March 2017 - keycloak-user - Jboss List Archives

Russian translation review

by Stian Thorgersen

Anyone capable of reviewing PR for the Russian translations: https://github.com/keycloak/keycloak/pull/3898

9 years

1
0
0 / 0

Re: [keycloak-user] How explicitly enable session management in Keycloak?

by Known Michael

Can anybody help? Do we have bug in 2.5.4? On Sun, Mar 12, 2017 at 11:56 AM, Known Michael <known.michael(a)gmail.com> wrote: > Stian, > > I have upgraded to Keycloak 2.5.4 but unfortunately I still have the > problem. > > I see in mod_auth_openidc logs the following: > > > > [Sun Mar 12 11:40:24 2017] [debug] src/mod_auth_openidc.c(1556): [client > clientIP] oidc_save_in_session: session management disabled: session_state > ((null)) and/or check_session_iframe (https://localhost/auth/ > realms/comp-realm/protocol/openid-connect/login-status-iframe.html) is > not provided, referer: https://server_ip/auth/realms/ > comp-realm/protocol/openid-connect/auth?response_type= > code&scope=openid&client_id=httpd_server_ip&state= > 8DpklUhcfpymZa89Dj0s7KNG9Xo&redirect_uri=https%3A%2F% > 2Fserver_ip%2Fprotected%2Fredirect_uri&nonce= > YxVGddiIoSvZtfxftxgKUQzZICfDsU1x7T5hCLhPpPk > > > > On Mon, Feb 6, 2017 at 9:33 AM, Stian Thorgersen <sthorger(a)redhat.com> > wrote: > >> It was fixed as part of https://issues.jboss.org/browse/KEYCLOAK-4338. >> >> On 3 February 2017 at 17:37, Known Michael <known.michael(a)gmail.com> >> wrote: >> >>> Stian, >>> Do you have open issues? >>> >>> >>> On Fri, Feb 3, 2017 at 10:47 AM, Stian Thorgersen <sthorger(a)redhat.com> >>> wrote: >>> >>>> There's some fixes to the RP iframe coming in 2.5.4 which will be out >>>> in a week or two. There was an issue with it expecting a "session_state" >>>> value that wasn't equal to the value from the tokens. >>>> >>>> You can try building master if you'd like to try it out in advance. >>>> >>>> On 1 February 2017 at 16:59, Known Michael <known.michael(a)gmail.com> >>>> wrote: >>>> >>>>> Hey, >>>>> >>>>> I use mod_auth_openidc version "2.1.2", Keycloak version “2.4.0” >>>>> >>>>> I was not able to implement the session management using OP and RP >>>>> frames >>>>> as described here: >>>>> >>>>> https://github.com/pingidentity/mod_auth_openidc/wiki/Sessio >>>>> n-Management >>>>> >>>>> I see in mod_auth_openidc logs the following: >>>>> >>>>> [Wed Feb 01 14:12:54 2017] [debug] src/mod_auth_openidc.c(1556): >>>>> [client >>>>> 192.168.111.33] oidc_save_in_session: session management disabled: >>>>> session_state ((null)) and/or check_session_iframe ( >>>>> https://localhost/auth/realms/realm/protocol/openid-connect/ >>>>> login-status-iframe.html) >>>>> is not provided, referer: >>>>> https://192.168.110.2/auth/realms/realm/protocol/openid-conn >>>>> ect/auth?response_type=code&scope=openid&client_id=httpd_192 >>>>> .168.110.2&state=i1YQ39FbBLSCTRyIgEN-F9CdDH4&redirect_uri=ht >>>>> tps%3A%2F%2F192.168.110.2%2Fprotected%2Fredirect_uri&nonce=0 >>>>> VJ7AO-QBaxVaUBL9goen7muN4Oka1dP_1iPEQ43o-M >>>>> >>>>> It looks like the session management is disabled because the Provider >>>>> did >>>>> not return a session_state parameter in the authentication response >>>>> (which >>>>> in its turn can be verified via the referer URL in the same log entry) >>>>> as >>>>> the spec dictates: >>>>> https://openid.net/specs/openid-connect-session-1_0.html#Cre >>>>> atingUpdatingSessions >>>>> >>>>> How should I configure explicitly enable session management in >>>>> Keycloak? >>>>> It should starts returning session_state in the authentication >>>>> responses. >>>>> >>>>> I see that it is implemented already >>>>> https://issues.jboss.org/browse/KEYCLOAK-451 but probably I miss >>>>> something. >>>>> _______________________________________________ >>>>> keycloak-user mailing list >>>>> keycloak-user(a)lists.jboss.org >>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user >>>> >>>> >>>> >>> >> >

9 years

1
0
0 / 0

Bearer only and client credentials

by Marcelo Nardelli

Hello, According to documentation, the OAuth2 client credentials flow corresponds to the concept of Service Accounts in Keycloak, right? Also, it seems that only confidential clients are allowed to participate in this flow, so this is not an option for bearer-only clients (I also found this issue here https://issues.jboss.org/browse/KEYCLOAK-4156) So, if a bearer-only client needs to access another protected resource regardless of who is calling it, what would be the recommended approach? Do I always need to make sure that any token generated for the bearer-only client also has the permissions for the other proteced resource? Or is there a way to make the bearer-only client get a token on it's own behalf? Did anyone else had this problem and used some sort of workaround to get the token for the bearer-only client? Thanks, Marcelo Nardelli

9 years

1
0
0 / 0

Event Listener SPI Add to Queue

by Matthew Woolnough

I'd like to queue messages to NSQ <http://nsq.io/> upon user CRUD operations. Are there any examples for this or any other queue? Thanks, mW

9 years

2
2
0 / 0

Session already invalidated

by Amat, Juan (Nokia - US)

Hello, I read this thread: http://lists.jboss.org/pipermail/keycloak-user/2017-February/009550.html I am hitting the same issue and I can use the same workaround. But I would really like to know why Keycloak calls session.invalidate when processing the logout. 'logout' and 'invalidate' are 2 different operations and in theory you may want to logout while still keeping the session alive. Thank you.

9 years

2
7
0 / 0

Is there a pre-save event

by Danny Im

Hi, I'm implementing an Event Listener Provider, and was wondering if there is a way to add some functionality before an object is created or updated. In my case, I would like to do some extra validation on incoming fields before a user is created within keycloak. In the javadoc: http://www.keycloak.org/docs-api/2.5/javadocs/index.html under org.keycloak.events.admin.OperationType I only see four actions: ACTION <http://www.keycloak.org/docs-api/2.5/javadocs/org/keycloak/events/admin/O...>, CREATE, <http://www.keycloak.org/docs-api/2.5/javadocs/org/keycloak/events/admin/O...> DELETE <http://www.keycloak.org/docs-api/2.5/javadocs/org/keycloak/events/admin/O...>, and UPDATE <http://www.keycloak.org/docs-api/2.5/javadocs/org/keycloak/events/admin/O...> Thanks! -- Danny Im Software Developer Polar Geospatial Center University of Minnesota

9 years

2
2
0 / 0

Unable to create keycloak admin client instance: class loader issue

by Danny Im

Hi, I'm trying to use the admin client (version 2.5.1) from within a custom Event Listener Provider, and when I try creating an instance of the admin client (via a call to the getInstance method of the org.keycloak.admin.client.Keycloak class), I get the following error: ERROR [io.undertow.request] (default task-14) UT005023: Exception handling request to /auth/admin/realms/master/events/config: org.jboss.resteasy.spi.UnhandledException: java.lang.IllegalArgumentException: interface org.keycloak.admin.client.token.TokenService is not visible from class loader Attached is the stack trace. Any idea why this is happening? Thanks! -- Danny Im Software Developer Polar Geospatial Center University of Minnesota

9 years

2
2
0 / 0

Integration with legacy systems

by Marcelo Nardelli

Hello, We recently started using Keycloak in our organization but we are not sure which approach would be best to use when there are some user permissions that rely on information managed by other systems (legacy systems that we have). In our specific case, we have the following setup: - A Keycloak server integrated with LDAP to retrieve users - A Java backend protected by Bearer Token - A Javascript frontend developed in EmberJS that accesses the Java backend One of the requirements we have is the following: - Users who have a certain managerial position must have a common set of permissions. To meet this requirement, we created a group, included the relevant users, and assigned the appropriate permissions (roles) to the group. This works fine for us. However, we have a legacy system that manages the positions that a user assumes in the organization, so that a user who today holds a management position may no longer have that position tomorrow in the legacy system. When he loses the management position, someone needs to be warned and manually remove the user from the Keycloak group. Ideally, we would like this process not to be so manual. Which approaches would be recommended for this situation? - Make the legacy system somehow access Keycloak to remove users from the group when needed - Make our application query the legacy system to verify that the permissions that are on the token are appropriate for the user's current position - Change the keycloak in some way to query the legacy system and determine based on this information whether the user should receive the permissions Thanks for the attention Marcelo Nardelli

9 years

2
4
0 / 0

Re: [keycloak-user] Session already invalidated

by Amat, Juan (Nokia - US)

> > > > Another thing is, that in the last mail of the thread you referenced, > > it's mentioned that there is bug in undertow. It will be fixed in undertow > 1.4.7.Final. > > So once it's possible to have Wildfly upgraded to this version, it > > won't be needed to have try/catch block anymore. > [JA] > Can you point me to the undertow ticket? I seem to remember reading some > ticket where they wanted to fix a similar issue but decided against as anyway > there is a still a time window when the session can be invalidated by another > thread. [JA] I probably got confused I was referring to this ticket: https://issues.jboss.org/browse/UNDERTOW-909 And indeed it was fixed in 1.4.7.Final. Not sure if this the same use case. In any case, ideally for me, Keycloak could have a 'invalidateSessionOnLogout' flag (as undertow has). By default it could be set to 'true' to keep the existing behavior but then applications could change it.

9 years

1
0
0 / 0

Keycloak 2.5.4 - persistence of replicated cache Session to file ?

by Choimet Antoine

Hello, We want to keep the sessions after a restart of an entire cluster of keycloaks. Can we store the data of the sessions caches (and maybe others) to a file ? The purpose here is if the cluster goes down, he can recover sessions from files. So the restart can be the more transparent to the client. ANTOINE CHOIMET Ingenieur d'Etudes et Developpement

9 years

1
0
0 / 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

keycloak-user March 2017