March 2015 - keycloak-user - Jboss List Archives

(no subject)

by Alex Gouvêa Vasconcelos

Cordialmente. Alex Gouvêa Vasconcelos mailto:alexgv99@gmail.com MSN: alexgv99(a)hotmail.com http://about.me/alexgv99

9 years, 1 month

1
0
0 / 0

Customization of authentication mechanism and +

by Kalinga Dissanayake

Guys, I need to understand the capability of keycloak with my requirement and to ensure that keycloak is scalable to meet my needs. My main requirement is to integrate keycloak to our system to support SSO hence I need to migrate my existing users. My main concerns; 1/ Customize authentication method. I need to authenticate users similar to what we currently use in our production system. In our system, users are identified by username, password and the pin. For instance; User -> jack, password -> pwd, pin -> 50000 User should enter all three to login to the system. I went through the codebase and I saw that the Authentication Manager (which is a concrete class) does all the work inside keycloak. I managed to customize the frontend with ease, however, in order to support the pin in the backend seems like I have to customize the AuthenticationManager class (no direct SPIs). Although there is a link here; [ http://docs.jboss.org/keycloak/docs/1.0-beta-3/userguide/html/authenticat... ]( http://docs.jboss.org/keycloak/docs/1.0-beta-3/userguide/html/authenticat... ) I cant seem to find anything here which matches the current code base (to via a new authentication method via spis) and the example has been removed. 2/ Customize password hashes. We have our own algorithm used to store password hashes. What should I do to add this to keycloak? I do not know the current passwords of the users already in our system, so when doing the migration i need keyclock to support the current algorithm we use. Can we plugin new hashing algorithms to meet my needs? Any other issues I might face? I feel key cloak is the right choice if the above two questions are answered. Please let me know.

9 years, 1 month

5
21
0 / 0

Compiled binaries

by Adil Arif

Hello, I am learning to hack on Keycloak. I am able to pull down the master code and compile it with Maven. However, I am unable to find where the compiled binaries are placed for keycloak-appliance-dist-all-******.zip or keycloak-war-dist-all-*****.zip after running `mvn package`. Thank you! Adil Arif

9 years, 1 month

2
1
0 / 0

Using KeyCloak Proxy with Saml/OpenId-Connect Protocols

by Lohitha Chiranjeewa

Hi, I have been trying to use the KeyCloak proxy to authorize my client application. In the application configurations, I have the option of setting the 'Client Protocol' to be either 'Saml' or 'OpenId-connect'. Although I have set it to both the options in my tests, I received the same response. It included 17 headers, which had KEYCLOAK_ACCESS_TOKEN, KEYCLOAK_SUBJECT, KEYCLOAK_USERNAME among others. No other useful information were included. My question is, what is the difference I am supposed to expect in the responses between Saml and OpenId-Connect protocols? If I get a valid Saml response (XML), where is it exactly located? Thanks!

9 years, 1 month

2
2
0 / 0

Admin's password override

by Juraci Paixão Kröhling

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 All, While it makes sense to ship with a default password for the admin user on Keycloak distributions, as it's reasonable to think that the admin is going to explore Keycloak right away, this expectation is not true for the situation where Keycloak is embedded into another product. I can imagine that the first time an "admin" will need to log into Keycloak's admin console when embedded into another product would be days/weeks after the initial setup. That said, I'm collecting ideas on how to solve this issue for Hawkular. The first and most intuitive solution I can think of is to import an users JSON file on the first boot, which would (in theory, I haven't tested) override the password for admin. This password would need to be stored in clear text somewhere in the system, but I believe the pros/cons are worth on this scenario (as this password will be valid only until the first login, so, days/weeks "only"). Do you have better ideas? Or feedback on whether the mentioned approach would/wouldn't work? Or strong arguments against doing that? - - Juca. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQEcBAEBAgAGBQJVCFuSAAoJEDnJtskdmzLMAWkH/juBqh3DlgQXPjU5CNubRzvI yst+2RhbESlMBxtcB+zXKLONbaiGOhdxdoAvg6qIq69WYZyYzYHEOFPMBLdZiN5D TZnNaGrBfsoJoMPmkNIs4YTJal8Gf3BRXrnRVjfIRI6D8TUpf+yVVEtd6/eGlajX tjTFWk7RgxmaNqPIaiBQONg1Ycx1GfE2NjSIo0CXcb13xix1Z/T2XzufTj8zGQru YiToATcX1kM27E3SgUax52pD9CtnQFrfkh7EeZsVciMM8yB/Fw0BAqSVxpBwza9b a7T5uynnk4AXxm4ZLFiclkqywgRpeeNpuhUngX1+02S8KlialFe+58CtXhjRPYs= =eea0 -----END PGP SIGNATURE-----

9 years, 1 month

3
6
0 / 0

XML tag name for "enable-basic-auth" in keycloak.json

by Guy Davis

Good day, I've been able to enable basic authentication when using a keycloak.json file placed into WEB-INF of my test war file. However, in other testing, I have a preference to use the standalone.xml tag configuration for the realm and each secured war. I get errors trying to place <enable-basic-auth>true</enable-basic-auth> tag within a <secure-deployment> tag. I'm testing against master built locally within the past few days. Looking at org.keycloak.subsystem.extension.SecureDeploymentDefinition it seems like this syntax is correct. This configuration file syntax is failing to start JBoss EAP 6.1.0alpha with: Caused by: javax.xml.stream.XMLStreamException: Unknown secure-deployment tag enable-basic-auth at org.keycloak.subsystem.extension.KeycloakSubsystemParser.readDeployment(KeycloakSubsystemParser.java:108) Thanks in advance, Guy

9 years, 1 month

2
2
0 / 0

Re: [keycloak-user] WS-Federation capability for SSO

by Randall_Theobald＠dell.com

Any response to my note below? Just looking if it is on the roadmap. Thanks. Randall Theobald Common Engineering - Performance Dell Software Group | Office of the CTO randall_theobald at dell.com<mailto:randall_theobald@dell.com> | RR1-C336 From: Theobald, Randall Sent: Monday, March 02, 2015 2:54 PM To: 'keycloak-user(a)lists.jboss.org' Subject: WS-Federation capability for SSO Hi, We're looking to use Keycloak capabilities to enable SSO between some systems. Does Keycloak have a timeline to support the following? * WS-Federation (passive) protocol * WS-Federation wrapped JSON Web Tokens (JWT) * WS-Trust + JWT Thanks, Randall Theobald Common Engineering - Performance Dell Software Group | Office of the CTO randall_theobald at dell.com<mailto:randall_theobald@dell.com> | RR1-C336

9 years, 1 month

3
2
0 / 0

Keycloak token and refresh token

by Emil Posmyk

Hi all I did some research about refreshing the tokens and now I know how to do this, but more important question is how should I use it. For example: when we have an object AccessTokenResponse then we can use token (String) or refresh token (this is used also for logout), first will be active eg: 5 minuts, but refresh token will be active forever (there is no expiration time if I understood correctly). But should I use refresh token to authenticate application or maybe only token with expiration should be used ? Other case is that I have a method for getting a map with access token. I used for that refresh token to get it. This access token now should be used as a new token and it is right way ? *regards* *--* *Emil Posmyk*

9 years, 1 month

2
1
0 / 0

SAML claim/user attribute mapping from LDAP integration

by Randall_Theobald＠dell.com

I am currently using Keycloak 1.1.0.Final, trying to enable SSO between two apps with an Active Directory user store. I have keycloak connected to the AD directly in my realm and have sync'ed the users. I can successfully login in to one of my apps. However, the other app requires an 'email' claim, which is missing. It looks like the AD uses just 'mail'. Is there any way to make this simple claim mapping in keycloak? Randall Theobald Common Engineering - Performance Dell Software Group | Office of the CTO randall_theobald at dell.com<mailto:randall_theobald@dell.com> | RR1-C336

9 years, 1 month

2
2
0 / 0

Getting Error! not found when selecting an application or role

by Marcel Koster

Good afternoon, I am using the keycloak 1.1.0-Final standalone in a fresh installation and I am receiving an "Error! Not found" when I select an application or a role which I just created. I checked the mongo database that I use and everything seems to be okay. Met vriendelijke groeten, Marcel Koster [image: Tizin] 0642044604 *Peizerstate* <http://www.twitter.com/TizinMobile> koster(a)tizin.nl Peizerweg 87A www.tizin.nl 9727AH Groningen

9 years, 1 month

2
2
0 / 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

keycloak-user March 2015