Re: [keycloak-user] Policy Enforcer in Spring Security Adapter
by Илья Король
Hi. I've just tried to make it working again but failed. I defined all
resources in keycloak and add appropriate configs to keycloak.json for
adapter.
I used default configs for adapter spring beans, taken from docs:
...
<security:http auto-config="false"
entry-point-ref="keycloakAuthenticationEntryPoint">
<security:custom-filter ref="keycloakPreAuthActionsFilter"
before="LOGOUT_FILTER" />
<security:custom-filter
ref="keycloakAuthenticationProcessingFilter" before="FORM_LOGIN_FILTER" />
<security:intercept-url pattern="/**" access="ROLE_USER"/>
<security:custom-filter ref="logoutFilter" position="LOGOUT_FILTER"
/>
</security:http>
example of spring controller:
@RestController
public class ProfileController {
@RequestMapping(method = RequestMethod.GET, value = "/profile")
public AccessToken getUserByToken() throws KeycloakApiException {
Authentication auth =
SecurityContextHolder.getContext().getAuthentication();
KeycloakPrincipal principal = (KeycloakPrincipal)
auth.getPrincipal();
return principal.getKeycloakSecurityContext().getToken();
}
...
}
Application is running on localhost:8080/apps/{spring-endpoint}, so
spring-root is localhost:8080/apps, and i set this url as base in client
settings in keycloak.
So far the most strange for me is that adapter doesn't print any logs
related to authorization during requests, i see only this:
DEBUG org.keycloak.adapters.PreAuthActionsHandler - adminRequest
http://localhost:8080/apps/profile
DEBUG
org.keycloak.adapters.springsecurity.filter.KeycloakAuthenticationProcessingFilter
- Request is to process authentication
DEBUG
org.keycloak.adapters.springsecurity.filter.KeycloakAuthenticationProcessingFilter
- Attempting Keycloak authentication
DEBUG
org.keycloak.adapters.springsecurity.authentication.SpringSecurityRequestAuthenticator
- Completing bearer authentication. Bearer roles: [ROLE_USER, ROLE_ADMIN]
DEBUG org.keycloak.adapters.RequestAuthenticator - User
'aa93b5d9-f02a-4557-a8b6-c7f083475bd5' invoking '
http://localhost:8080/apps/profile' on client 'apps-backend'
DEBUG org.keycloak.adapters.RequestAuthenticator - Bearer AUTHENTICATED
DEBUG
org.keycloak.adapters.springsecurity.filter.KeycloakAuthenticationProcessingFilter
- Auth outcome: AUTHENTICATED
DEBUG
org.keycloak.adapters.springsecurity.filter.KeycloakAuthenticationProcessingFilter
- Authentication success using bearer token/basic authentication. Updating
SecurityContextHolder to contain:
org.keycloak.adapters.springsecurity.token.KeycloakAuthenticationToken@4259cc27:
Principal: aa93b5d9-f02a-4557-a8b6-c7f083475bd5; Credentials: [PROTECTED];
Authenticated: true; Details:
org.keycloak.adapters.springsecurity.account.SimpleKeycloakAccount@c4e0280;
Granted Authorities: KeycloakRole{role='ROLE_USER'},
KeycloakRole{role='ROLE_ADMIN'}
keycloak.json: ===========================================
{
"realm": "test",
"auth-server-url": "http://localhost:8081/auth",
"ssl-required": "external",
"resource": "apps-backend",
"bearer-only": true,
"credentials": {
"secret": "74070785-cabf-4d28-83d7-f2dc31f081f5"
},
"policy-enforcer": {
"user-managed-access": {},
"enforcement-mode" : "ENFORCING",
"paths": [
{
"name": "User Info",
"path" : "/profile/userinfo",
"methods" : [
{
"method": "GET",
"scopes" : ["urn:apps-backend:scopes:userinfo:view"]
},
{
"method": "POST",
"scopes" : ["urn:apps-backend:scopes:userinfo:edit"]
}
]
},
{
"name" : "User Permissions",
"path" : "/profile/permissions",
"methods" : [
{
"method": "GET",
"scopes" : ["urn:apps-backend:scopes:permissions:view"]
}
]
},
{
"name" : "User Profile",
"path" : "/profile",
"methods" : [
{
"method": "GET",
"scopes" : ["urn:apps-backend:scopes:profile:view"]
}
]
},
{
"name" : "User Token",
"path" : "/profile/token"
},
{
"name" : "User Id Token"
}
]
}
}
keycloak-server authz-dump:=====================================
{
"allowRemoteResourceManagement": true,
"policyEnforcementMode": "ENFORCING",
"resources": [
{
"name": "User Info",
"uri": "/profile/userinfo",
"type": "urn:apps-backend:resources:profile:userinfo",
"scopes": [
{
"name": "urn:apps-backend:scopes:userinfo:edit"
},
{
"name": "urn:apps-backend:scopes:userinfo:view"
}
],
"typedScopes": []
},
{
"name": "User Profile",
"uri": "/profile",
"type": "urn:apps-backend:resources:profile",
"scopes": [
{
"name": "urn:apps-backend:scopes:profile:view"
}
],
"typedScopes": []
},
{
"name": "User Permissions",
"uri": "/profile/permissions",
"type": "urn:apps-backend:resources:profile:permissions",
"scopes": [
{
"name": "urn:apps-backend:scopes:permissions:view"
}
],
"typedScopes": []
},
{
"name": "User Token",
"uri": "/profile/token",
"type": "urn:apps-backend:resources:profile:token",
"typedScopes": []
},
{
"name": "User Id Token",
"uri": "/profile/idtoken",
"type": "urn:apps-backend:resources:profile:idtoken",
"typedScopes": []
}
],
"policies": [
{
"name": "Is user",
"type": "role",
"logic": "POSITIVE",
"decisionStrategy": "UNANIMOUS",
"config": {
"roles": "[{\"id\":\"ROLE_USER\",\"required\":true}]"
}
},
{
"name": "Is merchant",
"type": "role",
"logic": "POSITIVE",
"decisionStrategy": "UNANIMOUS",
"config": {
"roles": "[{\"id\":\"ROLE_MERCHANT\",\"required\":true}]"
}
},
{
"name": "Edit User Info",
"type": "scope",
"logic": "POSITIVE",
"decisionStrategy": "UNANIMOUS",
"config": {
"resources": "[\"User Info\"]",
"scopes": "[\"urn:apps-backend:scopes:userinfo:edit\"]",
"applyPolicies": "[\"Is user\"]"
}
},
{
"name": "View User Permissions",
"type": "scope",
"logic": "POSITIVE",
"decisionStrategy": "UNANIMOUS",
"config": {
"resources": "[\"User Permissions\"]",
"scopes": "[\"urn:apps-backend:scopes:permissions:view\"]",
"applyPolicies": "[\"Is user\"]"
}
},
{
"name": "View User Info",
"type": "scope",
"logic": "POSITIVE",
"decisionStrategy": "UNANIMOUS",
"config": {
"resources": "[\"User Info\"]",
"scopes": "[\"urn:apps-backend:scopes:userinfo:view\"]",
"applyPolicies": "[\"Is user\"]"
}
},
{
"name": "View Profile",
"type": "scope",
"logic": "POSITIVE",
"decisionStrategy": "UNANIMOUS",
"config": {
"resources": "[\"User Profile\"]",
"scopes": "[\"urn:apps-backend:scopes:profile:view\"]",
"applyPolicies": "[\"Is user\"]"
}
},
{
"name": "Access Profile",
"type": "resource",
"logic": "POSITIVE",
"decisionStrategy": "UNANIMOUS",
"config": {
"resources": "[\"User Profile\"]",
"applyPolicies": "[\"Is user\"]"
}
},
{
"name": "Token Access",
"type": "resource",
"logic": "POSITIVE",
"decisionStrategy": "UNANIMOUS",
"config": {
"resources": "[\"User Token\"]",
"applyPolicies": "[\"Is merchant\"]"
}
}
],
"scopes": [
{
"name": "urn:apps-backend:scopes:permissions:view"
},
{
"name": "urn:apps-backend:scopes:userinfo:view"
},
{
"name": "urn:apps-backend:scopes:userinfo:edit"
},
{
"name": "urn:apps-backend:scopes:profile:view"
}
]
}
7 years, 1 month
Custom Protocol Mapper automatically which registering an application
by ansarihaseb
Hello Keycloakers,
I want to automatically save a custom protocol mapper when I register
a new application on Keycloak. My token has some custom key values and I
want to grab these values on the client side. When I login I am able to get
all attributes of the user from the external IDP and save it in Keycloak
User's attributes. But to display it on client side for e.g by using JSP
pages I have to create a custom Protocol Mapper for that application and I
want this part to happen automatically that corresponds to my token
attributes. Hence, I could use it easily on JSP pages with getOtherClaims
method on id token.
Any help would be really appreciated !!!
Thanks
--
View this message in context: http://keycloak-user.88327.x6.nabble.com/Custom-Protocol-Mapper-automatic...
Sent from the keycloak-user mailing list archive at Nabble.com.
7 years, 1 month
Attempting to build authenticator example and failing.
by Reed Lewis
I downloaded Keycloak version 2.5.1 example file. Extracted it onto a CentOS 7 machine, and installed Java-1.8.0 and java-devel.
When I attempted to use the example file: /examples/providers/authenticator
By typing: mvn clean install wildfly:deploy
I got the following error on the terminal where I was executing mvn:
ERROR] Failed to execute goal org.wildfly.plugins:wildfly-maven-plugin:1.1.0.Beta1:deploy (default-cli) on project authenticator-required-action-example: Failed to execute goal deploy: {"WFLYCTL0062: Composite operation failed and was rolled back. Steps that failed:" => {"Operation step-1" => {"WFLYCTL0080: Failed services" => {"jboss.deployment.unit.\"authenticator-required-action-example.jar\".POST_MODULE" => "org.jboss.msc.service.StartException in service jboss.deployment.unit.\"authenticator-required-action-example.jar\".POST_MODULE: WFLYSRV0153: Failed to process phase POST_MODULE of deployment \"authenticator-required-action-example.jar\"
[ERROR] Caused by: java.lang.NoClassDefFoundError: Failed to link org/keycloak/examples/authenticator/SecretQuestionAuthenticatorFactory (Module \"deployment.authenticator-required-action-example.jar:main\" from Service Module Loader): org/keycloak/authentication/AuthenticatorFactory"}}}}
[ERROR] -> [Help 1]
[ERROR]
[ERROR] To see the full stack trace of the errors, re-run Maven with the -e switch.
[ERROR] Re-run Maven using the -X switch to enable full debug logging.
[ERROR]
[ERROR] For more information about the errors and possible solutions, please read the following articles:
[ERROR] [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/MojoExecutionException
[root@localhost authenticator]# pwd
/root/keycloak-demo-2.5.1.Final/examples/providers/authenticator
Thank you,
Reed Lewis
This was what was displayed on the Keycloak server.
12:06:20,685 INFO [org.jboss.as.server.deployment] (MSC service thread 1-1) WFLYSRV0027: Starting deployment of "authenticator-required-action-example.jar" (runtime-name: "authenticator-required-action-example.jar")
12:06:20,761 INFO [org.keycloak.subsystem.server.extension.KeycloakProviderDeploymentProcessor] (MSC service thread 1-4) Deploying Keycloak provider: {0}
12:06:20,767 WARN [org.jboss.modules] (MSC service thread 1-4) Failed to define class org.keycloak.examples.authenticator.SecretQuestionAuthenticatorFactory in Module "deployment.authenticator-required-action-example.jar:main" from Service Module Loader: java.lang.NoClassDefFoundError: Failed to link org/keycloak/examples/authenticator/SecretQuestionAuthenticatorFactory (Module "deployment.authenticator-required-action-example.jar:main" from Service Module Loader): org/keycloak/authentication/AuthenticatorFactory
at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62)
at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
at java.lang.reflect.Constructor.newInstance(Constructor.java:423)
at org.jboss.modules.ModuleClassLoader.defineClass(ModuleClassLoader.java:446)
at org.jboss.modules.ModuleClassLoader.loadClassLocal(ModuleClassLoader.java:274)
at org.jboss.modules.ModuleClassLoader$1.loadClassLocal(ModuleClassLoader.java:78)
at org.jboss.modules.Module.loadModuleClass(Module.java:605)
at org.jboss.modules.ModuleClassLoader.findClass(ModuleClassLoader.java:190)
at org.jboss.modules.ConcurrentClassLoader.performLoadClassUnchecked(ConcurrentClassLoader.java:363)
at org.jboss.modules.ConcurrentClassLoader.performLoadClass(ConcurrentClassLoader.java:351)
at org.jboss.modules.ConcurrentClassLoader.loadClass(ConcurrentClassLoader.java:93)
at java.lang.Class.forName0(Native Method)
at java.lang.Class.forName(Class.java:348)
at java.util.ServiceLoader$LazyIterator.nextService(ServiceLoader.java:370)
at java.util.ServiceLoader$LazyIterator.next(ServiceLoader.java:404)
at java.util.ServiceLoader$1.next(ServiceLoader.java:480)
at org.keycloak.provider.DefaultProviderLoader.load(DefaultProviderLoader.java:47)
at org.keycloak.provider.ProviderManager.load(ProviderManager.java:93)
at org.keycloak.services.DefaultKeycloakSessionFactory.loadFactories(DefaultKeycloakSessionFactory.java:206)
at org.keycloak.services.DefaultKeycloakSessionFactory.deploy(DefaultKeycloakSessionFactory.java:112)
at org.keycloak.provider.ProviderManagerRegistry.deploy(ProviderManagerRegistry.java:42)
at org.keycloak.subsystem.server.extension.KeycloakProviderDeploymentProcessor.deploy(KeycloakProviderDeploymentProcessor.java:54)
at org.jboss.as.server.deployment.DeploymentUnitPhaseService.start(DeploymentUnitPhaseService.java:147)
at org.jboss.msc.service.ServiceControllerImpl$StartTask.startService(ServiceControllerImpl.java:1948)
at org.jboss.msc.service.ServiceControllerImpl$StartTask.run(ServiceControllerImpl.java:1881)
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
at java.lang.Thread.run(Thread.java:745)
12:06:20,768 ERROR [org.jboss.msc.service.fail] (MSC service thread 1-4) MSC000001: Failed to start service jboss.deployment.unit."authenticator-required-action-example.jar".POST_MODULE: org.jboss.msc.service.StartException in service jboss.deployment.unit."authenticator-required-action-example.jar".POST_MODULE: WFLYSRV0153: Failed to process phase POST_MODULE of deployment "authenticator-required-action-example.jar"
at org.jboss.as.server.deployment.DeploymentUnitPhaseService.start(DeploymentUnitPhaseService.java:154)
at org.jboss.msc.service.ServiceControllerImpl$StartTask.startService(ServiceControllerImpl.java:1948)
at org.jboss.msc.service.ServiceControllerImpl$StartTask.run(ServiceControllerImpl.java:1881)
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
at java.lang.Thread.run(Thread.java:745)
Caused by: java.lang.NoClassDefFoundError: Failed to link org/keycloak/examples/authenticator/SecretQuestionAuthenticatorFactory (Module "deployment.authenticator-required-action-example.jar:main" from Service Module Loader): org/keycloak/authentication/AuthenticatorFactory
at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62)
at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
at java.lang.reflect.Constructor.newInstance(Constructor.java:423)
at org.jboss.modules.ModuleClassLoader.defineClass(ModuleClassLoader.java:446)
at org.jboss.modules.ModuleClassLoader.loadClassLocal(ModuleClassLoader.java:274)
at org.jboss.modules.ModuleClassLoader$1.loadClassLocal(ModuleClassLoader.java:78)
at org.jboss.modules.Module.loadModuleClass(Module.java:605)
at org.jboss.modules.ModuleClassLoader.findClass(ModuleClassLoader.java:190)
at org.jboss.modules.ConcurrentClassLoader.performLoadClassUnchecked(ConcurrentClassLoader.java:363)
at org.jboss.modules.ConcurrentClassLoader.performLoadClass(ConcurrentClassLoader.java:351)
at org.jboss.modules.ConcurrentClassLoader.loadClass(ConcurrentClassLoader.java:93)
at java.lang.Class.forName0(Native Method)
at java.lang.Class.forName(Class.java:348)
at java.util.ServiceLoader$LazyIterator.nextService(ServiceLoader.java:370)
at java.util.ServiceLoader$LazyIterator.next(ServiceLoader.java:404)
at java.util.ServiceLoader$1.next(ServiceLoader.java:480)
at org.keycloak.provider.DefaultProviderLoader.load(DefaultProviderLoader.java:47)
at org.keycloak.provider.ProviderManager.load(ProviderManager.java:93)
at org.keycloak.services.DefaultKeycloakSessionFactory.loadFactories(DefaultKeycloakSessionFactory.java:206)
at org.keycloak.services.DefaultKeycloakSessionFactory.deploy(DefaultKeycloakSessionFactory.java:112)
at org.keycloak.provider.ProviderManagerRegistry.deploy(ProviderManagerRegistry.java:42)
at org.keycloak.subsystem.server.extension.KeycloakProviderDeploymentProcessor.deploy(KeycloakProviderDeploymentProcessor.java:54)
at org.jboss.as.server.deployment.DeploymentUnitPhaseService.start(DeploymentUnitPhaseService.java:147)
... 5 more
12:06:20,769 ERROR [org.jboss.as.controller.management-operation] (management-handler-thread - 4) WFLYCTL0013: Operation ("add") failed - address: ([("deployment" => "authenticator-required-action-example.jar")]) - failure description: {"WFLYCTL0080: Failed services" => {"jboss.deployment.unit.\"authenticator-required-action-example.jar\".POST_MODULE" => "org.jboss.msc.service.StartException in service jboss.deployment.unit.\"authenticator-required-action-example.jar\".POST_MODULE: WFLYSRV0153: Failed to process phase POST_MODULE of deployment \"authenticator-required-action-example.jar\"
Caused by: java.lang.NoClassDefFoundError: Failed to link org/keycloak/examples/authenticator/SecretQuestionAuthenticatorFactory (Module \"deployment.authenticator-required-action-example.jar:main\" from Service Module Loader): org/keycloak/authentication/AuthenticatorFactory"}}
12:06:20,769 ERROR [org.jboss.as.server] (management-handler-thread - 4) WFLYSRV0021: Deploy of deployment "authenticator-required-action-example.jar" was rolled back with the following failure message:
{"WFLYCTL0080: Failed services" => {"jboss.deployment.unit.\"authenticator-required-action-example.jar\".POST_MODULE" => "org.jboss.msc.service.StartException in service jboss.deployment.unit.\"authenticator-required-action-example.jar\".POST_MODULE: WFLYSRV0153: Failed to process phase POST_MODULE of deployment \"authenticator-required-action-example.jar\"
Caused by: java.lang.NoClassDefFoundError: Failed to link org/keycloak/examples/authenticator/SecretQuestionAuthenticatorFactory (Module \"deployment.authenticator-required-action-example.jar:main\" from Service Module Loader): org/keycloak/authentication/AuthenticatorFactory"}}
12:06:20,772 INFO [org.jboss.as.server.deployment] (MSC service thread 1-1) WFLYSRV0028: Stopped deployment authenticator-required-action-example.jar (runtime-name: authenticator-required-action-example.jar) in 2ms
12:06:20,773 INFO [org.jboss.as.controller] (management-handler-thread - 4) WFLYCTL0183: Service status report
WFLYCTL0186: Services which failed to start: service jboss.deployment.unit."authenticator-required-action-example.jar".POST_MODULE
7 years, 1 month
OpenId identity provider (integration with Azure)
by Andrius Karpavičius
Hi
I have created OpenId identity provider with Azure Active directory and it
works. What I am failing is to retrieve any group or role information from
Azure, so I can assign corresponding roles in Keycloak.
In their documentation, https://docs.microsoft.com/en-
us/azure/active-directory/develop/active-directory-token-and-claims I see
that if response_type is specified as "id_token" additional claims "roles"
and "groups" should be returned.
But Keycloak's redirect to authorization URL in Azure contains parameter
response_type=code and there is no way to overwrite it.
Azure AD's openId configuration https://login.microsoftonline.
com/e061e904-dda8-491c-9f2f-d1e3051a5191/.well-known/openid-configuration
returns "response_types_supported":["code","id_token","code
id_token","token id_token","token"] but in "claims_supported" don't mention
"groups" nor "roles" claims.
So question - is it possible to change response_type to include id_token,
so groups or roles claims are retrieved and can be used in mapper to assign
corresponding roles in Keycloak. If not - what is a suggested approach -
store the token and retrieve them separately?
Thanks
Andrius Karpavicius
7 years, 1 month
OpenID Connect: userkey instead of username
by Tech
Dear experts,
we are working with an application that implements with a plugin OIDC.
What we detected is that when we run the authentication for a local user
present into Keycloak, the remote username appearing on the application
is the Keycloak's userKey instead of the Keycloak's username.
Is there anything that we should do to retrieve instead the username?
Thanks!
7 years, 1 month
[HELP] Unable to configure postgreSQL datasource
by tostasul＠cock.li
Hello,
I'm trying to configure a PostgresSQL datasource by following the
tutorial presented in the documentation:
https://keycloak.gitbooks.io/documentation/server_installation/topics/dat...
.
I'm doing the configuration for a standalone server by running
standalone.bat and by configuring everything in
keycloak-3.0.0.Final/standalone/configuration/standalone.xml .
I'm following the documentation step-by-step, but I get the following
error running standalone.bat every-time, and thus I'm unable to connect
to the database.
15:33:11,684 ERROR [org.jboss.as.controller.management-operation]
(Controller Boot Thread) WFLYCTL0013: Operation ("add"
) failed - address: ([
("subsystem" => "datasources"),
("data-source" => "KeycloakDS")
]) - failure description: {"WFLYCTL0180: Services with
missing/unavailable dependencies" => [
"org.wildfly.data-source.KeycloakDS is missing
[jboss.jdbc-driver.postgres-driver]",
"jboss.driver-demander.java:jboss/datasources/KeycloakDS is missing
[jboss.jdbc-driver.postgres-driver]"
]}
15:33:11,687 ERROR [org.jboss.as.controller.management-operation]
(Controller Boot Thread) WFLYCTL0013: Operation ("add"
) failed - address: ([
("subsystem" => "datasources"),
("data-source" => "KeycloakDS")
]) - failure description: {"WFLYCTL0180: Services with
missing/unavailable dependencies" => [
"org.wildfly.data-source.KeycloakDS is missing
[jboss.jdbc-driver.postgres-driver]",
"jboss.driver-demander.java:jboss/datasources/KeycloakDS is missing
[jboss.jdbc-driver.postgres-driver]",
"org.wildfly.data-source.KeycloakDS is missing
[jboss.jdbc-driver.postgres-driver]"
I have tried different versions of JDBC drivers provided by:
https://jdbc.postgresql.org/download.html, but to no avail, even by
using the version mentioned in the documentation.
At this point I am stuck since my configuration files look exactly like
in the documentation. What exactly could I be missing? Is the
documentation up to date?
Thanks in advance for any help,
My best regards.
7 years, 1 month
regarding service accounts
by Avinash Kundaliya
Hello,
I have been looking at service accounts recently. So, from what i
understand, for the service account to manage users and roles, it has to be
given the `realm_management.manage-users` client role right?
My confusion is that once a client has the following permission, it can
technically manage the roles for the whole realm right? Is there a way to
limit this to just the client. So, the client should be able to manage
roles and user-role mapping for the client itself.
Is it possible to do something like that?
--
---
Avinash Kundaliya
avinash(a)avinash.com.np
http://avinash.com.np
7 years, 1 month
