May 2017 - keycloak-user - Jboss List Archives

Can't set password when registering a user

by Scott Finlay

Hi, According to the Keycloak admin API documentation: http://www.keycloak.org/docs-api/2.5/rest-api/index.html#_create_a_new_user -> http://www.keycloak.org/docs-api/2.5/rest-api/index.html#_userrepresentation -> http://www.keycloak.org/docs-api/2.5/rest-api/index.html#_credentialrepre... We should be able to provide credentials when creating a new user, but when I provide credentials it doesn't seem to set the password for the new user. Here is what my request looks like: POST /auth/admin/realms/myrealm/users/ {"enabled":true,"username":"blah(a)blop.com","email":"blah(a)blop.com","firstName":"Blah","lastName":"Blop","attributes":{"userId":["1234"]},"credentials":[{"type":"password","temporary":false,"value":"secr$tP4ssword"}]} Just as an experiment, I tried passing a single "credential" instead of an array of credentials and I got this error back: internal server error;KeyCloak HTTP Error Response [400]: com.fasterxml.jackson.databind.JsonMappingException: Can not deserialize instance of java.util.ArrayList out of START_OBJECT token at [Source: io.undertow.servlet.spec.ServletInputStreamImpl@264472bc; line: 1, column: 156] (through reference chain: org.keycloak.representations.idm.UserRepresentation["credentials"]) So clearly Keycloak is actually parsing this field. Am I doing something wrong with this request or is the documentation wrong? Right now what we've been doing to get around this is registering the user and then doing a reset password request after, but this makes the request to our service take twice as long. It would be great if we could reduce this to a single request. Regards, Scott

8 years, 10 months

3
7
0 / 0

authz client incompatible with client definition

by Denny Israel

I am writing a command line interface which needs to authenticate against keycloak. After creating the client definition in keycloaks admin console i copy the installation data (keycloak.json) into the cli. When i try to use the authz client i am not even able to create the client because it does not know the option "ssl-required". When i remove this option the client can be created but throws another exception when i call "obtainAccessToken", this time complaining about missing credentials. The credentials are missing because i made the client "public". Am i doing something wrong or do i missunderstand the purpose of the authz client?

8 years, 10 months

3
2
0 / 0

OAuth2 token introspection requires an active session?

by Iván Perdomo

Hi all, We're trying to use offline access [1] to retrieve access_tokens on behalf of the user and access a protected resource in a long running process. This protected resource checks the validity of the access_token using the OAuth2 token introspection. In our tests we found that the introspection flag "active" true|false depends on having an active session in the server. Which seems to defeat the purpose of the offline access capabilities. I have tested with versions 2.5.5.Final and 3.0.0.Final and the behavior is the same. * Get an offline token via direct grants * Get an access_token using the offline_token * We have an active session * Use the token introspection for the access_token and get the expected result: active=true * Wait for SSO Idle timeout (so the session expires) * Get a new access_token using the "stored" offline_token * Use the token introspection with the new access_token. Keycloak returns active=false because we don't have a session. But the access_token is valid, and not expired. The following code repository has an isolated test case of this scenario: https://github.com/iperdomo/keycloak-oauth2-instrospection The described steps are in this script: https://github.com/iperdomo/keycloak-oauth2-instrospection/blob/master/te... I tried to look for logged issues regarding token introspection and didn't found anything related to this problem. Is this a bug or an expected behavior? [1] https://keycloak.gitbooks.io/documentation/server_admin/topics/sessions/o... Thanks for your support. -- Iván

8 years, 10 months

4
8
0 / 0

KeyCloak Performance and Sizing

by ost1988＠aol.com

Hi everyone, we're going to setup a KeyCloak infrastructure to handle identity management for up to 4 million users. In order to handle this amount we'd like to setup a proper infrastructure. The general idea is to create a containerised cluster of key cloak servers connected to an highly available db2 database. Therefore i'd like to understand what kind of data and amount is persisted in the db. I haven't found any details about sizing a key cloak infrastructure - i hope you can share some more details with me. Kind Regards

8 years, 10 months

1
0
0 / 0

Problem when we execute storage provider SPI in domain mode.

by Cindy Margarita Pacheco Alvarez

We have created a storage provider SPI with keycloak-2.2.1.Final but we have a problem when we execute this SPI in domain mode. We use a postgres XADatasource and we create the SPI in the same way as the storage provider example. We have a master with a single slave. When we ask for a token we have the following error: The pre-jca synchronization org.jboss.as.ejb3.component.stateful.StatefulSessionSynchronizationInterceptor$StatefulSessionSynchronization@3a417315 associated with tx TransactionImple < ac, BasicAction: 0:ffffc0a83866:-33c4bf71:5910ee3a:da status: ActionStatus.ABORTED > failed during after completion: java.lang.IllegalStateException: Transaction DummyTransaction{xid=DummyXid{id=11}, status=1} is not in a valid state to be invoking cache operations on……. And org.infinispan.util.concurrent.TimeoutException: ISPN000299: Unable to acquire lock after 10 seconds for key f:96007b81-fe12-491d-9a7f-c0bfabc8345a:name.lastname and requestor GlobalTransaction:<null>:13:local. Lock is held by GlobalTransaction:<null>:10:local….. (you can see the complete trace in log.log, adjunted in this e-mail) ------- we’ve applied the solution of http://lists.jboss.org/pipermail/keycloak-user/2016-October/007901.html but when we do a lot of requests we have an error with the entity manager. 12:20:20,203 ERROR [io.undertow.request] (default task-13) UT005023: Exception handling request to /auth/realms/Latam-Realm/protocol/openid-connect/token: org.jboss.resteasy.spi.UnhandledException: org.keycloak.models.ModelException: java.lang.IllegalStateException: EntityManager is closed [Server:server-one] at org.jboss.resteasy.core.ExceptionHandler.handleApplicationException(ExceptionHandler.java:76) [Server:server-one] at org.jboss.resteasy.core.ExceptionHandler.handleException(ExceptionHandler.java:212) [Server:server-one] at org.jboss.resteasy.core.SynchronousDispatcher.writeException(SynchronousDispatcher.java:168) [Server:server-one] at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:411) [Server:server-one] at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:202) [Server:server-one] at org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.service(ServletContainerDispatcher.java:221) [Server:server-one] at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:56) [Server:server-one] at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:51) [Server:server-one] at javax.servlet.http.HttpServlet.service(HttpServlet.java:790) [Server:server-one] at io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:85) [Server:server-one] at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:129) [Server:server-one] at org.keycloak.services.filters.KeycloakSessionServletFilter.doFilter(KeycloakSessionServletFilter.java:90) [Server:server-one] at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:60) [Server:server-one] at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131) [Server:server-one] at io.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.java:84) [Server:server-one] at io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:62) [Server:server-one] at io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36) [Server:server-one] at org.wildfly.extension.undertow.security.SecurityContextAssociationHandler.handleRequest(SecurityContextAssociationHandler.java:78) [Server:server-one] at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) [Server:server-one] at io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:131) [Server:server-one] at io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:57) All of this only happen when we use domain mode with different slaves. But in standalone mode in local machines works perfectly.

8 years, 11 months

1
0
0 / 0

Need info on Keycloak benchmarks & success stories

by Dmitry Telegin

Hi, MGTS, Moscow's leading telephony and internet provider with ~4M subscribers, holds a tender for a web SSO solution to replace their current OpenAM. Our company participates with Keycloak/RHSSO based solution. We've successfully passed an RFI phase and advanced to RFP, where we will be asked to produce the following performance measurements: - single node capacity (logins/sec) for a known server configuration; - capacity increase per each node added to the cluster. Thus, I wanted to ask if anyone has performed such a sort of benchmarking for Keycloak, and if the results are available. If not, what's the best approach to perform benchmarking ourselves? Did anyone have success with keycloak-benchmark? Additionally, it would help us much if we could refer to some success stories of real-world Keycloak deployments, preferably in the telecom area. Thanks! Dmitry

8 years, 11 months

3
6
0 / 0

Forgot password does not verify the account

by tecnologia＠growingup.com.co

The password remembering option is not validating that the email is registered. The expected result is that you do not use an unregistered email, you get an error message Always confirms, even when the account does not exist. -- Jairo Henao Rojas

8 years, 11 months

2
1
0 / 0

Issue with OAuth token introspection

by Jason B

Hello All, I am having an issue with OAuth token introspection. Our Keycloak service is accessible with two different host names. For example access-external.naidm.com & acess-internal.naidm.com As an end user when I am obtaining the OAuth token through access-external.naidm.com and passing it to the resource server and resource server trying to inspect the token through access-internal.naidm.com token introspection is failing and we are always getting {"active": false} irrespective of whether issued token is valid or not. If we try to validate the OAuth token through access-external.naimd.com endpoint introspection is succeeding. So we arrived at a conclusion that same endpoint (with same FQDN) need to be used for obtaining and introspecting an OAuth token. Also, we noticed that tokens issued over HTTPS protocol can't be validated over HTTP protocol and vice versa. We are not concerned about HTTP but we are concerned about the why introspection is failing with different FQDN end points. BTW, we are using Keycloak 3.1 CR1. Any thoughts on why Keycloak behaving this way? Is there any way we can change this behavior? Please share your thoughts on this. - J

8 years, 11 months

1
1
0 / 0

Best way to verify an AccessToken with RSATokenVerifer and keycloak-admin-client

by Thomas Darimont

Hello Group, what is currently the best way to verify an access token with the keycloak-admin-client in an application without a configured keycloak deployment/adapter? In the adapter scenario the PublicKey needed by the RSATokenVerifier is retrieved with a PublicKeyLocator which is provided by the KeycloakDeployment. With no deployment at hand one needs to retrieve the public key dynamically to deal with key rotation. I found two variants to do this - which one do you think is the best? Variant 1) Iterate over keycloak.realm(realmId).keys().getKeyMetadata().getKeys() and find the public key currently referenced by the kid in the JWKSHeader of the AccessToken. However this requires that the current user / client role has at least one role of the realm-management client, e.g. view-realm. Variant 2) Send a GET Request without any authentication to http://192.168.99.1:8080/auth This will return the representation of the PublicRealmResource as JSON which contains the currently active RSA public key for the realm. This variant doesn't require any role on the client / user since it doesn't require authentication. Unfortunately the current keycloak-admin-client doesn't seem to provide a way to access the PublicRealmResource information which requires additional code to fetch the resource. Is there a reason for this or is this "just" an API gap that can be fixed? You can find a gist with a quick demo for the two variants here: https://gist.github.com/thomasdarimont/52152ed68486c65b50a04fcf7bd9bbde Cheers, Thomas

8 years, 11 months

2
2
0 / 0

Criticial vulnerability fixed in Keycloak Node.js adapters

by Stian Thorgersen

A criticial vulnerability was discovered in Keycloak Node.js adapters. We highly recommend everyone upgrades to version 3.1.0 of the adapter immediately. This adapter will work with Keycloak 2 and upwards. For more details see CVE-2017-7474 <https://access.redhat.com/security/cve/cve-2017-7474>.

8 years, 11 months

1
0
0 / 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

keycloak-user May 2017