November 2017 - keycloak-user - Jboss List Archives

by Jean-François HEROUARD

Hi, I am using the token exchange feature of Keycloak 3.4, which is really great and useful in my REST backoffice (before the only way i found was to do a lot of 302 in browser to get needed access tokens). Everything is documented for server configuration, but in java client is there a new function to exchange a token ? I wrote some code extending the current AuthzClient if anybody is looking for the same thing : public AccessTokenResponse exchangeAccessToken(String bearer, String bearerIdpName) { return this.http.<AccessTokenResponse>post(authzClient.getServerConfiguration().getTokenEndpoint()) .authentication() .client() .param("grant_type", "urn:ietf:params:oauth:grant-type:token-exchange") .param("subject_token", bearer) .param("subject_issuer", bearerIdpName) .param("subject_token_type", "urn:ietf:params:oauth:token-type:access_token") .param("audience", authzClient.getConfiguration().getResource()) .response() .json(AccessTokenResponse.class) .execute(); } Thanks

8 years, 4 months

1
0
0 / 0

Keycloak plugin using keycloak-services

by Anton Mazkovoi

Hi, I have a small plugin that adds a simple REST service to keycloak, which I would like to restrict access to members of the admin role. I am following the example: https://github.com/keycloak/keycloak/blob/3.2.1.Final/examples/providers/... I am deploying the plugin by copying into the "standalone/deployments” directory. The plugin errors out with: java.lang.NoClassDefFoundError: org/keycloak/services/managers/AppAuthManager How do I declare the dependency on "keycloak-services”? Or is there a simpler way to restrict access to a REST service to admin role members? Cheers, Anton

8 years, 4 months

2
1
0 / 0

KC-SERVICES0047: my-registration-action (test.extension.MyRegistrationFormActionFactory) is implementing the internal SPI form-action. This SPI is internal and may chang e without notice ---> Should I be concerned?

by SW

I created my own KeycloakRegistrationAction and it gives me this warning. Should I be concerned when upgrading to newer versions in the future? -- Sent from: http://keycloak-user.88327.x6.nabble.com/

8 years, 4 months

1
0
0 / 0

AuthzClient.create() for Spring Boot usage

by Niko Köbler

Hi, the „keycloak-authz-client“ package provides the AuthzClient class, which can be created by calling „AuthzClient.create()“. This automatically detects a „keycloak.json“ file and reads values for the „Configuration“ object. This is all good. But when it comes to Spring Boot apps using the Spring Boot Adapter, there is no „keycloak.json“ file and instead the values are provided via the „application.properties“ (or .yml, or else). I would appreciate, that „AuthzClient.create()“ would also be possible to detect the Spring Boot Property configuration and use it from there. Was this already discussed? Is it planned? Should I create a ticket for it? If you already have any ideas, share them with me, I could do a PR for it. Currently, I’m using a workaround like this: https://gist.github.com/dasniko/2c64393da0bca89434670908141914c4 <https://gist.github.com/dasniko/2c64393da0bca89434670908141914c4> So I can inject the AuthzClient everywhere I like and the KeycloakSpringBootProperties object is injected in the Bean definition. It’s not a nice way, although it works. The classes „Configuration“ and „KeycloakSpringBootProperties“ both extend „AdapterConfig“. Perhaps AuthzClient could also use AdapterConfig, instead of only Configuration!? Regards, - Niko

8 years, 4 months

2
1
0 / 0

Keycloak Facebook Social Login

by Madhan Kumar S P

Hello All, I am trying to integrate the Keycloak with Facebook social plugin. I had gone through the examples and documentation. This works fine if I use the Keycloak hosted Login Page. What I need is that we want to host our own login page and use the Keycloak APIs to register the user and login. I mean, I want to host our Sign Up/Login Page. When the user clicks on the Login with Facebook, we want to redirect the user to FB and get the approval and collect the details, create the user details that we need for our application. Then register the user on the Keycloak. I don’t see any documentation for this. I would be really grateful if you can shed some light on this and point to the documentation that would help me in achieving this. Thanks & Regards, Madhan Kumar S P

8 years, 4 months

3
2
0 / 0

When KeycloakSecurityContext is initialized and available?

by Sinan Mustafov

Hello, I have backend with JAX-RS REST endpoint secured with bearer token and angular2 app as frontend (everything is the same like in the quickstarts). What Im trying to do is to get the KeycloakSecurityContext in ServletRequestListener, so I can get the authenticated user and initialize my own context in the backend for the current request. Here is the code: @WebListener public class RequestListener implements ServletRequestListener { @Override public void requestInitialized(ServletRequestEvent event) { ServletRequest servletRequest = event.getServletRequest(); Object keycloakContext = servletRequest.getAttribute( KeycloakSecurityContext.class.getName()); System.out.println("INIT: " + keycloakContext); } @Override public void requestDestroyed(ServletRequestEvent event) { ServletRequest servletRequest = event.getServletRequest(); Object keycloakContext = servletRequest.getAttribute( KeycloakSecurityContext.class.getName()); System.out.println("DESTROY: " + keycloakContext); } } What happens: In requestInitialized method the context is null, but its available in requestDestroyed method. Do you have any idea why is this happening or when the KeycloakSecurityContext is added to the request? Regards.

8 years, 4 months

1
0
0 / 0

Admin initiated login-actions emails with action tokens no longer redirect user to proper screen since upgrading to 3.4.0.Final

by Edgar Vonk - Info.nl

Since upgrading from Keycloak 3.2.0.Final to 3.4.0.Final the links in the admin initiated login-actions emails no longer work for us. We use such emails e.g. to require the user to set his/her password before their account can be used. Such login action links in the 'change password’ emails are of the format: https://HOSTNAME/auth/realms/graydon-customers/login-actions/action-token... when the user clicks this link Keycloak 3.2.0 redirected the user to: https://HOSTNAME/auth/realms/graydon-customers/login-actions/required-act... However since we upgraded to Keycloak 3.4.0.Final this is no longer the case and the user is not redirected to the required action page at all.. Does anyone have tips on what may be the issue? Was there anything changed from 3.2.0 to 3.4.0 that could explain this? Or is it perhaps a bug in Keycloak? PS: we run Keycloak in a cluster with a persistent clustered Infinispan cache. So far we have not emptied our Keycloak database nor completely removed this cache when upgrading Keycloak. cheers

8 years, 4 months

1
0
0 / 0

[spring-adapter] Changing the redirect_uri parameter sent to Keycloak

by Christophe Tafani-Dereeper

Hi, I'm using Keycloak with the Spring Boot Adapter. Is there any way to customize the redirect_uri parameter being sent to Keycloak when initiating a login? I went through the docs but couldn't find anything on the topic. Thank you, Christophe

8 years, 4 months

1
0
0 / 0

Putting password update form on account update page

by Loïc Lambrichts

Hi guys, Im currently working on a project where we are using Keycloak as offsite SSO. To improve the user journey we are trying to put the password update form on the account update page. The idea is to have the password update on the same page where the user can change his email, first name and last name. We tried to copy paste the code from the password template (the form only) to he account template but it didn't work. Any idea how can I do that ? Or maybe it’s no possible… Thanks. Have a good day.

8 years, 4 months

1
0
0 / 0

Help with docker compose

by juanignacioborda＠gmail.com

Hi there I'm having some issues setting up a docker-compose file my file is as folows: version: "3" services: ########################### ##### Mysql server DB #### ########################### mysql: image: mysql:5 environment: MYSQL_ROOT_PASSWORD: developer MYSQL_DATABASE: keycloack MYSQL_USER: keycloak MYSQL_PASSWORD: developer volumes: - ./backups:/backups ############################### ##### KEYCLOAK server #### ############################### server: image: jboss/keycloak depends_on: - mysql ports: - "9081:8080" environment: DB_VENDOR: MYSQL MYSQL_DATABASE: keycloak MYSQL_USERNAME: root MYSQL_PASSWORD: developer KEYCLOAK_USER: admin KEYCLOAK_PASSWORD: keycloak VIRTUAL_HOST: keycloack.lab links: - mysql:mysql But server refuses to start and throw db cant connect errors Any help would be very appreciated Thanks!

8 years, 4 months

3
3
0 / 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

keycloak-user November 2017