August 2016 - keycloak-user - Jboss List Archives

by William Drescher [CELUM]

I am creating a basic invitation flow, Step1: User receives email with link to registration Step1: User fills out registration Step1: User is transferred to application The first two steps I completed by creating a required action provider and remotely created the user with the proper email and then sent an ExecuteActionsEmail, the problem is that after the user fills out the information and updates their account I am unable to redirect them to the application. I've tried setting the redirect URI in the context client session without success and was wondering if anyone knew a way to do this. I also would like to authorize the user for the application so they don't have to login again. I've gone through the documentation but wasn't able to find anything applicable. I'm also wondering where I can find documentation on the Keycloak project architecture to help in understanding how Keycloak works. Thanks, Will

7 years, 9 months

1
0
0 / 0

Username Password Form as Alternative

by Filipe Lautert

Hello I would like to have the "Username Password Form" auth type as a fallback option - I've setup my personalized auth methods, but if they don't succeed I wan't the user to be shown the login form. The issue that I face is that even when I authenticate the user successfully (in my Authenticator code with context.setUser(myUser); context.success(); ) the login form is still shown to the user, even if it's inside a auth type "Browser Forms" set up as alternative. I worked around it creating a class called AlternativeUsernamePasswordFormFactory that extends UsernamePasswordFormFactory, and the only change that I did to it was to add the AuthenticationExecutionModel.Requirement.ALTERNATIVE to the REQUIREMENT_CHOICES . Now, if I set this new auth type as alternative in Keycloak, it does what I want. So my questions are: am I missing something to mark my Authenticator as sufficient to end the flow and return to the client? if not, is there a reason why UsernamePasswordFormFactory doesn't provide the ALTERNATIVE option, and can I suggest a patch to add it to this class? Cheers filipe -- filipe lautert

7 years, 9 months

2
1
0 / 0

GoogleIdentityProvider seems to be broken for Keycloak 2.1.0.CR1

by Sigbjørn Dybdahl

Hello, I'm trying to configure an instance of Keycloak using version 2.1.0.CR1 and I've run into a problem when using the Google Identity Provider with the default configuration. That is, during the callback I observe a org.keycloak.broker.provider.IdentityBrokerException: Could not fetch attributes (see complete stacktrace below for details) from userinfo endpoint which seems to be linked to the 403 Forbidden return code when calling https://www.googleapis.com/plus/v1/people/me/openIdConnect. This seems to be similar to https://issues.jboss.org/browse/KEYCLOAK-2942, but even when adding the additional Google+ scopes (making scope=openid profile email https://www.googleapis.com/auth/plus.me https://www.googleapis.com/auth/plus.login) the call fails. As for JIRA-2942, I've tried setting up a user-defined OpenId Connect provider with the default scope, which works just fine. Have I forgotten any important parameter while configuring the standard Google support? Or is this a regression for this release? Regards, Sigbjørn Dybdahl --- Here's the complete stacktrace for the exception: 20:07:12,247 ERROR [org.keycloak.broker.oidc.AbstractOAuth2IdentityProvider] (default task-20) Failed to make identity provider oauth callback: org.keycloak.broker.provider.IdentityBrokerException: Could not fetch attributes from userinfo endpoint. at org.keycloak.broker.oidc.OIDCIdentityProvider.getFederatedIdentity(OIDCIdentityProvider.java:304) at org.keycloak.broker.oidc.AbstractOAuth2IdentityProvider$Endpoint.authResponse(AbstractOAuth2IdentityProvider.java:230) at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.lang.reflect.Method.invoke(Method.java:498) at org.jboss.resteasy.core.MethodInjectorImpl.invoke(MethodInjectorImpl.java:139) at org.jboss.resteasy.core.ResourceMethodInvoker.invokeOnTarget(ResourceMethodInvoker.java:295) at org.jboss.resteasy.core.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:249) at org.jboss.resteasy.core.ResourceLocatorInvoker.invokeOnTargetObject(ResourceLocatorInvoker.java:138) at org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorInvoker.java:107) at org.jboss.resteasy.core.ResourceLocatorInvoker.invokeOnTargetObject(ResourceLocatorInvoker.java:133) at org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorInvoker.java:101) at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:395) at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:202) at org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.service(ServletContainerDispatcher.java:221) at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:56) at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:51) at javax.servlet.http.HttpServlet.service(HttpServlet.java:790) at io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:85) at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:129) at org.keycloak.services.filters.KeycloakSessionServletFilter.doFilter(KeycloakSessionServletFilter.java:90) at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:60) at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131) at io.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.java:84) at io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:62) at io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36) at org.wildfly.extension.undertow.security.SecurityContextAssociationHandler.handleRequest(SecurityContextAssociationHandler.java:78) at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) at io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:131) at io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:57) at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) at io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:46) at io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64) at io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:60) at io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:77) at io.undertow.security.handlers.NotificationReceiverHandler.handleRequest(NotificationReceiverHandler.java:50) at io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43) at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) at org.wildfly.extension.undertow.security.jacc.JACCContextIdHandler.handleRequest(JACCContextIdHandler.java:61) at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) at io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:284) at io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:263) at io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:81) at io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:174) at io.undertow.server.Connectors.executeRootHandler(Connectors.java:202) at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:793) at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) at java.lang.Thread.run(Thread.java:745) Caused by: java.io.IOException: Server returned HTTP response code: 403 for URL: https://www.googleapis.com/plus/v1/people/me/openIdConnect at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method) at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62) at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45) at java.lang.reflect.Constructor.newInstance(Constructor.java:423) at sun.net.www.protocol.http.HttpURLConnection$10.run(HttpURLConnection.java:1890) at sun.net.www.protocol.http.HttpURLConnection$10.run(HttpURLConnection.java:1885) at java.security.AccessController.doPrivileged(Native Method) at sun.net.www.protocol.http.HttpURLConnection.getChainedException(HttpURLConnection.java:1884) at sun.net.www.protocol.http.HttpURLConnection.getInputStream0(HttpURLConnection.java:1457) at sun.net.www.protocol.http.HttpURLConnection.getInputStream(HttpURLConnection.java:1441) at sun.net.www.protocol.https.HttpsURLConnectionImpl.getInputStream(HttpsURLConnectionImpl.java:254) at org.keycloak.broker.provider.util.SimpleHttp.asString(SimpleHttp.java:148) at org.keycloak.broker.oidc.util.JsonSimpleHttp.asJson(JsonSimpleHttp.java:46) at org.keycloak.broker.oidc.OIDCIdentityProvider.getFederatedIdentity(OIDCIdentityProvider.java:267) ... 50 more Caused by: java.io.IOException: Server returned HTTP response code: 403 for URL: https://www.googleapis.com/plus/v1/people/me/openIdConnect at sun.net.www.protocol.http.HttpURLConnection.getInputStream0(HttpURLConnection.java:1840) at sun.net.www.protocol.http.HttpURLConnection.getInputStream(HttpURLConnection.java:1441) at sun.net.www.protocol.http.HttpURLConnection.getHeaderField(HttpURLConnection.java:2943) at sun.net.www.protocol.https.HttpsURLConnectionImpl.getHeaderField(HttpsURLConnectionImpl.java:291) at org.keycloak.broker.provider.util.SimpleHttp.asString(SimpleHttp.java:147) ... 52 more

7 years, 9 months

4
6
0 / 0

Is it possible to authenticate against a Keycloak's Identity Provider (OpenAM) without using the Login screen?

by Abelardo Vacca

I am wondering if it is possible to delegate to authentication to an identity provider, as you would on the Login Page, but using the REST API. I've posted to stackoverflow a few minutes ago with details and diagrams to try to explain the best I could: http://stackoverflow.com/questions/38859379/is-it-possible-to-authenticat... Please feel free to correct any misconceptions I might have, I am new to all these tools I am posting about (APIMAN, Keycloak and OpenAM) Thanks,Abelardo

7 years, 9 months

3
2
0 / 0

Keycloak 2.1.0.Final released

by Marek Posolda

Keycloak 2.1.0.Final has just been released. This release only contains one fix related to Authorization services since 2.1.0.CR1 release. For the list of resolved issues check out JIRA <https://issues.jboss.org/issues/?jql=project%20%3D%20keycloak%20and%20fix...> and to download the release go to the Keycloak homepage <http://www.keycloak.org/downloads>. Before you upgrade refer to the migration guide <https://keycloak.gitbooks.io/server-adminstration-guide/content/v/2.1/top...>

7 years, 9 months

1
0
0 / 0

Can no longer create users in Active Directory from Keycloak

by Edgar Vonk - Info.nl

Hi, We no longer seem to be able to create new users in Keycloak with the LDAP/MSAD User Federation set up with ‘Sync Registrations’ turned on. I think this is since we migrated to Keycloak 2.0.0.Final (not 100% sure). When I try to create a new user from Keycloak (Manage - Users) I only see the error message ‘Error! Could not create user’ but nothing else. Nothing in the logs unfortunately. Not even at the debug level. Any pointers on where to start looking for a solution? I have the Keycloak source code available. cheers Edgar

7 years, 9 months

2
3
0 / 0

Multiple calls required to create a user

by Tom Pearson

Hi, I'm creating a new user through the admin API. In order to do this I have to make 3 separate calls (createUser <http://www.keycloak.org/docs/rest-api/index.html#_create_a_new_user>, resetPassword <http://www.keycloak.org/docs/rest-api/index.html#_set_up_a_temporary_pass...> and addRealmLevelRoles <http://www.keycloak.org/docs/rest-api/index.html#_add_realm_level_role_ma...>) as the credentials and realm roles in the UserRepresentation <http://www.keycloak.org/docs/rest-api/index.html#_userrepresentation> are ignored. I then have to make another call to getEffectiveRealmLevelRoles <http://www.keycloak.org/docs/rest-api/index.html#_get_effective_realm_lev...> as the getUser <http://www.keycloak.org/docs/rest-api/index.html#_get_represenation_of_th...> method doesn't return the roles. If I were to require the client level roles this would be 6 calls to create and return the user. Is there a reason as to why this is the case? As an aside, in the docs the reset password method is called "Set up a temporary password for the user" but in my experience the password is never temporary regardless of the value of the temporary flag. Kind regards, Tom

7 years, 9 months

4
10
0 / 0

Keycloak doesn't close the user session after the user is deleted

by Jagannadha Rekala

Hello, We are using Keycloak with SAML HTTP post binding with service provider clients. User 'X' is logged into the service provider via Keycloak's SSO. The user 'X' has been deleted by admin user via Keycloak's Admin console. Still the user session for 'X' is maintained. Keycloak doesn't logout the active session for the user 'X'. Please let me know if there is any configuration to force logout the user after the user deletion from Admin console. Thanks, Jagan

7 years, 9 months

1
0
0 / 0

CXF Keycloak Admin Client

by Luigi De Masi

Hi, I'm working on a Spring boot + Fuse integration Service project that use cxf to expose restful web services and KC admin client to manage users in a realm. I had some issues (that I was expecting...) running CXF servers and RESTEasy KC admin client together so I decided to remove all RESTEasy/jboss dependency from KC client and adapt the code to use CXF as JAX-RS implementation. It works quite well with very few changes, so I decided to share it on my github in case someone else is in the same situation as me or prefer CXF over RESTEasy. https://github.com/luigidemasi/keycloak-cxf-admin-client I'm also thinking about adding OSGI support to have the possibility to deploy it in karaf and maybe a camel component as well. Regards. -- Luigi De Masi *"Talk is cheap. Show me the code."* * -- Linus Torvalds* -- ------------------------------ Extra srl p: +39 0587975800 a: Via Salvo D'Acquisto 40/P - 56025 - Pontedera - Italy <https://goo.gl/maps/ngs7hecn9By> w: www.extrasrl.it e: info(a)extrasys.it <https://www.facebook.com/Extra-149813195076455/?fref=ts> <https://twitter.com/extrasrl> <https://www.linkedin.com/company/extra-srl> <https://flipboard.com/@extrasrl/soluzioni-per-il-business-0rk6urr6y> <https://www.youtube.com/channel/UCZa_aTznqeh5zoIPKPk1dNg> Le informazioni trasmesse sono riservate alla persona o ente alla quali sono indirizzate e possono contenere informazioni riservate e/o materiale di valore. Qualsiasi revisione, ritrasmissione, diffusione o altro uso, o l'adozione di azioni basate su tali informazioni da parte di soggetti diversi dal destinatario è proibita. Se avete ricevuto per errore questo messaggio, siete pregati di informare il mittente e cancellare il materiale contenuto da ogni computer. The information transmitted is intended for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender and delete the material from any computer.

7 years, 9 months

3
4
0 / 0

ClientRoles property is empty in UserRepresentation

by NEMECKAY Marek

Dear all, We are facing a problem with retrieving the client roles from Keycloak. In our implementation we are using the following API to find a retrieve user data via username: http://www.keycloak.org/docs/rest-api/index.html#_get_users In the retrieved UserRepresentation<http://www.keycloak.org/docs/rest-api/index.html> object instance the property clientRoles is always null. We are using Keycloak 1.9.8 connected to a LDAP server for user federation. We are connecting a receiving the access token with a admin-user of the corresponding realm. This works just fine. We are also receiving user data like name, e-mail etc., but the client roles are always null. The mappers to sync roles between Keycloak and LDAP are also defined and working. Is there anything else we have overlooked or we should check? Thanks and BR, Marek

7 years, 9 months

3
3
0 / 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

keycloak-user August 2016