October 2018 - keycloak-user - Jboss List Archives

by Biradar, Mallikarjuna (HYD)

Hi Team, I have implemented cookie based Keycloak Authentication in my Asp.net MVC with C# & Jquery application. It's WORKING FINE in LOCAL when run from Visual Studio but not working when DEPLOYED to Web Server Hosted environment. 1.Accessing the Web Sever domain hosted Url, I am able to get KeyCloak Login screen as shown below. [cid:image001.png@01D46C4D.60B3BA60] 2.Enter Username & Password that are configured for a user in Keycloak server and click on 'Access'. Authentication is successful but I get error as shown in below screenshot instead of redirecting to View/Page or Action method in Controller class that has been set attribute [Authorize] and same Action method is set as default in Gloabal.asx.cs fle. [cid:image002.png@01D46C4D.E69C1FA0] Please help me to resolve this issue. My implementation: 1. startup.cs code [cid:image003.png@01D46C4E.13D63000] 2. Global.asax.cs code: [cid:image004.png@01D46C4E.613F6320] 3. Controller class - Action method [cid:image005.png@01D46C4E.613F6320] Regards, Mallikarjun Biradar Kantar Disclaimer<http://www.kantar.com/disclaimer.html>

5 years, 6 months

1
0
0 / 0

SAML 2.0 Broker Kickoff - Config Issue or Bug?

by Josh Cain

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Hi all, I'm trying to drop into a SAML 2.0 brokered flow, and I can't seem to get Keycloak to kick if off right. Here's what I'm doing: 1) Setting up a third-party IDP as an Identity Provider by importing SAML 2.0 metadata. 2) Attempting a standard login flow against a client, then clicking the newly added identity provider on the login screen. 3) Watch, as Keycloak gives me an "Invalid Request" error message After looking under the hood, I can see that it's fussing about not having a ClientID: [2018-10-24 20:12:41,591+0000] DEBUG [org.keycloak.services.resources.IdentityBrokerService] (default task- 61) Invalid request. Authorization code, clientId or tabId was null. Code=IugzCrTYU0xfZ_sLF1prPRTZC5WsR9-F3HrDyCUegLE, clientId=null, tabID=vPZ0M6-0eao I also just attempted with a Github provider, and encountered the same issue. Not sure what's going on, as the IdentityProviderBean doesn't use the clientId (as I'd imagine it shouldn't?) when constructing the provider urls, seems strange that it would be required: String loginUrl = Urls.identityProviderAuthnRequest(baseURI, identityProvider.getAlias(), realm.getName()).toString(); Sooo... can someone help me figure out what I'm doing wrong here? I'm guessing user error is the problem here (otherwise, alot of brokering would be busted). Thanks! - -- Josh Cain Senior Software Applications Engineer, RHCE Red Hat North America -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEyXW6Vl+0L9r9LpVurGNtyYPQwPgFAlvQ2rEACgkQrGNtyYPQ wPhVPhAApyIVMKeGMfGsMr2HNeNIngfG91posPwGWoNWUjy8ZD6dBXgM8qbUnIgr SC9i43Kde6EyANNA1dy5Wh45xCX3SlyFm4Pet5IvoxRa1/+hx8OEGMW0R9hfNm33 36ZyrbJtZtowtXJzZklATxAoT5yuzZe+tLmEn3edj9rSV3U6LfRrrFbGHkq+qPp6 rsN5/BkBemP1aQH/ssw/lX137js83B8XELfXvfkf53AIZWDTS5v2ssSR5eUOu+bc 15vzg9uWJtmhi7hr2Ws9StKVWARttnjR0Q0gXf4Fy4IqCEK4TfTZhDmv60wNfUsR B1S6OGcxNjzmjbtvwqSxEAxGt/Ll9SLTJLVMbddpIIWmPJs0edhz8pr3etYOFtQr LriHg4iBZ/CTdMBI47oYHbg/uc0XFtbLQ3RnZ8GmOwq9b4BvxJ8rNiHWhdACW4MN Gi5EUHn6kfXDRs/WVGFJ5LFQgBDEMwbCpoBtXBoZisC8KJZCKVDe1fcw90U256iF o1+pWZiJtq7/VfohKFMOeQJ79lym5VieAgVB7TwoITNWKYKL4gVVuEi6pcAhrdNd fVy2f4dS1qqN8Meq04iCMejpDI8zU+XLv6HEkWqxVgyvULDJA56o4Fpsc7KtIq07 UzxpmQ34FoGXz8JwlMjCVT6ZJ4X8BHYAf8KRkKWSNO3fgubnWN0= =y2UI -----END PGP SIGNATURE-----

5 years, 6 months

1
1
0 / 0

keycloak-quickstarts: app-authz-photoz vs. app-authz-uma-photoz

by Melissa Palmer

Hi, Please can someone let me know what is the difference between the two quick-starts app-authz-photoz vs. app-authz-uma-photoz? Thanks In Advance Melissa

5 years, 6 months

2
3
0 / 0

Use of event.clientId in FreeMarker

by GARDAIS Ionel

Hi, I've configured the localisation and FTL templates to send an email at every successful login. I'd like to add, beside the date and the source IP, the client through the user was connected However, event.clientId always resolves to null, whereas event.ipAddress and event.date are correct. Here is what lies in the .ftl file : ${msg("eventLoginBody",event.date,event.ipAddress,event.clientId)} messages_en.properties contains eventLoginSubject=Successful login eventLoginBody=A successful login was detected to your account on {0} from {1} for {2}. If this was not you, please contact an admin. eventLoginBodyHtml=<p>A successful login was detected to your account on {0} from {1} for {2}. If this was not you, please contact an admin.</p> If I logg the event to the console, clientId is correctly set. Does EmailTemplateProvider swallow the clientId field ? Am I missing something in the template definition ? Thanks, Ionel Ionel GARDAIS CIO - IT Team manager -- 232 avenue Napoleon BONAPARTE 92500 RUEIL MALMAISON Capital EUR 219 300,00 - RCS Nanterre B 408 832 301 - TVA FR 09 408 832 301

5 years, 6 months

1
2
0 / 0

Need help to Manage SSO in node application without any library

by Shubham Akodiya

Hi Team, I'm integrating the node application with keycloak without using *keycloak-connect library, *So In this case, I'm handling the following things at my end - - Managing user session. - Display our app login page instead of keycloak default page. - Performing the user authentication and authorization using the keycloak URLs. I have taken the reference of this app <https://github.com/v-ladynev/keycloak-nodejs-example> but I'm facing the problem in SSO and I'm guessing that this is happening because of not using the keycloak library, In which session is managed by keycloak. So how to achieve this in my application ? Thanks, Shubham Akodiya

5 years, 6 months

2
1
0 / 0

Add x5c to be generated as part of the JWK

by Work Account

Hi, In an effort to use keycloak as an IDP with Azure for multi factor authentication, Azure expects the x5c property to be available in the JWK when querying the jwks_uri. The change would simply include the x5c property as part of the returned JWK as described here (https://tools.ietf.org/html/rfc7517#section-4.7). In short, the x5c property contains the certificate chain. The change would involve updating core\src\main\java\org\keycloak\jose\jwk\JWKBuilder.java to generate the certificate chain from the RsaKeyMetadata certificate. Thanks

5 years, 6 months

1
0
0 / 0

User Federation for Admin Users

by Pulkit Srivastava

Hi, Is it possible to use an external user federation for admin users in keycloak. These users should be able to login to keycloak admin. Thanks, Pulkit

5 years, 6 months

2
1
0 / 0

Keycloak RBAC permission check in node API

by Shubham Akodiya

Hi Team, I was integrating the keycloak with nodejs and I want to restrict the nodeJS API. I've added the *Authorization settings (scope, resources and policies) *while creating the client. But struggling, how to protect the API endpoints basis on the resource and scopes in nodejs app. I've declared following resources and scopes in the client and also, added some policies basis on the role. 'res:customer', 'scopes:create'], ['/customers(*)', 'get', 'res:customer', 'scopes:view'], ['/campaigns', 'post', 'res:campaign', 'scopes:create'], ['/campaigns(*)', 'get', 'res:campaign', 'scopes:view Although, I've checked the link <https://github.com/v-ladynev/keycloak-nodejs-example> and while I insight into the code I found that there is one API http://localhost:8080/auth/ realms/{realmName}/authz/entitlement/{clientName} which accepts the authorization token in header and permissions in body like '[{"resource_set_name": "res:campaign", "scopes": [ 'scopes:view' ]}]', so this way we could check that whether user have sufficient permission or not. *But while going through the doc, I found that the entitlement API was removed in the keycloak new version*. *So how can we perform the similar permission checks in new keycloak version. Is there any API supported just like entitlement ? or Is there any alternative way available to perform the protection check ?* Thanks, Shubham Akodiya

5 years, 6 months

2
1
0 / 0

Creating new user throws error when using AWS Simple AD

by Robin Kearney

Hi, I've got Keycloak 4.5.0.Final setup to talk to an AWS instance of their Simple AD - which is Samba 4 behind the scenes. Connectivity and authentication works ok, as does the initial sync all users. However, when I create a new user through Keycloak, I get an error "Error! Could not create user" in the UI and the following logs: keycloak_1 | 20:45:52,571 WARN [org.keycloak.services.resources.admin.UsersResource] (default task-17) Could not create user: org.keycloak.models.ModelException: Could not modify attribute for DN [cn=example12,CN=Users,DC=ad,DC=example,DC=com] keycloak_1 | Caused by: javax.naming.NameNotFoundException: [LDAP: error code 32 - 00002030: No such Base DN: cn=example12,CN=Users,DC=ad,DC=example,DC=com]; remaining name 'cn=example12,CN=Users,DC=ad,DC=example,DC=com' The full stack trace is here https://gist.githubusercontent.com/rk295/a8ada3cd79212e73d2e55215e4d53e34... What is interesting is the user is created successfully in LDAP. ldif https://gist.githubusercontent.com/rk295/0bde9a03f057dea09ea08f7f0050785e... However in this ldif, is the following fields show "IA==" rather than the value I entered (example12 in both cases) sn:: IA== givenName:: IA== I have both the firstname and lastname mappers setup to map the following fields: usermodel attribute firstName -> ldap givenName usermodel attribute lastName -> ldap sn Both setup with RO false, always read from LDAP true, is mandatory true, is binary false. If I hit the button to resync changed (or all) users, the user shows in the Keycloak admin, but the fields above missing. Hope somebody can help! r.

5 years, 6 months

1
1
0 / 0

Logout via admin API causes offline token to go stale

by keycloak-user＠imber.wien

Hi, there's a message by Ritesh Garg dated May 25, 2018, about Offline Tokens becoming invalid when user sessions are logged out via Admin REST API. (I just joined the list, so I cannot easily reply to that message directly.) The issue is still reproducable in 4.5.0.Final and also affects the User Account app (when the user clicks "Log out all sessions", Offline Tokens cannot be used anymore). I created KEYCLOAK-8638 for this. Cheers, Mario.

5 years, 6 months

1
0
0 / 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

keycloak-user October 2018