March 2017 - keycloak-user - Jboss List Archives

Re: [keycloak-user] Logout in broker mode doesn't propagate session's termination

by Dmitry Korchemkin

I'm killing sessions using keycloak's admin console GUI, namely Session tab, where i can either kill a session or send a Revocation message. I've tried setting up Single Log Out URL's the way examples suggest, i.e. for SAML it is set to " http://localhost:8080/auth/realms/saml-broker-realm/protocol/saml", as specified in xml descriptor. Same with backchannel logout, switching it on or off seems to do nothing in this case. 2017-03-07 21:51 GMT+03:00 <keycloak-user-request(a)lists.jboss.org>: > > Date: Tue, 7 Mar 2017 08:57:04 -0500 > From: Bill Burke <bburke(a)redhat.com> > Subject: Re: [keycloak-user] Logout in broker mode doesn't propagate > session's termination > To: keycloak-user(a)lists.jboss.org > Message-ID: <dabc3430-e5ed-e834-6f87-dd711b341117(a)redhat.com> > Content-Type: text/plain; charset=windows-1252; format=flowed > > How exactly are you killing sessions? Through the admin console? Can > you specify exactly what operations you are performing. > > For SAML and OIDC there is a logout URL you have to specify. There's > also a "Backchannel Logout" supported switch that has to be true. > > > On 3/7/17 6:33 AM, Dmitry Korchemkin wrote: > > I was testing single logout in broker mode and came around this logical, > > but not exactly desirable behaviour, when session on the broker and > session > > on the external idp states are not linked between the idp's. > > > > My setup is broker saml example provided with keycloak, but instead of an > > actual application i log in to the broker using "/account" url. Should be > > all the same, since it's just another web-app, protected by this realm. > > > > The behaviour is as follows: > > If i kill a session on the external keycloak idp, the user is not logged > > out. I assume since local session is alive and well the token is not > being > > revoked. > > > > If i kill a session on the broker keycloak, upon hitting f5 user is > > redirected to the broker login page, but when i press external idp login > > button, he's logged right back with no credentials asked. I guess since > the > > session between 2 idp's is still up, broker thinks this user is already > > authenticated. > > > > I tested both oidc and saml, tried different backchannel/frontchannel > > toggles in the UI of both broker and external IDP, but this had no > visible > > effect. > > > > Can you please clarify if the behaviour observed is expected and normal, > or > > did i miss some configuration steps? > > _______________________________________________ > > keycloak-user mailing list > > keycloak-user(a)lists.jboss.org > > https://lists.jboss.org/mailman/listinfo/keycloak-user >

7 years, 2 months

2
1
0 / 0

REST API client allowRemoteResourceManagement

by Sven Thoms

Both on the POST and PUT for client, with authorizationservicesenabled Set to true, I cannot set allowRemoteResourceManagement to true. It is as if the Admin REST interface just ignores that setting. Can anyone confirm and possibly explain, please?

7 years, 2 months

2
4
0 / 0

Realm PasswordPolicy PasswordHashProvider xxxx not found

by upesh.m

Hi,I created a custom PasswordHashprovider which implements PasswordHashProviderFactory, PasswordHashProvider. I have given an id to the algorithm also, the getId( ) method returns a value 'xxxx'. I created a*org.keycloak.hash.PasswordHashProviderFactory* file and added the packagename+(name of my provider) to the file. Then the complete jar file was dropped to deployments folder, it got deployed successfully. Then I went to password policy subtab under Authentication and changed algorithm name to 'xxxx'. But still its not working. In the log it says Realm PasswordPolicy PasswordHashProvider xxxx not found . Is there any place where I need to configure this provider inside keycloak?ThanksUpesh M. -- View this message in context: http://keycloak-user.88327.x6.nabble.com/Realm-PasswordPolicy-PasswordHas... Sent from the keycloak-user mailing list archive at Nabble.com.

7 years, 2 months

1
0
0 / 0

ClassCastException in SimpleHttpFacade - WebAuthenticationDetails cannot be cast to SecurityContext

by Zaunegger, Jörg

Hi, we want to use keycloak in our spring-boot-application. So as a keycloak adapter we are using the keycloak-spring-security-adapter. For using authorization in keycloak-spring-security-adapter we found the following jira enhancement https://issues.jboss.org/browse/KEYCLOAK-3474. So we configured our WebSecurityConfigurationAdapter#configure() like this for using KeycloakAuthenticationProcessingFilter: http .sessionManagement() .sessionCreationPolicy(SessionCreationPolicy.STATELESS) .sessionAuthenticationStrategy(sessionAuthenticationStrategy()) .and() .addFilterBefore(keycloakPreAuthActionsFilter(), LogoutFilter.class) .addFilterBefore(keycloakAuthenticationProcessingFilter(), BasicAuthenticationFilter.class) .addFilterAfter(keycloakAuthenticatedActionsFilter(), KeycloakAuthenticationProcessingFilter.class) … The problem is, we are now getting a ClassCastException in SimpleHttpFacade. Stack trace: Caused by: java.lang.ClassCastException: org.keycloak.adapters.springsecurity.account.SimpleKeycloakAccount cannot be cast to org.keycloak.KeycloakSecurityContext at org.keycloak.adapters.springsecurity.facade.SimpleHttpFacade.getSecurityContext(SimpleHttpFacade.java:60) ~[keycloak-spring-security-adapter-2.5.4.Final.jar:2.5.4.Final] at org.keycloak.adapters.authorization.AbstractPolicyEnforcer.authorize(AbstractPolicyEnforcer.java:70) ~[keycloak-adapter-core-2.5.4.Final.jar:2.5.4.Final] at org.keycloak.adapters.authorization.PolicyEnforcer.enforce(PolicyEnforcer.java:79) ~[keycloak-adapter-core-2.5.4.Final.jar:2.5.4.Final] at org.keycloak.adapters.AuthenticatedActionsHandler.isAuthorized(AuthenticatedActionsHandler.java:142) ~[keycloak-adapter-core-2.5.4.Final.jar:2.5.4.Final] ... 56 common frames omitted We could fix this, with the following changes: 1) Override SimpleHttpFacade#getSecurityContext() and changed it as following: Object details = getAuthentication(SecurityContextHolder.getContext()); if (details != null) { if (details instanceof KeycloakSecurityContext) { return (KeycloakSecurityContext) details; } else if (details instanceof OidcKeycloakAccount) { return ((OidcKeycloakAccount) details).getKeycloakSecurityContext(); } } return null; 2) Using our own KeycloakAuthenticatedActionsFilter, which is a copy of the original KeycloakAuthenticatedActionsFilter, except we are then using our own SimpleHttpFacade. So is there a bug in SimpleHttpFacade or is the problem caused by a misconfiguration of ourselves? Regards Jörg Zaunegger

7 years, 2 months

2
1
0 / 0

Unable To Use Refresh Token

by Sagar Ahire

Hello, I've deployed keyclock 2.4.0 in a kubernetes environment. While refreshing the access token I'm getting following response. {'error': 'invalid_grant', 'error_description': 'Client session not active'}. Here is what I did: Step1: First, I generated three access tokens and refresh tokens (rf1,rf2,rf3), then I used this refresh_tokens to refresh the access tokens. I got the access tokens successfully for all three requests. (Successful scenario) Step2: I restarted some of the pods from the keyclock cluster, I tried to refresh the access tokens using the same refresh tokens(rf1,rf2,rf3) again, using rf1 I could refresh the access token but using rf2,rf3 I got the response mentioned above ('client session not active'). I made sure rf2 and rf3 are not expired. I'm unable to use refresh token even though it is not expired. I suspect session created on one pod is not properly shared between all the members of a cluster and I'm loosing the session if one of my pod is restarted or goes down. Can someone please suggest any solution for this? Any help would be greatly appreciated. regards, -Sagar

7 years, 2 months

4
6
0 / 0

keycloak 2.5.4 - Multi Data Center with TCP

by Choimet Antoine

Hello, We want to implement Multi datacenter feature with keycloak 2.5.4. We already have two clusters with TCP stacks. We need the relay the backups between the two, I've tried to put a back up mais the property 'site' is not recognized. Anyone has a sample of configuration in TCP for multi data center please ?

7 years, 2 months

2
1
0 / 0

Using a different claim in the data from a Third Party IDP to associate the user with a Keycloak User..

by Reed Lewis

Note, This is the second attempt to send this. The first did not seem to go through. Right now I am working on getting Keycloak to be able to use Azure with Keycloak logging in. The issue is that we are going to prepopulate the users in Keycloak by calling Azure to get a list of users using the Azure route here: https://graph.microsoft.com/v1.0/myOrganization/users We get an access and refresh token not using Keycloak, then call the above route. It returns data like this: {"@odata.context":"https://graph.microsoft.com/v1.0/$metadata#users","@odata.nextLink":"https://graph.microsoft.com/v1.0/myOrganization/users?$skiptoken=X%<secret>","value":[{"id":"<ID1>","businessPhones":[],"displayName":"user081","givenName":null,"jobTitle":null,"mail":null,"mobilePhone":null,"officeLocation":null,"preferredLanguage":null,"surname":null,"userPrincipalName":"nothing(a)carboniteinc.com"} Continuing on and on. The <ID1> is a guuid that identifies the user. When I use Keycloak in debug mode this is in the log file: {"amr":"[\"wia\"]","family_name":"someone","given_name":”first","ipaddr":"<IP>","name":"me","oid":"<ID1>”,"onprem_sid":"something else", "platf":"5","sub":"A different value here","tid":"Another differen value","unique_name":"<secret>@carbonite.com","upn":"<secret>@carbonite.com","ver":"1.0"} It is using the value in the “sub” claim to associate the user in Azure with the user in Keycloak. Is there a way to change Keycloak in the config to use the OID instead since that matches what I get from the user listing? Because the sub claim is not known when listing the users. Thank you, Reed Lewis This message is the property of CARBONITE, INC. and may contain confidential or privileged information. If this message has been delivered to you by mistake, then do not copy or deliver this message to anyone. Instead, destroy it and notify me by reply e-mail.

7 years, 2 months

1
0
0 / 0

oidc wildfly apdater and wildfly single-sign-on

by Amat, Juan (Nokia - US)

I will start by saying that this is my first post to this list so forgive me if this topic has already been addressed. I will also thank all the people who work on Keycloak (regulars and contributors). Now back to my topic. In our next release we are planning to use Keycloak (version 2.5.1) in the context of a new Angular2 based client and stateless REST services. At the time we also want to use Keycloak with our legacy applications. Our legacy applications (a bunch of webapps and rest services) run on Wildfly 10. The 'Getting Started' Chapter of the Keycloak documentation looks to good as simply adding some configuration in the standalone.xml and with no code changes it works. I did try that and it worked fine with our legacy applications except for the logout. I opened (twice) this ticket: https://issues.jboss.org/browse/KEYCLOAK-4397 The problem is that we used to configure the undertow sub-system with <single-sign-on> which allow us to log in to one webapp and navigate to another without the need to reauthenticate. I removed this <single-sign-on> and now we had other problems. Our webapp sometimes do XMLHttpRequest requests to another webapp/rest service. And Keycloak will then return 302 which does not work too well. I did see this ticket https://issues.jboss.org/browse/KEYCLOAK-2962 but it will not help us much I think (It is my understanding that with this fix and using autodetect we will get 401 back and this is not what we want). We did configure Keycloak with the 'session' token store so we thought that maybe using the 'cookie' token store will be better. But it did not help because the path of the cookie is the webapp context. IOW it is not propagated when we call another webapp. There is this opened ticket https://issues.jboss.org/browse/KEYCLOAK-4342 about the same issue. In the end I am wondering if Keycloak should support this configuration, that is having undertow <single-sign-on> enabled. Or, and it would be also OK for us, if we could configure the Keycloak cookie path. Did any of you had the same issue? And if so how did you resolve it? Or is what I am doing not possible without some code changes? TIA.

7 years, 2 months

1
0
0 / 0

Forcing reauthentication from a client, even when session is active

by John D. Ament

Hi, I have a use case where I need to reauthenticate a client, even if their session is active. I can use the Keycloak javascript adapter on the client side, if needed, and was wondering if this is something built in? I was also expecting to leverage either the OIDC or SAML adapter on the server side. Can that work, regardless or server side adapter? John

7 years, 2 months

5
12
0 / 0

Using external infinispan for DB operations cache

by Singh, Vikrant

Hi, I am using an external infinispan in replicated clustered mode as distributed cache with keycloak for HA failover scenarios. Keycloak out of box have two kind of caches, one DB operations cache and other session related cache. I would like to know what is best practice related to using an external infinispan for DB operations related cache and is this DB cache is actually the keycloak hibernate cache. Thanks, Vikrant ********************************************************************** KPMG (in India) allows reasonable personal use of the e-mail system. Views and opinions expressed in these communications do not necessarily represent those of KPMG (in India). ******************************************************************************************************* DISCLAIMER The information in this e-mail is confidential and may be legally privileged. It is intended solely for the addressee. Access to this e-mail by anyone else is unauthorized. If you have received this communication in error, please address with the subject heading "Received in error," send to postmaster1(a)kpmg.com, then delete the e-mail and destroy any copies of it. If you are not the intended recipient, any disclosure, copying, distribution or any action taken or omitted to be taken in reliance on it, is prohibited and may be unlawful. Any opinions or advice contained in this e-mail are subject to the terms and conditions expressed in the governing KPMG client engagement letter. Opinions, conclusions and other information in this e-mail and any attachments that do not relate to the official business of the firm are neither given nor endorsed by it. KPMG cannot guarantee that e-mail communications are secure or error-free, as information could be intercepted, corrupted, amended, lost, destroyed, arrive late or incomplete, or contain viruses. KPMG, an Indian partnership and a member firm of KPMG International Cooperative ("KPMG International"), a Swiss entity that serves as a coordinating entity for a network of independent firms operating under the KPMG name. KPMG International Cooperative (“KPMG International”) provides no services to clients. Each member firm of KPMG International Cooperative (“KPMG International”) is a legally distinct and separate entity and each describes itself as such. *******************************************************************************************************

7 years, 2 months

1
0
0 / 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

keycloak-user March 2017