June 2016 - keycloak-user - Jboss List Archives

by Thomas Raehalme

Hi! Has anyone encountered any problems with a JavaScript client running on Internet Explorer? It seems that IE applies some restrictions regarding <iframe /> and cookies. Unless the Keycloak server in question returns a P3P header, IE does not allow any cookies to be set by Keycloak inside the <iframe> on a JavaScript client. Here's Microsoft's blog post regarding the issue: https://blogs.msdn.microsoft.com/ieinternals/2013/09/17/a-quick-look-at-p3p/ If I have understood correctly IE doesn't really care about the header's value as long as it has been set. For example Google returns: P3P: CP="This is not a P3P policy! See https://www.google.com/support/accounts/answer/151657?hl=en for more info." What do you think, should Wildfly in the Keycloak distribution add the P3P header by default? Best regards, Thomas

9 years, 1 month

4
18
0 / 0

External Username, Password, Email... dataset with Keycloak

by Reed Lewis

Hi, We are examining KeyCloak (It looks like it can do what we want), but we have the need to have an external lookup of accounts who are not in KeyCloak in an external database which is accessible via a REST call. I know about federation, but would prefer to only check the external datasource if the user is not in KeyCloak, but from then on have all the data “live” in KeyCloak and never refer to the external datasource again once the account is “migrated” into KeyCloak. Can this be done with some modification of federation? We do not want to add the user accounts directly into KeyCloak as there are many more there than will ever be in KeyCloak. Thank you, Reed Lewis

9 years, 2 months

4
16
0 / 0

Redirect Issue with keycloak behind proxy and app behind Keycloak security proxy

by Guy Bowdler

hi all, We have the following set up with two DMZ boxes, one running a single KeyCloak security proxy and sending requests to a local NGINX proxy which farms out requests to internal applications. This should allow us to maintain a single namespace for all applications (<hostname>/appname redirects to appname.local) and gives authenticated visibility of who's accessing what at the front end proxy. DMZ: [KeyCloakSecProxy:80 ---> NGINX:8080] ---> TRUST: [Various applications] ---> TRUST: [Various applications] Keycloak runs on its own server and is published via an NGINX proxy in the DMZ DMZ: [NGINX:80] ---> TRUST: [Keycloak:8080] So clients hit the KeyCloak security Proxy, are redirected to KeyCloak and then after logging in, we get an "invalid Redirect URI" error from Keycloak. We've found that for some reason, the redirect URL from KeyCloak is appending the :8080 port value from the KeyCloak Security proxy (verified as if we change this port number, the value changes in the redirect URL). It's like KeyCloak is redirecting back to the NGINX:8080 proxy direct rather than back to the KeyCloak security proxy, which is what we were expecting. This is possibly by design, or possibly a bug, or possibly a side effect of our configuration. Has anyone tried using the KeyCloak security proxy in this manner? It's clear that the intended use is as a single instance adapter for a single local application, whereas our application happens to be an nginx proxy redirecting to different applications using location directives.

9 years, 5 months

3
4
0 / 0

Allow google login without reauthentication

by Harits Elfahmi

Hello, Currently we use google login using the identity provider in keycloak. The first broker login states that we must verify existing account and then reauthenticate using user password form. Is it possible to use the already available executions/flows and skip the reauthentication part? So if the google email already exist in a keycloak account, we allow them to login without the form. Or must we create a custom execution? Is it possible using custom execution? Thanks -- Cheers, *Harits* Elfahmi

9 years, 7 months

2
3
0 / 0

Getting 401 if trying to access app via loadbalancer

by KASALA Štefan

Hello, we have installed JBoss Overlord Rtgov 2.1.0 which is using Keycloak 1.2.0.Beta1. It is running on JBoss EAP 6.3, I will name it with hostname app01. We have a load balancer under another hostname lbapp in front of the deployed app. I am able to call the rest interface of RtGov directly on machine app01 but not using lbapp, I get 401 - Unauthorized from Keycloak. My guess is there is some check against hostname in http request. Is there some possibility to register aliases with the keycloak to enable calls via load balancer? Thanks. Stefan Kasala ________________________________ Táto správa je určená iba pre uvedeného príjemcu a môže obsahovať dôverné alebo interné informácie. Ak ste ju omylom obdržali, upovedomte o tom prosím odosielateľa a vymažte ju. Akýkoľvek iný spôsob použitia tohto e-mailu je zakázaný. This message is for the designated recipient only and may contain confidential or internal information. If you have received it in error, please notify the sender immediately and delete the original. Any other use of the e-mail by you is prohibited.

9 years, 7 months

3
6
0 / 0

Token generation: possibilities to improve performance

by Matuszak, Eduard

Hello Motivated by considerations on how to improve the performance of the token generation process I have two questions: - I noticed that Keycloak's token generation via endpoint "auth/realms/ccp/protocol/openid-connect/token" generates a triple of tokens (access-, refresh- and id-token). Is there any possibility to dispense with the id-token generation? - Is there a possibility to cause Keycloak to generate more "simple" bearer tokens then complex jwt-tokens? Best regards, Eduard Matuszak

9 years, 9 months

6
12
0 / 0

Re: [keycloak-user] Keycloak single sign on with Keberos(AD)

by Marek Posolda

||Adding list back again for tracking (Ray, please use "Reply all" when reply to the mails). From my googling, it seems that DefectiveTokenDetected can happen for NTLM requests as well. Btv. I found some tips on StackOverflow how to prevent use NTLM instead of Kerberos5 http://stackoverflow.com/questions/2973355/defective-token-deteced-error-... . Maybe something from those will help: - Use different machines for client (browser) and keycloak server - Ensure both machines are in windows domain - Use some different encryptions in kerberos client file. ( krb5.ini ) file. The post mentions "arcfour-hmac-md5" however the post is 6 years old :) Still it might help to add/remove some encryptions from krb5.ini file and check if client machine and IE will use krb5 ticket instead of NTLM - Fix DNS records or "SPN records" (I don't have a clue what it is :) So see post for more details) Marek On 29/06/16 16:41, Zhou, Limin (Ray) wrote: > > Marek > > I sent you two log files yesterday via two emails, I am able to see > your analysis(such OID etc.) from the first log, but not the second > logs, in the second log we were getting GSSException instead of the > hand shake message, I am wondering why it likes this, and are they > the same thing regarding my issues? > > Sorry to disturb you again > > Raymond > > P.S I have attached the two logs again for you to reference > > *From:*Zhou, Limin (Ray) > *Sent:* Wednesday, June 29, 2016 10:18 AM > *To:* 'Marek Posolda' > *Subject:* RE: [keycloak-user] Keycloak single sign on with Keberos(AD) > > Marek > > Thank you so much for your analysis, I am wondering whether you can > tell me how you mapped your diagnose with the server.log line#? I > think this will help us more when we tuning either our bowser and > domain setting, because I cannot see any 401 heading, first OID, the > KRB5 OLD from the log file > > Really appreciate your help > > Raymond > > *From:*Marek Posolda [mailto:mposolda@redhat.com] > *Sent:* Wednesday, June 29, 2016 4:01 AM > *To:* Zhou, Limin (Ray) > *Cc:* keycloak-user(a)lists.jboss.org <mailto:keycloak-user@lists.jboss.org> > *Subject:* Re: [keycloak-user] Keycloak single sign on with Keberos(AD) > > Hi Raymond, > > returning keycloak-user list back for tracking purposes. > > What I can see in the server.log is happening is that: > - Keycloak ask browser to send SPNEGO token (by sending 401 with > "WWW-Authenticate: Negotiate" header). So far everything as expected > - Browser replies with SPNEGO token, however it uses NTLM as the > preferred choice ( First OID is 1.3.6.1.4.1.311.2.2.10 ) together with > NTLM token. The KRB5 OID ( 1.2.840.113554.1.2.2 ) is in the supported > mechanisms too. > - Keycloak replies with NegTokenTarg token when it's asking for > sending SPNEGO token backed by KRB5 instead of NTLM (as Keycloak > doesn't understant NTLM atm. There is related discussion on > keycloak-user > http://lists.jboss.org/pipermail/keycloak-user/2016-June/006758.html ) > - Browser doesn't respond to NegTokenTarg with SPNEGO+KRB5 token anymore > > Not sure what are your possibilities TBH. Either somehow setup browser > to reply to second request with NegTokenTarg and send SPNEGO+KRB5 > token. Or re-configure your Windows domain (or client machines + > browser) to skip using NTLM. Right now, I don't have any clue how to > do that TBH. > > Marek > > On 28/06/16 21:58, Zhou, Limin (Ray) wrote: > > Hi Marek > > If you haven’t looked at my previous server.log, then use this one > instead, in this log we were getting an exception > > *GSSException: Defective token detected (Mechanism level: > GSSHeader did not find the right tag)* > > When we hit the url, maybe this will make things easier > > Please let me know if you need anything more > > Thanks a lot > > Raymond > > *From:*Zhou, Limin (Ray) > *Sent:* Tuesday, June 28, 2016 10:00 AM > *To:* 'Marek Posolda' > *Subject:* RE: [keycloak-user] Keycloak single sign on with > Keberos(AD) > > Hi Marek > > I have attached my keycloak server log to you, after adding the > two properties, we can see an exception shows up when I hitting > my url, after the exception, I think the default keycloak login > page shows up, and rest of the log were generated by my manual login > > Hope this can give us some clue > > Thanks a lot > > Raymond > > *From:*Marek Posolda [mailto:mposolda@redhat.com] > *Sent:* Tuesday, June 28, 2016 1:43 AM > *To:* Zhou, Limin (Ray) > *Subject:* Re: [keycloak-user] Keycloak single sign on with > Keberos(AD) > > Thanks Raymond, > > is it possible to also enable the system properties > |-Dsun.security.krb5.debug=true| and > |-Dsun.security.spnego.debug=true and see if there are some more > details in the log? You can add system properties either directly > to standalone/configuration/standalone.xml file or by adding them > to java opts in bin/standalone.conf| > > |Thanks,| > |Marek| > > On 27/06/16 23:18, Zhou, Limin (Ray) wrote: > > Hello Marek > > Thanks for answering my post, following are the log piece > after hitting the first page, hope this helps. > > Please let me know if you need anything more > > Thank you so much > > Raymond > > 2016-06-27 17:11:13,453 INFO [stdout] (default task-24) Debug > is true storeKey true useTicketCache false useKeyTab true > doNotPrompt true ticketCache is null isInitiator false KeyTab > is C:\FIRMS-domain\kcsso.keytab refreshKrb5Config is false > principal is > HTTP/t430-pbdc41e.monad.moneris.com(a)MONAD.MONERIS.COM > <mailto:HTTP/t430-pbdc41e.monad.moneris.com@MONAD.MONERIS.COM> > tryFirstPass is false useFirstPass is false storePass is false > clearPass is false > > 2016-06-27 17:11:13,453 INFO [stdout] (default task-24) > principal is > HTTP/t430-pbdc41e.monad.moneris.com(a)MONAD.MONERIS.COM > <mailto:HTTP/t430-pbdc41e.monad.moneris.com@MONAD.MONERIS.COM> > > 2016-06-27 17:11:13,453 INFO [stdout] (default task-24) Will > use keytab > > 2016-06-27 17:11:13,453 INFO [stdout] (default task-24) > Commit Succeeded > > 2016-06-27 17:11:13,453 INFO [stdout] (default task-24) > > 2016-06-27 17:11:13,454 INFO [stdout] (default task-24) > [Krb5LoginModule]: Entering logout > > 2016-06-27 17:11:13,454 INFO [stdout] (default task-24) > [Krb5LoginModule]: logged out > Subject > > *From:*Marek Posolda [mailto:mposolda@redhat.com] > *Sent:* Monday, June 27, 2016 5:55 AM > *To:* Zhou, Limin (Ray); keycloak-user(a)lists.jboss.org > <mailto:keycloak-user@lists.jboss.org> > *Subject:* Re: [keycloak-user] Keycloak single sign on with > Keberos(AD) > > It may help if you enable all the possible debug/trace logging > and post the log here. This may give more info what is the > issue. See docs how to enable logging : > https://keycloak.gitbooks.io/server-adminstration-guide/content/v/2.0/top... > > Try to send the log from the point once you trigger the > authentication request (or from the point when you hit your > app URL) > > Thanks, > Marek > > On 24/06/16 20:22, Zhou, Limin (Ray) wrote: > > Hello everyone > > I am new to Keycloak and new to here > > Our web application is running on Jboss EAP 7, We have > configured KeyCloak standalone server 1.9.7 running on > different port(same server box) to manage the user > authentication and authorization, behind KeyCloak we have > configured Keberos in User Federation to talk our company > AD server, we are able to login by using our AD account, > but not in single sign on way, each time when we hitting > the our app URL, the Keycloak login page will show up. > > It looks like the TGT or ST hand shake was not successful, > is there any document I can reference it to debug the issue? > > Any comments or suggestion would be very welcome > > thanks in advance > > raymond > > ------------------------------------------------------------------------ > > Moneris Solutions Corporation | 3300 Bloor Street West | > Toronto | Ontario | M8X 2X2 | Canada www.moneris.com > <http://www.moneris.com> 1-866-319-7450 > If you wish to unsubscribe from future updates from > Moneris, please click here > <https://www.moneris.com/en/About-Moneris/Contact-Moneris/Unsubscribe.aspx>. > Please see the Moneris Privacy Policy here > <http://www.moneris.com/Home/Legal/Website-Policies/Privacy-Policy.aspx>. > > > This e-mail may be privileged and/or confidential, and the > sender does not waive any related rights and obligations. > Any distribution, use or copying of this e-mail or the > information it contains by other than an intended > recipient is unauthorized. If you received this e-mail in > error, please advise me (by return e-mail or otherwise) > immediately. > > ------------------------------------------------------------------------ > > Corporation Solutions Moneris | 3300, rue Bloor Ouest | > Toronto | Ontario | M8X 2X2 | Canada www.moneris.com > <http://www.moneris.com> 1-866-319-7450 > Si vous désirez enlever votre nom de la liste d’envoi de > Moneris, veuillez cliquer ici > <https://www.moneris.com/about-moneris/contact-moneris/unsubscribe?sc_lang...>. > Veuillez consulter la Politique de confidentialité de > Moneris ici > <http://www.moneris.com/Home/Legal/Website-Policies/Privacy-Policy.aspx?sc...>. > > > Ce courriel peut contenir des renseignements confidentiels > ou privilégiés, et son expéditeur ne renonce à aucun droit > ni à aucune obligation connexe. La distribution, > l’utilisation ou la reproduction du présent courriel ou > des renseignements qu’il contient par une personne autre > que son destinataire prévu sont interdites. Si vous avez > reçu ce courriel par erreur, veuillez m’en aviser > immédiatement (par retour de courriel ou autrement). > > > _______________________________________________ > > keycloak-user mailing list > > keycloak-user(a)lists.jboss.org > <mailto:keycloak-user@lists.jboss.org> > > https://lists.jboss.org/mailman/listinfo/keycloak-user > > ------------------------------------------------------------------------ > > Moneris Solutions Corporation | 3300 Bloor Street West | > Toronto | Ontario | M8X 2X2 | Canada www.moneris.com > <http://www.moneris.com> 1-866-319-7450 > If you wish to unsubscribe from future updates from Moneris, > please click here > <https://www.moneris.com/en/About-Moneris/Contact-Moneris/Unsubscribe.aspx>. > Please see the Moneris Privacy Policy here > <http://www.moneris.com/Home/Legal/Website-Policies/Privacy-Policy.aspx>. > > > This e-mail may be privileged and/or confidential, and the > sender does not waive any related rights and obligations. Any > distribution, use or copying of this e-mail or the information > it contains by other than an intended recipient is > unauthorized. If you received this e-mail in error, please > advise me (by return e-mail or otherwise) immediately. > > ------------------------------------------------------------------------ > > Corporation Solutions Moneris | 3300, rue Bloor Ouest | > Toronto | Ontario | M8X 2X2 | Canada www.moneris.com > <http://www.moneris.com> 1-866-319-7450 > Si vous désirez enlever votre nom de la liste d’envoi de > Moneris, veuillez cliquer ici > <https://www.moneris.com/about-moneris/contact-moneris/unsubscribe?sc_lang...>. > Veuillez consulter la Politique de confidentialité de Moneris > ici > <http://www.moneris.com/Home/Legal/Website-Policies/Privacy-Policy.aspx?sc...>. > > > Ce courriel peut contenir des renseignements confidentiels ou > privilégiés, et son expéditeur ne renonce à aucun droit ni à > aucune obligation connexe. La distribution, l’utilisation ou > la reproduction du présent courriel ou des renseignements > qu’il contient par une personne autre que son destinataire > prévu sont interdites. Si vous avez reçu ce courriel par > erreur, veuillez m’en aviser immédiatement (par retour de > courriel ou autrement). > > ------------------------------------------------------------------------ > > Moneris Solutions Corporation | 3300 Bloor Street West | Toronto | > Ontario | M8X 2X2 | Canada www.moneris.com > <http://www.moneris.com> 1-866-319-7450 > If you wish to unsubscribe from future updates from Moneris, > please click here > <https://www.moneris.com/en/About-Moneris/Contact-Moneris/Unsubscribe.aspx>. > Please see the Moneris Privacy Policy here > <http://www.moneris.com/Home/Legal/Website-Policies/Privacy-Policy.aspx>. > > > This e-mail may be privileged and/or confidential, and the sender > does not waive any related rights and obligations. Any > distribution, use or copying of this e-mail or the information it > contains by other than an intended recipient is unauthorized. If > you received this e-mail in error, please advise me (by return > e-mail or otherwise) immediately. > > ------------------------------------------------------------------------ > > Corporation Solutions Moneris | 3300, rue Bloor Ouest | Toronto | > Ontario | M8X 2X2 | Canada www.moneris.com > <http://www.moneris.com> 1-866-319-7450 > Si vous désirez enlever votre nom de la liste d’envoi de Moneris, > veuillez cliquer ici > <https://www.moneris.com/about-moneris/contact-moneris/unsubscribe?sc_lang...>. > Veuillez consulter la Politique de confidentialité de Moneris ici > <http://www.moneris.com/Home/Legal/Website-Policies/Privacy-Policy.aspx?sc...>. > > > Ce courriel peut contenir des renseignements confidentiels ou > privilégiés, et son expéditeur ne renonce à aucun droit ni à > aucune obligation connexe. La distribution, l’utilisation ou la > reproduction du présent courriel ou des renseignements qu’il > contient par une personne autre que son destinataire prévu sont > interdites. Si vous avez reçu ce courriel par erreur, veuillez > m’en aviser immédiatement (par retour de courriel ou autrement). > > ------------------------------------------------------------------------ > Moneris Solutions Corporation | 3300 Bloor Street West | Toronto | > Ontario | M8X 2X2 | Canada www.moneris.com 1-866-319-7450 > If you wish to unsubscribe from future updates from Moneris, please > click here > <https://www.moneris.com/en/About-Moneris/Contact-Moneris/Unsubscribe.aspx>. > Please see the Moneris Privacy Policy here > <http://www.moneris.com/Home/Legal/Website-Policies/Privacy-Policy.aspx>. > > This e-mail may be privileged and/or confidential, and the sender does > not waive any related rights and obligations. Any distribution, use or > copying of this e-mail or the information it contains by other than an > intended recipient is unauthorized. If you received this e-mail in > error, please advise me (by return e-mail or otherwise) immediately. > ------------------------------------------------------------------------ > Corporation Solutions Moneris | 3300, rue Bloor Ouest | Toronto | > Ontario | M8X 2X2 | Canada www.moneris.com 1-866-319-7450 > Si vous désirez enlever votre nom de la liste d’envoi de Moneris, > veuillez cliquer ici > <https://www.moneris.com/about-moneris/contact-moneris/unsubscribe?sc_lang...>. > Veuillez consulter la Politique de confidentialité de Moneris ici > <http://www.moneris.com/Home/Legal/Website-Policies/Privacy-Policy.aspx?sc...>. > > > Ce courriel peut contenir des renseignements confidentiels ou > privilégiés, et son expéditeur ne renonce à aucun droit ni à aucune > obligation connexe. La distribution, l’utilisation ou la reproduction > du présent courriel ou des renseignements qu’il contient par une > personne autre que son destinataire prévu sont interdites. Si vous > avez reçu ce courriel par erreur, veuillez m’en aviser immédiatement > (par retour de courriel ou autrement).

9 years, 9 months

2
1
0 / 0

Obtaining full profile from "userinfo" endpoint

by Brian Watson

Hi all, Keycloak version: 1.9.8 Here is my use case: I want to keep the access token JWS as lean as possible, only containing user roles and a few custom claims I have added. I want no PII in the access token. However, I would like my internal services to obtain the full user profile (name, email, etc...) from the OIDC "/userinfo" endpoint. Unfortunately, I can only seem to obtain the "sub" claim and the few custom claims that already exist in the access token. I don't see any support for adding scope values to the request. Is there any way to accomplish what I would like, or any other ways of obtaining this info that I may be missing? Thanks in advance

9 years, 9 months

3
7
0 / 0

MDC log messages not showing up

by Scott Rossillo

I’m trying to use a use the Mapped Diagnostic Context (MDC) on org.jboss.logging.MDC to register a custom header for logging. I’m populating the MDC from an Undertow HttpHandler. This part is working, however, the value set in the MDC is never logged. I’m using %X{MDC_KEY} in standalone.xml. Does anyone know why MDC values aren’t logged? Scott Rossillo Smartling | Senior Software Engineer srossillo(a)smartling.com

9 years, 10 months

2
1
0 / 0

Keycloak and Salesforce IdP identity brokering

by Peter Nalyvayko

Hello, I am trying to integrate keycloak and Salesforce using Salesforce as an identity provider. It seems some of the information required to properly set up the Salesforce as SAML IdP is missing in the keycloak's SAML identity provider configuration. For example, "Entity Id", according to the Salesforce documentation, is "This value comes from the service provider. Each entity ID in an organization must be unique. If you’re accessing multiple apps from your service provider, you only need to define the service provider once, and then use the RelayState parameter to append the URL values to direct the user to the correct app after signing in." (https://help.salesforce.com/HTViewHelpDoc?id=service_provider_define.htm&...). The SAML identity provider configuration in keycloak does not have a setting to specify "Entity Id". Another missing attribute is "ACS URL" (The ACS, or assertion consumer service, URL comes from the SAML service provider.). Has anyone been able to set up Salesforce as IdP and keycloak as SP using keycloak's SAML identity provider? Is this even possible given that some required parameters are missing?ThxPeter

9 years, 10 months

1
1
0 / 0

Searching on Keycloak mailing list archive

by Rafael T. C. Soares

How can I search for something on keycloak mailing lists archive? It appears keycloak lists are not indexed by JBoss Community Search engine [1][2] [1] http://search.jboss.org [2] https://developer.jboss.org/wiki/JBossCommunitySearchFAQ -- ___ Rafael T. C. Soares | Solution Architect JBoss Enterprise Middleware | Red Hat Brazil Mobile: +55 71 98181-3636 Phone: +55 11 3529-6096

9 years, 10 months

4
8
0 / 0

Mongo and 2.0.0.Final

by John Bartko

Hello all, I get the following stack trace attempting to use 2.0.0.Final against a MongoDB backend. Following the keycloak-mongo <https://github.com/jboss-dockerfiles/keycloak/tree/master/server-mongo> readme should reproduce the behavior. 21:58:31,802 ERROR [org.jboss.msc.service.fail] (ServerService Thread Pool -- 47) MSC000001: Failed to start service jboss.undertow.deployment.default-server.default-host./auth: org.jboss.msc.service.StartException in service jboss.undertow.deployment.default-server.default-host./auth: java.lang.RuntimeException: RESTEASY003325: Failed to construct public org.keycloak.services.resources.KeycloakApplication(javax.servlet.ServletContext,org.jboss.resteasy.core.Dispatcher) at org.wildfly.extension.undertow.deployment.UndertowDeploymentService$1.run(UndertowDeploymentService.java:85) at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511) at java.util.concurrent.FutureTask.run(FutureTask.java:266) at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) at java.lang.Thread.run(Thread.java:745) at org.jboss.threads.JBossThread.run(JBossThread.java:320) Caused by: java.lang.RuntimeException: RESTEASY003325: Failed to construct public org.keycloak.services.resources.KeycloakApplication(javax.servlet.ServletContext,org.jboss.resteasy.core.Dispatcher) at org.jboss.resteasy.core.ConstructorInjectorImpl.construct(ConstructorInjectorImpl.java:162) at org.jboss.resteasy.spi.ResteasyProviderFactory.createProviderInstance(ResteasyProviderFactory.java:2209) at org.jboss.resteasy.spi.ResteasyDeployment.createApplication(ResteasyDeployment.java:299) at org.jboss.resteasy.spi.ResteasyDeployment.start(ResteasyDeployment.java:240) at org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.init(ServletContainerDispatcher.java:113) at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.init(HttpServletDispatcher.java:36) at io.undertow.servlet.core.LifecyleInterceptorInvocation.proceed(LifecyleInterceptorInvocation.java:117) at org.wildfly.extension.undertow.security.RunAsLifecycleInterceptor.init(RunAsLifecycleInterceptor.java:78) at io.undertow.servlet.core.LifecyleInterceptorInvocation.proceed(LifecyleInterceptorInvocation.java:103) at io.undertow.servlet.core.ManagedServlet$DefaultInstanceStrategy.start(ManagedServlet.java:231) at io.undertow.servlet.core.ManagedServlet.createServlet(ManagedServlet.java:132) at io.undertow.servlet.core.DeploymentManagerImpl.start(DeploymentManagerImpl.java:526) at org.wildfly.extension.undertow.deployment.UndertowDeploymentService.startContext(UndertowDeploymentService.java:101) at org.wildfly.extension.undertow.deployment.UndertowDeploymentService$1.run(UndertowDeploymentService.java:82) ... 6 more Caused by: java.lang.RuntimeException: Property 'databaseSchema' needs to be specified in the configuration at org.keycloak.connections.jpa.DefaultJpaConnectionProviderFactory.lazyInit(DefaultJpaConnectionProviderFactory.java:131) at org.keycloak.connections.jpa.DefaultJpaConnectionProviderFactory.create(DefaultJpaConnectionProviderFactory.java:60) at org.keycloak.connections.jpa.DefaultJpaConnectionProviderFactory.create(DefaultJpaConnectionProviderFactory.java:48) at org.keycloak.services.DefaultKeycloakSession.getProvider(DefaultKeycloakSession.java:103) at org.keycloak.authorization.jpa.store.JPAAuthorizationStoreFactory.getEntityManager(JPAAuthorizationStoreFactory.java:54) at org.keycloak.authorization.jpa.store.JPAAuthorizationStoreFactory.create(JPAAuthorizationStoreFactory.java:35) at org.keycloak.authorization.jpa.store.JPAAuthorizationStoreFactory.create(JPAAuthorizationStoreFactory.java:32) at org.keycloak.services.DefaultKeycloakSession.getProvider(DefaultKeycloakSession.java:103) at org.keycloak.models.authorization.infinispan.CachedPolicyStore.getStoreFactory(CachedPolicyStore.java:193) at org.keycloak.models.authorization.infinispan.CachedPolicyStore.getDelegate(CachedPolicyStore.java:201) at org.keycloak.models.authorization.infinispan.CachedPolicyStore.findByType(CachedPolicyStore.java:179) at org.keycloak.authorization.policy.provider.drools.DroolsPolicyProviderFactory$1.onEvent(DroolsPolicyProviderFactory.java:75) at org.keycloak.services.DefaultKeycloakSessionFactory.publish(DefaultKeycloakSessionFactory.java:64) at org.keycloak.services.resources.KeycloakApplication.<init>(KeycloakApplication.java:130) at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method) at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62) at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45) at java.lang.reflect.Constructor.newInstance(Constructor.java:423) at org.jboss.resteasy.core.ConstructorInjectorImpl.construct(ConstructorInjectorImpl.java:150) ... 19 more 21:58:31,809 ERROR [org.jboss.as.controller.management-operation] (Controller Boot Thread) WFLYCTL0013: Operation ("add") failed - address: ([("deployment" => "keycloak-server.war")]) - failure description: {"WFLYCTL0080: Failed services" => {"jboss.undertow.deployment.default-server.default-host./auth" => "org.jboss.msc.service.StartException in service jboss.undertow.deployment.default-server.default-host./auth: java.lang.RuntimeException: RESTEASY003325: Failed to construct public org.keycloak.services.resources.KeycloakApplication(javax.servlet.ServletContext,org.jboss.resteasy.core.Dispatcher) Caused by: java.lang.RuntimeException: RESTEASY003325: Failed to construct public org.keycloak.services.resources.KeycloakApplication(javax.servlet.ServletContext,org.jboss.resteasy.core.Dispatcher) Caused by: java.lang.RuntimeException: Property 'databaseSchema' needs to be specified in the configuration"}} Any thoughts? Thanks, -John Bartko

9 years, 10 months

3
3
0 / 0

how get info from adapterConfig

by LIEVRE Olivier

Hello, I've secured a REST server with keycloak 1.9.7, and I would like to implement a public REST GET method for an non-authenticated user to get the adapderConfig info linked to my war. My war adapter is configured in my standalone.xml. Is there an easy way to read the adapterConfig info from standalone in that case? When a user makes an authenticated request, I can get that info with getting RefreshableKeycloakSecurityContext from httprequest. KR, Olivier

9 years, 10 months

3
2
0 / 0

Hardcoded Role Mapper Problem

by Jérôme Blanchard

Hi, I use a Role Mapper on an Identity Provider but it's not working as expected : - If the account does not exists and Identity Provider Auth is used to create a new account, Role is applied to the newly created keycloak account. - But if an account already exists and that I use the Identity Provider Association, the Role is not applied to the already existing keycloak account and the mapper has no effect, leaving the account in a unconsistent state for me... Is it a normal behaviour, is it fixed in latest releases (I use 1.7.0) ?? Thanks, Jérôme.

9 years, 10 months

2
2
0 / 0

Keycloak 2.0.0.Final released

by Stian Thorgersen

Keycloak 2.0.0.Final has just been released. This release only contains some minor fixes since 2.0.0.CR1. For the full list of resolved issues check out JIRA <https://issues.jboss.org/issues/?jql=project%20%3D%20keycloak%20and%20fix...> and to download the release go to the Keycloak homepage <http://www.keycloak.org/downloads>. Before you upgrade refer to the migration guide <https://keycloak.gitbooks.io/server-adminstration-guide/content/v/2.0/top...> .

9 years, 10 months

1
0
0 / 0

Stian: Continuation of Memory Leak Investigation

by Chris Hairfield

*My replies started bouncing; guess I sent too many pictures ;)* I'd be perfectly happy with that throughput. What other parameters did you run it under? JAVA_OPTS: "-server -Xms1g -Xmx4g -XX:MetaspaceSize=96M -XX:MaxMetaspaceSize=256m -Djava.net.preferIPv4Stack=true -Djboss.modules.system.pkgs=org.jboss.byteman -Djava.awt.headless=true -XX:+UseParallelGC -XX:ParallelGCThreads=4" Run command: bin/standalone.sh -c standalone.xml My standalone.xml: <cache-container name="keycloak" jndi-name="infinispan/Keycloak"> <local-cache name="realms"/> <local-cache name="users"> <eviction max-entries="10000" strategy="LRU"/> </local-cache> <local-cache name="sessions"/> <local-cache name="offlineSessions"/> <local-cache name="loginFailures"/> <local-cache name="work"/> <local-cache name="realmVersions"> <transaction mode="BATCH" locking="PESSIMISTIC"/> <eviction max-entries="10000" strategy="LRU"/> </local-cache> </cache-container> You can see memory starting to thrash at a higher rate (up to 1.4 GB). I only created 22k users in this test.

9 years, 10 months

2
2
0 / 0

Karaf Features problem

by Ygor Castor

I'm trying to install the keycloak adapter at Karaf 4.0.5, but i'm running in some problems, this one i'm not being able to solve: karaf@root()> feature:install keycloak-adapter-core Error executing command: Unable to resolve root: missing requirement [root] osgi.identity; osgi.identity=keycloak-adapter-core; type=karaf.feature; version="[2.0.0.CR1,2.0.0.CR1]"; filter:="(&(osgi.identity=keycloak-adapter-core)(type=karaf.feature)(version>=2.0.0.CR1)(version<=2.0.0.CR1))" [caused by: Unable to resolve keycloak-adapter-core/2.0.0.CR1: missing requirement [keycloak-adapter-core/2.0.0.CR1] osgi.identity; osgi.identity=org.keycloak.keycloak-adapter-core; type=osgi.bundle; version="[2.0.0.CR1,2.0.0.CR1]"; resolution:=mandatory [caused by: Unable to resolve org.keycloak.keycloak-adapter-core/2.0.0.CR1: missing requirement [org.keycloak.keycloak-adapter-core/2.0.0.CR1] osgi.wiring.package; filter:="(&(osgi.wiring.package=org.keycloak.authorization.client)(version>=2.0.0.CR1))"]] It seems that the feature can't find the "org.keycloak.authorization" bundle, how can i fix this?

9 years, 10 months

3
4
0 / 0

Disallow Join via OAuth?

by Chris Hairfield

I don't expect this is possible, but does anyone know whether one can prevent new account creation when Identity Brokering with Facebook and Google while still allowing sign-in? We are attempting to migrate our legacy IDM solution to Keycloak slowly and wish, for the time being, for all new account creation to still go through the legacy app. We have HAProxy in front of Keycloak. Is there a way to redirect users attempting to join via Facebook or Google to our legacy join page?

9 years, 10 months

2
2
0 / 0

keycloak-nodejs-connect with Express routes

by Scott Rossillo

Hey, I’m trying to register the NodeJS Keycloak Connect (0.22) with Express routes, such as: var foo = require('./routes/foo’); app.use(‘/foo’, foo); The problems are: 1. Adding the Keycloak protect middleware with "app.use(‘foo’, keycloak.protect(), foo)” causes infinite redirects 2. It can’t be registered in the route javascript file because keycloak.protect() expects the already initialized keycloak function. When dealing with large applications, it’s not feasible to register all routes in the main Express file. Any pointers or am I missing something? Thanks in advance, Scott Scott Rossillo Smartling | Senior Software Engineer srossillo(a)smartling.com

9 years, 10 months

2
3
0 / 0

Keycloak dies every few days for high memory usage

by afroufeq

Victor has post this question in StackOverflow. http://serverfault.com/questions/786895/keycloak-dies-every-few-days-for-... Does anyone know the answer? Cheers,

9 years, 10 months

2
1
0 / 0

Encrypted SAML response

by Pål Oliver Kristiansen

Hi! We have set up Keycloak as an IDP with a F5 BigIP APM as a SAML SP. Everything works well out of the box, but when we activate encryption of assertions, we get an error on the BigIP side. So in order to investigate the situation, I'm trying to understand the process of SAML assertion response encryption. And I am a bit confused when reading the Keycloak documentation and comparing that to what I see in the Keycloak admin console. Here is what I mean; in the documentation ( https://keycloak.github.io/docs/userguide/keycloak-server/html/saml.html), activating assertion response encryption is described like this: "Encrypt Assertions Encrypt assertions in SAML documents with the realm's private key. The AES algorithm is used with a key size of 128 bits." But in the admin console (under clients) it is described like this in the tooltip: "Encrypt Assertions Should SAML assertions be encrypted with client's public key using AES?" So basically, which key is used for encrypting the assertion response? I have inspected the actual HTTP post and it looks something like this: <samlp:Response> ... <saml:EncryptedAssertion> <xenc:EncryptedData xmlns:xenc="http://www.w3.org/2001/04/xmlenc#" Type="http://www.w3.org/2001/04/xmlenc#Element"> <xenc:EncryptionMethod Algorithm=" http://www.w3.org/2001/04/xmlenc#aes128-cbc"/> <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#"> <xenc:EncryptedKey> <xenc:EncryptionMethod Algorithm=" http://www.w3.org/2001/04/xmlenc#rsa-1_5"/> <xenc:CipherData> <xenc:CipherValue>---[block of cipher text]---</xenc:CipherValue> </xenc:CipherData> </xenc:EncryptedKey> </ds:KeyInfo> <xenc:CipherData> <xenc:CipherValue>---[block of cipher text]---</xenc:CipherValue> </xenc:CipherData> </xenc:EncryptedData> </saml:EncryptedAssertion> </samlp:Response> So it at least looks like the key to decrypt the encrypted response is included. It is encrypted using RSA, but with which key? My understanding was something like this: 1. The encryption of a SAML assertion response is done using AES-128, with some key. 2. The key is added alongside the encrypted assertion response and encrypted using the SP's public key. 3. The SP receives the encrypted assertion response and the encrypted key, decrypts the key using its' private key and uses this decrypted key to decrypt the actual assertion response. Is this generally correct? The error we get from BigIP is this: "failed to process encrypted assertion, error: RSA decrypt" Which leads me to think that maybe the decryption of the included key did not work out. Any ideas or tips to how to approach this? Thanks!

9 years, 10 months

4
5
0 / 0

Re: [keycloak-user] Keycloak single sign on with Keberos(AD)

by Marek Posolda

Hi Raymond, returning keycloak-user list back for tracking purposes. What I can see in the server.log is happening is that: - Keycloak ask browser to send SPNEGO token (by sending 401 with "WWW-Authenticate: Negotiate" header). So far everything as expected - Browser replies with SPNEGO token, however it uses NTLM as the preferred choice ( First OID is 1.3.6.1.4.1.311.2.2.10 ) together with NTLM token. The KRB5 OID ( 1.2.840.113554.1.2.2 ) is in the supported mechanisms too. - Keycloak replies with NegTokenTarg token when it's asking for sending SPNEGO token backed by KRB5 instead of NTLM (as Keycloak doesn't understant NTLM atm. There is related discussion on keycloak-user http://lists.jboss.org/pipermail/keycloak-user/2016-June/006758.html ) - Browser doesn't respond to NegTokenTarg with SPNEGO+KRB5 token anymore Not sure what are your possibilities TBH. Either somehow setup browser to reply to second request with NegTokenTarg and send SPNEGO+KRB5 token. Or re-configure your Windows domain (or client machines + browser) to skip using NTLM. Right now, I don't have any clue how to do that TBH. Marek On 28/06/16 21:58, Zhou, Limin (Ray) wrote: > > Hi Marek > > If you haven’t looked at my previous server.log, then use this one > instead, in this log we were getting an exception > > *GSSException: Defective token detected (Mechanism level: GSSHeader > did not find the right tag)*** > > When we hit the url, maybe this will make things easier > > Please let me know if you need anything more > > Thanks a lot > > Raymond > > *From:*Zhou, Limin (Ray) > *Sent:* Tuesday, June 28, 2016 10:00 AM > *To:* 'Marek Posolda' > *Subject:* RE: [keycloak-user] Keycloak single sign on with Keberos(AD) > > Hi Marek > > I have attached my keycloak server log to you, after adding the two > properties, we can see an exception shows up when I hitting my url, > after the exception, I think the default keycloak login page shows up, > and rest of the log were generated by my manual login > > Hope this can give us some clue > > Thanks a lot > > Raymond > > *From:*Marek Posolda [mailto:mposolda@redhat.com] > *Sent:* Tuesday, June 28, 2016 1:43 AM > *To:* Zhou, Limin (Ray) > *Subject:* Re: [keycloak-user] Keycloak single sign on with Keberos(AD) > > Thanks Raymond, > > is it possible to also enable the system properties > |-Dsun.security.krb5.debug=true| and |-Dsun.security.spnego.debug=true > and see if there are some more details in the log? You can add system > properties either directly to standalone/configuration/standalone.xml > file or by adding them to java opts in bin/standalone.conf| > > |Thanks,| > |Marek| > > On 27/06/16 23:18, Zhou, Limin (Ray) wrote: > > Hello Marek > > Thanks for answering my post, following are the log piece after > hitting the first page, hope this helps. > > Please let me know if you need anything more > > Thank you so much > > Raymond > > 2016-06-27 17:11:13,453 INFO [stdout] (default task-24) Debug is > true storeKey true useTicketCache false useKeyTab true doNotPrompt > true ticketCache is null isInitiator false KeyTab is > C:\FIRMS-domain\kcsso.keytab refreshKrb5Config is false principal > is HTTP/t430-pbdc41e.monad.moneris.com(a)MONAD.MONERIS.COM > <mailto:HTTP/t430-pbdc41e.monad.moneris.com@MONAD.MONERIS.COM> > tryFirstPass is false useFirstPass is false storePass is false > clearPass is false > > 2016-06-27 17:11:13,453 INFO [stdout] (default task-24) principal > is HTTP/t430-pbdc41e.monad.moneris.com(a)MONAD.MONERIS.COM > <mailto:HTTP/t430-pbdc41e.monad.moneris.com@MONAD.MONERIS.COM> > > 2016-06-27 17:11:13,453 INFO [stdout] (default task-24) Will use > keytab > > 2016-06-27 17:11:13,453 INFO [stdout] (default task-24) Commit > Succeeded > > 2016-06-27 17:11:13,453 INFO [stdout] (default task-24) > > 2016-06-27 17:11:13,454 INFO [stdout] (default task-24) > [Krb5LoginModule]: Entering logout > > 2016-06-27 17:11:13,454 INFO [stdout] (default task-24) > [Krb5LoginModule]: logged out Subject > > *From:*Marek Posolda [mailto:mposolda@redhat.com] > *Sent:* Monday, June 27, 2016 5:55 AM > *To:* Zhou, Limin (Ray); keycloak-user(a)lists.jboss.org > <mailto:keycloak-user@lists.jboss.org> > *Subject:* Re: [keycloak-user] Keycloak single sign on with > Keberos(AD) > > It may help if you enable all the possible debug/trace logging and > post the log here. This may give more info what is the issue. See > docs how to enable logging : > https://keycloak.gitbooks.io/server-adminstration-guide/content/v/2.0/top... > > Try to send the log from the point once you trigger the > authentication request (or from the point when you hit your app URL) > > Thanks, > Marek > > On 24/06/16 20:22, Zhou, Limin (Ray) wrote: > > Hello everyone > > I am new to Keycloak and new to here > > Our web application is running on Jboss EAP 7, We have > configured KeyCloak standalone server 1.9.7 running on > different port(same server box) to manage the user > authentication and authorization, behind KeyCloak we have > configured Keberos in User Federation to talk our company AD > server, we are able to login by using our AD account, but not > in single sign on way, each time when we hitting the our app > URL, the Keycloak login page will show up. > > It looks like the TGT or ST hand shake was not successful, is > there any document I can reference it to debug the issue? > > Any comments or suggestion would be very welcome > > thanks in advance > > raymond > > ------------------------------------------------------------------------ > > Moneris Solutions Corporation | 3300 Bloor Street West | > Toronto | Ontario | M8X 2X2 | Canada www.moneris.com > <http://www.moneris.com> 1-866-319-7450 > If you wish to unsubscribe from future updates from Moneris, > please click here > <https://www.moneris.com/en/About-Moneris/Contact-Moneris/Unsubscribe.aspx>. > Please see the Moneris Privacy Policy here > <http://www.moneris.com/Home/Legal/Website-Policies/Privacy-Policy.aspx>. > > > This e-mail may be privileged and/or confidential, and the > sender does not waive any related rights and obligations. Any > distribution, use or copying of this e-mail or the information > it contains by other than an intended recipient is > unauthorized. If you received this e-mail in error, please > advise me (by return e-mail or otherwise) immediately. > > ------------------------------------------------------------------------ > > Corporation Solutions Moneris | 3300, rue Bloor Ouest | > Toronto | Ontario | M8X 2X2 | Canada www.moneris.com > <http://www.moneris.com> 1-866-319-7450 > Si vous désirez enlever votre nom de la liste d’envoi de > Moneris, veuillez cliquer ici > <https://www.moneris.com/about-moneris/contact-moneris/unsubscribe?sc_lang...>. > Veuillez consulter la Politique de confidentialité de Moneris > ici > <http://www.moneris.com/Home/Legal/Website-Policies/Privacy-Policy.aspx?sc...>. > > > Ce courriel peut contenir des renseignements confidentiels ou > privilégiés, et son expéditeur ne renonce à aucun droit ni à > aucune obligation connexe. La distribution, l’utilisation ou > la reproduction du présent courriel ou des renseignements > qu’il contient par une personne autre que son destinataire > prévu sont interdites. Si vous avez reçu ce courriel par > erreur, veuillez m’en aviser immédiatement (par retour de > courriel ou autrement). > > > _______________________________________________ > > keycloak-user mailing list > > keycloak-user(a)lists.jboss.org > <mailto:keycloak-user@lists.jboss.org> > > https://lists.jboss.org/mailman/listinfo/keycloak-user > > ------------------------------------------------------------------------ > > Moneris Solutions Corporation | 3300 Bloor Street West | Toronto | > Ontario | M8X 2X2 | Canada www.moneris.com > <http://www.moneris.com> 1-866-319-7450 > If you wish to unsubscribe from future updates from Moneris, > please click here > <https://www.moneris.com/en/About-Moneris/Contact-Moneris/Unsubscribe.aspx>. > Please see the Moneris Privacy Policy here > <http://www.moneris.com/Home/Legal/Website-Policies/Privacy-Policy.aspx>. > > > This e-mail may be privileged and/or confidential, and the sender > does not waive any related rights and obligations. Any > distribution, use or copying of this e-mail or the information it > contains by other than an intended recipient is unauthorized. If > you received this e-mail in error, please advise me (by return > e-mail or otherwise) immediately. > > ------------------------------------------------------------------------ > > Corporation Solutions Moneris | 3300, rue Bloor Ouest | Toronto | > Ontario | M8X 2X2 | Canada www.moneris.com > <http://www.moneris.com> 1-866-319-7450 > Si vous désirez enlever votre nom de la liste d’envoi de Moneris, > veuillez cliquer ici > <https://www.moneris.com/about-moneris/contact-moneris/unsubscribe?sc_lang...>. > Veuillez consulter la Politique de confidentialité de Moneris ici > <http://www.moneris.com/Home/Legal/Website-Policies/Privacy-Policy.aspx?sc...>. > > > Ce courriel peut contenir des renseignements confidentiels ou > privilégiés, et son expéditeur ne renonce à aucun droit ni à > aucune obligation connexe. La distribution, l’utilisation ou la > reproduction du présent courriel ou des renseignements qu’il > contient par une personne autre que son destinataire prévu sont > interdites. Si vous avez reçu ce courriel par erreur, veuillez > m’en aviser immédiatement (par retour de courriel ou autrement). > > ------------------------------------------------------------------------ > Moneris Solutions Corporation | 3300 Bloor Street West | Toronto | > Ontario | M8X 2X2 | Canada www.moneris.com 1-866-319-7450 > If you wish to unsubscribe from future updates from Moneris, please > click here > <https://www.moneris.com/en/About-Moneris/Contact-Moneris/Unsubscribe.aspx>. > Please see the Moneris Privacy Policy here > <http://www.moneris.com/Home/Legal/Website-Policies/Privacy-Policy.aspx>. > > This e-mail may be privileged and/or confidential, and the sender does > not waive any related rights and obligations. Any distribution, use or > copying of this e-mail or the information it contains by other than an > intended recipient is unauthorized. If you received this e-mail in > error, please advise me (by return e-mail or otherwise) immediately. > ------------------------------------------------------------------------ > Corporation Solutions Moneris | 3300, rue Bloor Ouest | Toronto | > Ontario | M8X 2X2 | Canada www.moneris.com 1-866-319-7450 > Si vous désirez enlever votre nom de la liste d’envoi de Moneris, > veuillez cliquer ici > <https://www.moneris.com/about-moneris/contact-moneris/unsubscribe?sc_lang...>. > Veuillez consulter la Politique de confidentialité de Moneris ici > <http://www.moneris.com/Home/Legal/Website-Policies/Privacy-Policy.aspx?sc...>. > > > Ce courriel peut contenir des renseignements confidentiels ou > privilégiés, et son expéditeur ne renonce à aucun droit ni à aucune > obligation connexe. La distribution, l’utilisation ou la reproduction > du présent courriel ou des renseignements qu’il contient par une > personne autre que son destinataire prévu sont interdites. Si vous > avez reçu ce courriel par erreur, veuillez m’en aviser immédiatement > (par retour de courriel ou autrement).

9 years, 10 months

1
0
0 / 0

Help problem with Bad request

by Gyalai Milán

Hello, I have problem with the Bad request when the user login. I have a simple War with JSP-s. With the following keycloak.json { "realm": "test", "realm-public-key": "...", "auth-server-url": "keycloak-url", "ssl-required": "none", "resource": "dashboard-app", "public-client": true, "use-resource-role-mappings": false, "principal-attribute": "preferred_username" } The wildfly redirects to the keycloak perfectly and adds a status parameter to the URL. After the login we get a 400 Bad request error. In the wildfly log I found these lines. WARN [org.keycloak.adapters.OAuthRequestAuthenticator] (default task-111) state parameter invalid WARN [org.keycloak.adapters.OAuthRequestAuthenticator] (default task-111) cookie: 151/af93b54d-6b04-4d82-9a8b-1fe7203b279e WARN [org.keycloak.adapters.OAuthRequestAuthenticator] (default task-111) queryParam: 150/e946fb78-9902-4449-8c33-687fcaf98d3d What did I configure wrong? The Keycloak version is 1.9.8.Final . Any ideas ? Regards

9 years, 10 months

2
1
0 / 0

Does Keycloak's SPNEGO support include fall-back to NTLM in absence of Kerberos?

by Guy Davis

Good day, For sake of argument, assume that someone has set up a MS Active Directory domain with Kerberos disabled, but NTLM still enabled. In that situation, would a user browsing to a Keycloak-protected application, with LDAP+SPNEGO enabled (against that MS AD system) still allow for Integrated Windows Authentication (auto-login without prompt) to web application? Thanks much, Guy

9 years, 10 months

2
2
0 / 0

Question about the javascript-adapter and the check-sso option with a confidential client

by Tomás García

Hi, I wonder if it's possible to just check the SSO state with a confidential client. My use case is the following one: - I have a website which uses a confidential client to login with Keycloak. - I want to add autologin to this website. - So I use the javascript adapter with the following option object for the init method: { onLoad: 'check-sso' }. The javascript adapter is built without the secret key in its constructor (obviously if I put the secret key in there, there's no point to use a confidential client at all). But Keycloak fails with a "type=CODE_TO_TOKEN_ERROR, error=invalid_client_credentials" error. So I don't know how feasible or secure is to just check that the Keycloak session inside the cookie of the user's browser is still valid. In my case, the browser doesn't need to get the user info, access token, etc, because what I'll do is redirect the user to the Keycloak login page with the confidential client afterwards is the operation is successful. Since the Keycloak session is valid, Keycloak should redirect back with the authentication code without asking credentials to the user. Additional note: the CORS header isn't added to 400 responses in Keycloak, so it was a bit confusing looking at the JS console in the browser, because it complained about CORS but it was just Keycloak giving the 400 response without the allow-origin header. Thanks. -- *Tomás García Pérez * *Software Developer* *Intra**House***

9 years, 10 months

3
7
0 / 0

keycloak access token caching?

by Jannik Hüls

Hi, I use the /auth/realms/{realm}/protocol/openid-connect/token endpoint to create a User Session. The Session is shown inside keycloak and i get the access_token, refresh_token and id_token. When I now call the /auth/realms/{realm}/protocol/openid-connect/token/introspect I get a valid response containing “active”:”true” amongst others. I call it using POST method and providing cient_id, client_secret and token parameter as data. The token parameter contains the access_token value. I now log in to keycloak administrator and logout the User. Now I again call the introspection endpoint but still get a response containing "active":”true”. It seems that keycloak is caching the User Session and after some time I get “active”:”false”. May I be able to disable caching and to immediately get a introspection response that indicates that the User Session does not longer exist? Btw.: The same happens when I call the /auth/realms/{realm}/protocol/openid-connect/logout?redirect_uri= endpoint. I provided the access_token in the header. POST parameters are client_id, client_secret and refresh_token is this case. I use the introspection endpoint in the different RPs I use to validate whether the access_token is revoked in order to introduce single logout. Hence it would be nice to disable the caching to have less inconsistence. Bests Jannik

9 years, 10 months

2
4
0 / 0

Keycloak minimal for integration test

by Charlee Chitsuk

Hi, I would like to test my application via the Arquillian. Does keycloak provide the minimal server for integration test? -- Best Regards, Charlee Ch <https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_camp...> Virus-free. www.avast.com <https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_camp...> <#DDB4FAA8-2DD7-40BB-A1B8-4E2AA1F9FDF2>

9 years, 10 months

4
5
0 / 0

Major Memory Leak/Consumption When Creating Many Users

by Chris Hairfield

Hello, When testing Keycloak 1.9.8 by ingesting a few million users, we find that Keycloak leaks memory until it is rendered unresponsive (see graph). Increasing JVM memory only increases the time it takes to encounter this issue. We have put together a test project here <https://github.com/anaerobic/keycloak-leakage> and opened an issue here <https://issues.jboss.org/browse/KEYCLOAK-3146> as we continue to investigate. As we are relying on Keycloak as a central infrastructural component, any help would be greatly appreciated. We'll update with more information as we find it. Thanks, Chris [image: mem-cpu.png]

9 years, 10 months

3
14
0 / 0

Keycloak Adapter Set/Remove Cookies Depending on Path

by Sarp Kaya

According to this code: <https://github.com/keycloak/keycloak/blob/master/adapters/oidc/adapter-co...><https://github.com/keycloak/keycloak/blob/master/adapters/oidc/adapter-co...>https://github.com/keycloak/keycloak/blob/master/adapters/oidc/adapter-co... The cookie is only reset at the place where the logout path is. For instance: Applications serve at /foo/app and /bar/app And logout path is just /logout In that case that won't work because cookiePath for removeCookie would be /logout. The problem is the user is still logged in within the period of Access Token Lifespan. It doesn't make sense to have different logout URL for each application as such /bar/logout and /foo/logout . Is there a way to just keep single logout which logs out the user for each application? Thanks, Sarp Kaya

9 years, 10 months

2
1
0 / 0

Help - two issues

by James_Saxton＠ao.uscourts.gov

Good Day, Today I was trying to front-end KeyCloak with Apache. Background Keycloak 1.9.5 is installed successfully on linix, I can tuunel to it and log in using admin creds I set up. I installed a webserver and configured SSL for the webserver and Keycloak as outlined in 3.2.6. SSL/HTTPS Requirement/Modes through 3.2.8.2. Configure Wildfly undertow subsystem I restarted the webserver and the keycloak server. The webserver shows the credential pop up stating the site is "strictly private". Creds do not allow me to log in through a webserver, only if I use the SSH tunnel. Not sure were to go - the instruction are pretty simple, I suspect a config issue - not sure where though. Second issue, using the SSH tunnel, I enable require "ALL SSL" as a test knowing full well I could get locked out completely. How can I reset the require ALL SSL without using the console? Thanks in advance. James Saxton Software Infrastructure Division Administrative Office of the U.S. Courts One Columbus Circle, N.E. Washington, DC 20544 (C) 908-910-5566 Teamwork makes the dream work!

9 years, 10 months

2
1
0 / 0

Listing all realm users programmatically

by Haim Vana

Hi, Is there a way to list all realm users programmatically via the API ? also is there a way to delete all of them ? I think I should use the below, however what should I insert in the search method for getting all the users ? keyCloakClient.realms().realm(realmName).users().search() Thanks, Haim. The information contained in this message is proprietary to the sender, protected from disclosure, and may be privileged. The information is intended to be conveyed only to the designated recipient(s) of the message. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, use, distribution or copying of this communication is strictly prohibited and may be unlawful. If you have received this communication in error, please notify us immediately by replying to the message and deleting it from your computer. Thank you.

9 years, 10 months

4
4
0 / 0

How to restore session for UI to REST API

by Chris Pitman

Hey everyone, I'm running into an issue with an application that I've ported over to using Keycloak. I believe that the token issued by keycloak is expiring, which causes XMLHttpRequest's from my front end to be redirected to KeyCloak which then tries to redirect to Google (my identity provider). By the time it gets to google, there have been redirects across two different domains causing the browser to not set an origin header in the request to google, which then causes the browser to not process the response. What is the general way of handling a javascript ajax request when a token expires? Or to have a UI get a new token without requiring the entire ui to refresh to force the browser to redirect? For further background, here is my setup: I am using Google OpenID Connect as the identity provider. The application is protected with keycloak-proxy, which then passes requests on to the application. keycloak-proxy is the piece detecting the token is no longer valid and redirecting the ui to keycloak. Chris Pitman Architect, Red Hat Consulting

9 years, 10 months

3
5
0 / 0

reverse proxy support of Keycloak saml filter adapter

by ROMELOT Didier

Hi, we deploy applications that use keycloak SAML filter to handle SAML authentication. We face some trouble when configuring the app acting behind a reverse proxy. In that situation keycloak library raises an exception : WebBrowserSsoAuthenticationHandler ERROR Request URI does not match SAML request destination We try to fix it with configuration on reverse proxy but whithout success. Does anyone faced with such problem ? regards [http://collaboration2010.sharepoint.renault.fr/is/fsc/places/blog/Lists/P...] Didier ROMELOT DIA-AT - Technical Architecture API : FR EQV NOV 3 39 13, avenue Paul Langevin 92359 Le Plessis Robinson Cedex - FRANCE Tél. : +33 1 76 84 95 28 -- Disclaimer ------------------------------------ Ce message ainsi que les eventuelles pieces jointes constituent une correspondance privee et confidentielle a l'attention exclusive du destinataire designe ci-dessus. Si vous n'etes pas le destinataire du present message ou une personne susceptible de pouvoir le lui delivrer, il vous est signifie que toute divulgation, distribution ou copie de cette transmission est strictement interdite. Si vous avez recu ce message par erreur, nous vous remercions d'en informer l'expediteur par telephone ou de lui retourner le present message, puis d'effacer immediatement ce message de votre systeme. *** This e-mail and any attachments is a confidential correspondence intended only for use of the individual or entity named above. If you are not the intended recipient or the agent responsible for delivering the message to the intended recipient, you are hereby notified that any disclosure, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please notify the sender by phone or by replying this message, and then delete this message from your system.

9 years, 10 months

2
1
0 / 0

Email timeout error

by LEONARDO NUNES

Hi, i'm getting the error below when sending the verification email. An error page is shown, but I always receive the email. Most of the times it works fine, but sometimes it returns the error. Around 7 out of 10 times it works. I use the same SMTP host for other applications and I don't have this problem. For the Email configuration I only have Host and From configured. Is there a way to configure the timeout? 15:51:47,736 ERROR [org.keycloak.forms.login.freemarker.FreeMarkerLoginFormsProvider] (default task-4) Failed to send verification email: org.keycloak.email.EmailException: Failed to template email at org.keycloak.email.freemarker.FreeMarkerEmailTemplateProvider.send(FreeMarkerEmailTemplateProvider.java:179) at org.keycloak.email.freemarker.FreeMarkerEmailTemplateProvider.send(FreeMarkerEmailTemplateProvider.java:150) at org.keycloak.email.freemarker.FreeMarkerEmailTemplateProvider.sendVerifyEmail(FreeMarkerEmailTemplateProvider.java:146) at org.keycloak.forms.login.freemarker.FreeMarkerLoginFormsProvider.createResponse(FreeMarkerLoginFormsProvider.java:156) at org.keycloak.authentication.requiredactions.VerifyEmail.requiredActionChallenge(VerifyEmail.java:73) at org.keycloak.services.managers.AuthenticationManager.executionActions(AuthenticationManager.java:573) at org.keycloak.services.managers.AuthenticationManager.actionRequired(AuthenticationManager.java:504) at org.keycloak.services.managers.AuthenticationManager.nextActionAfterAuthentication(AuthenticationManager.java:426) at org.keycloak.services.resources.LoginActionsService$Checks.verifyRequiredAction(LoginActionsService.java:302) at org.keycloak.services.resources.LoginActionsService.processRequireAction(LoginActionsService.java:856) at org.keycloak.services.resources.LoginActionsService.requiredActionGET(LoginActionsService.java:849) at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.lang.reflect.Method.invoke(Method.java:497) at org.jboss.resteasy.core.MethodInjectorImpl.invoke(MethodInjectorImpl.java:139) at org.jboss.resteasy.core.ResourceMethodInvoker.invokeOnTarget(ResourceMethodInvoker.java:295) at org.jboss.resteasy.core.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:249) at org.jboss.resteasy.core.ResourceLocatorInvoker.invokeOnTargetObject(ResourceLocatorInvoker.java:138) at org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorInvoker.java:101) at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:395) at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:202) at org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.service(ServletContainerDispatcher.java:221) at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:56) at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:51) at javax.servlet.http.HttpServlet.service(HttpServlet.java:790) at io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:85) at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:129) at org.keycloak.services.filters.KeycloakSessionServletFilter.doFilter(KeycloakSessionServletFilter.java:88) at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:60) at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131) at io.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.java:84) at io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:62) at io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36) at org.wildfly.extension.undertow.security.SecurityContextAssociationHandler.handleRequest(SecurityContextAssociationHandler.java:78) at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) at io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:131) at io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:57) at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) at io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:46) at io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64) at io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:60) at io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:77) at io.undertow.security.handlers.NotificationReceiverHandler.handleRequest(NotificationReceiverHandler.java:50) at io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43) at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) at org.wildfly.extension.undertow.security.jacc.JACCContextIdHandler.handleRequest(JACCContextIdHandler.java:61) at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) at io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:284) at io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:263) at io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:81) at io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:174) at io.undertow.server.Connectors.executeRootHandler(Connectors.java:202) at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:793) at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) at java.lang.Thread.run(Thread.java:745) Caused by: org.keycloak.email.EmailException: javax.mail.MessagingException: Exception reading response; nested exception is: java.net.SocketTimeoutException: Read timed out at org.keycloak.email.DefaultEmailSenderProvider.send(DefaultEmailSenderProvider.java:128) at org.keycloak.email.freemarker.FreeMarkerEmailTemplateProvider.send(FreeMarkerEmailTemplateProvider.java:185) at org.keycloak.email.freemarker.FreeMarkerEmailTemplateProvider.send(FreeMarkerEmailTemplateProvider.java:177) ... 57 more Caused by: javax.mail.MessagingException: Exception reading response; nested exception is: java.net.SocketTimeoutException: Read timed out at com.sun.mail.smtp.SMTPTransport.readServerResponse(SMTPTransport.java:2351) at com.sun.mail.smtp.SMTPTransport.issueSendCommand(SMTPTransport.java:2228) at com.sun.mail.smtp.SMTPTransport.finishData(SMTPTransport.java:2027) at com.sun.mail.smtp.SMTPTransport.sendMessage(SMTPTransport.java:1242) at org.keycloak.email.DefaultEmailSenderProvider.send(DefaultEmailSenderProvider.java:125) ... 59 more Caused by: java.net.SocketTimeoutException: Read timed out at java.net.SocketInputStream.socketRead0(Native Method) at java.net.SocketInputStream.socketRead(SocketInputStream.java:116) at java.net.SocketInputStream.read(SocketInputStream.java:170) at java.net.SocketInputStream.read(SocketInputStream.java:141) at com.sun.mail.util.TraceInputStream.read(TraceInputStream.java:124) at java.io.BufferedInputStream.fill(BufferedInputStream.java:246) at java.io.BufferedInputStream.read(BufferedInputStream.java:265) at com.sun.mail.util.LineInputStream.readLine(LineInputStream.java:92) at com.sun.mail.smtp.SMTPTransport.readServerResponse(SMTPTransport.java:2331) ... 63 more -- Att, Leonardo Nunes Analista de Sistemas leo.nunes(a)gjccorp.com.br<mailto:leo.nunes@gjccorp.com.br> Skype: leonardo.puc +55 (62) 3250-1462 Grupo Jaime Câmara www.gjccorp.com.br<applewebdata://B0E38BB5-8499-4F51-929B-00F21C9F6683/www.gjccorp.com.br> ________________________________ Esta mensagem pode conter informação confidencial e/ou privilegiada. Se você não for o destinatário ou a pessoa autorizada a receber esta mensagem, não poderá usar, copiar ou divulgar as informações nela contidas ou tomar qualquer ação baseada nessas informações. Se você recebeu esta mensagem por engano, por favor avise imediatamente o remetente, respondendo o e-mail e em seguida apague-o. Agradecemos sua cooperação. This message may contain confidential and/or privileged information. If you are not the addressee or authorized to receive this for the addressee, you must not use, copy, disclose or take any action based on this message or any information herein. If you have received this message in error, please advise the sender immediately by reply e-mail and delete this message. Thank you for your cooperation

9 years, 10 months

3
4
0 / 0

Typo in Client Registration documentation

by Orestis Tsakiridis

All, it seems there is a typo in the Client Registration documentation lying at: http://keycloak.github.io/docs/userguide/keycloak-server/html/client-regi... Existing snippet: String initialAccessToken = "eyJhbGciOiJSUzI1NiJ9.eyJqdGkiOiJmMjJmNzQyYy04ZjNlLTQ2M...."; ClientRepresentation client = new ClientRepresentation(); client.setClientId(CLIENT_ID); ClientRegistration reg = ClientRegistration.create().url(" http://keycloak/auth/realms/myrealm/clients").build(); reg.auth(Auth.token(initialAccessToken)); client = reg.create(client); String registrationAccessToken = client.getRegistrationAccessToken(); Corrected snippet: String initialAccessToken = "eyJhbGciOiJSUzI1NiJ9.eyJqdGkiOiJmMjJmNzQyYy04ZjNlLTQ2M...."; ClientRepresentation client = new ClientRepresentation(); client.setClientId(CLIENT_ID); ClientRegistration reg = ClientRegistration.create().url(" http://keycloak/auth/realms/myrealm/*clients-registrations*").build(); reg.auth(Auth.token(initialAccessToken)); client = reg.create(client); String registrationAccessToken = client.getRegistrationAccessToken(); Please confirm and if valid, take care with that.

9 years, 10 months

2
1
0 / 0

Productized Keycloak now available from Red Hat

by Stian Thorgersen

For nearly 4 years ago Bill Burke and myself started two individual proof of concepts, both focusing on making it easier for developers to securing applications and services. Keycloak was born out of combining these two proof of concepts. There was barely any overlap and the two perfectly complemented each other. Fast forward to today and we now have a huge community with over 100 contributors and over 400 forks of our Github repository. It's no longer just myself and Bill working on Keycloak, we now have a strong team working on it and I'm very exited about the future of the project. You may have noticed that lately we've stopped adding new features and focused on improvements and testing. There's a good reason behind that! We've been working on creating a productized and supported version of Keycloak. I'm extremely pleased to announce that Red Hat now offers a productized and supported version of Keycloak! For more details on how to get support for Keycloak check out the product pages at: https://access.redhat.com/products/red-hat-single-sign-on Finally, I'd like to thank everyone that's been involved. All the core developers, quality engineers, others at Red Hat and last but not least our community!

9 years, 10 months

9
11
0 / 0

Keycloak single sign on with Keberos(AD)

by Zhou, Limin (Ray)

Hello everyone I am new to Keycloak and new to here Our web application is running on Jboss EAP 7, We have configured KeyCloak standalone server 1.9.7 running on different port(same server box) to manage the user authentication and authorization, behind KeyCloak we have configured Keberos in User Federation to talk our company AD server, we are able to login by using our AD account, but not in single sign on way, each time when we hitting the our app URL, the Keycloak login page will show up. It looks like the TGT or ST hand shake was not successful, is there any document I can reference it to debug the issue? Any comments or suggestion would be very welcome thanks in advance raymond ________________________________ Moneris Solutions Corporation | 3300 Bloor Street West | Toronto | Ontario | M8X 2X2 | Canada www.moneris.com 1-866-319-7450 If you wish to unsubscribe from future updates from Moneris, please click here<https://www.moneris.com/en/About-Moneris/Contact-Moneris/Unsubscribe.aspx>. Please see the Moneris Privacy Policy here<http://www.moneris.com/Home/Legal/Website-Policies/Privacy-Policy.aspx>. This e-mail may be privileged and/or confidential, and the sender does not waive any related rights and obligations. Any distribution, use or copying of this e-mail or the information it contains by other than an intended recipient is unauthorized. If you received this e-mail in error, please advise me (by return e-mail or otherwise) immediately. ________________________________ Corporation Solutions Moneris | 3300, rue Bloor Ouest | Toronto | Ontario | M8X 2X2 | Canada www.moneris.com 1-866-319-7450 Si vous désirez enlever votre nom de la liste d’envoi de Moneris, veuillez cliquer ici<https://www.moneris.com/about-moneris/contact-moneris/unsubscribe?sc_lang...>. Veuillez consulter la Politique de confidentialité de Moneris ici<http://www.moneris.com/Home/Legal/Website-Policies/Privacy-Policy.aspx?sc...>. Ce courriel peut contenir des renseignements confidentiels ou privilégiés, et son expéditeur ne renonce à aucun droit ni à aucune obligation connexe. La distribution, l’utilisation ou la reproduction du présent courriel ou des renseignements qu’il contient par une personne autre que son destinataire prévu sont interdites. Si vous avez reçu ce courriel par erreur, veuillez m’en aviser immédiatement (par retour de courriel ou autrement).

9 years, 10 months

2
1
0 / 0

Tomcat WebApp and MS AD

by Rodrigo Del Canto

Hello All, Can anyone tell me how to find a documentation on how to integrate Keycloak with MS Active Directory (if there is anything specific to Tomcat it will be very nice!). All the reference on google to documentation about LDAP or MSAD are broken. If I am going to be switching over to Keycloak I would like to use the latest stable release and its corresponding documentation. But I couldn't find any reference on http://www.keycloak.org/documentation.html Thanks a lot for your time!! Rod.

9 years, 10 months

2
1
0 / 0

Keycloak 2.0.0.CR1 Released

by Stian Thorgersen

We're finally back to adding new features. This release is just the beginning and we've planned loads of existing new features in the coming months. I'm really exited to introduce the authorization services we've just added. Through the authorization services you can centrally define and manage fine-grained permissions for your services. For more details check out the Authorization Services Guide <https://keycloak.gitbooks.io/authorization-services-guide/content/v/2.0/>. There's a brand new website at www.keycloak.org. Finally we've also completely reworked and significantly improved our documentation <http://www.keycloak.org/documentation.html>. For the full list of resolved issues check out JIRA <https://issues.jboss.org/issues/?jql=project%20%3D%20keycloak%20and%20fix...> and to download the release go to the Keycloak homepage <http://www.keycloak.org/downloads>. Before you upgrade refer to the migration guide <https://keycloak.gitbooks.io/server-adminstration-guide/content/v/2.0/top...>

9 years, 10 months

2
1
0 / 0

Need help: Configuring keycloak to work with IBM Websphere Application Server

by T, Suseendhiran (Nokia - IN/Bangalore)

Hello All, I am trying to configure Keycloak as openID connect provider and IBM Websphere Application Server as Relying Party. During authentication, keycloak sends the JWT. But IBM Websphere Application Server could not verify the token. Below Exception is thrown: com.ibm.websphere.security.WebTrustAssociationFailedException: CWTAI2007E: The OpenID Connect replying party (RP) encountered a failure during the login. The exception is [Failed to validate id token, exception thrown during verify [key is invalid]]. Check the logs for details that lead to this exception. at com.ibm.ws.security.oidc.client.RelyingParty.handleSigninCallback(RelyingParty.java:428) ...<skipping trace> at com.ibm.ws.util.ThreadPool$Worker.run(ThreadPool.java:1881) Caused by: com.ibm.ws.security.oidc.client.RelyingPartyException: Failed to validate id token, exception thrown during verify [key is invalid] at com.ibm.ws.security.oidc.client.SessionCache.updateEntryUsingStateId(SessionCache.java:352) at com.ibm.ws.security.oidc.client.RelyingParty.handleSigninCallback(RelyingParty.java:411) ... 28 more Caused by: java.lang.IllegalStateException: key is invalid at net.oauth.jsontoken.crypto.RsaSHA256Verifier.<init>(RsaSHA256Verifier.java:45) at com.ibm.ws.security.openidconnect.token.JWT.getJsonTokenParser(JWT.java:1017) at com.ibm.ws.security.openidconnect.token.JWT.verify(JWT.java:881) at com.ibm.ws.security.openidconnect.token.IDToken.verify(IDToken.java:578) at com.ibm.ws.security.oidc.client.SessionData.setIdToken(SessionData.java:294) at com.ibm.ws.security.oidc.client.SessionData.update(SessionData.java:131) at com.ibm.ws.security.oidc.client.SessionCache.updateEntryUsingStateId(SessionCache.java:343) ... 29 more Caused by: java.security.InvalidKeyException: No installed provider supports this key: (null) at java.security.Signature$Delegate.chooseProvider(Signature.java:1139) at java.security.Signature$Delegate.engineInitVerify(Signature.java:1172) at java.security.Signature.initVerify(Signature.java:462) at net.oauth.jsontoken.crypto.RsaSHA256Verifier.<init>(RsaSHA256Verifier.java:41) ... 35 more . Make sure that the setup is correct and that the user credentials are valid. [6/7/16 8:58:30:493 IST] 000002bb WebCollaborat A SECJ0056E: Authentication failed for reason CWTAI2007E: The OpenID Connect replying party (RP) encountered a failure during the login. The exception is [Failed to validate id token, exception thrown during verify [key is invalid]]. Check the logs for details that lead to this exception. ------------------------------------------------------------------------------------------------------------------------------------------- I have attached the Websphere log during authentication, Could someone help me analyse the issue? Versions used: Keycloak -1.9.4.Final IBM WebSphere Application Server Network Deployment - Version 8.5.5.8 Please let me know if any information needed. Regards, Suseendhiran T

9 years, 10 months

1
0
0 / 0

WildFly overlay not recommended for production?

by Ramon Rockx

Hello, First of all, Keycloak team, congratulations with your new website. It's looking good! When visiting the download page I saw the the text "Not recommended in production." which refers to the WildFly overlay. I was wondering why it is not recommended? Regards, Ramon Rockx

9 years, 10 months

2
1
0 / 0

Documentation down

by Geo Miller

It seems that keycloak.github.io forwards to keyclock.jboss.org and the links for docs do not work: http://keycloak.jboss.org/docs/userguide/keycloak-server/html/index.html http://keycloak.jboss.org/docs/rest-api/index.html I did not see this posted in the list or elsewhere, apologies if this is the wrong place. Geo -- Geo Miller Developer @ UberOps <http://www.uberops.com/> mobile: 404-530-9561 | geo(a)uberops.com

9 years, 10 months

3
3
0 / 0

Active Directory

by Christopher Davies

I am looking to use KeyCloak backed by an AD server. Can I check a few things that I understand are correct. 1) Using the User Federation SPI I import the following from ActiveDirectory into the KeyCloak database : first name, surname, email, username and password. 2) Password checks are made against the Keycloak database and not the ActiveDirectory system 3) Enabling kerberos authentication will allow me to do paswordless login using my web browser from my windows box Hope I am not to far from the mark Chris

9 years, 10 months

2
1
0 / 0

Re: [keycloak-user] Cannot update Client using clients-registrations endpoint

by Orestis Tsakiridis

Ok, seems like some more troubleshooting payed out. Seems like i missed the Accept header in the request :-) *Accept: application/json* The issue is now solved. On Tue, Jun 21, 2016 at 3:45 PM, Orestis Tsakiridis < orestis.tsakiridis(a)telestax.com> wrote: > Hello, > > I'm trying to update a keycloak Client using the client-registrations > endpoint as described here: > > > http://keycloak.github.io/docs/userguide/keycloak-server/html/client-regi... > > All seems fine and client creation as retrieval work but *update* keeps > failing. > > Here is what i do: > > 1. Create a new bearer-only Client with ClientID -> newclient > > 2. I 'Regenerate registration access token' here is what i get: > > eyJhbGciOiJSUzI1NiJ9.eyJqdGkiOiI0MGM1ZWIyNy1mYTNmLTRiNjktYjlmZC01NTIyYWM2NzYxZDkiLCJleHAiOjAsIm5iZiI6MCwiaWF0IjoxNDY2NTExNzEyLCJpc3MiOiJodHRwOi8vMTI3LjAuMC4xOjgwODEvYXV0aC9yZWFsbXMvcmVzdGNvbW0tdGVzdCIsImF1ZCI6Imh0dHA6Ly8xMjcuMC4wLjE6ODA4MS9hdXRoL3JlYWxtcy9yZXN0Y29tbS10ZXN0IiwidHlwIjoiUmVnaXN0cmF0aW9uQWNjZXNzVG9rZW4ifQ.bI2JQLOAwWdxgtaNgAXw8aliWRJRs7RviNJRPHPHyVFI6AfuBsEpZ9c5e_v6vFD0hWoNjneUnDmS-CUrzPKcBWrITXkrUwxwEQAJpQD-ONWim6AiVVOxr3sizgwxRyBX__Cny8IMm8BWjUIIIkRviSc9QE7tYscTRTE4AP5ZRlsmB7hsmfkRSgzmd5SF2ZQWj8DriSou_-ivzZ9wnlwENoewePOK1b6oZhhGQiGo4SM0pLkTWGkN8kuO3aYei6OKiol2eJn9B4bA7wr6uUruEAg03symAaDFWscpmHIl27sxF3XkYdn8F-vJwNdhFJx_t84IEKucwZEwdgNFuWZuIQ > > 3. I make the update request to: > > > http://127.0.0.1:8081/auth/realms/restcomm-test/clients-registrations/def... > > here is the curl command: > curl -i -X PUT \ > > -H "Authorization:Bearer > eyJhbGciOiJSUzI1NiJ9.eyJqdGkiOiJhNDc3NzA3Yi1hOGM4LTRjMGItYjExYi0xZWE4ZTgyNTNkYTgiLCJleHAiOjAsIm5iZiI6MCwiaWF0IjoxNDY2NTEyMDc4LCJpc3MiOiJodHRwOi8vMTI3LjAuMC4xOjgwODEvYXV0aC9yZWFsbXMvcmVzdGNvbW0tdGVzdCIsImF1ZCI6Imh0dHA6Ly8xMjcuMC4wLjE6ODA4MS9hdXRoL3JlYWxtcy9yZXN0Y29tbS10ZXN0IiwidHlwIjoiUmVnaXN0cmF0aW9uQWNjZXNzVG9rZW4ifQ.G33SBIhvFay8YAMkGxeyWMDSfeM9slS7pv49hWNxmmvaNUmUOFhP8e2-WcQJW2NZEumOKSm-UGk-2VH5EiB24F8DWn9hGVOlJdIysewbyei94Xqcu-xoOAhSRdcU3xOEEKrVBQxTAQRWahp5Jil1A_jHoY1bLcQk1Keu1WAOKDBgUyGu2pO7sfs1hjUHQ2V_pC9xOeC7rf3rpdXF7OAb9Xf8pD1_xfuUwMSGJzey0Mqs3dp9qS_v4g6CaOQvcMOVgf0_cb0RKkeSyqgxcTO0Laxrz7NNP4I9ZojLQE_8bEyPQyrREfWZj8zQp4hLO89k_O_xzv3iOYOj064xiEX6nA" > \ > > -H "Content-Type:application/json" \ > > -d \ > > '{"clientId":"newclient","enabled":false} > > ' \ > > ' > http://127.0.0.1:8081/auth/realms/restcomm-test/clients-registrations/def... > ' > > 4. I get a 500 Internal Server error response with the following error in > the logs: > > RESTEASY002005: Failed executing PUT > /realms/restcomm-test/clients-registrations/default/newclient: > org.jboss.resteasy.core.NoMessageBodyWriterFoundFailure: Could not find > MessageBodyWriter for response object of type: > org.keycloak.representations.idm.ClientRepresentation of media type: > application/octet-stream > > 5. If i run again i get a 401 so it seems that authorization passes the > first time but something breaks afterwards. Next time, the one-time token > is already consumed so i get a 401. Ok, that makes sense. > > As you may have noticed i'm using a pretty reduced version of the > ClientRepresentation but i've also experienced with others that are more or > less complete and also by sending the *exact json response as returned > when retrieving the client*. Same result :-( > > Also, the rest of the HTTP methods (POST on /default,DELETE, GET) work > fine with the registration access token. So it seems that either i'm > sending crap or sth else happens. > > Any ideas what may be wrong? > > Thanks >

9 years, 10 months

1
0
0 / 0

different datasource

by Daniele Capasso Barbato

Hi, I want to use in the same keycloak, different datasource to store in different database the eventsStore, realm and user data. I configure 3 different mysql connections KeycloakDS, KeycloakLocal and KeycloakRemote jndi source in standalone.xml for wildfly and it works correctly. In the keycloak-server.json there are this line for definition "eventsStore": { "provider": "jpa", "jpa": { "exclude-events": [ "REFRESH_TOKEN" ] } }, "realm": { "provider": "jpa" }, "user": { "provider": "jpa" }, and for connections "connectionsJpa": { "default": { "dataSource": "java:jboss/datasources/KeycloakDS", "databaseSchema": "update" } , }, but how is possible specify a different connectionsJpa and use it for realm,user and eventsStore ? I try to modify the jpa connections declaration like this "connectionsJpa": { "default": { "dataSource": "java:jboss/datasources/KeycloakDS", "databaseSchema": "update" } , "second": { "dataSource": "java:jboss/datasources/KeycloakLocal", "databaseSchema": "update" }, "third": { "dataSource": "java:jboss/datasources/KeycloakRemote", "databaseSchema": "update" } }, and no errors appears but all data and table are created in KeycloakDS only. How can I configure to use the second a jpa connection for "realm data" and to use third jpa connection for "users data" ? Thank you very much

9 years, 10 months

2
1
0 / 0

Cannot update Client using clients-registrations endpoint

by Orestis Tsakiridis

Hello, I'm trying to update a keycloak Client using the client-registrations endpoint as described here: http://keycloak.github.io/docs/userguide/keycloak-server/html/client-regi... All seems fine and client creation as retrieval work but *update* keeps failing. Here is what i do: 1. Create a new bearer-only Client with ClientID -> newclient 2. I 'Regenerate registration access token' here is what i get: eyJhbGciOiJSUzI1NiJ9.eyJqdGkiOiI0MGM1ZWIyNy1mYTNmLTRiNjktYjlmZC01NTIyYWM2NzYxZDkiLCJleHAiOjAsIm5iZiI6MCwiaWF0IjoxNDY2NTExNzEyLCJpc3MiOiJodHRwOi8vMTI3LjAuMC4xOjgwODEvYXV0aC9yZWFsbXMvcmVzdGNvbW0tdGVzdCIsImF1ZCI6Imh0dHA6Ly8xMjcuMC4wLjE6ODA4MS9hdXRoL3JlYWxtcy9yZXN0Y29tbS10ZXN0IiwidHlwIjoiUmVnaXN0cmF0aW9uQWNjZXNzVG9rZW4ifQ.bI2JQLOAwWdxgtaNgAXw8aliWRJRs7RviNJRPHPHyVFI6AfuBsEpZ9c5e_v6vFD0hWoNjneUnDmS-CUrzPKcBWrITXkrUwxwEQAJpQD-ONWim6AiVVOxr3sizgwxRyBX__Cny8IMm8BWjUIIIkRviSc9QE7tYscTRTE4AP5ZRlsmB7hsmfkRSgzmd5SF2ZQWj8DriSou_-ivzZ9wnlwENoewePOK1b6oZhhGQiGo4SM0pLkTWGkN8kuO3aYei6OKiol2eJn9B4bA7wr6uUruEAg03symAaDFWscpmHIl27sxF3XkYdn8F-vJwNdhFJx_t84IEKucwZEwdgNFuWZuIQ 3. I make the update request to: http://127.0.0.1:8081/auth/realms/restcomm-test/clients-registrations/def... here is the curl command: curl -i -X PUT \ > -H "Authorization:Bearer eyJhbGciOiJSUzI1NiJ9.eyJqdGkiOiJhNDc3NzA3Yi1hOGM4LTRjMGItYjExYi0xZWE4ZTgyNTNkYTgiLCJleHAiOjAsIm5iZiI6MCwiaWF0IjoxNDY2NTEyMDc4LCJpc3MiOiJodHRwOi8vMTI3LjAuMC4xOjgwODEvYXV0aC9yZWFsbXMvcmVzdGNvbW0tdGVzdCIsImF1ZCI6Imh0dHA6Ly8xMjcuMC4wLjE6ODA4MS9hdXRoL3JlYWxtcy9yZXN0Y29tbS10ZXN0IiwidHlwIjoiUmVnaXN0cmF0aW9uQWNjZXNzVG9rZW4ifQ.G33SBIhvFay8YAMkGxeyWMDSfeM9slS7pv49hWNxmmvaNUmUOFhP8e2-WcQJW2NZEumOKSm-UGk-2VH5EiB24F8DWn9hGVOlJdIysewbyei94Xqcu-xoOAhSRdcU3xOEEKrVBQxTAQRWahp5Jil1A_jHoY1bLcQk1Keu1WAOKDBgUyGu2pO7sfs1hjUHQ2V_pC9xOeC7rf3rpdXF7OAb9Xf8pD1_xfuUwMSGJzey0Mqs3dp9qS_v4g6CaOQvcMOVgf0_cb0RKkeSyqgxcTO0Laxrz7NNP4I9ZojLQE_8bEyPQyrREfWZj8zQp4hLO89k_O_xzv3iOYOj064xiEX6nA" \ > -H "Content-Type:application/json" \ > -d \ > '{"clientId":"newclient","enabled":false} > ' \ > ' http://127.0.0.1:8081/auth/realms/restcomm-test/clients-registrations/def... ' 4. I get a 500 Internal Server error response with the following error in the logs: RESTEASY002005: Failed executing PUT /realms/restcomm-test/clients-registrations/default/newclient: org.jboss.resteasy.core.NoMessageBodyWriterFoundFailure: Could not find MessageBodyWriter for response object of type: org.keycloak.representations.idm.ClientRepresentation of media type: application/octet-stream 5. If i run again i get a 401 so it seems that authorization passes the first time but something breaks afterwards. Next time, the one-time token is already consumed so i get a 401. Ok, that makes sense. As you may have noticed i'm using a pretty reduced version of the ClientRepresentation but i've also experienced with others that are more or less complete and also by sending the *exact json response as returned when retrieving the client*. Same result :-( Also, the rest of the HTTP methods (POST on /default,DELETE, GET) work fine with the registration access token. So it seems that either i'm sending crap or sth else happens. Any ideas what may be wrong? Thanks

9 years, 10 months

1
0
0 / 0

Idp and authenticate by default

by Sjef Hoeks

Hi, I setup Keycloak for using an Identity Provider. Everything works fine, i.e. when I open my application, I see the Keycloak login screen, choose the Identity Provider (e.g. GitHub), login and I can use my application. When I open the application again in a new tab, I'm already logged in and I can use the application without logging in again. But I always want to use the Identity Provider, so I check Authenticate by Default in the settings tab of the Identity Provider. Everything seems to work fine, but when I open the application in a second tab, the first tab is reauthenticating. And then the second tab is reauthenticating. And so on. I tried this with my own implemented Identity Provider and with GitHub. I expected that the only difference is that I don't have to choose the Identity Provider. According to the docs only step 3 and 4 from the base flow are skipped (show list of identity providers and select identity provider). But the behaviour is very different. Is this expected behaviour or a bug? Kind regards, Sjef Sjef Hoeks Technisch Architect [cid:GOUWit_logo_3612b840-badb-433c-9c06-73aec15567bc.jpg] Gouw Informatie Technologie bv Hogeweg 5, 5301 LB Zaltbommel Postbus 98, 5300 AB Zaltbommel T 0418 511 522 M E s.hoeks(a)gouwit.nl I www.gouwit.nl

9 years, 10 months

2
1
0 / 0

User federation and password reset

by Ramon Rockx

Hi, Currently I am working on a user federation provider which should help us out migrating from our old authentication application to Keycloak. All this is done basically by following this great blog https://tech.smartling.com/migrate-to-keycloak-with-zero-downtime . The blogs offers a way of migrating user accounts with hashed passwords in your legacy authentication application, without resetting the passwords of all users in Keycloak. In short, when authenticating a user, first Keycloak checks it's own local storage. If the user does not exists already, it will try to authenticate using our legacy authentication application and will copy the user data from the legacy application. When authentication fails the user will be federated. If successful, the entered password will be set for the Keycloak user. From now on the user is migrated and not federated any longer. However, there is still one scenario I can't figure out how to deal with: we still want to offer our users the possibility to reset their passwords. For non-federated users Keycloak will do just fine. For federated users Keycloak also offers the password reset, but the user will still remain federated. In this case I would like to remove the federation and update the credentials in the Keycloak local storage (so the user is migrated). So, long story short, I think the UserFederationProvider should also offer the possibility to anticipate on a password change. This way you can update the credentials and/or remove the federation link. Or is there some other solution? Regards, Ramon Rockx

9 years, 10 months

2
1
0 / 0

automated Sync Keycloak Roles To LDAP

by Arjan Schaaf

Hi there, I’m integrating Keycloak in an environment where a have a couple of ‘legacy’ applications that allow for LDAP based external authentication, but do not support Keycloak or oauth / OpenID connect out-of-the-box. So I’m creating a setup where I use Keycloak as the primary repository for storing users and groups/roles, but I connect a LDAP server that is kept in sync with Keycloak and bind these applications to the LDAP service. That setup works decent enough: newly created users in keycloak are synced to LDAP and so on. However syncing Keycloak roles to LDAP doesn’t seem to work as convenient. I’ve created a User Federation Mapper of type Role mappings and when I use the “Sync Keycloak Roles To LDAP” button, the roles are synced with LDAP. Great! But when I create a new role in Keycloak I expected it to be synced automatically, just like a new Keycloak user is synced directly to LDAP. I need to use the “Sync Keycloak Roles To LDAP” manually again to update LDAP. Is this how it is designed to work or is there are way to update LDAP directly after changing something to Keycloak roles? Cheers, Arjan

9 years, 10 months

2
1
0 / 0

Re: [keycloak-user] Note about the documentation - Valid account guessing with the "forgot password" feature in Keycloak

by Tomás García

Yes, we already did our own authentication flow here a couple of weeks ago, but I decided today to communicate this situation. The question is that part of the documentation should be clarified, because at least I was confused after I saw the inconsistency when seeing the behaviour of the registration form: A malicious user will still be capable of guessing valid users, so it's something that should be warned to developers / admins. (Sorry I activated the digest mode of the mailing list and I don't really know how to properly reply to a thread without receiving the original email) ------------------ Feel free to extend the plugin then. :) On 6/15/16 4:49 PM, Tomás García wrote: >* Hi, *>>* In this url: *>* http://keycloak.github.io/docs/userguide/keycloak-server/html/auth_spi.ht... <http://keycloak.github.io/docs/userguide/keycloak-server/html/auth_spi.ht...> *>>* , it says: *>>* "This form *WILL NOT* re-ask the user to enter in an email or username *>* if the previous email or username did not exist. You need to prevent *>* attackers from being able to guess valid users. So, if *>* AuthenticationFlowContext.getUser() returns null, you should proceed *>* with the flow to make it look like a valid user was selected." *>>* And I totally agree with that, but it doesn't apply to all cases *>* unfortunately. If the admin enables "User registration", the user *>* registration form will tell the a possible malicious guy if the email *>* combinations she's trying already exists, invalidating what the above *>* paragraph says. And I don't think there's a way to do the same as in the *>* "forgot password" feature with the registration form, because after *>* registration, there's an autologin. *>>* Actually it's confusing for users telling them an email was sent event *>* if it's not... People sometimes can forget that they're not registered *>* in the Keycloak system, so the "forgot password" feature as it is today *>* will make them wait forever. At least, sending them an email telling *>* them "You're not registered. You can register visiting this link." if *>* "User registration" is enabled or "Ask your admin to register your email *>* in the system" if it's not, would be definitely better. *>>* Thanks. *>>* -- *>>* *Tomás García Pérez *>* * *>>* *Software Developer* *>>* *IntraHouse* *>>>>* _______________________________________________ *>* keycloak-user mailing list *>* keycloak-user at lists.jboss.org <https://lists.jboss.org/mailman/listinfo/keycloak-user> *>* https://lists.jboss.org/mailman/listinfo/keycloak-user <https://lists.jboss.org/mailman/listinfo/keycloak-user> *> -- *Tomás García Pérez* *Software Developer* IntraHouse

9 years, 10 months

1
0
0 / 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

keycloak-user June 2016