2:30 a.m.
Hi Michal,
Nice to see Brno guy from StudentAgency using Keycloak :)
I suppose you're using servlet adapter? The servlet specs actually
enforces the security based on the URL request path declared in web.xml,
which is not ideal for some applications though. However there are ways
to solve this somehow. Few things:
- OpenID Connect has support for "prompt=none" feature and Keycloak
supports it. In shortcut, it allows the application to redirect to
Keycloak. Keycloak would never display login screen. In case that user
is not already logged, it directly redirects back to app with the error.
If he is logged, it redirects back to the app with success.
- So you can perhaps do something like at the beginning, try to visit:
http://yourhost/yourapp/secured?prompt=none . In case that user is not
logged, you will receive error from KC and hence you can redirect your
app to the http://yourhost/yourapp/unsecured and display that the user
is not yet logged. Otherwise user is logged.
- Once user clicks "login" you will just redirect to
http://yourhost/yourapp/secured, which will enforce displaying login
screen on Keycloak side.
- If the approach above is too quirky, you can perhaps achieve it some
other way if user is already logged. Maybe use iframe talking to
Keycloak? We have some support for session iframe in keycloak.js adapter
OOTB, in servlet adapter there is no support OOTB, but I think you
should be able to use it from your app. This may be a bit harder to
setup though, but likely doable.
Marek
On 15/08/17 16:59, Michal Keda wrote:
Both
Principal userPrincipal = httpServletRequest.getUserPrincipal();
RefreshableKeycloakSecurityContext context =
(RefreshableKeycloakSecurityContext)
httpServletRequest.getAttribute(KeycloakSecurityContext.class.getName());
are null when visiting unprotected homepage, even if user is logged
(directly in keycloak) until I visit my protected page.
Is this configuration error?
Dne 15.8.2017 v 8:57 Stian Thorgersen napsal(a):
> Wouldn't
>
http://docs.oracle.com/javaee/6/api/javax/servlet/http/HttpServletRequest...
>
<http://docs.oracle.com/javaee/6/api/javax/servlet/http/HttpServletRequest...
> do the trick?
>
> On 14 August 2017 at 17:22, Michal Keda <michal.keda(a)studentagency.cz
> <mailto:michal.keda@studentagency.cz>> wrote:
>
> Hello,
> I want to implement simple panel showing information about user logged
> into sso. The catch is that I need this panel even on pages that
> should
> not redirect to KC server when no user is logged in.
>
> This seems like basic behaviour for any homepage (show if user is
> logged
> in, but do not force immidiate redirect if isn't), but
> RefreshableKeycloakSecurityContext starts to pop up in my
> HttpServletRequest only after I access some protected page
> (specified in
> web.xml).
>
> So my question is (I guess..) if it is possible to get currently
> logged
> user, on page that is not protected by KC.
>
> I am using tomcat 7, java 8 (+wicket)
>
> Best regards,
>
> Michal Keda
> --
>
> Bc. Michal Keda
> programátor
>
> telefon: +420 539 000 711 <tel:%2B420%20539%20000%20711>
>
> StudentAgency logo <https://www.studentagency.cz/>
> AUTOBUSY | <https://jizdenky.studentagency.cz/
> <https://jizdenky.studentagency.cz/>> VLAKY |
> <https://www.regiojet.cz/> DOVOLENÁ | <https://www.dovolena.cz/>
> LETENKY
> | <https://www.studentagency.cz/letenky/index.html
> <https://www.studentagency.cz/letenky/index.html>> JAZYKOVÉ POBYTY |
> <https://www.jazykovepobyty.cz/ <https://www.jazykovepobyty.cz/>>
> PRACOVNÍ A AU PAIR POBYTY
> <https://www.pracovnipobyty.cz/ <https://www.pracovnipobyty.cz/>>
> STUDENT AGENCY k.s.
> Dům pánů z Lipé nám. Svobody 17
> 602 00 Brno infolinka: 800 100 300
> fax: +420 539 000 540 <tel:%2B420%20539%20000%20540>
> *www.studentagency.cz <http://www.studentagency.cz>*
> <https://www.studentagency.cz>
> STUDENT AGENCY cestování pro každého v každém věku.
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user(a)lists.jboss.org <mailto:keycloak-user@lists.jboss.org>
> https://lists.jboss.org/mailman/listinfo/keycloak-user
> <https://lists.jboss.org/mailman/listinfo/keycloak-user>
>
>
_______________________________________________
keycloak-user mailing list
keycloak-user(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user