassLoaderSetupAction$1.call(ContextClassLoaderSetupAction.java:43) at org.wildfly.extension.undertow.security.SecurityContextThreadSetupAction.lambda$create$0(SecurityContextThreadSetupAction.java:105) at org.wildfly.extension.undertow.security.SecurityContextThreadSetupAction$$Lambda$693.00000000BCF725B0.call(Unknown Source) at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502) at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction$$Lambda$694.00000000BD0FBEE0.call(Unknown Source) at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502) at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction$$Lambda$694.00000000BD0FBEE0.call(Unknown Source) at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502) at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction$$Lambda$694.00000000BD0FBEE0.call(Unknown Source) at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502) at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction$$Lambda$694.00000000BD0FBEE0.call(Unknown Source) at io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:272) at io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:81) at io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:104) at io.undertow.server.Connectors.executeRootHandler(Connectors.java:360) at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:830) at org.jboss.threads.ContextClassLoaderSavingRunnable.run(ContextClassLoaderSavingRunnable.java:35) at org.jboss.threads.EnhancedQueueExecutor.safeRun(EnhancedQueueExecutor.java:1985) at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.doRunTask(EnhancedQueueExecutor.java:1487) at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1378) at java.lang.Thread.run(Thread.java:812) ------------------ Interesting thing is keycloak handles OTP just fine if I have 'password+otp' only checked on, then we won't be able to log onto the machines via SSH using password, that defeats our purposes. I tested different version of JAVA and the latest keycloak (4.8.3) version (on REHL 7), all got the same results. I'm wondering if this is more likely a bug or I missed something. I'd appreciate if someone can advice what the approach is. Thank you very much. Mizuki

6 years, 7 months

2
7
0 / 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

keycloak-user March 2019