August 2017 - keycloak-user - Jboss List Archives

1 realm multiple ldap providers with username collisions

by Wim Vandenhaute

Hello list, What would be the advisable way of handling following use case: 1 application authn using keycloak with a realm with > 1 ldap configurations But in 2 or more of those ldap's there are equal usernames. How can we for user1 make sure ldap1 is used and for user2 ldap2? I.e. for example where we could provide a login form with the username/password but with an additional dropdown that has the configured ldap providers in it. What would be the advisable way of handling such a situation? Is there any support for this that I am missing? Would having 2 realms be the only way to handle this right now? p.s. We are developing against keycloak 2.5.5 at the moment Kind regards, Wim.

6 years, 7 months

2
1
0 / 0

Service account user attributes

by Daniel Storey

Hello I would like to use service accounts to allow my OIDC clients to obtain access tokens using the client credentials grant. Furthermore, I'm trying to find a way to define additional attributes for each service account client so that I can map them to custom claims via a protocol mapper. I notice that Keycloak creates an internal user for each service account in its database, but the user is not visible/editable through the admin UI. Therefore, I am unable to create attributes for the service account user as I can for 'normal' users. I think I can define custom claims for a service account using a protocol mapper (something like the "hardcoded claim" mapper), assuming I can distinguish service account requests from user requests in the mapper. If this approach is not recommended, I would be very grateful if you could suggest an alternative. Kind regards Dan

6 years, 7 months

3
7
0 / 0

password policy | federation to AD

by mj

Hi, REALM federated to active directory, with password requirements like: - required 1 uppercase - required 1 digit - required 1 lowercase - required 1 special character - min 8 characters - cannot contain username - max age 180 days Now, when I logon keycloak, I am asked to change my password. Correct. But when I provide a bad password like "123", I would expect keycloak to say something like: "ERROR: this password does not meet the password complexity requirements, please use ..." etc. However, the only message I receive with a password like "xyz" is: "Could not modify attribute for DN [CN=username,CN=Users,DC=ad,DC=company,DC=com]" So how is the user supposed to know what the configured password requirements are..? This is on keycloak 3.1.0 btw. Advise? MJ

6 years, 7 months

3
8
0 / 0

Single keycloak server using two (or more) URLs.

by rafterjiang

Is it possible to have one keycloak server but accessed by different URLs? How do we configure "keycloak.auth-server-url" for client adapter? For example Single keycloak server: keycloak01 For public access: https://public-url.keycloak01.test.com For internal access: https://internal-url.keycloak01.test.com How is this possible? thanks, R -- Sent from: http://keycloak-user.88327.x6.nabble.com/

6 years, 7 months

3
2
0 / 0

Using Keycloak with Microsoft Azure Active Directory

by Reed Lewis

I am attempting to use Microsoft Azure Active Directory with Keycloak. It is not working correctly. Here is how I have it configured: OpenID Connect V1.0 Enabled: On Store Tokens: On Store Tokens Readable: On Trust Email: On Authorization URL: https://login.microsoftonline.com/common/oauth2/authorize Token URL: https://login.microsoftonline.com/common/oauth2/token Logout URL: <none> Backchannel Logout: Off User Info URL: <blank> First Login Flow: First Broker Login It directs me to the Microsoft page to login correctly, but when it comes back to keycloak, it either only has the first and last name, but no email address. Is there something I have configured incorrectly? I also tried to use the built in Microsoft connector, but that does not work with Azure Active Directory. Thank you, Reed Lewis

6 years, 7 months

4
4
0 / 0

Keycloak restart necessary to access new resources?

by christian lutz

Hello, I just stumbled over a behavior I am not sure if intended or not. I add via the Admin REST API new resources to an existing client via realm.clients().get(xy).authorization.resources().create(newResource); Then I have a simple javascript policy checking if a user is allowed to access this specific resource. It always fails for recently added resources. But after I restart the keycloak it works. I tried to login with different browser the same behavior. Do I have to call a refresh or similar so the javascript policy is able to see the added resources? Or is this a bug? Sincerely Christian

6 years, 7 months

2
3
0 / 0

Keycloak / Azure AD Federation

by Jonas Weismueller

Hi, we configured AzureAD to use our keycloak instance, like this: $cer="$our_cert_string" $uri="https://keycloak.internal/auth/realms/azure/protocol/saml" $dom="test.domain.cloud" Set-MsolDomainAuthentication -DomainName $dom -Authentication Federated -ActiveLogOnUri $uri -SigningCertificate $cer -PassiveLogOnUri $uri -IssuerUri $uri -LogOffUri $uri -PreferredAuthenticationProtocol SAMLP When I know try to login on the azure portal, I get successfully redirected to https://keycloak.internal/auth/realms/azure/protocol/saml , but then I get the following error from keycloak: 2017-08-22 11:49:47,735 DEBUG [org.hibernate.internal.util.EntityPrinter] (default task-3) org.keycloak.events.jpa.EventEntity{clientId=null, realmId=azure, ipAddress=192.168.2.3, id=ab93af94-dcc5-4b8f-bd3a-8f8f3305439c, sessionId=null, time=1503402587482, error=invalid_authn_request, type=LOGIN_ERROR, userId=null, detailsJson={"reason":"invalid_destination"}} The SAML AuthnRequest sent by M$ looks as follows: 2017-08-22 11:49:47,371 DEBUG [org.keycloak.saml.SAMLRequestParser] (default task-3) <samlp:AuthnRequest ID="_2a11cf45-197e-4410-807b-c407548c250b" Version="2.0" IssueInstant="2017-08-22T11:47:46.793Z" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"><Issuer xmlns="urn:oasis:names:tc:SAML:2.0:assertion">urn:federation:MicrosoftOnline</Issuer><samlp:NameIDPolicy Format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"/></samlp:AuthnRequest> What we can see, is that the destination (optional?) attribute is missing. See http://www.datypic.com/sc/saml2/e-samlp_AuthnRequest.html Why is keycloak doing some strict checking about the optional destination parameter? Cheers Jonas

6 years, 7 months

3
7
0 / 0

Logout from external IDP, IDP doesn't support parameter forwarding

by joerg.js.schmidt＠daimler.com

I added an external OIDC provider as IDP in my Keycloak config. I've configured all Endpoints including the Logout URL. Loogin works perfectly. However when I try to logout from the external IDP, I see this URL: <some_url>?state=9ef361c6-e94b-469d-8f72-cef2f374bff8&id_token_hint=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.ewogInN1YiI6ICJGY0otNm1pYnNEZ3ZmWnFFN2hpSVVQNnBWTGhfWWpSQ1dROFFoMXVUeE53IiwKICJhdWQiOiAiNzE3NTdhZTgtODE1MC00MTcyLTk3NmMtZGUxZDdmZTEyOGJjIiwKICJjX2hhc2giOiAicGZMTHh5YzgxRW1rOTVpYVd0WkFCZyIsCiAiYWNyIjogImh0dHBzOi8vbG9naW4uc2VjdXJlLm1lcmNlZGVzLWJlbnouY29tL3dsL2xldmVsLTE1IiwKICJhenAiOiAiNzE3NTdhZTgtODE1MC00MTcyLTk3NmMtZGUxZDdmZTEyOGJjIiwKICJhdXRoX3RpbWUiOiAxNTA0MTY0NTY1LAogImlzcyI6ICJodHRwczovL2FwaS1jZXJ0LXRlc3QuaS5kYWltbGVyLmNvbS8iLAogImV4cCI6IDE1MDQxNzE3NjUsCiAiaWF0IjogMTUwNDE2NDU2NQp9.cRCPjvjJxpnkDsDVcSF4jne5_5EwTgF2Hd1kglPLTsw&post_logout_redirect_uri=<...>%2Fauth%2Frealms%2Fmy_realm%2Fbroker%2Fkeycloak-oidc%2Fendpoint%2Flogout_response And then the redirect from the IDP <some_url>/auth/realms/my_realm/broker/keycloak-oidc/endpoint/logout_response The URL parameter "state" is not appended to the logout_response, but it seems to be necessary for keycloak to do the logout. Is there any workaround? Joerg If you are not the addressee, please inform us immediately that you have received this e-mail by mistake, and delete it. We thank you for your support.

6 years, 7 months

1
0
0 / 0

Keycloak in kubernetes cluster with AWS postgress: standalone-ha?

by Tonnis Wildeboer

I am attempting to run Keycloak in a kubernetes cluster with a shared postgres (RDS) db. Everything is hosted on AWS. The keycloak instances are deployed using Helm. I have read the clustering documentation and from that it seems that the appropriate clustering mode in this scenario would be "Standalone Clustered Mode".Therefore, I am using the "jboss/keycloak-ha-postgres" Docker image. Since I am using the nginx Ingress controller I have the prescribed PROXY_ADDRESS_FORWARDING=true environment variable. Upon inspection of the Docker image, however, I noticed that the $JBOSS_HOME/standalone/configuration/standalone-ha.xml file in that image does not have the proxy-address-forwarding="${env.PROXY_ADDRESS_FORWARDING}" attribute in the <http-listener ...> element. I also noticed that the jboss-dockerfiles/keycloak-server base image has a sed command to add this to the standalone.xml file but not to the standalone-ha.xml file. Also, of the exmaples I have found via Google searches, I have not found examples of deploying Keycloak this way, which is surprising. I have seen examples with a single instance using the standalone postres image, but not "Standalone Clustered". So here are my questions: 1. What are the specific differences between using --server-config standalone-ha.xml vs standalone.xml? 2. Is there communication between the pods that needs to happen when running in "Standalone Clustered Mode"? (I ask this because I would need to make sure that this is possible, possibly across VPCs.) If so, what is it? I am hoping they just share a database. 3. Why doesn't the base jboss-dockerfiles/keycloak-server image also modify the standalone-ha.xml file too, in the same way it modifies the standalone.xml file: ( https://github.com/jboss-dockerfiles/keycloak/blob/0a54ccaccd5e27e75105b9... )? 4. Is there any other documentation, etc that I should be looking at? Thank you, Tonnis

6 years, 7 months

2
3
0 / 0

Admin URL configuration

by Amat, Juan (Nokia - US)

Hello, I have a question about the Admin URL configuration for an OIDC client. I have an application deployed on Wildfly 10.1. This application is not distributable, stateful and relies on sticky session (using the JSESSIONID cookie). Now on the same machine I have 2 wildfly instances. Question is what value should I provide in the for the Admin URL? I see that we have this ${application.session.host} but AFAIU this will not help as the host will be the same for both. Ciao.

6 years, 7 months

1
1
0 / 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

keycloak-user August 2017