December 2014 - keycloak-user - Jboss List Archives

by Bill Burke

Hey Keycloak community, Sorry if we were unresponsive last week...We were in Brno for a face to face meeting of entire team. One of us will blog about it next week sometime. -- Bill Burke JBoss, a division of Red Hat http://bill.burkecentral.com

11 years

1
0
0 / 0

Migration to Keycloak

by Jérôme Blanchard

Hi all, I have a question about migrating my application to keycloak. My application is based on : - some EJB components - a main REST interface driving the EJB components, - a HTML5/Angular GUI client - some remote REST api acting as clients of the main REST api. According to the documentation, I plane to use the adapters according to my components but I'm facing a problame for the main REST interface. By default, the main REST interface handles requests using a dedicated GUEST account. It's a kind of default account that is propagated to the EJB container using a classic login mechanism. This is handle in a ServletFilter that looks for HTTP Authentication headers. If headers are not found, authentication on the container is done using the default login 'guest'. For this special account, a dedicated login-module is used in the wildfly security domain (<login-module code="Identity" flag="required">) I'm trying to migrate to keycloak using the undertow adapter but I'm not able to handle a default login propagated to the EJB layer. The use case is that a simpe call to the REST api without authentication token header should result as a container authenticated user guest whereas requests with token included should try to perform the token base authentication. In that way, unauthenticated usage of HTML5/JS interface should result as guest requests and login process only required when main REST api throws AccessDeniedException. Is there is any way to perform this using the KEYCLOAK auth-method or do I have to write a specific Filter handling a kind of dual auth mechanism (guest and keycloak) ? Best regards, Jérôme.

11 years

2
4
0 / 0

1.1 documentation update for running in domain HA mode

by Schneider, John DODGE CONSULTING SERVICES, LLC

Hi guys, Thanks so much for getting clustering support working in 1.1. I have it up and running well in a Wildfly 8 domain setup under the "full-ha" profile. One thing that I was pulling my hair out about for a while today were some errors related to Infinispan config. I figured out that if running in HA cluster, you must include the "transport" element under the cache-container config (i.e. <transport lock-timeout="60000" />). It would be great if you could update Chapter 23 of the documentation to reflect this requirement. Thanks, John

11 years

2
1
0 / 0

Clarification of use case: simultaneous requests with expired token

by Kuznetsov, Mike

Hello, We are in the process of securing our REST APIs using Keycloak. Please confirm our understanding of the following: We have a use case where our web client may SIMULTANEOUSLY send several REST API calls (r1, r2,r3...) to our server using the Access Token (at1) and Refresh Token (rt1). When r1 is being handled, assuming that at1 is expired, server-side adapter will be taking care of getting new tokens (at2, rt2). Is it safe to assume that r2 and r3 will get hold of at2 and rt2? If so, is it valid to conclude that the adapter is maintaining state for the token. Thank You, Mikhail Kuznetsov

11 years

2
1
0 / 0

Federation

by Bellan Saravanan

Hello, The latest release notes talk about multi tenant enhancements like supporting multiple realms for a single application. Is it possible for a realm to delegate the authentication to a external identity provider like Ping or Okta (using SAML or OpenID Connect) providing some kind of identity federation. One of the requirements for our app is that one or more of out tenants can use their own AD directory for authenticating users into our service. Eventhough keycloak has support for LDAP/AD, I'm not sure if customers will open up their directory for direct connectivity from our cloud service into their on premise AD. Thanks,

11 years

2
1
0 / 0

Direct Grand loggins not listed in Sessions and Tokens

by Michael Gerber

Hi, I use the REST WebService /realms/{realm}/tokens/grants/access to grant access to resources protected by Keycloak. But these logged in users are not listed in the Sessions and Tokens section on the Admin page. Is there any way to get all active sessions for a given realm? kind regards Michael

11 years

1
0
0 / 0

Full Scope Allowed OFF

by Carlos Feria

Hi. Sorry by the question but i have a problem that i can’t solve. I’m using “Pure Client Javascript Adapter” and a APPLICATION WITH “Full Scope Allowed OFF, and Assigned Roles ”. When i do “*keycloak.init({ onLoad: ‘login-required’ })*” the login page shows, but there accept all user accounts, I need login just users with Assigned Roles on Scope”. Is there a bug? how can i solve my problem? Thanks for all. -- Carlos E. Feria Vila

11 years, 1 month

2
1
0 / 0

Keycloak 1.1.0.Beta2 released

by Bill Burke

A lot of new features this release. Tomcat 6, 7, and 8 adapters Jetty 8.1, 9.1, and 9.2 adapters HTTP Security Proxy for platforms that don’t have an adapter based on Undertow. Wildfly subsystem for auth server. Allows you to run keycloak in domain mode to make it easier to run in a cluster. Hope to do 1.1.0.Final sometime end of January. See http://keycloak.org for more details -- Bill Burke JBoss, a division of Red Hat http://bill.burkecentral.com

11 years, 1 month

3
3
0 / 0

SPNEGO and OpenID connect end points

by prab rrrr

Hi Bill and team - Congratulations on the new functionality in 1.1 Beta2. Now that Keycloak has a good deal of functionality, would you be able provide timelines for the below functionality:1) SPNEGO (Kerberos) authentication functionality 2) Complete OpenID Connect endpoint compatibility and plans for dynamic discovery Thanks,Raghu

11 years, 1 month

2
1
0 / 0

org.keycloak.util.JsonSerialization does not seem to support @JsonTypeInfo

by Dean Peterson

I receive the following error only when using org.keycloak.util.JsonSerialization to deserialize: Unrecognized field "class" (Class com.abecorn.model.Item), not marked as ignorable Here is the setup: @JsonTypeInfo(use = JsonTypeInfo.Id.CLASS, include = As.PROPERTY, property = "class") @JsonIgnoreProperties(ignoreUnknown = true) @Entity @Indexed public class Item { . . .

11 years, 1 month

2
1
0 / 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

keycloak-user December 2014