January 2018 - keycloak-user - Jboss List Archives

by Matthew Broadhead

org.keycloak.representations.idm.UserRepresentation (https://github.com/keycloak/keycloak/blob/master/core/src/main/java/org/k...) has a property enabled which is of type java.lang.Boolean. Technically this should have getters and setters of getEnabled and setEnabled. A type boolean would have isEnabled and setEnabled. This stops it from working with JSF (https://stackoverflow.com/questions/14400222/boolean-properties-starting-...) This also applies to totp and emailVerified in the same class.

6 years, 10 months

2
3
0 / 0

Keycloak realm detection from email domain

by Scott Hezzell

Hi I am building a multi-tenant mobile application that uses keycloak as a SSO server. We will pre-load users in keycloak using their email address as their username with a separate realm for each tenant. When a user logs into the mobile app I need to detect the realm from a user's email domain and redirect to the appropriate authorisation end point for the realm. Has anyone faced a similar problem? My thoughts at the moment is to build a proxy api that the mobile application redirects to that prompts the user for their email address, look up the configured tenant form the email domain and redirects to the appropriate realm's login page passing the mobile app credentials it passes to the proxy api and the entered user email as a login_hint. Can anyone see any issues with this approach? Or a suggest a better approach? Thanks Scott

7 years, 4 months

3
2
0 / 0

Organization Based Accounts and Permissions

by Charles Henck

Hello all,I’m working on an organization-based service and want to have resource-specific permissions that are restricted by (from a user perspective) organization-specific roles. Since I’m not familiar with the specific terminology, I’m thinking of something similar to how GitHub manages their permissions:- A single user can be a member of multiple organizations- A user can have a different roles with different organizations that grant them access to all of an organization's resources- A user can have access to a specific resource- That organization-specific role determines access to different organization resourcesAre there any best practices or patterns for this model? Thanks!Justin

7 years, 5 months

6
19
0 / 0

LDAP user group membership not syncing

by Luiz Carlos

Hi everyone I'm trying to sync the LDAP groups into Keycloak but it doesn't update the membership if I add or remove it from a group in LDAP. I was able to sync the groups and its users into Keycloak correctly if those wasn't provisioned before. For example, if the user already exists in Keycloak DB (provisioned from LDAP) and I remove it from a LDAP group (also provisioned from LDAP), the user in Keycloak continues to being a member of the group in the Groups tab of user's details screen and in client's group mappers. However, if I open the Members tab of group's details screen the user was removed from the group. Is there any way to solve this problem? Because of my company policy I can't use Keycloak to manage the groups. I'm using Keycloak 2.5.1. Thanks for the help -- Luiz Carlos

7 years, 5 months

3
2
0 / 0

user storage ldap or keycloak

by Istvan Orban

Dear Keycloak users. I am very new to keycloak and I really like it. it is great. I am currently migrating a legacy app ( using it's own user management ) to support SSO. I have set-up keycloak with openid connect and it works very well. At this point we need to decide if we will use keycloak as our main user store or we will set-up an LDAP. My question is that. Is keycloak designed in a way that it can fullfil all the responsibilities of the main user store? Any risk with this at all? ps: our userbase is small and at this point I am not sure if we want to add ldap just for this. -- Kind Regards, *----------------------------------------------------------------------------------------------------------------* *Istvan Orban* *I *Skype: istvan_o *I *Mobile: +44 (0) 7956 122 144 *I *

7 years, 5 months

3
2
0 / 0

Keycloak & Okta

by John D. Ament

Hi Just wondering, has anyone setup Keycloak w/ Okta? Every time I try to authenticate (both SP initiated and IdP initiated) it fails with this error 01:40:54,626 WARN [org.keycloak.events] (default task-7) type=IDENTITY_PROVIDER_LOGIN_ERROR, realmId=tenant1, clientId=null, userId=null, ipAddress=172.17.0.1, error=staleCodeMessage 01:40:54,627 ERROR [org.keycloak.services.resources.IdentityBrokerService] (default task-7) staleCodeMessage I suspect its a setup issue on my side, so was hoping someone else has tried this and can give tips. I even tried the import feature, no luck. John

7 years, 9 months

3
6
0 / 0

KeyCloak and Azure Active Directory / response_type

by Robin Diederen

Hello all, I’m trying to make KeyCloak (3.4.0 Final) work with Microsoft Azure AD using the OpenID Connect protocol (OIDC). My goal is for KeyCloak to be an identity broker between a number of in-house clients and Azure AD as identity backend. After configuring the appropriate endpoints for OIDC / oAuth v2.0 and some clients, upon hitting my client with my browser, KeyCloak redirects me to the Microsoft login page. Logging in works fine and my client / app is correctly recognized by Microsoft. However, when redirected back to KeyCloak, I’m presented with an error. Upon further investigation I’ve noticed that KeyCloak reports this error in its logs: “Failed to make identity provider oauth callback: org.keycloak.broker.provider.IdentityBrokerException: No access_token from server.”. This seems to be related to the response_type attribute, which is to be set from KeyCloak upon calling the Microsoft login page. Up till now, I did not find any way to make KeyCloak include this parameter with the preffered value, being “response_type=token_id”. KeyCloak however does include “response_type=code”, yet Microsoft doesn’t seem to like this. So here’s my question: how can I instruct KeyCloak to include this parameter to make it work with AzureAD? I’ve tried a number of settings in the client page, such as implicit and standard flow enabed / disabled, however, to no avail. Any help is greatly appreciated. Best, Robin

7 years, 10 months

2
2
0 / 0

Additional attributes for an authorization request

by Scott Elliott

Would therebe any way to pass additional attributes (say, something from a REST API call's headers or body) to an authorization request, and access it in a Javascript or rules based policy? I see that what is available in the Evaluation API currently is pretty limited.

7 years, 10 months

3
5
0 / 0

Best setup to extend Keycloak

by Francis Zabala

Hello, What is the best setup to develop custom SPI for Keycloak. I just skimmed the example codes in github and wondered on how to test my codes. Not TDD way of testing but a simple, hey, will this run properly? Anyway, the reason I need to extend this is to create an authentication flow that will use your internal SMS api for subscriber verification. Regards,Francis

8 years

1
1
0 / 0

Microsoft social identity provider returns id_token while access_token is expected

by Sid 0

I am using keycloak 3.4.1.Final (deployed by docker). diving into the issue, here are the logs: WARN [org.keycloak.connections.httpclient.DefaultHttpClientFactory] (default task-7) Truststore is disabled ERROR [org.keycloak.broker.oidc.AbstractOAuth2IdentityProvider] (default task-7) Failed to make identity provider oauth callback: org.keycloak.broker.provider.IdentityBrokerException: No access token available in OAuth server response: {"id_token":"eyJ0eXAiOi..."} at org.keycloak.broker.oidc.AbstractOAuth2IdentityProvider.getFederatedIdentity(AbstractOAuth2IdentityProvider.java:279) at org.keycloak.broker.oidc.AbstractOAuth2IdentityProvider$Endpoint.authResponse(AbstractOAuth2IdentityProvider.java:399) Note: with my current setup I don't have any issue with Google identity provider. Please let me know if more information needed for solving this issue, thanks. -- Sid

8 years, 1 month

2
1
0 / 0

How to stop the keycloak server from standalone sh

by Aritz Maeztu

Hello, I'm running a keycloak instance from a docker image, so when I start the container everything is up an running. Now I want to export the realms and users to deploy it in production and I've got two chances: 1- Copy the values from the mysql database (I'm using the keycloak-mysql image). 2- Run the standalone.sh export command. I would like to go the second way, but I'm into trouble since the widlfly server is launched with the docker container altogether. I can browse in to it for the standalone.sh script, but still haven't found a way to stop it (as the server is launched I get a "Address already in use" error when I try to perform the export while the server is running). Any ideas? Thanks in advance -- Aritz Maeztu Otaño Departamento Desarrollo de Software <https://www.linkedin.com/in/aritz-maeztu-ota%C3%B1o-65891942> <http://www.tesicnor.com> Pol. Ind. Mocholi. C/Rio Elorz, Nave 13E 31110 Noain (Navarra) Telf. Aritz Maeztu: 948 68 03 06 Telf. Secretaría: 948 21 40 40 Antes de imprimir este e-mail piense bien si es necesario hacerlo: El medioambiente es cosa de todos.

8 years, 1 month

4
4
0 / 0

User session logout in Keycloak Console seems not to work if using User Federation Provider

by Juan Pablo Perata

Hello, This issue seems application specific, but I could not reach to the root yet. I would like to know if someone faced this in Keycloak Admin Console or some tips you could give me to see what is going on. *Environment* Web application running on Wildfly 10.1.0.Final and secured with Keycloak. Keycloak 3.4.3.Final server running in <IP>:<PORT1> Wildfly 10.1.0.Final server running in <IP>:<PORT2> *Description* Found that session logout from Keycloak admin does not have effect for federated users in my web application. Steps: - develop your own user federation provider to connect to internal database (implements interfaces _UserStorageProvider, CredentialInputValidator, UserLookupProvider, OnUserCache_) - properly configured user federation provider in keycloak realm - configure and deploy a JSF based web OIDC client application in Wildfly secured by Keycloak - Go to: _<IP>:<PORT2>/<web-application_uri>_ and authenticate using federation provider Authentication succeeded - Go to Keycloak Console -> Realm -> Sessions -> (select web application client) -> Show sessions. Then select <user-authenticated> from displayed table -> "Sessions" tab - Click "Logout all sessions" or "Logout" the specific session. A success message is displayed and session disappears from table. - Go to _<IP>:<PORT2>/<web-application_uri>_ and check that session is still alive and user is authenticated. - Checked in a Filter in web application that "org.keycloak.KeycloakSecurityContext" security context is present with information from logged in user. *To note:* - (correct behaviour) If logout is performed from web application, single sign on session is logged out properly (HttpRequest.logout()). - (correct behaviour) Tested behaviour with [product-portal sample | https://github.com/keycloak/keycloak/tree/master/examples/demo-template/p...] application and *it works ok as expected*. Tested with users loaded in "demo" json and also using my own user federation provider and works well. Thanks in advance, Juan

8 years, 1 month

1
2
0 / 0

Authorization Services and UMA 2.0 changes

by Pedro Igor Silva

Hi All, We are about to finish the initial round of changes to make Keycloak Authorization Services compliant with UMA 2.0. One of the main changes is related with a new OAuth2 Grant Type introduced by UMA 2.0 [1] and how it will be used as a replacement for both Entitlement and Authorization API. In UMA 2.0, there is no Authorization API anymore, thus it will be removed on future versions of Keycloak. Regarding Entitlement API, it will also be removed in favor of the new grant type, but in this case we are using some extensions to UMA grant type to provide the same functionality. One of the objectives of this change in particular is to have a single endpoint from where permissions can be obtained. Another important change is also related with UMA where end-users should be able now to manage their own resource and permissions via Account Management Console. Users would be able to access a "Resource" page from where they can: * See the resources they own * Check for pending permission requests (waiting for the owners approval). As well options to grant/deny the request. * Check for all "shared resources" / granted permissions. As well options to revoke permissions * Select an user they want to grant access to a resource and/or scope Other changes are related with the Policy Enforcer, Authorization Client Java API and configuration. For these areas in particular changes are minimal, specially regarding policy enforcer configuration. These changes are targeted to Keycloak v4 and we'll be updating docs accordingly, specially on how to migrate to the new version. Regards. Pedro Igor [1] https://docs.kantarainitiative.org/uma/wg/oauth-uma-grant-2.0-09.html

8 years, 1 month

2
3
0 / 0

Keycloak REST API

by Stephane Epardaud

Hi, I'm trying to use the REST API of keycloak to seed an initial config for tests that depend on keycloak, but I only found this doc: http://www.keycloak.org/docs-api/3.3/rest-api/index.html Are there better docs somewhere else? If not: they barely explain what the entities are, and don't tell me which parts are settable, required, or server-generated. They also contain some links to types that are not documented (like Map), and don't explain how to get a token to play along (found that somewhere completely different). A set of examples with each endpoint and entity type would be _greatly_ appreciated too. Otherwise there's a lot of guesswork involved :( Otherwise, pretty impressed with the rest of KeyCloak, so don't take that issue harshly :) Cheers.

8 years, 1 month

3
3
0 / 0

WebLogic and KeycloakOIDCFilter

by Thomas Isaksen

Does anyone have a working example of this setup on WebLogic? I am still having problems with the infinite loop after authentication. I don't know if my Client config might be wrong. ./t

8 years, 1 month

2
4
0 / 0

Offline tokens with external IDP

by Haim Vana

Hi, We are using KeyCloak for a several weeks now, one of the flows is user script authentication with offline token: 1. The user log in to the UI 2. Generates offline token by entering his password again 3. Put the offline token in his script 4. Executes the script Now we want to add external IDP support, first is it possible to generate offline tokens for extremal IDP in KeyCloak ? if so how ? Second in section #2 above the user enters his password to generate the offline token, with external IDP we can't use his password, one alternative is to always generate the offline token in the login (add offline_access), however is it make sense to create offline token for every login ? Thanks, Haim. The information contained in this message is proprietary to the sender, protected from disclosure, and may be privileged. The information is intended to be conveyed only to the designated recipient(s) of the message. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, use, distribution or copying of this communication is strictly prohibited and may be unlawful. If you have received this communication in error, please notify us immediately by replying to the message and deleting it from your computer. Thank you.

8 years, 1 month

3
6
0 / 0

User impersonation - JWT

by Harry Trinta

Dears, I need a help with user impersonation on keycloak. I am authenticating users through the "/realms/test/protocol/openid-connect/token". As expected, it returns a token JWT. In my app, all requests go through apiman, which validates the JWT. Now, I need to personification of user. I'm calling the service "/admin/realms/test/users/USER_ID/impersonation", sending the token in the header (Authorization = Bearer eyJhbGciOiJSUzI1NiJ9 ...). The service /impersonation creates the user session on keycloak, however doesnt return a JWT, but 3 cookies. *I'd like to get the JWT of personified user instead of cookie.* It's possible? Best regards Harry Costa

8 years, 1 month

3
4
0 / 0

Re: [keycloak-user] [keycloak-dev] Trojan in Keycloak Javascript Adapter?

by Ariel Carrera

Thanks Ramunas, I will check My Windows defender’s definition version to compare with you. I have Windows 10 (64 bit) updated on December 2017. El El mié, 3 ene. 2018 a las 17:45, Rumanas <ramunask(a)gmail.com> escribió: > * just downloaded keycloak-js-adapter-dist-3.4.2.Final.zip file > * extracted and scanned "keycloak-js-adapter-dist-3.4.2.Final" folder with > Windows Defender on Windows 10 - no issues found > * checked for Windows updates. New update "Definition Update for Windows > Defender Antivirus - KB2267602 (Definition 1.259.1141.0)" was found and > installed. > * scanned again. No issues found. > > Ramūnas > -- Ariel Carrera

8 years, 1 month

2
4
0 / 0

getRoleMappings - please I need a help

by JOSE INACIO DA SILVA JUNIOR

Hi, I'm changing PropertyFileUserStorageProvider example. And I need to override the method: Set<RoleModel> getRoleMappingsInternal(); of the class AbstractUserAdapterFederatedStorage.class in order to retrive external roles based on a legacy system. How can I do that? I've tried: protected Set<RoleModel> getRoleMappingsInternal() { Set<RoleModel> roles = new HashSet<>(); RoleModel role = new MyRoleAdapter(realm,"role1","role1","role1 description", false); roles.add(role); return roles; } The code of MyRoleAdapter: public class MyRoleAdapter implements RoleModel{ private String id; private String name; private String description; private RealmModel container; private boolean isClientRole; public RoleProdesanAdapter(RealmModel container, String id, String name, String description, boolean isClientRole) { this.id = id; this.name = name; this.description = description; this.container = container; this.isClientRole = isClientRole; } // getters } Please help me. I've tried a lot but without success! Thanks in advance! Inácio

8 years, 1 month

2
1
0 / 0

adding realm level configuration parameter

by Ori Doolman

Hi, I want to perform some customization to Keycloak using existing SPIs. For that, I need to store a configuration parameter (may be different value per realm). What is the way to achieve that? Is there an SPI to extend the realm properties? The only solution I can think of now is setting a custom attribute in the users group of the realm. Thanks, Ori Doolman Lead Software Architect Amdocs Optima +972 9 778 6914 (office) +972 50 9111442 (mobile) [cid:image001.png@01D2C8DE.BFF33E10] This message and the information contained herein is proprietary and confidential and subject to the Amdocs policy statement, you may review at https://www.amdocs.com/about/email-disclaimer <https://www.amdocs.com/about/email-disclaimer>

8 years, 1 month

3
9
0 / 0

Keycloak OpenShift Template part of the openshift library project

by Charles Moulliard

Hi, The only Openshift Keycloak Template available (i think so) is part of the xpaas project and can be deployed according to this doc [1] on Openshift with the xpaas templates (A-MQ, ....) Is there any plans to have an openshift keycloak template available from the openshift library project [2] Without such info part of the library, then we can't install keycloak as it will not appear when you will browse the openshift catalog of your openshift cluster instance (running using minishift, ....) [1] https://access.redhat.com/documentation/en-us/red_hat_jboss_middleware_fo... [2] https://github.com/openshift/library Regards, Charles

8 years, 1 month

2
3
0 / 0

Keycloak logout not working for “bearer-only” application exposing REST services

by Dan Nemes

Hello, I am unable to logout an user. The logout works for a "confidential" applications but it doesn't for a "bearer-only" application (the REST services are still accessible after logout). I have the following configuration: - I have one "database" client application defined in Keycloak having access type "bearer-only" (created with the intent of exposing REST web services protected by Keycloak based on user roles) - I have one "rest_service" client application defined in keycloak having access type "confidential" (created with the intent of logging in users and allowing access to the "bearer-only" REST services after a successful login). The below described workflow is implemented in this application using REST web services I am performing the following steps: - An http GET request is performed on URL http://localhost:8180/auth/realms/demo/protocol/openid-connect/auth which redirects the user to the login page handled by Keycloak - The user performs the login using his credentials (using the credentials of a user defined in Keycloak) - Keycloak redirects the user to the "redirect_uri" which was passed in step 1. In this step Keycloak also provides as request parameters the "state" and "code" values. - After the user has been redirected back to the application I exchange the "code" received in step 3 for a token doing a POST request on http://localhost:8180/auth/realms/demo/protocol/openid-connect/token which is done successfully - After the access token is available I proceed to access the "bearer-only" REST web services. note: the REST web services exposed by the "bearer-only" service are not accessible unless the user has been logged in and it has the correct "role" assigned to it.Problem: As stated at the start of the post the user is still able to access the "bearer-only" REST web services after the logout has been done. The only thing that seems to work is the logout from the "confidential" application (the user is not able to access the application unless he logs in again).If I perform the logout of the user then the REST web services exposed by the bearer-only application are still accessible. In the Keycloak server I get the following WARN message: " Some clients have been not been logged out for user adminuser in demo realm: rest_service"I tried implementing the logout in three ways: - A redirect to URL http://localhost:8180/auth/realms/demo/protocol/openid-connect/logoutpassing in the redirect_uri and client_id parameters - A POST request to http://localhost:8180/auth/realms/demo/protocol/openid-connect/logoutpassing in the Authorization Bearer in the header and the client_id, refresh_token, client_secret and redirect_uri - A REST service exposed by the "bearer-only" service which does the following method call: HttpServletRequest request.logout() Neither of the above methods is working.PS: I did not want to go in to many details because even so the post is long enough. If I missed something please tell me and I will provide the additional information (if possible I can also attach the actual projects) Thank you,Dan Nemes | | Virus-free. www.avg.com |

8 years, 1 month

3
7
0 / 0

Atrributes in resources into Keycloak Authorization services

by Thiago Presa

Hi, We're looking into Keycloak Authorization services, but currently, we can't get our heads around configuring in Keycloak a policy the following authorization requirement: Suppose we have a corporate Google-docs-like app, where every document has a clearance level (e.g. confidential, internal, public). Every user has its own permission level, which indicates whether the user is allowed to access confidential, internal or public documents. Could you please advise as to how to implement such requirements into Keycloak Authorization services? Assuming this isn't currently supported, a simple solution seems to be implementing the ability to set resource attributes and make them available to policy construction. Would you be considering implementing such approach (or any other)? Best regards, Thiago Presa

8 years, 1 month

2
1
0 / 0

Refreshing Tokens

by Christopher Davies

I adding keycloak into a legacy application that uses GWT and Jetty. I have managed to get add Keycloak application using Spring-security. Because this is GWT I am doing the authorisation in the application myself. Sping just provides a way to get access to the KeycloakSecurityContext. The issue I have is refreshing the token. I can get hold of a RefreshableKeycloakSecurityContext instance and use that to get a refresh token. What surprised me is that I cannot refresh a token if the roles have changed. Is this correct. I was hoping that the application could notice the role changes and adapt itself on the fly. I do not want to have to logout to get the new roles it at all possible. Is there something that I have overlooked that will allow me to use the idToken to get a new accessToken given that the authentication of the user is still valid, it is just the roles the user is in that have changed. Thanks Chris

8 years, 2 months

3
5
0 / 0

Validate User Credentials Without Creating a Session

by Scott Finlay

Hi, We're currently using Keycloak 2.5.5.Final, and in this version it's not possible to validate a user's credentials (username / password combination) without actually logging the user in which results in a session (and our sessions are long- lived). Is there any new functionality introduced in the later versions of Keycloak to validate the credentials without actually logging the user in? Our use-case is that we have very long-lived tokens, but we want to require the user to re-enter his/her password in order to perform some certain sensitive tasks such as changing the password or username. If such functionality is not available, would it be possible to add this? Regards, Scott

8 years, 2 months

4
7
0 / 0

Fwd: how retrievie access token only with roles for specific target service(keycloak client)?

by Daniel Charczyński

Hi I'd like to talk with you about https://github.com/keycloak/keycloak/pull/4910 and https://issues.jboss.org/browse/KEYCLOAK-6092 we have CRITICAL security issue that target service is able to receive access token with roles to other services so it is able to reuse it. We need to implement feature thet makes it possible to get access token with roles per target service(client in keycloak) Out idea is to use client roles that requires scope. But in order to get all roles assigned from specific target service we need to chance current behaviour. At the moment there is possibility to get specific role using scope parameter <clinetId>/<role-name> but we need <clientId>/.* Have you got any idea to make it possible ASAP? We do not want to make any break changes... maybe we use wildcard instead od regexp like <clientId>/* ? Just let me know how to do it in order to be compatible with your future plans and make it possible to merge... Regards Daniel

8 years, 2 months

2
3
0 / 0

User registration flow - Can UID mapped into SN and CN ?

by Min Han Lee

Hello guys,, Our LDAP environment have a schema which required sn and cn to be stated when creating a new user, therefore the User Registration in the KC will not work as the KC can only use UID as the main attribute to register a new user, I'm thinking if anyone able to work this around by changing the UID to another attribute? Kind Regards

8 years, 2 months

2
1
0 / 0

Keycloak with NGINX proxy server not authenticating rest api

by karan shah

I have a sample app which correctly secures the rest api locally. Now when I put this in production behind a nginx proxy it does not work. No errors. It allows all request. Front end serer with ssl is https://frontend.com<https://frontend.com/> Back end server with ssl is https://backend.com<https://backend.com/> Keycloak proxy forward is true Front end server(node server on 9000) <-> NGINX <-> Keycloak (running on 8180) nginx file sample upstream keycloak_server { server localhost:8180; } upstream node_server { server localhost:9000; } location /auth/ { proxy_pass http://keycloak_server; proxy_http_version 1.1; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; } location / { proxy_pass http://node_server; proxy_http_version 1.1; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; } Front end server calls a backend api using Angular. REST api calls looks like https://backend.com/callTest Backend server(running on tomcat) <-> NGINX <-> Spring Boot(with keycloak) nginx sample location / { proxy_pass http://127.0.0.1:8080/dt-1.0/; proxy_http_version 1.1; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; } in angular keycloak.json looks like { "realm": "demo", "auth-server-url": "https://frontend.com/auth", "ssl-required": "none", "resource": "tutorial-frontend", "public-client": true } in spring boot keycloak properties look like keycloak.auth-server-url=https://frontend.com/auth keycloak.realm=demo keycloak.resource=1040nra-client keycloak.public-client=true keycloak.bearer-only = true keycloak.cors = true keycloak.security-constraints[0].authRoles[0]=user keycloak.security-constraints[0].securityCollections[0].patterns[0]=/* Please let me know how to correct this. I would really appreciate it.

8 years, 2 months

1
2
0 / 0

Keycloak Middleware for node with support for multiple realms

by Cesar Salazar

Hi, I was needing a node middleware to connect my app to keycloak. I was trying to use the official adapter, but it has the limitation that it works only for one realm. For my use case I need my app to work with any realm in my keycloak server. So, I created a module that allows multiple realms. I shared it on github: https://github.com/devsu/keycloak-nodejs-multirealm and uploaded to npm: keycloak-connect-multirealm. I'm sharing in this list for anyone that might need it, and to receive feedback. Feedback is always appreciated. Thanks! -- *Cesar Salazar* Development Manager DEVSU | www.devsu.com skype: cesarsalazar007 P: (213)-291-0752 M: +593 9 2917 160 (Ecuador)

8 years, 2 months

1
0
0 / 0

Created my own rest-service - CORS-Problem

by SW

I have my own rest-service in Keyclok. I does nothing exception for returning a string. When I am calling it from my javascript-app, I see that there are no access-control-headers set. How do I modify my rest-service, to get the access-control-headers to be set, besides of setting them myself? -- Sent from: http://keycloak-user.88327.x6.nabble.com/

8 years, 2 months

2
1
0 / 0

Keycloak Open Network Sockets Keep Growing

by Scott Baugher

Bottom line up-front: Keycloak's open socket connections (file handles) keep growing. I'm running Keycloak 3.2.1 Final in production on MS Azure using Ubuntu 16.04 LTS. All clients interact with Keycloak using the Javascript adapter. I have two Keycloak servers configured in HA mode. I have tried running the servers behind an Azure load balancer, and directly exposed to the Internet (to eliminate the load balancer as an issue), with no difference. I have also kept the servers in HA mode, but pulled one out of the load balancer pool. The server no longer in the pool does not see its connections grow. Monitored over a period of several days, the Java process associated with Keycloak starts around 400 file handles when the server is started, and keeps climbing by 30 - 80 handles per hour until it reaches the maximum, at which point keycloak stops functioning. If I do an "lsof -p [keycloak-pid]", it has hundreds to thousands of network socket connections open to real customer IP addresses (far more than would ever be expected based on the number of users). The number of connections never goes down (until the server is rebooted). I looked through all of issues resolved in every release since 3.2.1, but see nothing related to this. Does anyone have any idea what could possibly be going on?

8 years, 2 months

1
0
0 / 0

Offline tokens

by O'Callaghan, John

Hi I’m hoping someone can help with a question I have around offline tokens. I would like to be able to generate offline tokens for users of my system. At the moment the only way I can see to be able to create an offline token is to POST to “/realms/<name>/protocol/openid-connect/token“ with a scope : “offline_access” and pass in their username/password. This works fine if I am asking users to create their own offline tokens, but what I would like to be able to do is allow an admin user to create these offline tokens for users on request (without knowing their password). Is this possible? I have had a look in the REST api and didn’t see anything there but maybe its not documented? Many thanks! John Accenture Global Solutions Limited, 3 Grand Canal Plaza, Grand Canal Street Upper, Dublin 4 This e-mail and any files transmitted with it are confidential and are intended solely for the use of the individual or entity to which they are addressed. If you have received this e-mail in error, please notify the sender immediately and delete the original. Communications with Accenture or any of its group companies (“Accenture”), including telephone calls and e-mails, may be monitored by our systems for quality control and/or evidential purposes. Accenture does not accept service by e-mail of court proceedings, other processes or formal notices of any kind. Private company limited by shares registered in Ireland, Number 554978 ________________________________ This message is for the designated recipient only and may contain privileged, proprietary, or otherwise confidential information. If you have received it in error, please notify the sender immediately and delete the original. Any other use of the e-mail by you is prohibited. Where allowed by local law, electronic communications with Accenture and its affiliates, including e-mail and instant messaging (including content), may be scanned by our systems for the purposes of information security and assessment of internal compliance with Accenture policy. ______________________________________________________________________________________ www.accenture.com

8 years, 2 months

2
3
0 / 0

Why is the KEYCLOAK_LOCALE cookie httponly? And is there a way to get the locale on first call of page?

by Dominik Guhr

Hi everyone, so I tried to theme the loginpage here, which worked out pretty well at first, but when internationalization was a thing (I had to change the provided internationalization to a selectbox) I tried to get the KEYCLOAK_LOCALE cookie at page load to set the selected option by this cookie. sadly, document.cookie doesn't have the KEYCLOAK_LOCALE cookie inside, because it seems to be set to httponly=true which doesn't make it accessible via js. So, this was a problem because when you first(!) call the loginpage, there is no queryparam kc_locale=... set and I had to figure out which language is used and thus how to set the dropdowns selected option accordingly. My custom dropdown code just looks like this: <#if realm.internationalizationEnabled> <select name="languages" id="locale_dropdown"> <#list locale.supported as l> <option value="${l.url}"><a href="${l.url}"><${l.label}></a></option> </#list> </select> </#if> now when changing the login to english, not logging in, on next call of a protected page and redirect to the loginpage, I can't check in js which locale is set, for no querystring is set and the cookie is not accessible. So, 3 concrete questions: a) why is it httponly? xss attack prevention? b) Would it be possible to always get the locale in the querystring of login/pw form redirect? c) alternatively, is it possible to get the current locale in jsf by accessing locale.? Thanks in advance! Best regards, Dominik

8 years, 2 months

1
0
0 / 0

No state cookie returned from the keycloak adapter

by Sarp Kaya

Hello, A use case I have noticed is: 1) User tries to use the web application. Say http://www.app.com 2) The application redirects you to the login page http://www.keycloaklogin.com/auth/realms/realm-name/protocol… 3) Before logging in, user bookmarks this page. 4) User logs in and then gets redirected to http://www.app.com 5) All works fine up till now Now user logs out, closes browser etc. Now user starts the workflow from bookmarked page (http://www.keycloaklogin.com/auth…) 1) User sees a login page 2) User logs in 3) User gets redirected to http://www.app.com?state=… 4) At this point this below code: https://github.com/keycloak/keycloak/blob/master/adapters/oidc/adapter-co... is executed and user sees a 400 page due not having OAuth_Token_Request_State . So far you can argue that, well we didn’t want user not to have OAuth_Token_Request_State in the first place, but the next step that user can do is: 5) User goes to http://www.app.com page and then gets a redirect back to the login page http://www.keycloaklogin.com/auth/realms/realm-name/protocol… 6) Keycloak sees that user is already logged in so redirects back to the same page 7) User now can see http://www.app.com<http://www.app.com/> due to the OAuth_Token_Request_State created in step 5 So to me it seems like this check is obsolete, however I’m curious whether this has a user case or prevents anything. If not, then it might be worth fixing at the step 4 where user actually gets to see the page (or re issue OAuth_Token_Request_State ) instead of showing 400 page. Thanks, Sarp

8 years, 2 months

3
2
0 / 0

Is it possible to impersonate a user from a different realm?

by SW

Let's say you have an admin realm (which is not a master realm) and a customer-realm. Is it possible to impersonate a user in the customer-realm, when logged in to the admin realm? And if yes, how is it possible? If no, is there a way to archieve this programmatically, to give the admin realm, when impersonating "master-rights"? -- Sent from: http://keycloak-user.88327.x6.nabble.com/

8 years, 2 months

1
0
0 / 0

Delivery reports about your e-mail

by Post Office

8 years, 2 months

1
0
0 / 0

Uncaught SyntaxError: Unexpected end of JSON input on tutorial

by Viggo Navarsete

Hi, I've installed Wildfly 11.0.0.Final and keycloak 3.4.3.Final and have run the following tutorials: https://github.com/keycloak/keycloak-quickstarts/blob/latest/service-jee-... https://github.com/keycloak/keycloak-quickstarts/tree/latest/app-jee-html5 But I end up getting Uncaught SyntaxError: Unexpected end of JSON input at JSON.parse (<anonymous>) at XMLHttpRequest.req.onreadystatechange (app.js:44) whatever I click on of "Invoke Public, "Invoke Secured" and "Invoke Admin". Does anyone else have the same problem I have? It the line in bold that gives the error: req.onreadystatechange = function () { if (req.readyState == 4) { if (req.status == 200) { *output.innerHTML = 'Message: ' + JSON.parse(req.responseText).message;* } else if (req.status == 0) { output.innerHTML = '<span class="error">Request failed</span>'; } else { output.innerHTML = '<span class="error">' + req.status + ' ' + req.statusText + '</span>'; } } }; Regards, Viggo

8 years, 2 months

1
0
0 / 0

AD sAMAccountName Protocol Mapper

by trmadhu＠tafe.com

Dear All We have configured the AD Authentication in Keycloak using the User Federation. Currently we are configured the Username LDAP Attribute as "cn", but in our of the application, we need to send the sAMAccountName as the login parameter So kindly support in configuring the sAMAccountName as Protocol Mapper. [All] Above email is subject to 'Disclaimer' as per <a href="http://tafe.co.in/email-disclaimer.htm">http://tafe.co.in/email-disclaimer.htm</a>

8 years, 2 months

2
1
0 / 0

get Authorization reasons

by Corentin Dupont

Hi, I'm using the entitlement API to protect the resources of my API. Sometimes the user gets a "not authorized" message, and it's hard for him to known why. Is there any way to provide the user why more information with why it was rejected? Something similar with the infos provided by the "evaluate" panel, but with the API. Thanks Corentin

8 years, 2 months

2
3
0 / 0

Decoupled IDP brokering in different networks

by Scheinmann, Jonathan

Hi community, We currently have a setup of two Keycloak IDP's in completely different networks. That means, both Keycloak instances cannot see each other. However, the user (from the browser's point of perspective) can access both instances over a vpn connection. We would now like to "connect" both keycloak instances over identity brokering in a way that both instances can perform the authentication process without communicating directly with each other (maybe indirectly through the user's browser). We set up IDP brokering between both and everything worked fine to the point where the brokering instance performs a call-back to the other instance which of course led to an unknownhostexception. The question is therefore: is there a way to pass user data between both keycloak instances without direct communication but through a browser authentication flow. Or would that be a security risk? Regards Jonathan

8 years, 2 months

2
1
0 / 0

sAMAccountName Protocol Mapper

by trmadhu＠tafe.com

Dear All We have configured the AD Authentication in Keycloak using the User Federation. Currently we are configured the Username LDAP Attribute as "cn", but in our of the application, we need to send the sAMAccountName as the login parameter So kindly support in configuring the sAMAccountName as Protocol Mapper. Regards Madhu T R Above email is subject to 'Disclaimer' as per <a href="http://tafe.co.in/email-disclaimer.htm">http://tafe.co.in/email-disclaimer.htm</a>

8 years, 2 months

1
0
0 / 0

Collaboration of Impersonate and Javascript-Adapter

by SW

I got an application which is secured by the Keycloak-Javascript-Adapter. I need some admins which can impersonate as the user, and I was thinking to do this with.., you guessed it right: impersonate. I saw that impersonate is setting some cookies like KEYCLOAK_IDENTITY. What changes need to be made to make both collaborate: impersonate and the javascript adapter. Thx for any attempt to solve that puzzle, Sebastian -- Sent from: http://keycloak-user.88327.x6.nabble.com/

8 years, 2 months

1
0
0 / 0

Version 2.5.0 Java client cannot handshake with SSL SAN certificates?

by Bill Burton

Hello, I'm having an issue where after a user successfully logs in to the application, the Java client tries to connect to the Keycloak server to get the token verified and fails with the user seeing the text, "Forbidden" in the browser. In the server.log is the following: 2017-12-14 23:48:17,671 WARN [org.keycloak.events] (default task-18) type=CODE_TO_TOKEN_ERROR, realmId=MyRealm, clientId=my-client-1, userId=5d019b47-59dd-46f4 -8c31-8c280c5ba31a, ipAddress=10.65.15.22, error=invalid_code, grant_type=authorization_code, code_id=dc589b79-7ebc-4a73-a842-0ac988eb4cec, client_auth_method= client-secret 2017-12-14 23:48:17,674 DEBUG [org.keycloak.transaction.JtaTransactionWrapper] (default task-18) JtaTransactionWrapper commit 2017-12-14 23:48:17,676 DEBUG [org.keycloak.transaction.JtaTransactionWrapper] (default task-18) JtaTransactionWrapper end 2017-12-14 23:48:17,685 INFO [stdout] (default task-18) default task-18, WRITE: TLSv1.2 Application Data, length = 316 2017-12-14 23:48:17,794 INFO [stdout] (default task-12) default task-12, READ: TLSv1.2 Application Data, length = 552 2017-12-14 23:48:17,806 INFO [stdout] (default task-12) default task-12, called close() 2017-12-14 23:48:17,806 INFO [stdout] (default task-12) default task-12, called closeInternal(true) 2017-12-14 23:48:17,806 INFO [stdout] (default task-12) default task-12, SEND TLSv1.2 ALERT: warning, description = close_notify 2017-12-14 23:48:17,807 INFO [stdout] (default task-12) default task-12, WRITE: TLSv1.2 Alert, length = 26 2017-12-14 23:48:17,807 INFO [stdout] (default task-12) default task-12, called closeSocket(true) 2017-12-14 23:48:17,807 INFO [stdout] (default task-12) default task-12, called close() 2017-12-14 23:48:17,807 INFO [stdout] (default task-12) default task-12, called closeInternal(true) 2017-12-14 23:48:17,807 ERROR [org.keycloak.adapters.OAuthRequestAuthenticator] (default task-12) failed to turn code into token 2017-12-14 23:48:17,807 ERROR [org.keycloak.adapters.OAuthRequestAuthenticator] (default task-12) status from server: 400 2017-12-14 23:48:17,807 ERROR [org.keycloak.adapters.OAuthRequestAuthenticator] (default task-12) [unintelligible garbage] It's my understanding this is happening when the Java client attempts to connect to the Keycloak server via SSL and always fails in a manner similar to the above. Sometimes an exception is thrown with: 017-12-14 11:00:50,865 ERROR [org.keycloak.adapters.OAuthRequestAuthenticator] (default task-2) failed to turn code into token: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target Both the Java client and Keycloak server are at version 2.5.0 and deployed into Wildfly 10.0. The Oracle server JDK 1.8.0 build 144 is used all around running on RedHat Linux 6.5. The best I can tell is the SSL handshake is failing due to a certificate name mismatch even though I have the certificate and CA of the Keycloak server imported into the truststore used by the Java client. The SSL certificate used has SAN (Subject Alternative Name) entries for many DNS entries. It's defined something like: CN=abc.com dnsName=abc.com dnsName=def.com dnsName=ghi.com [ about 40 DNS entries in total] For the purpose of this example, the Keycloak server is deployed to def.com which is different than what's defined with the CN. When the Java Keycloak client in the same LAN attempts to connect to https://def.com/auth passing the token, this results in a *CODE_TO_TOKEN_ERROR* with the error, *invalid_code*. However, when using a regular non-SAN self-signed certificate in a testing environment where CN=def.com matches the DNS of the Keycloak server, the SSL handshake works successfully and there is no issue. The certificate was created using the letsencrypt.org CA - not that it would make any difference who the CA was. Due to limitations of the production environment I'm constrained to, using a non-SAN or dedicated certificate is not an option so I need to find a way get Keycloak to work with SAN certificates. I've spent a bit of time looking through all the current and past issues filed for Keycloak and have not found any issues that appear to be related to this issue. Have also looked through the Git commit history on github.com in the master branch back to 2.5.0 and not found much of anything that could be related to this issue. Upgrading to a newer version of the Keycloak client is not so simple as the application software vendor ships their product based on Wildfly 10.0, Keycloak client and server 2.5.0 plus their own integration support already configured in a single archive. Depending on how the archive is deployed and configured, it takes on different roles. In any case, I've tried to upgrade the client first to 2.5.5 and then to 3.4.3 but was unsuccessful in executing the .cli scripts either online or offline. Probably my mistake was I didn't remove the existing Keycloak client configuration in standalone.xml. However, if any of the vendor code that integrates with the Keycloak client has to be updated to work with the 3.x releases I don't have access to it. Thank you for any input, -Bill

8 years, 2 months

1
0
0 / 0

Getting Permissions from RPT

by Chandran Soundrapandian

Hi, I am evaluating keycloak and trying out the following scenario: The system has a resource 1. "Contact" and two client roles 1. Admin 2. Trainee The "Admin role" can create, view, edit and delete the "contact resource" The "Trainee Role" can create and view "contact resource" Followed the following steps to setup the resource server: 1. Created a resource "Contact" 2. Created scopes "create, view, edit and delete" 3. Created role based policy with Admin Role - "Contact Admin Policy" 4. Created role based policy with Trainee Role - "Contact Trainee Policy" 4. Created Scope based permission "Contact Admin Permission" with all the scopes (Create, View, Edit, Delete) and associated it the "contact Admin policy" 5. Created Scope based permission "Contact Trainee Permission" with create and view scopes and associated it with the "Contact Trainee Policy" After this setup, using the following Authz client code, trying to display the permission associated with the user AuthzClient authzClient = AuthzClient.create(); String accessToken = authzClient.obtainAccessToken("UserName", "UserPassword").getToken(); EntitlementResponse response = authzClient.entitlement(accessToken).getAll("Client ID"); String rpt = response.getRpt(); TokenIntrospectionResponse requestingPartyToken = authzClient.protection().introspectRequestingPartyToken(rpt); System.out.println("Token status is: " + requestingPartyToken.getActive()); System.out.println("Permissions granted by the server: "); for (Permission granted : requestingPartyToken.getPermissions()) { System.out.println(granted); } For admin I get: Permission {id=778e76d4-dc06-4e98-a213-fd7f22975ab7, name=Contact, scopes=[Contact:Edit, Contact:Delete]} where as the expected is: Permission {id=778e76d4-dc06-4e98-a213-fd7f22975ab7, name=Contact, scopes=[Contact:Create, Contact:View, Contact:Edit, Contact:Delete]} For Trainee I get - Nothing where as the expected is: Permission {id=778e76d4-dc06-4e98-a213-fd7f22975ab7, name=Contact, scopes=[Contact:Create, Contact:View]} Would you please let me know what I am doing wrong or how to setup resource server to get the expected output. Thanks -Chandran

8 years, 2 months

1
1
0 / 0

Max no of realms + users suitable

by Dieter Dirkes

Hi there, I know that Stian once said Keycloak will probably work very well with more than 10 realms ( http://lists.jboss.org/pipermail/keycloak-user/2016-October/008061.html). *My problem: *vendor is developing and operating callcenter software for ~800 customer companies. Their products are multi-tenant able, so each product could easily select the correct realm to use for authentication (based on email domain of user). I have added 500 realms with 50 users each to a single Keycloak instance and it gets really slow in the admin UI, even the OIDC calls itself are doing well (and yes: I´ve increased memory of the JVM already). Any suggestions how to handle this? (setting up 500 keycloaks on docker sounds not to be the best way). - Dieter --------------------- Dieter Dirkes codecentric AG | Wolbecker Windmühle 29j | 48167 Münster | Deutschland *ab 1.2.2018:* codecentric AG | dock14 | Am Mittelhafen 14 | 48155 Münster | Deutschland mailto:dieter.dirkes@codecentric.de | mobil: +49 (0) 173.7731855 www.codecentric.de | blog.codecentric.de | www.meettheexperts.de Sitz der Gesellschaft: Solingen | HRB 25917| Amtsgericht Wuppertal Vorstand: Michael Hochgürtel . Ulrich Kühn . Rainer Vehns Aufsichtsrat: Patric Fedlmeier (Vorsitzender) . Klaus Jäger . Jürgen Schütz Diese E-Mail einschließlich evtl. beigefügter Dateien enthält vertrauliche und/oder rechtlich geschützte Informationen. Wenn Sie nicht der richtige Adressat sind oder diese E-Mail irrtümlich erhalten haben, informieren Sie bitte sofort den Absender und löschen Sie diese E-Mail und evtl. beigefügter Dateien umgehend. Das unerlaubte Kopieren, Nutzen oder Öffnen evtl. beigefügter Dateien sowie die unbefugte Weitergabe dieser E-Mail ist nicht gestattet.

8 years, 2 months

1
0
0 / 0

Release cadence

by Stian Thorgersen

Up until now we've released Keycloak roughly every 6 weeks. We're now switching to 3 week sprints, which opens up the possibility to change how frequently we release Keycloak. We could keep it at 6 weeks (release every other sprint), do a release every 3 weeks or release less frequently (9 weeks perhaps). Thoughts?

8 years, 2 months

2
2
0 / 0

Getting my sessionId through REST?

by SW

How can I get the current sessionId that I am working on? For example, I am authenticating through a user admin in my keycloak-admin-library, now I can get the sessions that are linked to the user with GET /{realm}/users/{id}/sessions But I cannot determine, what the ID is, which I am currently using. Is there a way to archieve this? -- Sent from: http://keycloak-user.88327.x6.nabble.com/

8 years, 2 months

1
0
0 / 0

Impersonate - Change of token?

by SW

When I am calling the function with the keycloak-admin-client I am getting a redirect-uri and sameRealm in the JSON-Object. When I am calling keycloak.tokenManager().getAccessToken(), I thought that my token should be changed, because, if I am impersonating the user? And for example I should get attributes of the user through the token. -- Sent from: http://keycloak-user.88327.x6.nabble.com/

8 years, 2 months

1
0
0 / 0

Adding custom HTTP request attribute after successfull keycloak login in custom Authenticator or User Storage Provider?

by Juan Pablo Perata

Hi all, I developed a custom User Storage Provider which allows to federate users from a external database. I would like to know if it is possible to add a custom attribute to the HTTP request after successfull login, just in a similar way that KeycloakSecurityContext instance is set in attribute "KeycloakSecurityContext.class.getName()" (for example in keycloak class ServletRequestAuthenticator.java). It would be really good to do that in User Storage Provider or a custom authenticator. Context: I need to set up roles to the authenticated user after successfull login, but before entering to the application. Keycloak roles that not fit my needs. So it would be good to add this bunch of roles in a custom HTTP attribute. I appreciate if somebody faced this and have a cute solution to this :slightly_smiling_face: Thanks in advance,

8 years, 2 months

1
0
0 / 0

Adding custom HTTP request attribute after successfull keycloak login in custom Authenticator or User Storage Provider?

by Juan Pablo Perata

Hi all, I developed a custom User Storage Provider which allows to federate users from a external database. I would like to know if it is possible to add a custom attribute to the HTTP request after successfull login, just in a similar way that KeycloakSecurityContext instance is set in attribute "KeycloakSecurityContext.class.getName()" (for example in keycloak class ServletRequestAuthenticator.java). It would be really good to do that in User Storage Provider or a custom authenticator. Context: I need to set up roles to the authenticated user after successfull login, but before entering to the application. Keycloak roles that not fit my needs. So it would be good to add this bunch of roles in a custom HTTP attribute. I appreciate if somebody faced this and have a cute solution to this :slightly_smiling_face: Thanks in advance, Juan

8 years, 2 months

1
0
0 / 0

Keycloak Adapter for C#

by j0zeft

Good day Currently, the only available Keycloak Adapter for ASP .Net Applications is KeycloakOwinAuthentication by DylanPlecki. A couple of months back, Dylan posted in the repository's readme <https://github.com/dylanplecki/KeycloakOwinAuthentication/blob/master/REA...> that he's not maintaining it anymore and asked for someone to take over the adapter maintainance duties... I got in contact with him and he granted me write permission on Github, but I was missing the API key from NuGet.org in order to upload a new version of the package with a couple of fixes. I decided to fork the main project and put it under a different name, keeping the Author name to avoid confusion. Currently, the NuGet package KeyWin <https://www.nuget.org/packages/KeyWin/> is available on nuget.org with my first bug fixes to the library. -- Sent from: http://keycloak-user.88327.x6.nabble.com/

8 years, 2 months

2
1
0 / 0

Fine-grained permissions per resources on KeyCloak

by Yuriy Yunikov

Hi everyone, I need to create a fine-grained permissions system for backend resources using KeyCloak and looking for potential solutions of the problem. I've already checked resource management feature <http://www.keycloak.org/docs/3.3/authorization_services/topics/resource/o...>, but it doesn't work for me for the multiple reasons and has very limited integration in Java, so I don't consider it anymore. So another solution I came up with is having permission system based on roles and composite roles <http://www.keycloak.org/docs/3.3/server_admin/topics/roles/composite.html>. [role-name] (composite) - tenants:[permission] (composite) - tenants:[tenant-identifier]:[permission] (composite) - tenants:[tenant-identifier]:[tenant-resource]:[permission] (composite) - tenants:[tenant-identifier]:[tenant-resource]:[tenant-resource-identifier]:[permission] (non-composite) Permissions can be like create/read/update/delete and the plus of this is that it can scale if we'd have sub-resources. On the backend, I'll be able to create filters for these permissions and integrate it with Spring Security. I'm looking for opinions and would like to know if this is a valid structure or there are some other solutions which can be used. Any opinions on this? Regards, Yuriy

8 years, 2 months

1
0
0 / 0

Broker Links vs Federated Identities

by John D. Ament

Hi, When calling Keycloak's rest api, in 3.2, invoking UserResource.get().getFederatedIdenties() it seems to be returning the values of BrokerLinks instead of FederatedIdentityLinks. Is this on purpose? Relevant code: https://github.com/keycloak/keycloak/blob/master/model/jpa/src/main/java/... This seems to do it the way I would expect: https://github.com/keycloak/keycloak/blob/27b5e1aae2a895e28ac79aeb4da028e...

8 years, 2 months

1
0
0 / 0

validating an access token from an external service with a public client

by Rafael Chaves

Hi, Keycloak/OAuth newbie here, possibly asking a silly question. This is the architecture we have: 1) a web application, with authentication done via keycloak 2) an external service (REST API) that is invoked by the application above In that external service, I would like to implement a simple mechanism that allowed me to ensure the requests received are made by a valid user in that web application. We do not necessarily care about obtaining user information at this point (or permissions). The initial idea is that the web application would pass, in every request to the external service, an access token generated by Keycloak. The external service would then ensure that then token is indeed valid, which we assume involves accessing the Keycloak server (that would be fine). We looked into the entitlement API and that was pretty close (one legged verification), but it seemed to require the "Authorization Enabled" toggle to be ON in the client configuration. We do not understand the entire impact of enabling that configuration. But we noticed that at least the client is then required to use a secret to work, which the web applications currently does not use. Can that change be avoided, and are there other impacts? BTW, we are using Keycloak 3.3.0.Final. Thank you, Rafael

8 years, 2 months

1
0
0 / 0

password policy | Not (containing) Username

by lists

Hi, We would like to also prevent passwords *containing* the username, to also prevent passwords like Username_1980 The regular password policy "Not Username" only matches exact "username", rather than anything containing the username. Would it be possible to create a regex password policy to match a password *containing* the username? But I don't think this is possible..? Or perhaps I could file a feature request to change the current policy into "Not containing username"? MJ

8 years, 2 months

2
1
0 / 0

Keycloak 3.4 --> Possibility to search for attribute?

by SW

Is there a possibility in Keycloak 3.4.3 to search for an attribute? Would be quite handy for my usecase, because I am storing IDs for another system in the attributes. -- Sent from: http://keycloak-user.88327.x6.nabble.com/

8 years, 2 months

2
1
0 / 0

Keycloak 3.4.3, custom SPI deployment: noclassdef-error caused by ClassNotFoundException when trying to call LDAPStorageProvider

by Dominik Guhr

Hi everyone, sorry for spamming, but I have another problem here: I am using maven to deploy my jar-file to keycloak 3.4.3. I added the dependencies for kerberos and ldap federation like this (with and without scope provided): <dependency> <groupId>org.keycloak</groupId> <artifactId>keycloak-kerberos-federation</artifactId> <version>3.4.3.Final</version> </dependency> <dependency> <groupId>org.keycloak</groupId> <artifactId>keycloak-ldap-federation</artifactId> <version>3.4.3.Final</version> </dependency> In my IDE I can call the Classes in Question, e.g. LDAPStorageProvider, but when the jar is successfully deployed to keycloak, I get the following exception when my method is called: ...Caused by: java.lang.ClassNotFoundException: org.keycloak.storage.ldap.LDAPStorageProvider from [Module "deployment.ldap-authenticator.jar" from Service Module Loader] I looked in modules/...keycloak/ and saw all jars lying there in version 3.4.3.Final, I even looked inside with jar -tf, and the class in question is provided. As said, I tried to use scope provided and no scope, without effect. Apart from that, I changed the module.xml for the private jars by removing the private part from them and restarting the kc server, but without any effect. At this link u can see the build-definition of my pom.xml: https://pastebin.com/xgHdSGFa So, am I missing something? Hope anyone could help me out here. :/

8 years, 2 months

2
1
0 / 0

EJB sessionContext.isCallerInRole

by JOSE INACIO DA SILVA JUNIOR

Hi! I'm migrating a big JavaEE application to Keycloak and I'd like to keep using default JavaEE security methods like isCallerInRole or hasRole. My roles are generated programatically. How can I generate principal's roles programatically with Keycloak? Anyone could point me an example? Thanks Inácio

8 years, 2 months

1
0
0 / 0

keycloak proxy - How to hide the path after the TLD

by kevin_walsh＠deichmann.com

Dear list, I need to access static html views of our documentation server after authenticating users using keycloak. The html views are available at http://documentation:8090/view/department1 http://documentation:8090/view/department2 http://documentation:8090/view/department3 ... My idea was to use the keycloak proxy as follows: keycloak-proxy:8081 for department1 keycloak-proxy:8082 for department2 keycloak-proxy:8083 for department3 ... BUT I would like my users to see only keycloak_proxy:8081 not the following path, while they get the information of the respective path. Can I do this with keycloak proxy and which settings would I need? In a next step I need to add a proxy for Internet users to access the keycloak-proxy to hide even the "keycloak-proxy:PORT". My current proxy_department1.json is this (obviously without any path mappings): -begin----------------------------------------------------------------------- { "target-url":"http://documentation:8090", "bind-address":"0.0.0.0", "http-port":"8081", "applications": [ { "base-path":"/", "adapter-config": { "realm": "Manuals", "auth-server-url": " http://keycloak-proxy:8080/auth", "ssl-required": "none", "resource": "keycloak-proxy", "credentials": {"secret": "1234"}, "use-resource-role-mappings": false, "confidential-port": 0 }, "constraints": [ { "pattern":"*", "roles-allowed":["manuals_user"] }, { "pattern":"/view/manuals/*", "roles-allowed":["manuals_user"] } ] } ] } -end----------------------------------------------------------------------- Thank you & kind regards Kevin Walsh IT Software Development | Documentation Phone: +49 201 8676 932 Fax: +49 201 8676 49932 Mobil: +49 177 6664666 kevin_walsh(a)deichmann.com Von: keycloak-user-request(a)lists.jboss.org An: keycloak-user(a)lists.jboss.org Datum: 24.01.2018 14:26 Betreff: keycloak-user Digest, Vol 49, Issue 49 <Virus checked> Gesendet von: keycloak-user-bounces(a)lists.jboss.org Send keycloak-user mailing list submissions to keycloak-user(a)lists.jboss.org To subscribe or unsubscribe via the World Wide Web, visit https://lists.jboss.org/mailman/listinfo/keycloak-user or, via email, send a message with subject or body 'help' to keycloak-user-request(a)lists.jboss.org You can reach the person managing the list at keycloak-user-owner(a)lists.jboss.org When replying, please edit your Subject line so it is more specific than "Re: Contents of keycloak-user digest..." Today's Topics: 1. Re: Possibility to set new Provider in authentication flow for non-unique usernames (Dominik Guhr) 2. Re: Validate User Credentials Without Creating a Session (Marek Posolda) 3. Re: DB changes not refreshing on cluster nodes. (Marek Posolda) 4. Re: DB changes not refreshing on cluster nodes. (Angel Abella) ---------------------------------------------------------------------- Message: 1 Date: Wed, 24 Jan 2018 12:52:58 +0100 From: Dominik Guhr <pinguwien(a)gmail.com> Subject: Re: [keycloak-user] Possibility to set new Provider in authentication flow for non-unique usernames To: keycloak-user(a)lists.jboss.org Message-ID: <43b5c623-a20c-0c17-fab3-bd7d19f126d7(a)gmail.com> Content-Type: text/plain; charset=utf-8; format=flowed p.s. one provider uses Kerberos for Authentication, other does not. Am 24.01.18 um 12:51 schrieb Dominik Guhr: > So, further investigation notes: > > I think I should call the Provider like it's done here: > https://github.com/keycloak/keycloak/blob/master/examples/providers/user-... > in the create method, which allows me to call the corresponding > isValid(...) method of the required providers and only set the boolean > return value of validatePassword to false if the credentials doesn't > match in any of the providers. > > But to call this for ldap-providers set by admin interface, I need two > things: > > a) a Componentmodel. > Concrete Question: Anyone knows how to get the right ComponentModel > instance to use from my AuthenticationFlowContext of > AbstractUsernameFormAuthenticator.java? I've seen that it's possible to > get a List of ComponentModels by calling > context.getRealm().getComponents(), or by getComponent(String s), but I > don't know which String would be the valid parameter or which Model I > should take out of the List. > > b) the lookup-path. > Concrete question 2: Anyone knows how to get it form the internally used > Factories or s.th.? > > My Providers are 2 ldap directories which I want to iterate over for the > username. > > Thanks in advance! > > Best regards, > Dominik > > Am 24.01.18 um 09:27 schrieb Dominik Guhr: >> Hi everyone, >> >> I'm implementing an authentication SPI execution on top of the >> "normal" username/password form of kc 3.4.3.Final. -> >> https://github.com/keycloak/keycloak/blob/master/services/src/main/java/o... >> >> >> Sadly, usernames are not unique atm, so I need to change the >> execution, so that it doesn't stop with "invalid credentials" for a >> user who was found in one Provider. >> >> Instead of giving the "invalid credentials"-error, I want my execution >> to first check all other providers for the same username, and then >> check the credentials against all matches. And just in case of no >> credentials matching, it should fail, or login a new session for this >> user when one is found in any of my (3) Providers, which are added by >> user federation feature (2 ADs, one by a custom user storage SPI). >> >> So I drilled it down to the method validatePassword(...) in >> AbstractUsernameFormAuthenticator.java -> >> https://github.com/keycloak/keycloak/blob/master/services/src/main/java/o... >> line 191, which I want to change accordingly. Sadly, I can't find a >> method to get all Providers of the realm and check accordingly. The >> code I want to change is: >> >> if (password != null && !password.isEmpty() && >> context.getSession().userCredentialManager().isValid(context.getRealm(), >> user, credentials)) { >> ???????????? return true; >> ???????? } else {...} >> >> instead of just checking isValid() for one provider, which is what >> this does atm, I want to check all Providers. Like this pseudocode: >> >> if (password != null && !password.isEmpty() && >> context.getSession().userCredentialManager().isValid(context.getRealm(), >> user, credentials)) { >> ???????????? boolean isValid = false; >> ???????? List<Provider> realmProviders = context.getAllProviders(); >> ???????? for(Provider provider : realmProviders){ >> ???????????? isValid = provider.isValid(...); >> ???????? } >> ???????????? return isValid; >> ???????? } else {...} >> Could anyone perhaps give me a hint in how to achieve this? I haven't >> found a method yet to get all Providers and check for isValid in any >> of the given ones. >> >> Best regards, >> Dominik >> >> p.s. I created a stackoverflow question here: >> https://stackoverflow.com/questions/48399622/keycloak-check-password-in-m... >> feel free to comment/answer there :) ------------------------------ Message: 2 Date: Wed, 24 Jan 2018 13:59:05 +0100 From: Marek Posolda <mposolda(a)redhat.com> Subject: Re: [keycloak-user] Validate User Credentials Without Creating a Session To: Scott Finlay <scott.finlay(a)sixt.com>, "keycloak-user(a)lists.jboss.org" <keycloak-user(a)lists.jboss.org> Message-ID: <97c207c9-6f96-bd7c-b37f-27449b0b033a(a)redhat.com> Content-Type: text/plain; charset=utf-8; format=flowed Hi Scott, it's not available OOTB, but you can add your own REST endpoint to verify username/password. Or alternatively you can just do directGrant login (OAuth2 Resource Owner Password Credentials Grant) and then logout session. Marek On 23/01/18 09:49, Scott Finlay wrote: > Hi, > > > We're currently using Keycloak 2.5.5.Final, and in this version it's not possible > > to validate a user's credentials (username / password combination) without > > actually logging the user in which results in a session (and our sessions are long- > > lived). Is there any new functionality introduced in the later versions of Keycloak > > to validate the credentials without actually logging the user in? > > > Our use-case is that we have very long-lived tokens, but we want to require the > > user to re-enter his/her password in order to perform some certain sensitive tasks > > such as changing the password or username. > > > If such functionality is not available, would it be possible to add this? > > > Regards, > > Scott > _______________________________________________ > keycloak-user mailing list > keycloak-user(a)lists.jboss.org > https://lists.jboss.org/mailman/listinfo/keycloak-user ------------------------------ Message: 3 Date: Wed, 24 Jan 2018 14:00:56 +0100 From: Marek Posolda <mposolda(a)redhat.com> Subject: Re: [keycloak-user] DB changes not refreshing on cluster nodes. To: Angel Abella <aabella(a)bkool.com>, keycloak-user(a)lists.jboss.org Message-ID: <f29aac0f-e038-b725-9e81-68bfe0fb3f2d(a)redhat.com> Content-Type: text/plain; charset=utf-8; format=flowed I guess your cluster is not correctly setup, hence the node doesn't correctly propagate invalidation event to the other nodes and those nodes still see the stale entries in their cache. See Keycloak clustering documentation for more details how to setup/troubleshoot it. Marek On 23/01/18 13:01, Angel Abella wrote: > Hello list! > > We are experiencing some problems with our standalone-ha setup of Keycloak > 2.4.0. > Everithing works as expectd except ehn a user changes a password or is > added or removed from a group. When this happens the node making the change > is aware of it, but the other one does not until it is restarted. > > Any idea of what is going on? > > > > ------------------------------ Message: 4 Date: Wed, 24 Jan 2018 14:16:14 +0100 From: Angel Abella <aabella(a)bkool.com> Subject: Re: [keycloak-user] DB changes not refreshing on cluster nodes. To: Marek Posolda <mposolda(a)redhat.com> Cc: keycloak-user(a)lists.jboss.org Message-ID: <CAAGXFYyqzqsR7Hs5+ZdOM2N5-VuPdurMdvsDx58LFrJg5Q8oow(a)mail.gmail.com> Content-Type: text/plain; charset="utf-8" I've revised docs but everything seems to be ok. I am attaching the configuration file just in case someone can see what I'm missing. 2018-01-24 14:00 GMT+01:00 Marek Posolda <mposolda(a)redhat.com>: > I guess your cluster is not correctly setup, hence the node doesn't > correctly propagate invalidation event to the other nodes and those nodes > still see the stale entries in their cache. See Keycloak clustering > documentation for more details how to setup/troubleshoot it. > > Marek > > > On 23/01/18 13:01, Angel Abella wrote: > >> Hello list! >> >> We are experiencing some problems with our standalone-ha setup of Keycloak >> 2.4.0. >> Everithing works as expectd except ehn a user changes a password or is >> added or removed from a group. When this happens the node making the >> change >> is aware of it, but the other one does not until it is restarted. >> >> Any idea of what is going on? >> >> >> >> >> > -- Angel Abella *IT * *BKOOL* *Connect* *| Sport* mail: aabella(a)bkool.com mob: +34 691 77 18 98 add: C/ San Joaqu?n 3 - 28231 Las Rozas - Madrid www.bkool.com -------------- next part -------------- A non-text attachment was scrubbed... Name: standalone-ha.xml Type: text/xml Size: 30861 bytes Desc: not available Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20180124/c4443... ------------------------------ _______________________________________________ keycloak-user mailing list keycloak-user(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/keycloak-user End of keycloak-user Digest, Vol 49, Issue 49 *********************************************

8 years, 2 months

1
0
0 / 0

DB changes not refreshing on cluster nodes.

by Angel Abella

Hello list! We are experiencing some problems with our standalone-ha setup of Keycloak 2.4.0. Everithing works as expectd except ehn a user changes a password or is added or removed from a group. When this happens the node making the change is aware of it, but the other one does not until it is restarted. Any idea of what is going on? -- Angel Abella *IT * *BKOOL* *Connect* *| Sport* mail: aabella(a)bkool.com mob: +34 691 77 18 98 add: C/ San Joaquín 3 - 28231 Las Rozas - Madrid www.bkool.com

8 years, 2 months

2
2
0 / 0

Possibility to set new Provider in authentication flow for non-unique usernames

by Dominik Guhr

Hi everyone, I'm implementing an authentication SPI execution on top of the "normal" username/password form of kc 3.4.3.Final. -> https://github.com/keycloak/keycloak/blob/master/services/src/main/java/o... Sadly, usernames are not unique atm, so I need to change the execution, so that it doesn't stop with "invalid credentials" for a user who was found in one Provider. Instead of giving the "invalid credentials"-error, I want my execution to first check all other providers for the same username, and then check the credentials against all matches. And just in case of no credentials matching, it should fail, or login a new session for this user when one is found in any of my (3) Providers, which are added by user federation feature (2 ADs, one by a custom user storage SPI). So I drilled it down to the method validatePassword(...) in AbstractUsernameFormAuthenticator.java -> https://github.com/keycloak/keycloak/blob/master/services/src/main/java/o... line 191, which I want to change accordingly. Sadly, I can't find a method to get all Providers of the realm and check accordingly. The code I want to change is: if (password != null && !password.isEmpty() && context.getSession().userCredentialManager().isValid(context.getRealm(), user, credentials)) { return true; } else {...} instead of just checking isValid() for one provider, which is what this does atm, I want to check all Providers. Like this pseudocode: if (password != null && !password.isEmpty() && context.getSession().userCredentialManager().isValid(context.getRealm(), user, credentials)) { boolean isValid = false; List<Provider> realmProviders = context.getAllProviders(); for(Provider provider : realmProviders){ isValid = provider.isValid(...); } return isValid; } else {...} Could anyone perhaps give me a hint in how to achieve this? I haven't found a method yet to get all Providers and check for isValid in any of the given ones. Best regards, Dominik p.s. I created a stackoverflow question here: https://stackoverflow.com/questions/48399622/keycloak-check-password-in-m... feel free to comment/answer there :)

8 years, 2 months

1
2
0 / 0

How to configure keycloak with NGINX for J2EE web applicaton?

by subodhomjoshi82

How previously my web-application setup with keycloak? Installed keycloak in server machine Deployed the web-application in Jboss server Added the keycloak certificate into the Java Keytool in the machine where web-app running. Made following changes in Standalone.xml file of JBOSS ES6.4 * Added Extension* <extension module="org.keycloak.keycloak-adapter-subsystem"/> * Added security-domain* <security-domain name="keycloak"> <authentication> <login-module code="org.keycloak.adapters.jboss.KeycloakLoginModule" flag="required"/> </authentication> </security-domain> * Added Connector* <connector name="https" protocol="HTTP/1.1" scheme="https" socket-binding="https" enable-lookups="false" secure="true"> <ssl name="ssl" key-alias="initcert" password="keycloak" certificate-key-file="C:\Code_Base\keycloak_certificates\keycloak_server\keycloak.jks" protocol="TLSv1,SSLv3,SSLv2" verify-client="false"/> </connector> * Add SubSystem* <subsystem xmlns="urn:jboss:domain:keycloak:1.1"> <secure-deployment name="MyApp.war"> <realm>MYRealm</realm> <resource>MyApp</resource> <use-resource-role-mappings>true</use-resource-role-mappings> <auth-server-url>https://<Server IP>/auth/</auth-server-url> <ssl-required>NONE</ssl-required> <credential name="secret">5c9f6ea3-3448-4569-b6c4-a9e62de4db52</credential> </secure-deployment> </subsystem> So above changes working fine and my web application showing keycloak login page and after successful login its showing my web app Home page. Now my requirement to run Keycloak in HA mode with load balancer NGINX So NGINX will be in front end and NGINX will decide which keycloak to point when hitting https://<NGINX IP ADDRESS>/auth and below things already done . *What already done?* Installed HA Keycloak in Node1 and Running. Installed HA Keycloak in Node2 and Running. Installed common Database(Used by above keycloak) in Node3 and Running. Installed NGINX in Node4 and Running. Configure Both keycloak(Step1 and Step2) with NGINX Now NGINX url (https://<IP ADDRESS>/auth) showing login page of Keycloak and login also working. Now can someone please tell me what changes i have to do in Jboss so it will work with new setup -- Sent from: http://keycloak-user.88327.x6.nabble.com/

8 years, 2 months

1
0
0 / 0

KeycloakOIDCFilter infinite loop after authentication

by Thomas Isaksen

Hi I tried sending another mail containing a fiddler log but it bounced for some reason. Anyway, I have configured the filter on weblogic 12.2.1.3 as follows: <filter> <filter-name>Keycloak Filter</filter-name> <filter-class>org.keycloak.adapters.servlet.KeycloakOIDCFilter</filter-class> <init-param> <param-name>keycloak.config.skipPattern</param-name> <param-value>^(example1|example2|whatever).*</param-value> </init-param> </filter> <filter-mapping> <filter-name>Keycloak Filter</filter-name> <url-pattern>/keycloak/*</url-pattern> <url-pattern>/*</url-pattern> </filter-mapping> My keycloak.json is located in /WEB-INF/ { "realm": "Toyota Development", "auth-server-url": "http://localhost:18080/auth", "ssl-required": "external", "resource": "dummyWeb", "credentials": { "secret": "e9be44b7-394b-40d9-a8c0-203cdb9c450b" }, "confidential-port": 0 } Client config: Root URL: http://dev.toyota.no:7002/DummyWeb/ Valid Redirect URIs: http://dev.toyota.no:7002/DummyWeb/* Base URL: http://dev.toyota.no:7002/DummyWeb/ Admin URL: http://dev.toyota.no:7002/DummyWeb/keycloak Web Origins: http://localhost:8080 (keycloak server) http://dev.toyota.no.no:7002 Looks like I am getting authenticated but browser is stuck in an infinite loop. If I close the browser and try the same URL again it will go into a loop again unless I clear sessions from the keycloak admin console. You can see the fiddler log or log as text here: https://drive.google.com/drive/folders/1HiwSEe0WBWny3BQCrmXKz3LdNXVRxVVW?... If someone could please have a look at it I would be super happy! Thanks! -- Thomas Isaksen

8 years, 2 months

4
6
0 / 0

Fwd: Question : VUEJS + keycloak-js

by Christophe Lehingue

Hello everyone, I have a malfunction concerning keycloak-js with the ecosystem 'vujs'. I can connect: but I have to make another connection to access USER information Let me explain : 1) firts connexion [image: Images intégrées 1] At this stage: the connection is good, but I can not access the user info (and others) : i have theses errors [image: Images intégrées 2] I have to click again on my button "se connecter": to be able to recover the desired infos Do you have a solution ? sorry for my english but unfortunately i am french. Regards, Christophe

8 years, 2 months

2
1
0 / 0

Keycloak 1.7's static resources broken after :reload

by Andrea Scarpino

Hi there, I know 1.7 is really really really old, but I would like to know the reason behind this behaviour. Inoking ":reload", to restart the application server, breaks Keycloak static resources. A second ":reload" in row solves that. A third time will break it again and so on :-) To reproduce, download and unzip 1.7.0.Final, setup HTTPS, start the application server and try to fetch a static resource (e.g. https://localhost:8443/auth/welcome-content/keycloak_logo.png). Now :reload the application server (jboss-cli.sh --connect --command=:reload) and try to fetch the same resource (or any other); the request returns 404 and an exceptions is logged: ERROR [io.undertow.request] (default task-25) UT005023: Exception handling request to /auth/welcome-content/keycloak_logo.png: java.lang.RuntimeException: request path: /auth/welcome-content/keycloak_logo.png To me, it looks like the request output stream is closed before the data is sent to the client. Stacktrace is attached. Did you ever saw something like that? Thank you in advance for your help. Note: I cannot reproduce this with >= 1.8.0.Final, so this have already been fixed somewhere, but I would like to know where. I cannot reproduce it with WildFly 9.0.2.Final neither.

8 years, 2 months

1
0
0 / 0

Re: [keycloak-user] [keycloak-dev] WG: How to generate a token string in a custom keycloak extension?

by Thomas Darimont

Moving this discussion to keycloak-user. The functionality you are trying to build is also known as "magic-link", e.g. as used by services like slack. There is an open feature request for that in JIRA: https://issues.jboss.org/browse/KEYCLOAK-1942 Note that while this is very convenient to use it can be exploited quite badly, as mentioned in the JIRA issue. Cheers, Thomas 2018-01-23 16:46 GMT+01:00 Felix Peters <peters(a)develop4edu.de>: > Thanks for your quick response. > > > > I try to implement a prototype of a password-free authenticator like it > was mentioned in this thread: http://lists.jboss.org/ > pipermail/keycloak-user/2015-October/003387.html > > > > My current approach is to create a token on a rest endpoint and validate > this token in an custom authenticator. > > It’s just a POV, but I think a ActionToken can do the job. > > > > I was googleing around for an existing solution for password-free login > with Keycloak, but could not found something like that. > > > > Greeting, > Felix > > > > *Von:* Thomas Darimont [mailto:thomas.darimont@googlemail.com] > *Gesendet:* Dienstag, 23. Januar 2018 15:48 > *An:* Felix Peters <peters(a)develop4edu.de> > *Cc:* keycloak-dev(a)lists.jboss.org > *Betreff:* Re: [keycloak-dev] WG: How to generate a token string in a > custom keycloak extension? > > > > Hello Felix, > > > > What's your use case? > > > > Keycloak provides action tokens that permits its bearer to perform some > actions, e. g. to reset a password or validate e-mail address. > > > > Perhaps you could have a look at the action tokens SPI: > > http://www.keycloak.org/docs/3.3/server_development/topics/ > action-token-spi.html > > > > Keycloaks OIDC Tokens (AccessToken, RefreshToken, IDToken) are generated > within org.keycloak.protocol.oidc.TokenManager and exposed > > via the org.keycloak.protocol.oidc.endpoints.TokenEndpoint. Tokens can be > verified via the org.keycloak.RSATokenVerifier. > > > > Cheers, > > Thomas > > > > 2018-01-23 15:29 GMT+01:00 Felix Peters <peters(a)develop4edu.de>: > > Hi, > > I'm pretty new to Keycloak development and at the moment I'm trying to > develop some demo extensions to learn how SPI's an stuff like that work in > Keycloak. > > My Question is: > Is there a util- or helper-class which I can use to generate an secure > token string in my extension code (pretty much the same as an oauth access > or refresh token)? > I was not able to find something In the Keycloak code, but maybe there is > something like that. > Thank you in advance, > Felix Peters > > > _______________________________________________ > keycloak-dev mailing list > keycloak-dev(a)lists.jboss.org > https://lists.jboss.org/mailman/listinfo/keycloak-dev > > >

8 years, 2 months

1
0
0 / 0

Pre-delete event (again)

by Hammarberg, Daniel

Hello all, We are using Keycloak’s event mechanism to listen to create/update/delete events in Keycloak and pass them on to an MQ bus that is consumed by Siebel. Now, we have stumbled upon the problem described in the post below, namely that the delete event is passed after the user is deleted, making it impossible to read the user’s attributes from KC. The only thing that got fixed in the referenced bug report was that email was added to the delete event headers, which is not enough for us: The integration we have with Siebel is requiring the Siebel ID, which we have as an attribute on the user. My question is: Is it in any way possible to hook into the Keycloak delete event before the user is deleted or to read user attributes after receiving the delete event? Regards /Daniel The post I reference to above is: http://lists.jboss.org/pipermail/keycloak-user/2016-June/006626.html ________________________________ Capgemini is a trading name used by the Capgemini Group of companies which includes Capgemini Sverige AB, a company registered in Sweden (number 556092-3053) whose registered office is at Gustavslundsvägen 131 Box 825 – S-161 24 Bromma. This message contains information that may be privileged or confidential and is the property of the Capgemini Group. It is intended only for the person to whom it is addressed. If you are not the intended recipient, you are not authorized to read, print, retain, copy, disseminate, distribute, or use this message or any part thereof. If you receive this message in error, please notify the sender immediately and delete all copies of this message.

8 years, 2 months

2
2
0 / 0

Session Configuration Per Client

by Scott Finlay

Hi, We're currently using Keycloak 2.5.5.Final, and in this version the token lifetimes and session max and idle times can only be configured per realm. We have clients accessing the same user base via apps and via a website, and it would be nice if we could handle these different channels differently. Is it possible in the latest version of Keycloak to configure these on a client basis rather than per realm? Or if not, would it be possible to introduce this functionality? Regards, Scott

8 years, 2 months

1
0
0 / 0

Login on behalf

by Michael Hunziker

Hi! I'm struggling with the following problem: I am developing two apps (an iOS phone app for teachers and a web app for students running on tablets). Obviously the teacher (role TEACHER) is the master. I don't want the students (role STUDENT) to login on their tablets, the teacher should login on the tablet "as" the student. Here's what I came up with so far: - realm role "TEACHER" - user "testTeacher" with realm role "TEACHER" - client "teacher-ios-app" - client "student-web-app" I'm not sure how to handle the students. In one way they are "users" but they are not really allowed to login themselves on their devices, only a teacher should be allowed to do this. Have you ever done something like this? Cheers Michael

8 years, 2 months

1
0
0 / 0

Keycloak and Timesten DB integration

by Upananda Singha

Hi, I have been experimenting with Keycloak version 3.4 for our OIDC related use cases. Would like to know if Keycloak supports integration with Timesten Database (Oracle Timesten). It would be great if some one can provide some details on it. Thanks & Regds, Upananda

8 years, 2 months

1
0
0 / 0

Lookup user by ID in more than one Identity provider (ID is not unique)

by Dominik Guhr

Hi there, so I have the following scenario and hope you folks could help me out here: I've got a webapp and we're switching from old db-based login to keycloak. In our realm, we're federating the "old" userDB via an implementation of the User Federation SPI, and we're using spnego/kerberos authentication via federation of an Active Directory. Lookup is: 1. userDB 2. AD Now, use-case is as follows: 0. With kerberos-login, always use AD-login. => This works. :) But: there may be the same ID ("john.doe") in AD and userDB, but with different passwords. So, we want to achieve this: 1. When you use manual login (non-domain-pc or something), it should make no difference which password you enter, you get logged in, as the application itself don't care where you're from, it just needs the userdata. So, one might argue "why are you using the old userDB at all, then - you've got your AD, just use their data" - good question. But the userDB aggregates another AD, which is out of "political reasons" not accessible to us via keycloak identity federating / identity provider. We're trying to change this, but as you might know, these processes cost time.. time we do not have at the moment. So to get concrete: I implemented the Federation SPI and I think my starting point should be to change the overridden "getUserBy..."- methods which I pasted here: https://pastebin.com/ddZTYMD4 Now, instead of just returning null when isEmpty(), entity == null etc. is checked, my SPI impl. should be capable of calling the AD (possibly more than one in future) and check the same credentials against the AD database. And only if the user is not found in every provider, it should return null. So to be honest, I have no clue if this is a) the correct part I should start my call. May be isValid, though, for the User ("john.doe") itself IS found, but the password doesn't match b) where the correct point is '(if any) where to change this and c) how to make the call with my credentials to the AD, then. Would be super happy if anyone could help me out here! Best regards, Dominik

8 years, 2 months

1
0
0 / 0

Credential Reset Update Password | using secondary email address

by lists

Hi, Keycloak 3.4.1, with federated ldap accounts. The "Credential Reset" action "Update password" in keycloak admin sends a password reset link to the users primary email address. But the reason for the Credential Reset, usually *IS* (of course) the fact that the user can no knows his/her password, and therefore can no longer can access his/her email. Therefore we would like this reset link to go a seconday email address, or perhaps be asked which emailaddress to send to reset link to, perhaps defaulting to the usual primary address, but with the option to send it to another address. Would this not be a useful enhancement for others as well? Would it be worth submitting a feature request for? (or are we alone with this 'problem'?) MJ

8 years, 2 months

1
0
0 / 0

Autologin with access token

by Domenico Briganti

Hi folks, I have a question about access token. I've admit that I didn't read in toto the openidc spec :( I have a mobile app that has an access token used for API invocation and I need to open a webview to show a private page. I've read that I need to set the state cookie ( http://lists.jboss.org/ pipermail/keycloak-user/2016-October/007911.html ) with a redirect, and I can do it. But how can I get a code parameter from an access token? Maybe is there another way to do it? Thanks, Domenico Briganti

8 years, 2 months

1
0
0 / 0

Load custom theme from module

by Marvin Oßwald

Hello, if i’m registering my custom theme like this: ./keycloak/bin/jboss-cli.sh --command="module add --name=de.svg.keycloak.modules.keycloak-svg-theme --resources=keycloak-svg-theme-1.0.0.jar”

8 years, 2 months

2
2
0 / 0

Authentication fails for OTP user with kerberos

by Jochen Hein

I'm running FreeIPA and have users with and without OTP. OTP users authenticate with RADIUS (Privacyidea manages the tokens). My final goal is that users with a kerberos ticket can authenticate without password and users without ticket get asked for password+OTP (when configured). In FreeIPA a user is defined with password and radius authentication: $ ipa user-show jochen User login: jochen ... Kerberos principal: jochen(a)EXAMPLE.ORG ... User authentication types: password, radius According to the FreeIPA docs LDAP bind works with password only, but kerberos needs password+OTP. That works fine with sssd and other applications. I'm now running keycloak 3.4.2 and played with it. I've added a User Federation with LDAP to my FreeIPA server and enabled "Allow Kerberos Authentication". After that I can log in with my Kerberos ticket without further authentication. If I don't have a Kerberos ticket keycloak asks me for username and password - authentication works with LDAP bind as long as "Use Kerberos For Password Authentication" is disabled. For a regular (non-OTP) user I can authenticate with a Kerberos ticket. If the user does not have a Kerberos ticket, he is asked for username and password as expected, and authentication is successful. Another user with OTP-authentication in FreeIPA can also authenticate with his Kerberos ticket. If the OTP-user does not have a Kerberos ticket, keycloak asks for username and password (as expected). If the user federation has "Use Kerberos for Password Authentication" not selected, the user in FreeIPA needs to have password+OTP (or password+RADIUS) allowed and can authenticate against FreeIPA-LDAP with password only - that's not what I want[1]. When I enable "Use Kerberos For Password Authentication" non-OTP users can still authenticate, but OTP users can't. According to https://www.freeipa.org/page/V4/OTP#How_to_Test "Kerberos FAST is required for OTP operations." - and that's true. If I just use kinit I get "Generic preauthentication failure while getting initial credentials". The kerberos log has: Aug 08 21:24:17 freeipa1.jochen.org krb5kdc[4442](info): AS_REQ (4 etypes {18 17 16 23}) x.x.x.x: NEEDED_PREAUTH: jochen(a)EXAMPLE.ORG for krbtgt/JOCHEN.ORG(a)EXAMPLE.ORG, Additional pre-authentication required Aug 08 21:24:17 freeipa1.jochen.org krb5kdc[4442](info): preauth (encrypted_timestamp) verify failure: No matching key in entry Aug 08 21:24:17 freeipa1.jochen.org krb5kdc[4442](info): AS_REQ (4 etypes {18 17 16 23}) x.x.x.127: PREAUTH_FAILED: jochen(a)EXAMPLE.ORG for krbtgt/JOCHEN.ORG(a)EXAMPLE.ORG, Preauthentication failed debg log fom keycloak: 2017-08-08 21:24:17,473 INFO [stdout] (default task-1) Debug is true storeKey true useTicketCache false useKeyTab false doNotPrompt false ticketCache is null isInitiator true KeyTab is null refreshKrb5Config is false principal is null tryFirstPass is false useFirstPass is false storePass is false clearPass is false 2017-08-08 21:24:17,473 INFO [stdout] (default task-1) [Krb5LoginModule] user entered username: jochen(a)EXAMPLE.ORG 2017-08-08 21:24:17,473 INFO [stdout] (default task-1) 2017-08-08 21:24:17,605 INFO [stdout] (default task-1) [Krb5LoginModule] authentication failed 2017-08-08 21:24:17,605 INFO [stdout] (default task-1) Pre-authentication information was invalid (24) - PREAUTH_FAILED 2017-08-08 21:24:17,606 WARN [org.keycloak.events] (default task-1) type=LOGIN_ERROR, realmId=jochen.org, clientId=account, userId=3ebc8518-a488-4dce-bd94-4a72c03a5ed9, ipAddress=192.168.yy.xx, error=invalid_user_credentials, auth_method=openid-connect, auth_type=code, redirect_uri=https://saml.jochen.org/auth/realms/jochen.org/account/login..., code_id=eefbcc3e-f581-465c-bc28-7e37fc939ae6, username=jochen(a)example.org That look's like there is no FAST implemented, but that or Anonymous PKINIT seems to be needed for OTP authentication through Kerberos: https://www.freeipa.org/page/V4/OTP https://www.freeipa.org/page/V4/Kerberos_PKINIT On my systems the OTP-user can't kinit directly, but needs to "kinit -n" first: $ kinit otpuser kinit: Pre-authentication failed: invalid argument while getting initial credentials $ kinit -n $ klist Ticket cache: KEYRING:persistent:1004:1004 Default principal: WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS Valid starting Expires Service principal 04.11.2017 18:31:20 05.11.2017 18:31:20 krbtgt/EXAMPLE.ORG(a)EXAMPLE.ORG $ kinit -T KEYRING:persistent:1004:1004 otpuser Enter OTP Token Value: $ klist Ticket cache: KEYRING:persistent:1004:krb_ccache_ZKhNrfE Default principal: otpuser(a)EXAMPLE.ORG Valid starting Expires Service principal 04.11.2017 18:31:48 05.11.2017 18:31:37 krbtgt/EXAMPLE.ORG(a)EXAMPLE.ORG After some research I think that JDK doesn't implement FAST for now and the tickets/messages I found looked like it will be some time until that might be implemented (if ever). Would it be possible to implement that in keycloak? https://blog-ftweedal.rhcloud.com/2014/07/otp-authentication-in-freeipa/ has some python code that is implementing that for FreeIPA. I've looked at https://github.com/keycloak/keycloak/blob/master/federation/kerberos/src/... but don't see how that might be implemented there... I've already tried to add two providers to my user federation, LDAP and sssd. sssd can authentication my otpuser with password+OTP fine. But I couldn't get authentication with Kerberos ticket to work when I have both providers active. Is that something that should work? Any ideas? Thanks, Jochen [1] password allows authentication to LDAP (no OTP). RADIUS or OTP authentications against Kerberos, which handles OTP and RADIUS and needs password+OTP. -- This space is intentionally left blank.

8 years, 2 months

2
4
0 / 0

Book on Keycloak?

by Thomas Isaksen

Hi I found some good resources online but I'm a book guy, is there a book on Keycloak? ./t

8 years, 2 months

2
2
0 / 0

ejb getCallerPrincipal() returning anonymous en Wildfly11

by JOSE INACIO DA SILVA JUNIOR

Hi, I'm following the GettingStarted in the Keycloak documentation and everything works fine with Wildfly-10.1.0. But in Wildfly-11.0.0, the following code prints: USER: anonymous in the console. @Stateless public class TesteService { @Resource private SessionContext sessionContext; public void run() { System.out.println("USER: "+sessionContext.getCallerPrincipal()); } } What can I do to get my code working as expected with Wildfly11? Thanks in advance! Inacio

8 years, 2 months

1
0
0 / 0

kubernetes

by Simon Payne

Hi all, i'm trying to get keycloak clustered on google cloud using KUBE_PING. i have a starting keycloak server using docker based on the latest keycloak and using kubernetes-0.9.3 however, i get the message: [org.jgroups.protocols.kubernetes.KUBE_PING] (ServerService Thread Pool -- 51) namespace not set; clustering disabled i cant figure out how to add the namespace - all example are using infinispan which uses different markup to keycloak. my standalone-ha uses <protocol type="kubernetes.KUBE_PING"/> if i add any additional attributes on this tag then keycloak fails to start any help would be appreciated. thanks Simon.

8 years, 2 months

6
9
0 / 0

Keycloak, OpenShift and custom themes

by Anton

Hello I'm trying to figure how best to deploy Keycloak in OpenShift - and deploy one or more themes into keycloak. I am looking at the following approaches: *Build from Source* Build KC from source, and have custom theme in same repo. If I fork https://github.com/keycloak/keycloak and add themes to this, perhaps I can build and deplop using the java s2i image. So far I have not been able to get this to work. And the resulting image is much bigger than it needs - as it builds everything in the repo. *Chained Builds* It is possible to do a Chained Build ( https://blog.openshift.com/chaining-builds/) however, if I use an existing KC docker image, for example https://hub.docker.com/r/jboss/keycloak-openshift/tags/, Im not clear on how I can have another step in the build process that will fetch, build and deploy a theme. Any help and suggestions are greatly appreciated. -Anton

8 years, 2 months

5
5
0 / 0

infinite redirect with KeycloakOIDCFilter

by Thomas Isaksen

I have this in web.xml but I am getting an infinite redirect after logon: <filter> <filter-name>Keycloak Filter</filter-name> <filter-class>org.keycloak.adapters.servlet.KeycloakOIDCFilter</filter-class> <init-param> <param-name>keycloak.config.skipPattern</param-name> <param-value>^(example1|example2|whatever).*</param-value> </init-param> </filter> <filter-mapping> <filter-name>Keycloak Filter</filter-name> <url-pattern>/keycloak/*</url-pattern> <url-pattern>/protected/*</url-pattern> <url-pattern>/*</url-pattern> </filter-mapping> Fiddler: I have attached a fiddler archive if anyone could have a look at it and figure out what's going on it would be great. Thanks -- Thomas Isaksen

8 years, 2 months

1
0
0 / 0

How to set admin password?

by Anton

Hello I'm using jboss/keycloak-ha-postgres docker image, and have tried running `add-user-keycloak.sh -u admin -p admin` but am still unable to login using this username/combo. Can someone please tell me how to set the admin password? Thanks

8 years, 2 months

2
1
0 / 0

CORS issue when using introspect API

by eric.kapitza＠web.de

8 years, 2 months

1
2
0 / 0

Iframe login form

by Gregory Durham

Hello, We are currently evaluating keycloak as a solution for idp/sso, and are currently looking at how integration should look like. In order to keep the login experience seamless, we have an iframe approach working, and have locked down the X-Frame-Option and the Content-Security-Policy for frame-ancestors to limit it to our site/domain. The redirect is captured by the iframe and the code is passed to the main page and the keycloak.js is initialized with this to get the token. Is this supported and if not why not? I want to make sure that there isn't something I am missing in how this works from a security and usage point of view. Thank you, Greg

8 years, 2 months

2
1
0 / 0

Multi-Valued User Attributes

by Michael Poettgen

(Keycloak version is 3.4.3) If I understand things correctly, the OIDC Token mappers for User Attributes can send claims for multi-valued attributes. How do I add a multi-valued attribute to a user via the UI? When I "Add" another attribute with the same name to a user, the new attribute value will override the old value. Is there a special syntax or mechanism that I need to use? Thanks for your help. Michael This message may contain confidential information. If you are not the intended recipient, do not disseminate, distribute, or copy this e-mail or its attachments. Please notify the sender of the error immediately by e-mail or at the telephone number listed below, and delete this e-mail and any attachments from your system. Receipt by anyone other than the intended recipient(s) is not a waiver of any trade secrets, proprietary interests, or other applicable rights. E-mail transmission is not necessarily secure or error-free, as information could be intercepted, corrupted, lost, destroyed, delayed, incomplete, or may contain viruses. The sender disclaims all liability for any errors or omissions arising as a result of the e-mail transmission. OEConnection LLC, (888) 776-5792, www.oeconnection.com

8 years, 2 months

2
1
0 / 0

[dev] Search all users in a realm with a non-verified email?

by Tomás García

Hi, Using the userStorageManager, I don't think I could possibly get a collection of UserModels where all users are just those where the EMAIL_VERIFIED bit is set to 0, right? If I'm wrong please let me know. My use case is I'm creating a task to delete those users after a time as long as the realm is configured to verify the email. I managed to get the rest of the details right I think thanks to Marek Posolda, but I cannot find a way to search specifically those users, because gathering all users in memory and then iterating all the collection wouldn't be optimal. I'd rather let that job to be done by the persistence layer. Thanks.

8 years, 2 months

2
1
0 / 0

custom authenticator invoking with a REST API for authentication

by Sud Ramasamy

Hi, We have a need to intercept the existing form based login authentication for a realm and instead of going to the Keycloak database to validate username/password we need to invoke a REST endpoint with the username/password combination to authenticate the user. Using the User Storage SPI is not an option since it integrates at the JPA layer. We will need to integrate via an authentication REST API hosted externally to RH-SSO. Please provide some of the options that are available to us to accomplish. Appreciate the help. -sud

8 years, 2 months

1
1
0 / 0

keycloak adapter with apache karaf 4.1.3

by LIEVRE Olivier

Hello, I'd like to use keycloak to secure rest api loaded as a bundle in apache karaf 4. I've tried to use samples provided with keycloak for fuse, it seams they are working with karaf 3 only. Does someone already try to use keyccoak OSGI adapter with Karaf 4 and succeed to use them ? Thks for your answer, Olivier LIEVRE

8 years, 2 months

1
0
0 / 0

OIDC and XFO

by Felipe Braun Azambuja

Hey guys, I've been struggling with OIDC and XFO, and I could use some help from you all. My deployment is like this: Vue.js app (nginx):80 (app.public.domain) | | \-> reverse proxy (nginx):443 ---> keycloak:8080 (sso.public.domain) (sso.internal) The app doesn't work due to XFO trying to open login-status-iframe.html. If I make the app go straight to KC in :8080, it works as it should (strangely enough, because KC isn't sending XFO header. I have XFO set on the reverse proxy, with SAMEORIGIN, tried to change to ALLOW-FROM, tried to add XFO to the app's nginx, and all I get is the same thing. The browser gets redirected to KC login page, I get authenticated, but the app doesn't work. *Where* and *how* should the header be set? This setup with nginx works great in SAML, and since we do not have enough IPv4, I can't expose it directly. Keycloak was upgraded to 3.4.3.Final prior to this app being deployed. Thanks! -- Felipe Braun Azambuja DBA Tecnologia da Informação e Comunicação (48) 3281 9577 felipe.braun(a)intelbras.com.br Esta mensagem, incluindo seus anexos, contém informações protegidas por lei, sujeitas a privilégios e/ou confidencialidades, não podendo ser retransmitida, arquivada, divulgada ou copiada sem autorização do remetente. O remetente utiliza o correio eletrônico no exercício do seu trabalho ou em razão dele, eximindo esta instituição de qualquer responsabilidade por utilização indevida. Caso tenha recebido esta mensagem por engano, por favor informe o remetente respondendo imediatamente a este e-mail, e em seguida apague-a do seu computador. The information contained in this e-mail and its attachments are protected by law, subjected to privilege and/or confidentiality and cannot be retransmitted, filed, disclosed or copied without authorization from the sender. The sender uses the electronic mail in the exercise of his/her work or by virtue thereof, and the institution accepts no liability from its undue use. If you have received this message by mistake, please notify us immediately by returning the e-mail and deleting this message from your system.

8 years, 2 months

1
0
0 / 0

Integrate with WebLogic?

by Thomas Isaksen

Hi I'm wondering what I have to do to integrate with WebLogic. Am looking to replace OAM with Keycloak but looks like there is no WebLogic support out of the box. Do I just have to implement an Identity Asserter for WebLogic and I'm good to go or do I need to implement anything on Keycloak's end as well? Thanks -- Thomas Isaksen

8 years, 2 months

2
2
0 / 0

[HS256] Use HS256 rather than RS256 for Id Token Signature

by FOUTREIN Thomas

Hello, I m trying to connect our keycloak instance with France Connect (the french public openid connect platform) But France Connect doesn't accept Id Token signed with RSA key , it only accept HS256 with a shared secret to verify the signature I tried to desactivate in my Realm the RSA Provider , but this has no effect on the Token generated (always RS256) Do you have a simple solution for that ? thanks in advance Thomas

8 years, 2 months

2
2
0 / 0

Re: [keycloak-user] Different theme for each client

by Stian Thorgersen

[Added the list back] To reply to everyone just do "reply all" and it should include the list. On 17 January 2018 at 10:29, <eric.kapitza(a)web.de> wrote: > Hello Stian, Hello Marek, > > I really love that you want to developt this feature! :) > > I think it's good if you can set the theme per client, with a fallback to > the default theme. This is probably what most people need when they look > for this feature. > > Btw how do I correctly reply to somebody like you did, so everyone will > get the new message? Must I just send a new mail to the email list with the > same title? > > One other question, maybe you know it, do you think it is right now > technically possible to use keycloak login page within an IFrame in our > application with JS-Adapter? > > Eric > *Gesendet:* Mittwoch, 17. Januar 2018 um 09:38 Uhr > *Von:* "Stian Thorgersen" <sthorger(a)redhat.com> > *An:* "Marek Posolda" <mposolda(a)redhat.com> > *Cc:* keycloak-user <keycloak-user(a)lists.jboss.org> > *Betreff:* Re: [keycloak-user] Different theme for each client > On 17 January 2018 at 09:35, Marek Posolda <mposolda(a)redhat.com> wrote: > > > On 17/01/18 09:03, Stian Thorgersen wrote: > > > > Added a public ThemeSelectorSPI [1] that allows adding custom logic for > > selecting what theme to use. The default implementation is very simple at > > the moment [2]. It simply looks for the realm setting and fallbacks to > the > > default if not set. > > > > Changing the selector is a global thing and there is no mechanism to > > configure a separate selector for a realm. That's something we could > > consider adding later if needed. > > > > The question is should we provide the ability to set the theme per-client > > or is that actually quite cumbersome to use? There could be hundreds of > > clients. > > > > I think that yes. It can be cumbersome, but this applies for many > > client-specific settings. For example you may have some custom > > protocolMapper, which you want to use for more clients and then you also > > need to edit protocolMappers in all clients to add this custom > > protocolMapper. > > > > We can also support theme per clientTemplate, so if client doesn't have > > theme set, it can try the theme from clientTemplate and fallback to realm > > and finally to default if nothing is set. > > > > OK. I guess implementation should be pretty straightforward as both clients > and client templates have attributes. > > > > > > > > Marek > > > > > > [1] https://github.com/stianst/keycloak/tree/KEYCLOAK-6289 > > [2] https://github.com/stianst/keycloak/blob/KEYCLOAK-6289/services/src/ > > main/java/org/keycloak/theme/DefaultThemeSelectorProvider.java#L17 > > > > On 17 January 2018 at 08:54, Marek Posolda <mposolda(a)redhat.com> wrote: > > > >> +1 to handle on the client. Seems to be better than handle in the theme > >> itself. > >> > >> Marek > >> > >> > >> On 17/01/18 08:19, Stian Thorgersen wrote: > >> > >>> I've started work on this as I needed a simple dev task to wake up ;) > >>> > >>> https://issues.jboss.org/browse/KEYCLOAK-3370 > >>> > >>> On 16 January 2018 at 17:06, Josh Cain <jcain(a)redhat.com> wrote: > >>> > >>> +1 for that solution, would make some of what we're looking to do in > the > >>>> near future *way* cleaner! > >>>> > >>>> Josh Cain > >>>> Senior Software Applications Engineer, RHCE > >>>> Red Hat North America > >>>> jcain(a)redhat.com IRC: jcain > >>>> > >>>> On 01/16/2018 08:54 AM, Stian Thorgersen wrote: > >>>> > >>>>> It makes sense to add two options: > >>>>> > >>>>> 1. Expose client attributes to theme. That would allow setting an > >>>>> > >>>> attribute > >>>> > >>>>> on a specific client or a client template to then have some > conditions > >>>>> to > >>>>> provide variants within a theme. > >>>>> 2. Allow overriding theme in client and client template. No need to > add > >>>>> something additional to themes as they can already be extended. We > >>>>> simply > >>>>> need to allow users to specify a different theme. In this case we may > >>>>> > >>>> also > >>>> > >>>>> want to add a ThemeSelectorSPI that would allow some custom logic to > >>>>> > >>>> select > >>>> > >>>>> the theme (could be based on headers for instance in the case of a > >>>>> mobile > >>>>> theme). > >>>>> > >>>>> On 16 January 2018 at 14:09, Marek Posolda <mposolda(a)redhat.com> > >>>>> wrote: > >>>>> > >>>>> We can probably do some builtin support for clients into the themes > >>>>>> itself. Doing it properly may take few days. Depends if we want to > >>>>>> support that. AFAIR Stian didn't like that, but to me it makes sense > >>>>>> that some people want different look&feel based on client. > >>>>>> > >>>>>> For example template file can be lookup from the directory with the > >>>>>> clientId (EG. theme/my-theme/login/customer-portal/login.ftl ). If > it > >>>>>> doesn't exists, then fallback to the current location without > >>>>>> "clientId" > >>>>>> directory. Maybe something similar would be needed for the CSS files > >>>>>> and > >>>>>> other resources. > >>>>>> > >>>>>> But for some very basic cases, people can probably already handle it > >>>>>> by > >>>>>> add some "if" into the freemarker template itself and use different > >>>>>> CSS > >>>>>> styles based on the client or something like this. > >>>>>> > >>>>>> Marek > >>>>>> > >>>>>> > >>>>>> On 16/01/18 00:09, Bill Burke wrote: > >>>>>> > >>>>>>> I wonder how hard it would be to implement? > >>>>>>> > >>>>>>> On Mon, Jan 15, 2018 at 3:22 PM, Marek Posolda < > mposolda(a)redhat.com> > >>>>>>> > >>>>>> wrote: > >>>>>> > >>>>>>> I think that Freemarker theme (at least login theme) has access to > >>>>>>>> ClientBean through the "client" expression . So it's likely > already > >>>>>>>> possible to do some hacking in the template itself and provide > >>>>>>>> > >>>>>>> different > >>>> > >>>>> CSS according to the client used. Not very nice, but likely should be > >>>>>>>> somehow possible. > >>>>>>>> > >>>>>>>> Marek > >>>>>>>> > >>>>>>>> On 15/01/18 18:26, Josh Cain wrote: > >>>>>>>> > >>>>>>>>> Was originally discussed here: > >>>>>>>>> http://lists.jboss.org/pipermail/keycloak-user/2016- > >>>>>>>>> > >>>>>>>> January/004288.html > >>>>>> > >>>>>>> And I asked the same question again here: > >>>>>>>>> http://lists.jboss.org/pipermail/keycloak-user/2016-July/007 > >>>>>>>>> 052.html > >>>>>>>>> > >>>>>>>>> But feel free to keep bumping. It's a feature I'd like to see > >>>>>>>>> anyway > >>>>>>>>> > >>>>>>>> ;-) > >>>>>> > >>>>>>> Josh Cain > >>>>>>>>> Senior Software Applications Engineer, RHCE > >>>>>>>>> Red Hat North America > >>>>>>>>> jcain(a)redhat.com IRC: jcain > >>>>>>>>> > >>>>>>>>> On 01/15/2018 06:10 AM, eric.kapitza(a)web.de wrote: > >>>>>>>>> > >>>>>>>>>> _______________________________________________ > >>>>>>>>>> keycloak-user mailing list > >>>>>>>>>> keycloak-user(a)lists.jboss.org > >>>>>>>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user > >>>>>>>>>> > >>>>>>>>>> _______________________________________________ > >>>>>>>>> keycloak-user mailing list > >>>>>>>>> keycloak-user(a)lists.jboss.org > >>>>>>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user > >>>>>>>>> > >>>>>>>> _______________________________________________ > >>>>>>>> keycloak-user mailing list > >>>>>>>> keycloak-user(a)lists.jboss.org > >>>>>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user > >>>>>>>> > >>>>>>> > >>>>>>> _______________________________________________ > >>>>>> keycloak-user mailing list > >>>>>> keycloak-user(a)lists.jboss.org > >>>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user > >>>>>> > >>>>>> _______________________________________________ > >>>>> keycloak-user mailing list > >>>>> keycloak-user(a)lists.jboss.org > >>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user > >>>>> > >>>>> > >>>> _______________________________________________ > >>>> keycloak-user mailing list > >>>> keycloak-user(a)lists.jboss.org > >>>> https://lists.jboss.org/mailman/listinfo/keycloak-user > >>>> > >>>> _______________________________________________ > >>> keycloak-user mailing list > >>> keycloak-user(a)lists.jboss.org > >>> https://lists.jboss.org/mailman/listinfo/keycloak-user > >>> > >> > >> > >> > > > > > _______________________________________________ > keycloak-user mailing list > keycloak-user(a)lists.jboss.org > https://lists.jboss.org/mailman/listinfo/keycloak-user >

8 years, 2 months

2
3
0 / 0

Re: [keycloak-user] [keycloak-dev] Keycloak support

by Stian Thorgersen

http://www.keycloak.org/support.html ;) On 18 January 2018 at 01:00, Kalidindi, Sai Soma Kala < sai-soma-kala.kalidindi(a)microfocus.com> wrote: > Hi, > > We are having an issue where we see some of the entries getting deleted > from user_entity table when we start our keycloak. After days of debugging > we don't know why this is happening. We are planning to buy commercial > support for this issue. Looks like only the Red hat versions of keycloak > has commercial support. We are using open source verison 1.9.8. Can someone > point me in right direction on where we can get commercial support for open > source versions. > > Thanks, > Sai. > _______________________________________________ > keycloak-dev mailing list > keycloak-dev(a)lists.jboss.org > https://lists.jboss.org/mailman/listinfo/keycloak-dev >

8 years, 2 months

1
0
0 / 0

Diagnosing SAMLv2 Identity Provider

by Michael Poettgen

I've got a 3.4.3 Keycloak server deployed in a Docker environment and I am having some trouble setting up attribute mapping for an external SAML v2 Identity Provider. I'm not sure what exactly the external Identity Provider is sending so I was wondering whether there is an easy way to diagnose the SAML assertions that we are getting from them. However I couldn't find any details in the Events section. Thanks, Michael This message may contain confidential information. If you are not the intended recipient, do not disseminate, distribute, or copy this e-mail or its attachments. Please notify the sender of the error immediately by e-mail or at the telephone number listed below, and delete this e-mail and any attachments from your system. Receipt by anyone other than the intended recipient(s) is not a waiver of any trade secrets, proprietary interests, or other applicable rights. E-mail transmission is not necessarily secure or error-free, as information could be intercepted, corrupted, lost, destroyed, delayed, incomplete, or may contain viruses. The sender disclaims all liability for any errors or omissions arising as a result of the e-mail transmission. OEConnection LLC, (888) 776-5792, www.oeconnection.com

8 years, 2 months

3
3
0 / 0

Timeout during import

by Knurr, Michael

When importing realm data from json, the import with default settings will run into a timeout after exactly 5 minutes. Following the guide on https://mirocupak.com/enabling-long-deployments-on-wildfly/, I set the jboss.as.management.blocking.timeout and deployment-scanner deployment-timeout to 900 seconds. Now the process does not run into a timeout any longer. However after 5 minutes the process shows a huge number of warnings like these 10:47:24,804 WARN [com.arjuna.ats.arjuna] (Transaction Reaper) ARJUNA012117: TransactionReaper::check timeout for TX 0:ffff7f000101:148e7def:5a5f1a7f:e in state RUN 10:47:24,805 WARN [org.hibernate.resource.transaction.backend.jta.internal.synchronization.SynchronizationCallbackCoordinatorTrackingImpl] (Transaction Reaper Worker 0) HHH000451: Transaction afterCompletion called by a background thread; delaying afterCompletion processing until the original thread can handle it. [status=4] 10:47:24,805 WARN [org.hibernate.resource.transaction.backend.jta.internal.synchronization.SynchronizationCallbackCoordinatorTrackingImpl] (Transaction Reaper Worker 0) HHH000451: Transaction afterCompletion called by a background thread; delaying afterCompletion processing until the original thread can handle it. [status=4] 10:47:24,805 WARN [org.hibernate.resource.transaction.backend.jta.internal.synchronization.SynchronizationCallbackCoordinatorTrackingImpl] (Transaction Reaper Worker 0) HHH000451: Transaction afterCompletion called by a background thread; delaying afterCompletion processing until the original thread can handle it. [status=4] The import seems to go through but the server startup finally fails with an error: 10:49:25,924 INFO [org.keycloak.services] (ServerService Thread Pool -- 58) KC-SERVICES0032: Import finished successfully 10:49:25,942 WARN [com.arjuna.ats.arjuna] (ServerService Thread Pool -- 58) ARJUNA012077: Abort called on already aborted atomic action 0:ffff7f000101:148e7def:5a5f1a7f:e 10:49:25,945 INFO [org.jboss.as.server] (Thread-2) WFLYSRV0220: Server shutdown has been requested via an OS signal 10:49:25,949 ERROR [org.jboss.msc.service.fail] (ServerService Thread Pool -- 58) MSC000001: Failed to start service jboss.undertow.deployment.default-server.default-host./auth: org.jboss.msc.service.StartException in service jboss.undertow.deployment.default-server.default-host./auth: java.lang.RuntimeException: RESTEASY003325: Failed to construct public org.keycloak.services.resources.KeycloakApplication(javax.servlet.ServletContext,org.jboss.resteasy.core.Dispatcher) at org.wildfly.extension.undertow.deployment.UndertowDeploymentService$1.run(UndertowDeploymentService.java:84) at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511) at java.util.concurrent.FutureTask.run(FutureTask.java:266) at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) at java.lang.Thread.run(Thread.java:745) at org.jboss.threads.JBossThread.run(JBossThread.java:320) Caused by: java.lang.RuntimeException: RESTEASY003325: Failed to construct public org.keycloak.services.resources.KeycloakApplication(javax.servlet.ServletContext,org.jboss.resteasy.core.Dispatcher) at org.jboss.resteasy.core.ConstructorInjectorImpl.construct(ConstructorInjectorImpl.java:162) at org.jboss.resteasy.spi.ResteasyProviderFactory.createProviderInstance(ResteasyProviderFactory.java:2298) at org.jboss.resteasy.spi.ResteasyDeployment.createApplication(ResteasyDeployment.java:340) at org.jboss.resteasy.spi.ResteasyDeployment.start(ResteasyDeployment.java:253) at org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.init(ServletContainerDispatcher.java:120) at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.init(HttpServletDispatcher.java:36) at io.undertow.servlet.core.LifecyleInterceptorInvocation.proceed(LifecyleInterceptorInvocation.java:117) at org.wildfly.extension.undertow.security.RunAsLifecycleInterceptor.init(RunAsLifecycleInterceptor.java:78) at io.undertow.servlet.core.LifecyleInterceptorInvocation.proceed(LifecyleInterceptorInvocation.java:103) at io.undertow.servlet.core.ManagedServlet$DefaultInstanceStrategy.start(ManagedServlet.java:250) at io.undertow.servlet.core.ManagedServlet.createServlet(ManagedServlet.java:133) at io.undertow.servlet.core.DeploymentManagerImpl$2.call(DeploymentManagerImpl.java:565) at io.undertow.servlet.core.DeploymentManagerImpl$2.call(DeploymentManagerImpl.java:536) at io.undertow.servlet.core.ServletRequestContextThreadSetupAction$1.call(ServletRequestContextThreadSetupAction.java:42) at io.undertow.servlet.core.ContextClassLoaderSetupAction$1.call(ContextClassLoaderSetupAction.java:43) at org.wildfly.extension.undertow.security.SecurityContextThreadSetupAction.lambda$create$0(SecurityContextThreadSetupAction.java:105) at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1508) at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1508) at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1508) at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1508) at io.undertow.servlet.core.DeploymentManagerImpl.start(DeploymentManagerImpl.java:578) at org.wildfly.extension.undertow.deployment.UndertowDeploymentService.startContext(UndertowDeploymentService.java:100) at org.wildfly.extension.undertow.deployment.UndertowDeploymentService$1.run(UndertowDeploymentService.java:81) ... 6 more Caused by: java.lang.RuntimeException: javax.transaction.RollbackException: ARJUNA016102: The transaction is not active! Uid is 0:ffff7f000101:148e7def:5a5f1a7f:e at org.keycloak.transaction.JtaTransactionWrapper.handleException(JtaTransactionWrapper.java:77) at org.keycloak.transaction.JtaTransactionWrapper.commit(JtaTransactionWrapper.java:94) at org.keycloak.services.DefaultKeycloakTransactionManager.commit(DefaultKeycloakTransactionManager.java:136) at org.keycloak.models.utils.KeycloakModelUtils.runJobInTransaction(KeycloakModelUtils.java:233) at org.keycloak.services.resources.KeycloakApplication.<init>(KeycloakApplication.java:137) at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method) at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62) at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45) at java.lang.reflect.Constructor.newInstance(Constructor.java:423) at org.jboss.resteasy.core.ConstructorInjectorImpl.construct(ConstructorInjectorImpl.java:150) ... 28 more Caused by: javax.transaction.RollbackException: ARJUNA016102: The transaction is not active! Uid is 0:ffff7f000101:148e7def:5a5f1a7f:e at com.arjuna.ats.internal.jta.transaction.arjunacore.TransactionImple.commitAndDisassociate(TransactionImple.java:1279) at com.arjuna.ats.internal.jta.transaction.arjunacore.BaseTransaction.commit(BaseTransaction.java:126) at com.arjuna.ats.jbossatx.BaseTransactionManagerDelegate.commit(BaseTransactionManagerDelegate.java:89) at org.wildfly.transaction.client.LocalTransaction.commitAndDissociate(LocalTransaction.java:73) at org.wildfly.transaction.client.ContextTransactionManager.commit(ContextTransactionManager.java:71) at org.keycloak.transaction.JtaTransactionWrapper.commit(JtaTransactionWrapper.java:92) ... 36 more It seems like the import is still running in some sort of transaction timeout. Is there any other way to configure the transaction timeout?

8 years, 2 months

2
2
0 / 0

SAML Attribute to Role

by Michael Poettgen

On Keycloak 3.4.3 I'm trying to use a "SAML Attribute to Role" role mapper to extract roles from a "roles" attribute sent by an external SAML IdP. I know that the attribute has values as when I try to map it to a user attribute I get an exception that the user attribute cannot be saved, because the value exceeds the maximum length of 256. What I don't know is whether the roles are sent in 1 - one attribute with multiple values, 2 - multiple attributes with one value or 3 - one attribute with one concatenated value. I guess looking at the code that only 2 would work, 3 would be unusual, but 1 should work as well. Can anyone share his experience with this? At the moment none of my roles get applied. Thanks, Michael This message may contain confidential information. If you are not the intended recipient, do not disseminate, distribute, or copy this e-mail or its attachments. Please notify the sender of the error immediately by e-mail or at the telephone number listed below, and delete this e-mail and any attachments from your system. Receipt by anyone other than the intended recipient(s) is not a waiver of any trade secrets, proprietary interests, or other applicable rights. E-mail transmission is not necessarily secure or error-free, as information could be intercepted, corrupted, lost, destroyed, delayed, incomplete, or may contain viruses. The sender disclaims all liability for any errors or omissions arising as a result of the e-mail transmission. OEConnection LLC, (888) 776-5792, www.oeconnection.com

8 years, 2 months

1
0
0 / 0

Different theme for each client

by eric.kapitza＠web.de

8 years, 2 months

5
11
0 / 0

offlineSessions data in cache vs db

by Tonnis Wildeboer

Hello Keycloak Users, Ultimately, what we want to do is have three nodes in one Kubernetes namespace that define a cluster. Then be able to add three more nodes to the cluster in a new namespace that shares the same subnet and database, then kill off the original three nodes, effectively migrating the cluster to the new namespace and do all this without anyone being logged out. The namespace distinction is invisible to Keycloak, as far as I can tell. What we have tried: * Start with 3 standalone-ha mode instances clustered with JGroups/JDBC_PING. * Set the number of cache owners for sessions to 6. * Start the three new instances in the new Kubernetes namespace, configured exactly the same as the first three - that is, same db, same number of cache owners. * Kill the original three But it seems this caused offlineSession tokens to be expired immediately. I found this in the online documentation (http://www.keycloak.org/docs/latest/server_installation/index.html#server...): > The second type of cache handles managing user sessions, offline tokens, and keeping track of login failures... The data held in these caches is temporary, in memory only, but is possibly replicated across the cluster. > The sessions, authenticationSessions, offlineSessions and loginFailures caches are the only caches that may perform replication. Entries are not replicated to every single node, but instead one or more nodes is chosen as an owner of that data. If a node is not the owner of a specific cache entry it queries the cluster to obtain it. What this means for failover is that if all the nodes that own a piece of data go down, that data is lost forever. By default, Keycloak only specifies one owner for data. So if that one node goes down that data is lost. This usually means that users will be logged out and will have to login again. It appears, based on these documentation comments and our experience, that the "source of truth" regarding offlineSessions is the data in the "owner" caches, is NOT the database, as I would have expected. It also seems to be the case that if a node joins the cluster (as defined by JGroups/JDBC_PING), it will NOT be able to populate its offlineSessions cache from the database, but must rely on replication from one of the owner nodes. Questions: 1. Is the above understanding regarding the db vs cache correct? 2. If so, please explain the design/reasoning behind this behavior. Otherwise, please correct my understanding. 3. Is there a way to perform this simple migration without losing any sessions? Thanks, --Tonnis

8 years, 2 months

3
7
0 / 0

Failed to initialize in KC 3.4

by Corentin Dupont

Hi guys, I use this code in my javascript application: var keycloak = Keycloak(); keycloak.init().success(function(authenticated) { alert(authenticated ? 'authenticated' : 'not authenticated'); }).error(function() { alert('failed to initialize'); }); Since I updated Keycloak I get the message 'failed to initialize'. It was working well with the previous version of KC 3.2. What could it be? How can I get a better error message? Thanks!

8 years, 2 months

5
10
0 / 0

Running two Keycloak instances in parallel

by Knurr, Michael

Hi all When trying to upgrade Keycloak to the latest version I ran into problems. Unfortunately It turned out that we ran into different upgrade behaviors on different machines. With the latest version, the upgrade is running locally, on test and on stage. As a last step I now tried to test the upgrade procedure on the production machine with a keycloak instance running on a different port. When running the upgrade on a server with an already running keycloak instance, the new server runs into a timeout because of concurrency. 10:16:24,926 INFO [org.keycloak.connections.jpa.updater.liquibase.LiquibaseJpaUpdaterProvider] (ServerService Thread Pool -- 58) Updating database. Using changelog META-INF/jpa-changelog-master.xml 10:21:22,322 ERROR [org.jboss.as.controller.management-operation] (Controller Boot Thread) WFLYCTL0348: Timeout after [300] seconds waiting for service container stability. Operation will roll back. Step that first updated the service container was 'add' at address '[ ("core-service" => "management"), ("management-interface" => "http-interface") ]' 10:21:23,397 WARN [com.arjuna.ats.arjuna] (Transaction Reaper) ARJUNA012117: TransactionReaper::check timeout for TX 0:ffff7f000101:73d290d3:5a5dc2e6:d in state RUN 10:21:23,402 WARN [com.arjuna.ats.arjuna] (Transaction Reaper Worker 0) ARJUNA012121: TransactionReaper::doCancellations worker Thread[Transaction Reaper Worker 0,5,main] successfully canceled TX 0:ffff7f000101:73d290d3:5a5dc2e6:d 10:21:23,668 WARN [com.arjuna.ats.arjuna] (Transaction Reaper) ARJUNA012117: TransactionReaper::check timeout for TX 0:ffff7f000101:73d290d3:5a5dc2e6:10 in state RUN 10:21:23,669 WARN [com.arjuna.ats.arjuna] (Transaction Reaper Worker 0) ARJUNA012121: TransactionReaper::doCancellations worker Thread[Transaction Reaper Worker 0,5,main] successfully canceled TX 0:ffff7f000101:73d290d3:5a5dc2e6:10 10:21:27,328 ERROR [org.jboss.as.controller.management-operation] (Controller Boot Thread) WFLYCTL0190: Step handler org.jboss.as.server.DeployerChainAddHandler$FinalRuntimeStepHandler@20b4c4cb for operation add-deployer-chains at address [] failed handling operation rollback -- java.util.concurrent.TimeoutException: java.util.concurrent.TimeoutException at org.jboss.as.controller.OperationContextImpl.waitForRemovals(OperationContextImpl.java:522) ... What might be the reason for this? Shouldn't it possible to run two keycloak servers (with a different port offset) on a single machine? How can I test the keycloak upgrade on the production machine without stopping the running server instance? Best regards Michael

8 years, 2 months

2
2
0 / 0

Re-authenticate user and populate login form with session data

by Christer Vaskinn

Hi. We're trying to implement re-authentication for privileged functions using OIDC and prompt=login. As such, we'd like to populate the username field in login.ftl with the username of the currently logged in user. Is that possible? Best regards Christer Vaskinn

8 years, 2 months

3
4
0 / 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

keycloak-user January 2018