January 2017 - keycloak-user - Jboss List Archives

Keycloak data stores - Config, User, Realm, Session ...

by Santosh Haranath

We are evaluating to use Keycloak for a multi-tenant access management solution deployed across 2 regions. Red Hat OpenShift Container Platform version 3.3 is the deployment platform. We have some data model constraints which requires us to use LDAP store. - What is Keycloak's configuration store? How is configuration synchronized? Where is SAML meta data, OAuth Client credentials etc. stored? - I have read concerns about Mongo DB data store due to transaction requirements and possible removal of support from V3. Which SPI requires transactions? When is Version 3 due ? - Can we split data store responsibilities as below? SPI -> Data Store Provider /subsystem=keycloak-server/spi=realm -> Mongo /subsystem=keycloak-server/spi=user -> LDAP /subsystem=keycloak-server/spi=userSessionPersister -> Infinispan /subsystem=keycloak-server/spi=authorizationPersister -> Infinispan /subsystem=keycloak-server/spi=userFederatedStorage -> LDAP /subsystem=keycloak-server/spi=eventsStore -> Mongo Thanks.

7 years, 11 months

2
1
0 / 0

StaleCodeMessage on IDP Initiated SAML SSO

by Chris Brandhorst

I have two Keycloak instances, A is an IdP for B. From the login screen of B, this works as it should. However, I can’t get IDP Initiated SSO from A to B to work. I filled the "IDP Initiated SSO URL Name” field with a name (say “bbbbb”) in A. When I try to navigate to: http://aaaaa/auth/realms/his/protocol/saml/clients/bbbbb i always end up with the following logging: 22:42:02,993 DEBUG [org.keycloak.services] (default task-23) Authorization code is not valid. Code: null 22:42:02,994 WARN [org.keycloak.events] (default task-23) type=IDENTITY_PROVIDER_LOGIN_ERROR, realmId=master, clientId=null, userId=null, ipAddress=127.0.0.1, error=staleCodeMessage 22:42:02,994 ERROR [org.keycloak.services] (default task-23) staleCodeMessage Which in itself is not surprising, because indeed, there is no Authorization code in play here, but that’s the whole idea of IDP Initiated SSO, no? What must I do to get this to work? Thanks, Chris Brandhorst

7 years, 11 months

2
4
0 / 0

Using email attribute in SAML identity brokering

by Moshe Ben-Shoham

Hi, We have a few clients integrated with Keycloak relam, using email address as the user identifier. Now we wish to integrate KeyCloak with external IdP using its identity brokering capabilities based on SAML. The problem is, the user identifier in the external IdP is not the email address but some other username. We are able to get the email as an attribute in the SAML assertion coming into KeyCloak, but the missing part is mapping the email attribute to the user identifier in KeyCloak - how do we do that? Thanks! The information contained in this message is proprietary to the sender, protected from disclosure, and may be privileged. The information is intended to be conveyed only to the designated recipient(s) of the message. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, use, distribution or copying of this communication is strictly prohibited and may be unlawful. If you have received this communication in error, please notify us immediately by replying to the message and deleting it from your computer. Thank you.

7 years, 11 months

2
2
0 / 0

RBAC : adding permissions to roles

by Avinash Kundaliya

Hello, I have a very basic question and am curious how to model this via keycloak. In my application I have some roles. I want to map each role to a set of permissions so that based on those permissions i can check if the user has access to a specific action/resource in my application server. (pretty much how classically RBAC is done) I am curious if there is a defined pattern/way of modeling such a behavior in keycloak, or would the best way to do this would be to define and map permissions (to roles) in the application (i.e outside keycloak). What is the best practice for such a case? Regards, Avinash

7 years, 11 months

3
6
0 / 0

Synchronization Issue on Periodic Full Sync

by Sumit Das

Hi I have kept the "Periodic Full Sync" on during creation of an LDAP federation with an Active Directory instance. When I am creating a new user, the sync works and I am able to view the same user on the AD instance. But when I am creating any new role or group, the same is not reflected on the AD instance. I have refreshed the respective folders on the AD instance but still I am not able to view the updated Groups and Roles. But when I am assigning these roles or groups to any user, and then when the periodic sync triggers, at that moment I am able to view that respective Group or Role on the AD instance and the association with the user is also reflected. So newly created roles and groups are not reflected on the AD instance but when associated with a user, the syncing is reflected. Can you please guide me if I am doing something wrong or is this how the Keycloak LDAP Federation is supposed to work -- *Sumit Das* *Mobile No.- +91-9986872466 *

7 years, 11 months

2
1
0 / 0

Passing an array of user realm roles in a Token Mapper

by HATHERLY, Adam (NHS DIGITAL)

Hi, I have been using the Token Mappers within a Client to map a set of Keycloak Group Memberships into an attribute in the Token, so the client application can grant appropriate access based on this. The groups are coming through as an array in the token, which works nicely. I wanted to switch to using a "User Realm Role" mapper instead of "Group Memberships" because I can then set up automatic realm roles based on the identity source, which I can't do with Groups. My problem is, when I create a new User Realm Role mapper in the Client definition, the only types I can specify for the field are String, long, int or boolean. If I choose String, the list of roles comes through as a comma-separated String rather than an array in the JSON object. I'd rather not update all my clients to parse this - is there any way of getting keycloak to return the roles as an array rather than a string? Is this against the spec, or is there some other limitation I am not aware of that prevents this? Thanks, Adam.? Adam Hatherly Senior Technical Architect Central Architecture Service NHS Digital adam.hatherly(a)nhs.net<mailto:adam.hatherly@nhs.net> 0113 397 4164 07920 861 737 ******************************************************************************************************************** This message may contain confidential information. If you are not the intended recipient please inform the sender that you have received the message in error before deleting it. Please do not disclose, copy or distribute information in this e-mail or take any action in reliance on its contents: to do so is strictly prohibited and may be unlawful. Thank you for your co-operation. NHSmail is the secure email and directory service available for all NHS staff in England and Scotland NHSmail is approved for exchanging patient data and other sensitive information with NHSmail and GSi recipients NHSmail provides an email address for your career in the NHS and can be accessed anywhere For more information and to find out how you can switch, visit www.nhsdigital.nhs.uk/nhsmail ********************************************************************************************************************

7 years, 11 months

2
1
0 / 0

h2 for production

by lists

Hi, I understand that it is not recommened to use h2 as your production database format. However, reading this: http://stackoverflow.com/questions/12064030/are-there-any-reasons-why-h2-... and given our situation (small userbase, no heavy use, no cluster / replication, no HA, etc, etc) is choosing h2 really a bad idea? Could we, for example, run into problems with keycloak updates? MJ

7 years, 11 months

2
2
0 / 0

remove permission to a group of users (veto keycloak auth)

by David Delbecq

Hello, I'm trying to find out the best way to migrate one of our current behaviour to a keycloak based installation. We currently have a many to one relationship between user account and companies. A company can have multiple users in the application. We need to be able to disable a complete company on one application. What is the best approach to doing this? I tried (and failed) to create an additional required login module in wildfly and have this return false on login() if company has not been enabled in application. It seems that when you come with a bearer token, you don't go into login modules (neither mine nor the keycloak one), you are just immediately recognized by subsystem which then bypass the jaas login modules of keycloak. I can't just disable the users, as they still need to be able to log in on our other applications. I was thinking into using Groups in keycloak, one for each company&application combo and add / remove an automatic required role to block access to disabled companies. But it means a double maintenance between keycloak and our internal database to maintain the list of companies. Is there someway to tap in the the wildfly keycloak subsystem to veto valid authentications? thank you. -- <http://www.trimble.com/> David Delbecq Software engineer, Transport & Logistics Geldenaaksebaan 329, 1st floor | 3001 Leuven +32 16 391 121 <+32%2016%20391%20121> Direct david.delbecq(a)trimbletl.com <http://www.trimbletl.com/>

7 years, 11 months

2
2
0 / 0

Optional 2FA

by Stefan Schlesinger

Hi, is there a way to configure Keycloak, so that 2FA via OTP gets optional for certain clients only? Best, Stefan.

7 years, 11 months

2
1
0 / 0

question on integration in a mixed environment

by Istvan Orban

I am in the middle of setting up SSO in our infrastructure and I am wondering if people would more experience could share their learnings. I already have a reverse-proxy in-front of our system. We have several legacy java apps running on tomcat We have SPA apps as well written in JS We have few APIs that will also need to be protected I have two ways to set SSO up for us. set up SSO on the reverse proxy using mod_auth_openidc so our gatekeeper makes sure that anyone who is hitting our services is already validated. add a keycloak libs to each individual service My preference is to set this up on the referse proxy. Are there any disadvantages / best practices when it comes to this? For legacy apps I would just use the HTTP headers added by the reverse proxy to find user details For the new apps I would like to use the keycloak libs to get user details. I do not want to go down some routes which is obviously problematic. So Any tips so that I can save some time are very welcome. -- Kind Regards, *----------------------------------------------------------------------------------------------------------------* *Istvan Orban* *I *Skype: istvan_o *I *Mobile: +44 (0) 7956 122 144 *I *

7 years, 11 months

1
0
0 / 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

keycloak-user January 2017