August 2016 - keycloak-user - Jboss List Archives

User Federation : How to implement provider if users are stored in other stores

by Deepak Garg

Hi, We have a existing web application which is using RDBMS database for authentication and authorization. I like to know how I can use keycloak to authenticate my user against same RDBMS databse. In your documentation under User Federation you have mentioned that we can implement our own provider if we have users in other stores such as RDBMS. Can you please let me know how to do it. We are running ASP.Net web apps which is written in HTML5, JQuery and CSS3. Thanks, Deepak

7 years, 8 months

2
1
0 / 0

send-verify-email with redirect seems not to work

by Stephen Flynn

I am using the following Rest API call on a standalone Keycloak server (v2.0.0)... */auth/admin/realms/{realm}/users/{id}/send-verify-email?client_id=XYZ&redirect_uri=abc* The call works almost as expected... * sends email with link to users email (https://auth.xyz.com/auth/realms/abc/login-actions/required-action?code=x....) * the link, when followed, marks the user as 'email verified' and clears the required action. * events log (event = CUSTOM_REQUIRED_ACTION, custom_required_action=VERIFY_EMAIL) looks OK and includes the correct redirect_uri as included in the initiating REST call. * link can only be used once. BUT the link doesn't redirect back to the redirect_uri as I would expect. Instead the user browser remains at the emailed link (https://auth.xyz.com/auth/realms/abc/login-actions/required-action?code=x....). Am I missing something here ? Am I expecting the wrong behaviour or is this a bug ? best rgds, Steve F. -- =================================================== *Stephen Flynn* *Director, JF Technology (UK) Ltd* Cell (UK) : +44 7768 003 882 Phone : +44 20 7833 8346 IM : xmpp:stephen.flynn@jftechnology.com IM : aim:stephen.flynn@jftechnology.com Website : http://www.jftechnology.com Tech support : support(a)jftechnology.com <mailto:support@jftechnology.com> ===================================================

7 years, 8 months

1
0
0 / 0

Can't retrieve group roles in access token

by Cedric Falletta

Hello, I recently installed keycloak 2.0.0 and I'm having troubles retrieving the roles of my users in the access token. I made a simple test in which I created a user "WebUser" and a group "GROUP-Website". I added the role "GROUP-Website" to my "WebUser" and then assigned the role "ROLE-Website" to this group. User should then inherit from this role. I then configured a client which maps groups and roles to my access tokens. It works well, but I can't find "ROLE-Website". Note that if I add a specific role directly to the user, it will be present in the access token. My problem here is then only related to the roles of my groups not being assigned to the user. As far as I understood from other issues, these roles should be present in the token. Can you then tell me if I somehow misconfigured the client or the mapper ? Thank you, Cédric Lampiris SA/NV Rue Saint-Laurent, 54. 4000 - Liège. Belgique [Lampiris]<https://www.lampiris.be/isol> [Facebook]<https://facebook.com/lampirisEU> [Twitter] <https://twitter.com/lampiris> [LinkedIn] <https://www.linkedin.com/company/lampiris> [Google+] <https://plus.google.com/110992956589822085996> [YouTube] <https://youtube.com/user/lampirismedia> [Instagram] <https://instagram.com/lampiris> Please consider the environment before printing this e-mail This message contains confidential information and is intended only for the individual(s) addressed in the message. If you are not the addressee you are notified that disseminating, distributing or copying this e-mail is strictly prohibited.

7 years, 8 months

2
2
0 / 0

How to configure a user Federation SPI implementation

by Zhaohua Meng

I wrote a user federation SPI implementation to integrate our internal user management. Particularly, an implementation of org.keycloak.models.UserFederationProviderFactory and org.keycloak.models.UserFederationProvider. My question is, how do you configure it in the keycloak-server.json? The documentation gave example for event listener but not user federation. Following the doc with similar approach I tried “{ “userFederation”: { “my-impl”: { “myProperty”:””, ...} …}}”, and all kinds of combinations like that but nothing worked. I’d really appreciate if you can share some experience here. I’m quoting the doc in this regard here: https://keycloak.gitbooks.io/server-developer-guide/content/v/2.0/topics/... ...… Configuring a provider You can pass configuration options to your provider by setting them in keycloak-server.json. For example to set the max value for my-event-listener add: { "eventsListener": { "my-event-listener": { "max": 100 } } } ….. Thanks, -- Zhaohua Meng Business Intelligence, AppNexus 973-936-8028 (cell) 973-415-8028 (home)

7 years, 8 months

3
4
0 / 0

OIDCFilterSessionStore

by Mohan.Radhakrishnan＠cognizant.com

Hi, I have some doubts. I am using spring boot. The servlet filter adapter actually uses sessions. Is that right ? I was thinking the token will be required for every Rest endpoint access. But unless I clear jsessionid it is not required. Have I understood this correctly ? How do I get the claims from my implicit token ? Do I need the spring boot adapter ? Can I see an example combining implicit token and boot adapter ? Thanks, Mohan This e-mail and any files transmitted with it are for the sole use of the intended recipient(s) and may contain confidential and privileged information. If you are not the intended recipient(s), please reply to the sender and destroy all copies of the original message. Any unauthorized review, use, disclosure, dissemination, forwarding, printing or copying of this email, and/or any action taken in reliance on the contents of this e-mail is strictly prohibited and may be unlawful. Where permitted by applicable law, this e-mail and other e-mail communications sent to and from Cognizant e-mail addresses may be monitored.

7 years, 8 months

2
3
0 / 0

Does keycloak configuration support preventing a user from double simultaneous sign on?

by Richard Lavallee

Does keycloak configuration support preventing a user from double simultaneous sign on? E.g. User A on machine X logs in via Keycloak and same user A on machine B also logs in via Keycloak; both for same Realm. -Richard

7 years, 8 months

2
1
0 / 0

One click social-account linking widgets on website autheticated by Keycloak JS adapter

by Vlastimil Elias

Hi, we have a requirement to implement 'One click social-account linking widgets' on website autheticated by Keycloak JS adapter. To achieve this a button would be placed on the website with the following flow: 1. User logs into the website (keycloak JS adapter) 2. User browser to a part of the site requiring social account linking (site checks linking status of current user for given social login provider based on info in token - we wrote our mapper for this) 3. User clicks on a button to link the required social account with his Keycloak account 4. User is directed through the linking process (which is similar as Social Link action in Account app) 5. User is returned to original page on successful account linking (token in js client must be refreshed to contain actual info about social links). Is there any way how to achieve this? I tried to call JS client login method with idpHint when user is logged in (keycloak.login({"idpHint":"github"})), but it doesn't work as expected. Thanks a lot in advance Vlastimil -- Vlastimil Elias Principal Software Engineer Red Hat Developer | Engineering

7 years, 8 months

3
3
0 / 0

How to implement this using Keycloak

by Rong Sang (CL-ATL)

Hi all, I’m doing a POC using Keycloak. The normal authentication/authorization features work well, but I have the following requirement that cannot find a straightforward solution for. I hope some security experts in the mailing list can point me to the right direction. Here is the requirement. A hospital has multiple units. Users should not have the access to patients in a unit that they are not authorized. I have one service that returns a list of patients across units. What’s the best way to set up authorization for this service? As I said earlier, I cannot find a feature for me to implement this. Any idea is greatly appreciated. Thanks, Rong

7 years, 8 months

3
7
0 / 0

Re: [keycloak-user] Multi tenancy -Groups

by Aikeaguinea

I had a thread on this list with I think the same question. You can find it here: http://keycloak-user.88327.x6.nabble.com/keycloak-user-One-client-applica... > Pls help. > > > Regards, > Subrahmanyam > > > > > Hi, > Here are few questions regarding Groups and multi tenancy > approaches. > 1. Assuming a scenario where one client (application) in keycloak > to be accessible by couple of customers (customer 1 and customer > 2). Then what is the possible approaches. > 2. Can I have one realm per customer, in this case the client has > to be duplicated against per realm and Keycloak.json file has > to be updated every time when a new customer comes in. > 3. If we have one realm and a group per customer, then I should be > able to restrict the access (user management) per group. > > > Please suggest on this. > > > Regards, > Subrahmanyam. > > > > Email had 1 attachment: > * ATT00001.txt 1k (text/plain) -- Aikeaguinea aikeaguinea(a)xsmail.com -- http://www.fastmail.com - Does exactly what it says on the tin

7 years, 8 months

1
0
0 / 0

Unable to understand authorization/get it to work

by Ushanas Shastri

Hello, This is my first post on this mailing list, and I've been evaluating Keycloak for a couple of days. I've been unable to get Authorization to work the way I thought it should. Maybe I've not understood it right, and could do with some help. I am using the builtin Evaluation tool to check. Here's my scenario: I have a web based application, where we have typical CRUD operations being performed. For e.g. the application maintains a list of Source from which we expect to receive data. Users have the ability to add, edit, view or delete a Source, provided the Sources belong to their Business Unit. Here's what I did in Keycloak. - Created Source as a resource, with the 4 actions as scopes (add, edit, view and delete). - Added a Role based Policy to a role called "ViewOnly" - The ViewOnly role is mapped to users. - Created a Scope based permission, where View is the only scope on the resource, attached to the ViewOnly policy. Now, when I use the evaluation tool for scope "View", I get a permit, which is as expected. I then check the evaluation tool for scope "Delete", I get a a message "Could not obtain any result for the given authorization request. Check if the provided resource(s) or scope(s) are associated with any policy." Is this as expected? Isn't this supposed to return a Deny since the Policy Enforcement Mode on the realm is "Enforcing". Is this just a UI message, indicating the same as a Deny? Now, I add Delete as a scope to the same permission, and check on Delete scope in the evaluation tool, but I continue to get the same message as above. Shouldn't I be receiving a PERMIT now, as the same permission was modified to include the Delete Scope? The summary is that if I have more than one scope added to the permission, the evaluation tool returns this message. If I have only one scope in a policy, it works for me. What am I missing? Regards, Ushanas. This message is for the named person's use only. It may contain confidential, proprietary or legally privileged information. No confidentiality or privilege is waived or lost by any mis-transmission. If you receive this message in error, please immediately delete it and all copies of it from your system, destroy any hard copies of it and notify the sender. You must not, directly or indirectly, use, disclose, distribute, print, or copy any part of this message if you are not the intended recipient. Viteos Capital Market Services Ltd.and any of its subsidiaries each reserve the right to monitor all e-mail communications through its networks. Any views expressed in this message are those of the individual sender, except where the message states otherwise and the sender is authorized to state them to be the views of any such entity

7 years, 8 months

2
1
0 / 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

keycloak-user August 2016