October 2017 - keycloak-user - Jboss List Archives

No state cookie returned from the keycloak adapter

by Sarp Kaya

Hello, A use case I have noticed is: 1) User tries to use the web application. Say http://www.app.com 2) The application redirects you to the login page http://www.keycloaklogin.com/auth/realms/realm-name/protocol… 3) Before logging in, user bookmarks this page. 4) User logs in and then gets redirected to http://www.app.com 5) All works fine up till now Now user logs out, closes browser etc. Now user starts the workflow from bookmarked page (http://www.keycloaklogin.com/auth…) 1) User sees a login page 2) User logs in 3) User gets redirected to http://www.app.com?state=… 4) At this point this below code: https://github.com/keycloak/keycloak/blob/master/adapters/oidc/adapter-co... is executed and user sees a 400 page due not having OAuth_Token_Request_State . So far you can argue that, well we didn’t want user not to have OAuth_Token_Request_State in the first place, but the next step that user can do is: 5) User goes to http://www.app.com page and then gets a redirect back to the login page http://www.keycloaklogin.com/auth/realms/realm-name/protocol… 6) Keycloak sees that user is already logged in so redirects back to the same page 7) User now can see http://www.app.com<http://www.app.com/> due to the OAuth_Token_Request_State created in step 5 So to me it seems like this check is obsolete, however I’m curious whether this has a user case or prevents anything. If not, then it might be worth fixing at the step 4 where user actually gets to see the page (or re issue OAuth_Token_Request_State ) instead of showing 400 page. Thanks, Sarp

6 years, 10 months

3
2
0 / 0

Blog post about cross-datacenter replication in Keycloak 3.3.CR1

by Thomas Darimont

Hello, in case you missed it (as I did...), there is an interesting blog post about cross-datacenter replication in Keycloak 3.3.CR1 http://blog.keycloak.org/2017/09/cross-datacenter-support-in-keycloak.html @keycloak-Team Would be great if you could drop a mail to the mailing list for articles like this :) Cheers, Thomas

6 years, 10 months

3
2
0 / 0

JS adapter constantly refreshing page

by sesnor.silva＠sapo.pt

Hello, I'm trying to integrate keycloak's JS adapater into an application. However for some reason the page keeps refreshing (every 5 seconds or so?) after successfully logging in. I managed to reproduce the problem with the following minimal code:  <!DOCTYPE html> <html> <head> <title></title> </head> <body> <script type="text/javascript" src="https://ajax.googleapis.com/ajax/libs/angularjs/1.6.4/angular.min.js"></script> <script type="text/javascript" src="<MY KEYCLOAK SERVER>/auth/js/keycloak.js"></script> <script type="text/javascript"> angular.element(document).ready(function() { var keycloakAuth = Keycloak('keycloak.json'); keycloakAuth.init({ onLoad: 'login-required' }).success(function(authenticated) { keycloakAuth.loadUserInfo().success(function (userInfo) { console.log(userInfo) }); }).error(function() { var error = "There was an error initializing the authentication module."; console.error(error); }); }); </script> </body> </html> I tried searching around but I didn't find too many answers. I tried to base my implementation around: https://github.com/bandrzejczak/keycloak-angular-akka-http/blob/master/cl... and https://github.com/keycloak/keycloak/tree/master/examples/demo-template/a... But I get the same behavior every time: The page just keeps refreshing. It seems to be related to blocking third-party cookies on the browser. I use Firefox 53. Since my Keycloak isn't on the same host as the application, I think the browser rejects the keycloak's cookies. If this is the case, what could be a workaround for this? Is there any option on the adapter's side? I'm worried some browser might block third-party cookies by default (Opera and Brave Browser come to mind). Thank you, My best regards, Silva

6 years, 11 months

3
2
0 / 0

How to display user information from keycloak SAML adapter assertions/session?

by ken edward

Hello, I have configured a tomcat Keycloak SAML adapter with ADFS as my Idp. I created a simple web app with a protected /saml directory. It seems to work. BUT how can I display the logged in user information after the user is authenticated? org.keycloak.adapters.saml.SamlSession : org.keycloak.adapters.saml.SamlSession@13a50bc9 Ken

6 years, 12 months

3
4
0 / 0

Credential Representation TOTP example

by Maximiliano

I'm trying to add a TOTP for an user with Admin Client API. Someone has an CredentialRepresentation setup for TOTP? -- View this message in context: http://keycloak-user.88327.x6.nabble.com/Credential-Representation-TOTP-e... Sent from the keycloak-user mailing list archive at Nabble.com.

6 years, 12 months

2
6
0 / 0

sessions are lost after restart - 3.3.0.CR2

by shop24＠wolke7.net

Hi, as we plan to update to 3.3.0.Final, I already started to play with the current CR2 and check the features we use. We save our sessions in the file based infinispan cache <local-cache name="sessions" xmlns="urn:jboss:domain:infinispan:4.0"> <file-store passivation="false" fetch-state="true" purge="false" relative-to="jboss.home.dir" path="/infinistate/session" /> </local-cache> I can see the session.dat file there growing on the amount of sessions, and as long as the server stays alive, the sessions can be counted. But when I restart the server, no sessions are visible on the admin console neither by the REST API. Those things worked at least until 3.1.0.Final. Is this a bug or can I configure this some how different now? Are you working on it and it is one of the point, that are not final? Regards, Marie

7 years

3
3
0 / 0

OTP Policy updates not reflects in Google Authenticator

by forums.akurathi＠gmail.com

Dear all, We are running into a weird problem i.e., updates to OTP policy does not reflect at google authenticator app. We wonder is there any special instructions needed to get this working. A sequence of steps : 1) create realm, create user 2) enable OTP 3) login with the newly created user 4) system asks you to configure OTP 5) update OTP policy such as number of digits from 6 to 8 6) try login again 7) system asks you to enter OTP but authentication fails We expect the system should route the user to configure OTP page rather than prompting to enter OTP which anyways fails. Your response is highly appreciated !!! Thanks in advance Regards Krishna Kumar Akurathi

7 years

2
2
0 / 0

identity broker role mapping bug?

by Simon Payne

Hi, i think i may have found a bug in the identity provider mapping of claims to roles. it appears that if i have an identity provider with claims in the token, which i want to map to a role in the identity broker, then it only does this once during the first time login. if i remove the claim from the identity provider token, then this successfully removes it from the broker - but never remaps if i then add it again. the scenario i am trying to create here is that the identity provider is responsible for authentication where active directory groups appears as claim in the token. the broker then map this claim to the role providing the authorization. this behaviour appears to be the same whether i map a broker role to a custom claim or a realm role in the provider token. hope this makes sense, thanks Simon.

7 years, 1 month

2
4
0 / 0

User registration outside of Keycloak login form

by Niels Bertram

Hi Keycloak users, a strange question for the community ... I have a customer that wants to have SSO but does not want to use the Keycloak registration screens (themed or otherwise) but requires the user to be "logged in" to Keycloak after user registration. My understanding is that to get the SSO magic to work, a user agent must be redirected to the Keycloak server so the KEYCLOAK_SESSION? cookie can be set so that when the user navigates to another SSO enabled site after user registration, they would be identified in the auth flow of this client. Is there any way to create a valid SSO session without using the registration forms of Keycloak server itself? Like doing an XHR request that would create a user registration and also sets the required server side cookies in the user agent? Interested to hear your thoughts. Many thanks, Niels

7 years, 1 month

2
1
0 / 0

Keycloak & Large # of Realms

by John D. Ament

Hi All Looking for some more insight, haven't heard about this issue in a while. The specific endpoint I'm having issues with is the /auth/admin/realms endpoint -> https://github.com/keycloak/keycloak/blob/master/services/src/main/java/o... For what Keycloak is doing in the UI for the list realms, is it necessary to provide all realm details or can it use a simplified version of the realm representation to populate the drop down in the top left navigation (at least I'm assuming that's where it's being fetched to be populated into)? I'm seeing this endpoint perform particularly slowly. Some of the key spots (I have 125 - 750 calls to select authentica0_.ID as ID1_3_0_, authentica0_.ALIAS as ALIAS2_3_0_, authentica0_.BUILT_IN as BUILT_IN3_3_0_, authentica0_.DESCRIPTION as DESCRIPT4_3_0_, authentica0_.PROVIDER_ID as PROVIDER5_3_0_, authentica0_.REALM_ID as REALM_ID7_3_0_, authentica0_.TOP_LEVEL as TOP_LEVE6_3_0_ from AUTHENTICATION_FLOW authentica0_ where authentica0_.ID='15249ca1-1be3-4b59-a0e0-80bf00a107a4' (the ID changes per request, looks like you're loading auth flows per ID) - 250 calls to get client entities - 125 calls for groups, locales, enabled events, required actions, roles, smtp config, idps, attributes, roles, role mappers, etc. I suspect the 125 calls are needed, we don't want to load those in a larger batch. However, if there's a simpler use for realms that would be beneficial from a loading standpoint. John

7 years, 1 month

2
3
0 / 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

keycloak-user October 2017