June 2016 - keycloak-user - Jboss List Archives

WildFly overlay not recommended for production?

by Ramon Rockx

Hello, First of all, Keycloak team, congratulations with your new website. It's looking good! When visiting the download page I saw the the text "Not recommended in production." which refers to the WildFly overlay. I was wondering why it is not recommended? Regards, Ramon Rockx

10 years, 1 month

2
1
0 / 0

Documentation down

by Geo Miller

It seems that keycloak.github.io forwards to keyclock.jboss.org and the links for docs do not work: http://keycloak.jboss.org/docs/userguide/keycloak-server/html/index.html http://keycloak.jboss.org/docs/rest-api/index.html I did not see this posted in the list or elsewhere, apologies if this is the wrong place. Geo -- Geo Miller Developer @ UberOps <http://www.uberops.com/> mobile: 404-530-9561 | geo(a)uberops.com

10 years, 1 month

3
3
0 / 0

Active Directory

by Christopher Davies

I am looking to use KeyCloak backed by an AD server. Can I check a few things that I understand are correct. 1) Using the User Federation SPI I import the following from ActiveDirectory into the KeyCloak database : first name, surname, email, username and password. 2) Password checks are made against the Keycloak database and not the ActiveDirectory system 3) Enabling kerberos authentication will allow me to do paswordless login using my web browser from my windows box Hope I am not to far from the mark Chris

10 years, 1 month

2
1
0 / 0

Re: [keycloak-user] Cannot update Client using clients-registrations endpoint

by Orestis Tsakiridis

Ok, seems like some more troubleshooting payed out. Seems like i missed the Accept header in the request :-) *Accept: application/json* The issue is now solved. On Tue, Jun 21, 2016 at 3:45 PM, Orestis Tsakiridis < orestis.tsakiridis(a)telestax.com> wrote: > Hello, > > I'm trying to update a keycloak Client using the client-registrations > endpoint as described here: > > > http://keycloak.github.io/docs/userguide/keycloak-server/html/client-regi... > > All seems fine and client creation as retrieval work but *update* keeps > failing. > > Here is what i do: > > 1. Create a new bearer-only Client with ClientID -> newclient > > 2. I 'Regenerate registration access token' here is what i get: > > eyJhbGciOiJSUzI1NiJ9.eyJqdGkiOiI0MGM1ZWIyNy1mYTNmLTRiNjktYjlmZC01NTIyYWM2NzYxZDkiLCJleHAiOjAsIm5iZiI6MCwiaWF0IjoxNDY2NTExNzEyLCJpc3MiOiJodHRwOi8vMTI3LjAuMC4xOjgwODEvYXV0aC9yZWFsbXMvcmVzdGNvbW0tdGVzdCIsImF1ZCI6Imh0dHA6Ly8xMjcuMC4wLjE6ODA4MS9hdXRoL3JlYWxtcy9yZXN0Y29tbS10ZXN0IiwidHlwIjoiUmVnaXN0cmF0aW9uQWNjZXNzVG9rZW4ifQ.bI2JQLOAwWdxgtaNgAXw8aliWRJRs7RviNJRPHPHyVFI6AfuBsEpZ9c5e_v6vFD0hWoNjneUnDmS-CUrzPKcBWrITXkrUwxwEQAJpQD-ONWim6AiVVOxr3sizgwxRyBX__Cny8IMm8BWjUIIIkRviSc9QE7tYscTRTE4AP5ZRlsmB7hsmfkRSgzmd5SF2ZQWj8DriSou_-ivzZ9wnlwENoewePOK1b6oZhhGQiGo4SM0pLkTWGkN8kuO3aYei6OKiol2eJn9B4bA7wr6uUruEAg03symAaDFWscpmHIl27sxF3XkYdn8F-vJwNdhFJx_t84IEKucwZEwdgNFuWZuIQ > > 3. I make the update request to: > > > http://127.0.0.1:8081/auth/realms/restcomm-test/clients-registrations/def... > > here is the curl command: > curl -i -X PUT \ > > -H "Authorization:Bearer > eyJhbGciOiJSUzI1NiJ9.eyJqdGkiOiJhNDc3NzA3Yi1hOGM4LTRjMGItYjExYi0xZWE4ZTgyNTNkYTgiLCJleHAiOjAsIm5iZiI6MCwiaWF0IjoxNDY2NTEyMDc4LCJpc3MiOiJodHRwOi8vMTI3LjAuMC4xOjgwODEvYXV0aC9yZWFsbXMvcmVzdGNvbW0tdGVzdCIsImF1ZCI6Imh0dHA6Ly8xMjcuMC4wLjE6ODA4MS9hdXRoL3JlYWxtcy9yZXN0Y29tbS10ZXN0IiwidHlwIjoiUmVnaXN0cmF0aW9uQWNjZXNzVG9rZW4ifQ.G33SBIhvFay8YAMkGxeyWMDSfeM9slS7pv49hWNxmmvaNUmUOFhP8e2-WcQJW2NZEumOKSm-UGk-2VH5EiB24F8DWn9hGVOlJdIysewbyei94Xqcu-xoOAhSRdcU3xOEEKrVBQxTAQRWahp5Jil1A_jHoY1bLcQk1Keu1WAOKDBgUyGu2pO7sfs1hjUHQ2V_pC9xOeC7rf3rpdXF7OAb9Xf8pD1_xfuUwMSGJzey0Mqs3dp9qS_v4g6CaOQvcMOVgf0_cb0RKkeSyqgxcTO0Laxrz7NNP4I9ZojLQE_8bEyPQyrREfWZj8zQp4hLO89k_O_xzv3iOYOj064xiEX6nA" > \ > > -H "Content-Type:application/json" \ > > -d \ > > '{"clientId":"newclient","enabled":false} > > ' \ > > ' > http://127.0.0.1:8081/auth/realms/restcomm-test/clients-registrations/def... > ' > > 4. I get a 500 Internal Server error response with the following error in > the logs: > > RESTEASY002005: Failed executing PUT > /realms/restcomm-test/clients-registrations/default/newclient: > org.jboss.resteasy.core.NoMessageBodyWriterFoundFailure: Could not find > MessageBodyWriter for response object of type: > org.keycloak.representations.idm.ClientRepresentation of media type: > application/octet-stream > > 5. If i run again i get a 401 so it seems that authorization passes the > first time but something breaks afterwards. Next time, the one-time token > is already consumed so i get a 401. Ok, that makes sense. > > As you may have noticed i'm using a pretty reduced version of the > ClientRepresentation but i've also experienced with others that are more or > less complete and also by sending the *exact json response as returned > when retrieving the client*. Same result :-( > > Also, the rest of the HTTP methods (POST on /default,DELETE, GET) work > fine with the registration access token. So it seems that either i'm > sending crap or sth else happens. > > Any ideas what may be wrong? > > Thanks >

10 years, 1 month

1
0
0 / 0

different datasource

by Daniele Capasso Barbato

Hi, I want to use in the same keycloak, different datasource to store in different database the eventsStore, realm and user data. I configure 3 different mysql connections KeycloakDS, KeycloakLocal and KeycloakRemote jndi source in standalone.xml for wildfly and it works correctly. In the keycloak-server.json there are this line for definition "eventsStore": { "provider": "jpa", "jpa": { "exclude-events": [ "REFRESH_TOKEN" ] } }, "realm": { "provider": "jpa" }, "user": { "provider": "jpa" }, and for connections "connectionsJpa": { "default": { "dataSource": "java:jboss/datasources/KeycloakDS", "databaseSchema": "update" } , }, but how is possible specify a different connectionsJpa and use it for realm,user and eventsStore ? I try to modify the jpa connections declaration like this "connectionsJpa": { "default": { "dataSource": "java:jboss/datasources/KeycloakDS", "databaseSchema": "update" } , "second": { "dataSource": "java:jboss/datasources/KeycloakLocal", "databaseSchema": "update" }, "third": { "dataSource": "java:jboss/datasources/KeycloakRemote", "databaseSchema": "update" } }, and no errors appears but all data and table are created in KeycloakDS only. How can I configure to use the second a jpa connection for "realm data" and to use third jpa connection for "users data" ? Thank you very much

10 years, 1 month

2
1
0 / 0

Cannot update Client using clients-registrations endpoint

by Orestis Tsakiridis

Hello, I'm trying to update a keycloak Client using the client-registrations endpoint as described here: http://keycloak.github.io/docs/userguide/keycloak-server/html/client-regi... All seems fine and client creation as retrieval work but *update* keeps failing. Here is what i do: 1. Create a new bearer-only Client with ClientID -> newclient 2. I 'Regenerate registration access token' here is what i get: eyJhbGciOiJSUzI1NiJ9.eyJqdGkiOiI0MGM1ZWIyNy1mYTNmLTRiNjktYjlmZC01NTIyYWM2NzYxZDkiLCJleHAiOjAsIm5iZiI6MCwiaWF0IjoxNDY2NTExNzEyLCJpc3MiOiJodHRwOi8vMTI3LjAuMC4xOjgwODEvYXV0aC9yZWFsbXMvcmVzdGNvbW0tdGVzdCIsImF1ZCI6Imh0dHA6Ly8xMjcuMC4wLjE6ODA4MS9hdXRoL3JlYWxtcy9yZXN0Y29tbS10ZXN0IiwidHlwIjoiUmVnaXN0cmF0aW9uQWNjZXNzVG9rZW4ifQ.bI2JQLOAwWdxgtaNgAXw8aliWRJRs7RviNJRPHPHyVFI6AfuBsEpZ9c5e_v6vFD0hWoNjneUnDmS-CUrzPKcBWrITXkrUwxwEQAJpQD-ONWim6AiVVOxr3sizgwxRyBX__Cny8IMm8BWjUIIIkRviSc9QE7tYscTRTE4AP5ZRlsmB7hsmfkRSgzmd5SF2ZQWj8DriSou_-ivzZ9wnlwENoewePOK1b6oZhhGQiGo4SM0pLkTWGkN8kuO3aYei6OKiol2eJn9B4bA7wr6uUruEAg03symAaDFWscpmHIl27sxF3XkYdn8F-vJwNdhFJx_t84IEKucwZEwdgNFuWZuIQ 3. I make the update request to: http://127.0.0.1:8081/auth/realms/restcomm-test/clients-registrations/def... here is the curl command: curl -i -X PUT \ > -H "Authorization:Bearer eyJhbGciOiJSUzI1NiJ9.eyJqdGkiOiJhNDc3NzA3Yi1hOGM4LTRjMGItYjExYi0xZWE4ZTgyNTNkYTgiLCJleHAiOjAsIm5iZiI6MCwiaWF0IjoxNDY2NTEyMDc4LCJpc3MiOiJodHRwOi8vMTI3LjAuMC4xOjgwODEvYXV0aC9yZWFsbXMvcmVzdGNvbW0tdGVzdCIsImF1ZCI6Imh0dHA6Ly8xMjcuMC4wLjE6ODA4MS9hdXRoL3JlYWxtcy9yZXN0Y29tbS10ZXN0IiwidHlwIjoiUmVnaXN0cmF0aW9uQWNjZXNzVG9rZW4ifQ.G33SBIhvFay8YAMkGxeyWMDSfeM9slS7pv49hWNxmmvaNUmUOFhP8e2-WcQJW2NZEumOKSm-UGk-2VH5EiB24F8DWn9hGVOlJdIysewbyei94Xqcu-xoOAhSRdcU3xOEEKrVBQxTAQRWahp5Jil1A_jHoY1bLcQk1Keu1WAOKDBgUyGu2pO7sfs1hjUHQ2V_pC9xOeC7rf3rpdXF7OAb9Xf8pD1_xfuUwMSGJzey0Mqs3dp9qS_v4g6CaOQvcMOVgf0_cb0RKkeSyqgxcTO0Laxrz7NNP4I9ZojLQE_8bEyPQyrREfWZj8zQp4hLO89k_O_xzv3iOYOj064xiEX6nA" \ > -H "Content-Type:application/json" \ > -d \ > '{"clientId":"newclient","enabled":false} > ' \ > ' http://127.0.0.1:8081/auth/realms/restcomm-test/clients-registrations/def... ' 4. I get a 500 Internal Server error response with the following error in the logs: RESTEASY002005: Failed executing PUT /realms/restcomm-test/clients-registrations/default/newclient: org.jboss.resteasy.core.NoMessageBodyWriterFoundFailure: Could not find MessageBodyWriter for response object of type: org.keycloak.representations.idm.ClientRepresentation of media type: application/octet-stream 5. If i run again i get a 401 so it seems that authorization passes the first time but something breaks afterwards. Next time, the one-time token is already consumed so i get a 401. Ok, that makes sense. As you may have noticed i'm using a pretty reduced version of the ClientRepresentation but i've also experienced with others that are more or less complete and also by sending the *exact json response as returned when retrieving the client*. Same result :-( Also, the rest of the HTTP methods (POST on /default,DELETE, GET) work fine with the registration access token. So it seems that either i'm sending crap or sth else happens. Any ideas what may be wrong? Thanks

10 years, 1 month

1
0
0 / 0

Idp and authenticate by default

by Sjef Hoeks

Hi, I setup Keycloak for using an Identity Provider. Everything works fine, i.e. when I open my application, I see the Keycloak login screen, choose the Identity Provider (e.g. GitHub), login and I can use my application. When I open the application again in a new tab, I'm already logged in and I can use the application without logging in again. But I always want to use the Identity Provider, so I check Authenticate by Default in the settings tab of the Identity Provider. Everything seems to work fine, but when I open the application in a second tab, the first tab is reauthenticating. And then the second tab is reauthenticating. And so on. I tried this with my own implemented Identity Provider and with GitHub. I expected that the only difference is that I don't have to choose the Identity Provider. According to the docs only step 3 and 4 from the base flow are skipped (show list of identity providers and select identity provider). But the behaviour is very different. Is this expected behaviour or a bug? Kind regards, Sjef Sjef Hoeks Technisch Architect [cid:GOUWit_logo_3612b840-badb-433c-9c06-73aec15567bc.jpg] Gouw Informatie Technologie bv Hogeweg 5, 5301 LB Zaltbommel Postbus 98, 5300 AB Zaltbommel T 0418 511 522 M E s.hoeks(a)gouwit.nl I www.gouwit.nl

10 years, 1 month

2
1
0 / 0

User federation and password reset

by Ramon Rockx

Hi, Currently I am working on a user federation provider which should help us out migrating from our old authentication application to Keycloak. All this is done basically by following this great blog https://tech.smartling.com/migrate-to-keycloak-with-zero-downtime . The blogs offers a way of migrating user accounts with hashed passwords in your legacy authentication application, without resetting the passwords of all users in Keycloak. In short, when authenticating a user, first Keycloak checks it's own local storage. If the user does not exists already, it will try to authenticate using our legacy authentication application and will copy the user data from the legacy application. When authentication fails the user will be federated. If successful, the entered password will be set for the Keycloak user. From now on the user is migrated and not federated any longer. However, there is still one scenario I can't figure out how to deal with: we still want to offer our users the possibility to reset their passwords. For non-federated users Keycloak will do just fine. For federated users Keycloak also offers the password reset, but the user will still remain federated. In this case I would like to remove the federation and update the credentials in the Keycloak local storage (so the user is migrated). So, long story short, I think the UserFederationProvider should also offer the possibility to anticipate on a password change. This way you can update the credentials and/or remove the federation link. Or is there some other solution? Regards, Ramon Rockx

10 years, 1 month

2
1
0 / 0

automated Sync Keycloak Roles To LDAP

by Arjan Schaaf

Hi there, I’m integrating Keycloak in an environment where a have a couple of ‘legacy’ applications that allow for LDAP based external authentication, but do not support Keycloak or oauth / OpenID connect out-of-the-box. So I’m creating a setup where I use Keycloak as the primary repository for storing users and groups/roles, but I connect a LDAP server that is kept in sync with Keycloak and bind these applications to the LDAP service. That setup works decent enough: newly created users in keycloak are synced to LDAP and so on. However syncing Keycloak roles to LDAP doesn’t seem to work as convenient. I’ve created a User Federation Mapper of type Role mappings and when I use the “Sync Keycloak Roles To LDAP” button, the roles are synced with LDAP. Great! But when I create a new role in Keycloak I expected it to be synced automatically, just like a new Keycloak user is synced directly to LDAP. I need to use the “Sync Keycloak Roles To LDAP” manually again to update LDAP. Is this how it is designed to work or is there are way to update LDAP directly after changing something to Keycloak roles? Cheers, Arjan

10 years, 1 month

2
1
0 / 0

Re: [keycloak-user] Note about the documentation - Valid account guessing with the "forgot password" feature in Keycloak

by Tomás García

Yes, we already did our own authentication flow here a couple of weeks ago, but I decided today to communicate this situation. The question is that part of the documentation should be clarified, because at least I was confused after I saw the inconsistency when seeing the behaviour of the registration form: A malicious user will still be capable of guessing valid users, so it's something that should be warned to developers / admins. (Sorry I activated the digest mode of the mailing list and I don't really know how to properly reply to a thread without receiving the original email) ------------------ Feel free to extend the plugin then. :) On 6/15/16 4:49 PM, Tomás García wrote: >* Hi, *>>* In this url: *>* http://keycloak.github.io/docs/userguide/keycloak-server/html/auth_spi.ht... <http://keycloak.github.io/docs/userguide/keycloak-server/html/auth_spi.ht...> *>>* , it says: *>>* "This form *WILL NOT* re-ask the user to enter in an email or username *>* if the previous email or username did not exist. You need to prevent *>* attackers from being able to guess valid users. So, if *>* AuthenticationFlowContext.getUser() returns null, you should proceed *>* with the flow to make it look like a valid user was selected." *>>* And I totally agree with that, but it doesn't apply to all cases *>* unfortunately. If the admin enables "User registration", the user *>* registration form will tell the a possible malicious guy if the email *>* combinations she's trying already exists, invalidating what the above *>* paragraph says. And I don't think there's a way to do the same as in the *>* "forgot password" feature with the registration form, because after *>* registration, there's an autologin. *>>* Actually it's confusing for users telling them an email was sent event *>* if it's not... People sometimes can forget that they're not registered *>* in the Keycloak system, so the "forgot password" feature as it is today *>* will make them wait forever. At least, sending them an email telling *>* them "You're not registered. You can register visiting this link." if *>* "User registration" is enabled or "Ask your admin to register your email *>* in the system" if it's not, would be definitely better. *>>* Thanks. *>>* -- *>>* *Tomás García Pérez *>* * *>>* *Software Developer* *>>* *IntraHouse* *>>>>* _______________________________________________ *>* keycloak-user mailing list *>* keycloak-user at lists.jboss.org <https://lists.jboss.org/mailman/listinfo/keycloak-user> *>* https://lists.jboss.org/mailman/listinfo/keycloak-user <https://lists.jboss.org/mailman/listinfo/keycloak-user> *> -- *Tomás García Pérez* *Software Developer* IntraHouse

10 years, 1 month

1
0
0 / 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

keycloak-user June 2016