OIDC protocol extension
by Karipineni, Neelima,M.D.
We have a use case where we’re trying to implement an OAuth2 profile which requires an extra claim on the access token when a certain auth request scope is used.
The expected behavior is that when a certain scope is present in the auth endpoint request then during the Authorization flow the user is shown an extra screen where they input an identifier which ultimately is included as a claim in the access token. Details are at http://docs.smarthealthit.org/authorization/ (Standalone launch sequence) for reference.
Any suggestions on how to accomplish this in keycloak? I considered using an ActionToken like in the quickstarts external action token example, but the additional execution needs to happen even when the user has previously authenticated. It’s like an additional consent step after user and client authentication rather than an additional authentication step.
My current thought is to implement a custom LoginProtocol that wraps OIDCLoginProtocol, as shown in https://github.com/keycloak/keycloak/tree/openshift-integration/services/..., and have an additional redirect in the authenticated method that functions similarly to the external action token example. The callback endpoint would persist the extra claim against the client session until the access token is requested.
I’m not sure it’s possible to extend the OIDC protocol within a new protocol. Preliminarily after installing a shell wrapper protocol, it’s missing the OIDC configuration properties and mappers in the admin console. Is something like this possible without copying/recreating large chunks of the OIDC code? If not, any suggestions on alternative ways to accomplish this?
As an additional wrench, we’re still on v3.3.0 and upgrade is not on the schedule as of now.
The information in this e-mail is intended only for the person to whom it is
addressed. If you believe this e-mail was sent to you in error and the e-mail
contains patient information, please contact the Partners Compliance HelpLine at
http://www.partners.org/complianceline . If the e-mail was sent to you in error
but does not contain patient information, please contact the sender and properly
dispose of the e-mail.
4 years, 8 months
- 3
- 4
UserRepresentation enabled Boolean
by Matthew Broadhead
org.keycloak.representations.idm.UserRepresentation
(https://github.com/keycloak/keycloak/blob/master/core/src/main/java/org/k...)
has a property enabled which is of type java.lang.Boolean. Technically
this should have getters and setters of getEnabled and setEnabled. A
type boolean would have isEnabled and setEnabled. This stops it from
working with JSF
(https://stackoverflow.com/questions/14400222/boolean-properties-starting-...)
This also applies to totp and emailVerified in the same class.
4 years, 11 months
- 2
- 3
LDAP user federation with AD range retrieval
by Sidney Beekhoven
Hello,
We have a keycloak setup (3.4.3.Final) with active directory as a user federation provider. We ran into an issue with adding a certain role to users. We got an error message like this:
Uncaught server error: org.keycloak.models.ModelException: Could not modify attribute for DN [CN=xxxxxxx,OU=Roles,OU=Customers,DC=xxxxxxxx,DC=com]
at org.keycloak.storage.ldap.idm.store.ldap.LDAPOperationManager.modifyAttributes(LDAPOperationManager.java:569)
at org.keycloak.storage.ldap.idm.store.ldap.LDAPOperationManager.modifyAttributes(LDAPOperationManager.java:110)
at org.keycloak.storage.ldap.idm.store.ldap.LDAPIdentityStore.update(LDAPIdentityStore.java:112)
at org.keycloak.storage.ldap.LDAPUtils.addMember(LDAPUtils.java:181)
at org.keycloak.storage.ldap.mappers.membership.role.RoleLDAPStorageMapper.addRoleMappingInLDAP(RoleLDAPStorageMapper.java:262)
at org.keycloak.storage.ldap.mappers.membership.role.RoleLDAPStorageMapper$LDAPRoleMappingsUserDelegate.grantRole(RoleLDAPStorageMapper.java:380)
at org.keycloak.models.cache.infinispan.UserAdapter.grantRole(UserAdapter.java:316)
at org.keycloak.services.resources.admin.RoleMapperResource.addRealmRoleMappings(RoleMapperResource.java:236)
…
Caused by: javax.naming.directory.NoSuchAttributeException: [LDAP: error code 16 - 00000057<tel:16%20-%2000000057>: LdapErr: DSID-0C090C03, comment: Error in attribute conversion operation, data 0, v1db1]; remaining name ‘CN=xxxxx,OU=Roles,OU=Customers,DC=xxxxxx,DC=com'
at com.sun.jndi.ldap.LdapCtx.mapErrorCode(LdapCtx.java:3175)
at com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:3100)
at com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:2891)
at com.sun.jndi.ldap.LdapCtx.c_modifyAttributes(LdapCtx.java:1475)
at com.sun.jndi.toolkit.ctx.ComponentDirContext.p_modifyAttributes(ComponentDirContext.java:277)
at com.sun.jndi.toolkit.ctx.PartialCompositeDirContext.modifyAttributes(PartialCompositeDirContext.java:192)
at com.sun.jndi.toolkit.ctx.PartialCompositeDirContext.modifyAttributes(PartialCompositeDirContext.java:181)
at javax.naming.directory.InitialDirContext.modifyAttributes(InitialDirContext.java:167)
at javax.naming.directory.InitialDirContext.modifyAttributes(InitialDirContext.java:167)
After some investigation the issue is that active directory uses range retrieval when there are more than 1500 entries in the member (list) property of a group. See eg https://docs.microsoft.com/en-us/previous-versions/windows/desktop/ldap/s....
When i look at the keycloak source code it looks like keycloak does not handle/support the range retrieval, so an error happens when trying to add a user to that role.
For now we work around the issue by setting the MaxValRange to a higher value. See https://support.microsoft.com/en-us/help/315071/how-to-view-and-set-ldap-... for more info about this.
The real solution would probably be to add support for range retrieval in the keycloak ldap user federation provider, so i will create a jira ticket for that.
Did anyone else maybe run into this issue, and if so had another solution for it?
Kind regards,
Sidney Beekhoven
4 years, 11 months
- 2
- 4
KC installation DB problems
by Henning Waack
Dear all.
I try to setup KC 4.2.1 (also tried with 4.0.0) on Ubuntu 18.04 with Mysq
5.7l/MariaDB 10.x. It works totally fine on my Vagrant box (I use Ansible),
but on the "real" server the Liquibase init scripts time out. Please note
that the DB is installed physically on the same machine as Keycloak,
connection is done trough localhost.
The error is some kind of transaction timeout exception, please see below
the log. It is interesting to note that a) the script runs for more than 5
minutes before it fails, and b) most tables have been created in the DB,
but after this error the state is unrecoverable.
Do you have any pointers/hints on why I run into these timeout issues? I am
totally at loss, having tried so many combinations (KC version x DB type x
DB version), which all run fine on Vagrant but fail on the server.
Thanks in advance & greetings
Henning
------
2018-09-20 19:00:53,220 INFO
[org.keycloak.connections.infinispan.DefaultInfinispanConnectionProviderFactory]
(ServerService Thread Pool -- 49) Node name: sso, Site name: null
2018-09-20 19:00:55,982 INFO
[org.keycloak.connections.jpa.updater.liquibase.LiquibaseJpaUpdaterProvider]
(ServerService Thread Pool -- 49) Initializing database schema. Using
changelog META-INF/jpa-changelog-master.xml
2018-09-20 19:05:53,240 WARN [com.arjuna.ats.arjuna] (Transaction Reaper)
ARJUNA012117: TransactionReaper::check timeout for TX
0:ffff91eff4af:-1fd3cdfc:5ba3d243:e in state RUN
2018-09-20 19:05:53,252 WARN [com.arjuna.ats.arjuna] (Transaction Reaper
Worker 0) ARJUNA012121: TransactionReaper::doCancellations worker
Thread[Transaction Reaper Worker 0,5,main] successfully canceled TX
0:ffff91eff4af:-1fd3cdfc:5ba3d243:e
2018-09-20 19:05:53,938 WARN [com.arjuna.ats.arjuna] (Transaction Reaper)
ARJUNA012117: TransactionReaper::check timeout for TX
0:ffff91eff4af:-1fd3cdfc:5ba3d243:11 in state RUN
2018-09-20 19:05:53,940 WARN [com.arjuna.ats.arjuna] (Transaction Reaper
Worker 0) ARJUNA012121: TransactionReaper::doCancellations worker
Thread[Transaction Reaper Worker 0,5,main] successfully canceled TX
0:ffff91eff4af:-1fd3cdfc:5ba3d243:11
2018-09-20 19:06:13,864 INFO [org.hibernate.jpa.internal.util.LogHelper]
(ServerService Thread Pool -- 49) HHH000204: Processing PersistenceUnitInfo
[
name: keycloak-default
...]
2018-09-20 19:06:13,913 INFO [org.hibernate.Version] (ServerService Thread
Pool -- 49) HHH000412: Hibernate Core {5.1.10.Final}
2018-09-20 19:06:13,914 INFO [org.hibernate.cfg.Environment]
(ServerService Thread Pool -- 49) HHH000206: hibernate.properties not found
2018-09-20 19:06:13,916 INFO [org.hibernate.cfg.Environment]
(ServerService Thread Pool -- 49) HHH000021: Bytecode provider name :
javassist
2018-09-20 19:06:13,943 INFO [org.hibernate.annotations.common.Version]
(ServerService Thread Pool -- 49) HCANN000001: Hibernate Commons
Annotations {5.0.1.Final}
2018-09-20 19:06:14,076 INFO [org.hibernate.dialect.Dialect]
(ServerService Thread Pool -- 49) HHH000400: Using dialect:
org.hibernate.dialect.MySQL5Dialect
2018-09-20 19:06:14,107 INFO
[org.hibernate.envers.boot.internal.EnversServiceImpl] (ServerService
Thread Pool -- 49) Envers integration enabled? : true
2018-09-20 19:06:14,534 INFO
[org.hibernate.validator.internal.util.Version] (ServerService Thread Pool
-- 49) HV000001: Hibernate Validator 5.3.5.Final
2018-09-20 19:06:15,154 INFO
[org.hibernate.hql.internal.QueryTranslatorFactoryInitiator] (ServerService
Thread Pool -- 49) HHH000397: Using ASTQueryTranslatorFactory
2018-09-20 19:06:15,842 WARN
[org.hibernate.engine.jdbc.spi.SqlExceptionHelper] (ServerService Thread
Pool -- 49) SQL Error: 0, SQLState: null
2018-09-20 19:06:15,842 ERROR
[org.hibernate.engine.jdbc.spi.SqlExceptionHelper] (ServerService Thread
Pool -- 49) javax.resource.ResourceException: IJ000460: Error checking for
a transaction
2018-09-20 19:06:15,843 INFO
[org.hibernate.event.internal.DefaultLoadEventListener] (ServerService
Thread Pool -- 49) HHH000327: Error performing load command :
org.hibernate.exception.GenericJDBCException: Unable to acquire JDBC
Connection
2018-09-20 19:06:15,844 WARN [com.arjuna.ats.arjuna] (ServerService Thread
Pool -- 49) ARJUNA012077: Abort called on already aborted atomic action
0:ffff91eff4af:-1fd3cdfc:5ba3d243:11
2018-09-20 19:06:15,850 WARN [com.arjuna.ats.arjuna] (ServerService Thread
Pool -- 49) ARJUNA012077: Abort called on already aborted atomic action
0:ffff91eff4af:-1fd3cdfc:5ba3d243:e
2018-09-20 19:06:15,853 INFO [org.jboss.as.server] (Thread-2) WFLYSRV0220:
Server shutdown has been requested via an OS signal
2018-09-20 19:06:15,857 ERROR [org.jboss.msc.service.fail] (ServerService
Thread Pool -- 49) MSC000001: Failed to start service
jboss.undertow.deployment.default-server.default-host./auth:
org.jboss.msc.service.StartException in service
jboss.undertow.deployment.default-server.default-host./auth:
java.lang.RuntimeException: RESTEASY003325: Failed to construct public
org.keycloak.services.resources.KeycloakApplication(javax.servlet.ServletContext,org.jboss.resteasy.core.Dispatcher)
at
org.wildfly.extension.undertow.deployment.UndertowDeploymentService$1.run(UndertowDeploymentService.java:84)
at
java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
at java.util.concurrent.FutureTask.run(FutureTask.java:266)
at
java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
at
java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
at java.lang.Thread.run(Thread.java:748)
at org.jboss.threads.JBossThread.run(JBossThread.java:320)
Caused by: java.lang.RuntimeException: RESTEASY003325: Failed to construct
public
org.keycloak.services.resources.KeycloakApplication(javax.servlet.ServletContext,org.jboss.resteasy.core.Dispatcher)
at
org.jboss.resteasy.core.ConstructorInjectorImpl.construct(ConstructorInjectorImpl.java:162)
at
org.jboss.resteasy.spi.ResteasyProviderFactory.createProviderInstance(ResteasyProviderFactory.java:2298)
at
org.jboss.resteasy.spi.ResteasyDeployment.createApplication(ResteasyDeployment.java:340)
at
org.jboss.resteasy.spi.ResteasyDeployment.start(ResteasyDeployment.java:253)
at
org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.init(ServletContainerDispatcher.java:120)
at
org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.init(HttpServletDispatcher.java:36)
at
io.undertow.servlet.core.LifecyleInterceptorInvocation.proceed(LifecyleInterceptorInvocation.java:117)
at
org.wildfly.extension.undertow.security.RunAsLifecycleInterceptor.init(RunAsLifecycleInterceptor.java:78)
at
io.undertow.servlet.core.LifecyleInterceptorInvocation.proceed(LifecyleInterceptorInvocation.java:103)
at
io.undertow.servlet.core.ManagedServlet$DefaultInstanceStrategy.start(ManagedServlet.java:250)
at
io.undertow.servlet.core.ManagedServlet.createServlet(ManagedServlet.java:133)
at
io.undertow.servlet.core.DeploymentManagerImpl$2.call(DeploymentManagerImpl.java:565)
at
io.undertow.servlet.core.DeploymentManagerImpl$2.call(DeploymentManagerImpl.java:536)
at
io.undertow.servlet.core.ServletRequestContextThreadSetupAction$1.call(ServletRequestContextThreadSetupAction.java:42)
at
io.undertow.servlet.core.ContextClassLoaderSetupAction$1.call(ContextClassLoaderSetupAction.java:43)
at
org.wildfly.extension.undertow.security.SecurityContextThreadSetupAction.lambda$create$0(SecurityContextThreadSetupAction.java:105)
at
org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1508)
at
org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1508)
at
org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1508)
at
org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1508)
at
io.undertow.servlet.core.DeploymentManagerImpl.start(DeploymentManagerImpl.java:578)
at
org.wildfly.extension.undertow.deployment.UndertowDeploymentService.startContext(UndertowDeploymentService.java:100)
at
org.wildfly.extension.undertow.deployment.UndertowDeploymentService$1.run(UndertowDeploymentService.java:81)
... 6 more
Caused by: org.keycloak.models.ModelException:
javax.persistence.PersistenceException:
org.hibernate.exception.GenericJDBCException: Unable to acquire JDBC
Connection
at
org.keycloak.connections.jpa.PersistenceExceptionConverter.convert(PersistenceExceptionConverter.java:61)
at
org.keycloak.connections.jpa.PersistenceExceptionConverter.invoke(PersistenceExceptionConverter.java:51)
at com.sun.proxy.$Proxy68.find(Unknown Source)
at
org.keycloak.models.jpa.MigrationModelAdapter.getStoredVersion(MigrationModelAdapter.java:38)
at
org.keycloak.migration.MigrationModelManager.migrate(MigrationModelManager.java:84)
at
org.keycloak.services.resources.KeycloakApplication.migrateModel(KeycloakApplication.java:245)
at
org.keycloak.services.resources.KeycloakApplication.migrateAndBootstrap(KeycloakApplication.java:186)
at
org.keycloak.services.resources.KeycloakApplication$1.run(KeycloakApplication.java:145)
at
org.keycloak.models.utils.KeycloakModelUtils.runJobInTransaction(KeycloakModelUtils.java:227)
at
org.keycloak.services.resources.KeycloakApplication.<init>(KeycloakApplication.java:136)
at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native
Method)
at
sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62)
at
sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
at java.lang.reflect.Constructor.newInstance(Constructor.java:423)
at
org.jboss.resteasy.core.ConstructorInjectorImpl.construct(ConstructorInjectorImpl.java:150)
... 28 more
Caused by: javax.persistence.PersistenceException:
org.hibernate.exception.GenericJDBCException: Unable to acquire JDBC
Connection
at
org.hibernate.jpa.spi.AbstractEntityManagerImpl.convert(AbstractEntityManagerImpl.java:1692)
at
org.hibernate.jpa.spi.AbstractEntityManagerImpl.convert(AbstractEntityManagerImpl.java:1619)
at
org.hibernate.jpa.spi.AbstractEntityManagerImpl.find(AbstractEntityManagerImpl.java:1106)
at
org.hibernate.jpa.spi.AbstractEntityManagerImpl.find(AbstractEntityManagerImpl.java:1033)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at
sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
at
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:498)
at
org.keycloak.connections.jpa.PersistenceExceptionConverter.invoke(PersistenceExceptionConverter.java:49)
... 41 more
Caused by: org.hibernate.exception.GenericJDBCException: Unable to acquire
JDBC Connection
at
org.hibernate.exception.internal.StandardSQLExceptionConverter.convert(StandardSQLExceptionConverter.java:47)
at
org.hibernate.engine.jdbc.spi.SqlExceptionHelper.convert(SqlExceptionHelper.java:111)
at
org.hibernate.engine.jdbc.spi.SqlExceptionHelper.convert(SqlExceptionHelper.java:97)
at
org.hibernate.resource.jdbc.internal.LogicalConnectionManagedImpl.acquireConnectionIfNeeded(LogicalConnectionManagedImpl.java:87)
at
org.hibernate.resource.jdbc.internal.LogicalConnectionManagedImpl.getPhysicalConnection(LogicalConnectionManagedImpl.java:109)
at
org.hibernate.engine.jdbc.internal.StatementPreparerImpl.connection(StatementPreparerImpl.java:47)
at
org.hibernate.engine.jdbc.internal.StatementPreparerImpl$5.doPrepare(StatementPreparerImpl.java:146)
at
org.hibernate.engine.jdbc.internal.StatementPreparerImpl$StatementPreparationTemplate.prepareStatement(StatementPreparerImpl.java:172)
at
org.hibernate.engine.jdbc.internal.StatementPreparerImpl.prepareQueryStatement(StatementPreparerImpl.java:148)
at
org.hibernate.loader.plan.exec.internal.AbstractLoadPlanBasedLoader.prepareQueryStatement(AbstractLoadPlanBasedLoader.java:241)
at
org.hibernate.loader.plan.exec.internal.AbstractLoadPlanBasedLoader.executeQueryStatement(AbstractLoadPlanBasedLoader.java:185)
at
org.hibernate.loader.plan.exec.internal.AbstractLoadPlanBasedLoader.executeLoad(AbstractLoadPlanBasedLoader.java:121)
at
org.hibernate.loader.plan.exec.internal.AbstractLoadPlanBasedLoader.executeLoad(AbstractLoadPlanBasedLoader.java:86)
at
org.hibernate.loader.entity.plan.AbstractLoadPlanBasedEntityLoader.load(AbstractLoadPlanBasedEntityLoader.java:167)
at
org.hibernate.persister.entity.AbstractEntityPersister.load(AbstractEntityPersister.java:4069)
at
org.hibernate.event.internal.DefaultLoadEventListener.loadFromDatasource(DefaultLoadEventListener.java:508)
at
org.hibernate.event.internal.DefaultLoadEventListener.doLoad(DefaultLoadEventListener.java:478)
at
org.hibernate.event.internal.DefaultLoadEventListener.load(DefaultLoadEventListener.java:219)
at
org.hibernate.event.internal.DefaultLoadEventListener.proxyOrLoad(DefaultLoadEventListener.java:278)
at
org.hibernate.event.internal.DefaultLoadEventListener.doOnLoad(DefaultLoadEventListener.java:121)
at
org.hibernate.event.internal.DefaultLoadEventListener.onLoad(DefaultLoadEventListener.java:89)
at
org.hibernate.internal.SessionImpl.fireLoad(SessionImpl.java:1142)
at
org.hibernate.internal.SessionImpl.access$2600(SessionImpl.java:167)
at
org.hibernate.internal.SessionImpl$IdentifierLoadAccessImpl.doLoad(SessionImpl.java:2762)
at
org.hibernate.internal.SessionImpl$IdentifierLoadAccessImpl.load(SessionImpl.java:2741)
at org.hibernate.internal.SessionImpl.get(SessionImpl.java:978)
at
org.hibernate.jpa.spi.AbstractEntityManagerImpl.find(AbstractEntityManagerImpl.java:1075)
... 47 more
Caused by: java.sql.SQLException: javax.resource.ResourceException:
IJ000460: Error checking for a transaction
at
org.jboss.jca.adapters.jdbc.WrapperDataSource.getConnection(WrapperDataSource.java:146)
at
org.jboss.as.connector.subsystems.datasources.WildFlyDataSource.getConnection(WildFlyDataSource.java:64)
at
org.hibernate.engine.jdbc.connections.internal.DatasourceConnectionProviderImpl.getConnection(DatasourceConnectionProviderImpl.java:122)
at
org.hibernate.internal.AbstractSessionImpl$NonContextualJdbcConnectionAccess.obtainConnection(AbstractSessionImpl.java:386)
at
org.hibernate.resource.jdbc.internal.LogicalConnectionManagedImpl.acquireConnectionIfNeeded(LogicalConnectionManagedImpl.java:84)
... 70 more
Caused by: javax.resource.ResourceException: IJ000460: Error checking for a
transaction
at
org.jboss.jca.core.connectionmanager.tx.TxConnectionManagerImpl.getManagedConnection(TxConnectionManagerImpl.java:425)
at
org.jboss.jca.core.connectionmanager.AbstractConnectionManager.allocateConnection(AbstractConnectionManager.java:789)
at
org.jboss.jca.adapters.jdbc.WrapperDataSource.getConnection(WrapperDataSource.java:138)
... 74 more
Caused by: javax.resource.ResourceException: IJ000459: Transaction is not
active: tx=Local transaction (delegate=TransactionImple < ac, BasicAction:
0:ffff91eff4af:-1fd3cdfc:5ba3d243:11 status: ActionStatus.ABORTED >,
owner=Local transaction context for provider JBoss JTA transaction provider)
at
org.jboss.jca.core.connectionmanager.tx.TxConnectionManagerImpl.getManagedConnection(TxConnectionManagerImpl.java:409)
... 76 more
2018-09-20 19:06:15,872 INFO [org.wildfly.extension.undertow] (MSC service
thread 1-7) WFLYUT0008: Undertow HTTPS listener https suspending
2018-09-20 19:06:15,872 INFO
[org.jboss.as.connector.subsystems.datasources] (MSC service thread 1-3)
WFLYJCA0010: Unbound data source [java:jboss/datasources/KeycloakDS]
2018-09-20 19:06:15,877 INFO
[org.jboss.as.connector.subsystems.datasources] (MSC service thread 1-2)
WFLYJCA0010: Unbound data source [java:jboss/datasources/ExampleDS]
2018-09-20 19:06:15,878 INFO [org.jboss.as.connector.deployers.jdbc] (MSC
service thread 1-6) WFLYJCA0019: Stopped Driver service with driver-name =
h2
2018-09-20 19:06:15,881 INFO [org.jboss.as.connector.deployers.jdbc] (MSC
service thread 1-2) WFLYJCA0019: Stopped Driver service with driver-name =
mariadb
2018-09-20 19:06:15,881 INFO [org.wildfly.extension.undertow] (MSC service
thread 1-7) WFLYUT0007: Undertow HTTPS listener https stopped, was bound to
0.0.0.0:8443
2018-09-20 19:06:15,885 INFO [org.wildfly.extension.undertow] (MSC service
thread 1-7) WFLYUT0008: Undertow HTTP listener default suspendi
--
5 years, 2 months
- 2
- 1
Deploying Keycloak on Openshift with MariaDB persistence produces errors in logs
by Cristi Cioriia
Hello,
While deploying Keycloak 4.5.0.Final in an Openshift environment, using
Mariadb (Galera) as a database produces several exceptions in the logs, all
of them being related to the communication between the Keycloak server and
the database. The access to the Galera server (3 instances) is performed
via a Maxscale proxy. The Galera server, Maxscale (deployment of 3 pods)
and Keycloak (deployment of 2 replicas) are all deployed inside Openshift,
on AWS (1master + 3 workers).
I am hoping you guys can help with fixing these issues.
The errors look like below:
08:40:46,603 WARN
[org.jboss.jca.adapters.jdbc.local.LocalManagedConnectionFactory]
(ConnectionValidator) IJ030027: Destroying connection that is not valid,
due to the following exception: org.mariadb.jdbc.MariaDbConnection@76883993:
java.sql.SQLNonTransientConnectionException: (conn=24) unexpected end of
stream, read 0 bytes from 4 (socket was closed by server)
at
org.mariadb.jdbc.internal.util.exceptions.ExceptionMapper.get(ExceptionMapper.java:175)
at
org.mariadb.jdbc.internal.util.exceptions.ExceptionMapper.getException(ExceptionMapper.java:110)
at
org.mariadb.jdbc.MariaDbStatement.executeExceptionEpilogue(MariaDbStatement.java:228)
at
org.mariadb.jdbc.MariaDbStatement.executeInternal(MariaDbStatement.java:334)
at org.mariadb.jdbc.MariaDbStatement.execute(MariaDbStatement.java:386)
at
org.jboss.jca.adapters.jdbc.CheckValidConnectionSQL.isValidConnection(CheckValidConnectionSQL.java:74)
at
org.jboss.jca.adapters.jdbc.BaseWrapperManagedConnectionFactory.isValidConnection(BaseWrapperManagedConnectionFactory.java:1273)
at
org.jboss.jca.adapters.jdbc.BaseWrapperManagedConnectionFactory.getInvalidConnections(BaseWrapperManagedConnectionFactory.java:1086)
at
org.jboss.jca.core.connectionmanager.pool.mcp.SemaphoreConcurrentLinkedDequeManagedConnectionPool.validateConnections(SemaphoreConcurrentLinkedDequeManagedConnectionPool.java:1442)
at
org.jboss.jca.core.connectionmanager.pool.validator.ConnectionValidator$ConnectionValidatorRunner.run(ConnectionValidator.java:277)
at
java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
at
java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
at java.lang.Thread.run(Thread.java:748)
Caused by: java.sql.SQLException: unexpected end of stream, read 0 bytes
from 4 (socket was closed by server)
Query is: SELECT 1
at
org.mariadb.jdbc.internal.util.LogQueryTool.exceptionWithQuery(LogQueryTool.java:119)
at
org.mariadb.jdbc.internal.protocol.AbstractQueryProtocol.executeQuery(AbstractQueryProtocol.java:199)
at
org.mariadb.jdbc.MariaDbStatement.executeInternal(MariaDbStatement.java:328)
... 9 more
Caused by: java.io.EOFException: unexpected end of stream, read 0 bytes
from 4 (socket was closed by server)
at
org.mariadb.jdbc.internal.io.input.StandardPacketInputStream.getPacketArray(StandardPacketInputStream.java:239)
at
org.mariadb.jdbc.internal.io.input.StandardPacketInputStream.getPacket(StandardPacketInputStream.java:207)
at
org.mariadb.jdbc.internal.protocol.AbstractQueryProtocol.readPacket(AbstractQueryProtocol.java:1347)
at
org.mariadb.jdbc.internal.protocol.AbstractQueryProtocol.getResult(AbstractQueryProtocol.java:1328)
at
org.mariadb.jdbc.internal.protocol.AbstractQueryProtocol.executeQuery(AbstractQueryProtocol.java:196)
... 10 more
I suspect that the errors come from the way the jdbc data source is
configured. The mariadb configurations related to connections and wait
timeouts are like below:
max_connections=1000
wait_timeout=180
The second issue I noticed was the following: one of the pods in the
deployments (we deploy 2 replicas of Keycloak) sometimes does not start
correctly because of the following exception, which is still related to the
database connection:
08:13:03,409 ERROR [org.jboss.msc.service.fail] (ServerService Thread Pool
-- 52) MSC000001: Failed to start service
jboss.undertow.deployment.default-server.default-host./auth:
org.jboss.msc.service.StartException in service
jboss.undertow.deployment.default-server.default-host./auth:
java.lang.RuntimeException: RESTEASY003325: Failed to construct public
org.keycloak.services.resources.KeycloakApplication(javax.servlet.ServletContext,org.jboss.resteasy.core.Dispatcher)
at
org.wildfly.extension.undertow.deployment.UndertowDeploymentService$1.run(UndertowDeploymentService.java:81)
at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
at java.util.concurrent.FutureTask.run(FutureTask.java:266)
at
org.jboss.threads.ContextClassLoaderSavingRunnable.run(ContextClassLoaderSavingRunnable.java:35)
at
org.jboss.threads.EnhancedQueueExecutor.safeRun(EnhancedQueueExecutor.java:1985)
at
org.jboss.threads.EnhancedQueueExecutor$ThreadBody.doRunTask(EnhancedQueueExecutor.java:1487)
at
org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1378)
at java.lang.Thread.run(Thread.java:748)
at org.jboss.threads.JBossThread.run(JBossThread.java:485)
Caused by: java.lang.RuntimeException: RESTEASY003325: Failed to construct
public
org.keycloak.services.resources.KeycloakApplication(javax.servlet.ServletContext,org.jboss.resteasy.core.Dispatcher)
at
org.jboss.resteasy.core.ConstructorInjectorImpl.construct(ConstructorInjectorImpl.java:162)
at
org.jboss.resteasy.spi.ResteasyProviderFactory.createProviderInstance(ResteasyProviderFactory.java:2676)
at
org.jboss.resteasy.spi.ResteasyDeployment.createApplication(ResteasyDeployment.java:361)
at
org.jboss.resteasy.spi.ResteasyDeployment.startInternal(ResteasyDeployment.java:274)
at
org.jboss.resteasy.spi.ResteasyDeployment.start(ResteasyDeployment.java:86)
at
org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.init(ServletContainerDispatcher.java:119)
at
org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.init(HttpServletDispatcher.java:36)
at
io.undertow.servlet.core.LifecyleInterceptorInvocation.proceed(LifecyleInterceptorInvocation.java:117)
at
org.wildfly.extension.undertow.security.RunAsLifecycleInterceptor.init(RunAsLifecycleInterceptor.java:78)
at
io.undertow.servlet.core.LifecyleInterceptorInvocation.proceed(LifecyleInterceptorInvocation.java:103)
at
io.undertow.servlet.core.ManagedServlet$DefaultInstanceStrategy.start(ManagedServlet.java:300)
at
io.undertow.servlet.core.ManagedServlet.createServlet(ManagedServlet.java:140)
at
io.undertow.servlet.core.DeploymentManagerImpl$2.call(DeploymentManagerImpl.java:584)
at
io.undertow.servlet.core.DeploymentManagerImpl$2.call(DeploymentManagerImpl.java:555)
at
io.undertow.servlet.core.ServletRequestContextThreadSetupAction$1.call(ServletRequestContextThreadSetupAction.java:42)
at
io.undertow.servlet.core.ContextClassLoaderSetupAction$1.call(ContextClassLoaderSetupAction.java:43)
at
org.wildfly.extension.undertow.security.SecurityContextThreadSetupAction.lambda$create$0(SecurityContextThreadSetupAction.java:105)
at
org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1514)
at
org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1514)
at
org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1514)
at
org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1514)
at
io.undertow.servlet.core.DeploymentManagerImpl.start(DeploymentManagerImpl.java:597)
at
org.wildfly.extension.undertow.deployment.UndertowDeploymentService.startContext(UndertowDeploymentService.java:97)
at
org.wildfly.extension.undertow.deployment.UndertowDeploymentService$1.run(UndertowDeploymentService.java:78)
... 8 more
Caused by: java.lang.RuntimeException: Failed to connect to database
at
org.keycloak.connections.jpa.DefaultJpaConnectionProviderFactory.getConnection(DefaultJpaConnectionProviderFactory.java:373)
at
org.keycloak.connections.jpa.updater.liquibase.lock.LiquibaseDBLockProvider.lazyInit(LiquibaseDBLockProvider.java:65)
at
org.keycloak.connections.jpa.updater.liquibase.lock.LiquibaseDBLockProvider.lambda$waitForLock$0(LiquibaseDBLockProvider.java:97)
at
org.keycloak.models.utils.KeycloakModelUtils.suspendJtaTransaction(KeycloakModelUtils.java:611)
at
org.keycloak.connections.jpa.updater.liquibase.lock.LiquibaseDBLockProvider.waitForLock(LiquibaseDBLockProvider.java:95)
at
org.keycloak.services.resources.KeycloakApplication$1.run(KeycloakApplication.java:143)
at
org.keycloak.models.utils.KeycloakModelUtils.runJobInTransaction(KeycloakModelUtils.java:227)
at
org.keycloak.services.resources.KeycloakApplication.<init>(KeycloakApplication.java:136)
at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
at
sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62)
at
sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
at java.lang.reflect.Constructor.newInstance(Constructor.java:423)
at
org.jboss.resteasy.core.ConstructorInjectorImpl.construct(ConstructorInjectorImpl.java:150)
... 31 more
Caused by: java.sql.SQLException: javax.resource.ResourceException:
IJ000453: Unable to get managed connection for
java:jboss/datasources/KeycloakDS
at
org.jboss.jca.adapters.jdbc.WrapperDataSource.getConnection(WrapperDataSource.java:146)
at
org.jboss.as.connector.subsystems.datasources.WildFlyDataSource.getConnection(WildFlyDataSource.java:64)
at
org.keycloak.connections.jpa.DefaultJpaConnectionProviderFactory.getConnection(DefaultJpaConnectionProviderFactory.java:367)
... 43 more
Caused by: javax.resource.ResourceException: IJ000453: Unable to get
managed connection for java:jboss/datasources/KeycloakDS
at
org.jboss.jca.core.connectionmanager.AbstractConnectionManager.getManagedConnection(AbstractConnectionManager.java:690)
at
org.jboss.jca.core.connectionmanager.tx.TxConnectionManagerImpl.getManagedConnection(TxConnectionManagerImpl.java:430)
at
org.jboss.jca.core.connectionmanager.AbstractConnectionManager.allocateConnection(AbstractConnectionManager.java:789)
at
org.jboss.jca.adapters.jdbc.WrapperDataSource.getConnection(WrapperDataSource.java:138)
... 45 more
Caused by: javax.resource.ResourceException: IJ031084: Unable to create
connection
at
org.jboss.jca.adapters.jdbc.local.LocalManagedConnectionFactory.createLocalManagedConnection(LocalManagedConnectionFactory.java:345)
at
org.jboss.jca.adapters.jdbc.local.LocalManagedConnectionFactory.getLocalManagedConnection(LocalManagedConnectionFactory.java:352)
at
org.jboss.jca.adapters.jdbc.local.LocalManagedConnectionFactory.createManagedConnection(LocalManagedConnectionFactory.java:287)
at
org.jboss.jca.core.connectionmanager.pool.mcp.SemaphoreConcurrentLinkedDequeManagedConnectionPool.createConnectionEventListener(SemaphoreConcurrentLinkedDequeManagedConnectionPool.java:1326)
at
org.jboss.jca.core.connectionmanager.pool.mcp.SemaphoreConcurrentLinkedDequeManagedConnectionPool.getConnection(SemaphoreConcurrentLinkedDequeManagedConnectionPool.java:499)
at
org.jboss.jca.core.connectionmanager.pool.AbstractPool.getSimpleConnection(AbstractPool.java:632)
at
org.jboss.jca.core.connectionmanager.pool.AbstractPool.getConnection(AbstractPool.java:604)
at
org.jboss.jca.core.connectionmanager.AbstractConnectionManager.getManagedConnection(AbstractConnectionManager.java:624)
... 48 more
Caused by: java.sql.SQLNonTransientConnectionException: could not load
system variables
at
org.mariadb.jdbc.internal.util.exceptions.ExceptionMapper.get(ExceptionMapper.java:175)
at
org.mariadb.jdbc.internal.util.exceptions.ExceptionMapper.getException(ExceptionMapper.java:110)
at
org.mariadb.jdbc.internal.protocol.AbstractConnectProtocol.connectWithoutProxy(AbstractConnectProtocol.java:1093)
at org.mariadb.jdbc.internal.util.Utils.retrieveProxy(Utils.java:494)
at
org.mariadb.jdbc.MariaDbConnection.newConnection(MariaDbConnection.java:150)
at org.mariadb.jdbc.Driver.connect(Driver.java:86)
at
org.jboss.jca.adapters.jdbc.local.LocalManagedConnectionFactory.createLocalManagedConnection(LocalManagedConnectionFactory.java:321)
... 55 more
Caused by: java.sql.SQLNonTransientConnectionException: could not load
system variables
at
org.mariadb.jdbc.internal.util.exceptions.ExceptionMapper.get(ExceptionMapper.java:175)
at
org.mariadb.jdbc.internal.util.exceptions.ExceptionMapper.connException(ExceptionMapper.java:83)
at
org.mariadb.jdbc.internal.protocol.AbstractConnectProtocol.readPipelineAdditionalData(AbstractConnectProtocol.java:606)
at
org.mariadb.jdbc.internal.protocol.AbstractConnectProtocol.connect(AbstractConnectProtocol.java:477)
at
org.mariadb.jdbc.internal.protocol.AbstractConnectProtocol.connectWithoutProxy(AbstractConnectProtocol.java:1089)
... 59 more
Caused by: java.sql.SQLException: Error reading SessionVariables results.
Socket is connected ? true
at
org.mariadb.jdbc.internal.protocol.AbstractConnectProtocol.readRequestSessionVariables(AbstractConnectProtocol.java:572)
at
org.mariadb.jdbc.internal.protocol.AbstractConnectProtocol.readPipelineAdditionalData(AbstractConnectProtocol.java:603)
... 61 more
The pod is in state running, but it is not ready, as it can be seen below:
oc describe pod keycloak-787795bbcb-qng6j
Name: keycloak-787795bbcb-qng6j
Namespace: frame-2900
Start Time: Thu, 25 Oct 2018 10:03:30 +0200
Labels: application=keycloak
pod-template-hash=3433516676
Annotations: openshift.io/scc=restricted
Status: *Running*
IP: 10.131.0.12
Controlled By: ReplicaSet/keycloak-787795bbcb
Containers:
keycloak:
Container ID:
docker://b703c13a70ffa24f696e08996590b972ec65e6b6041f8d08f50a44372b9e4760
Image: jboss/keycloak
Image ID: docker-pullable://
docker.io/jboss/keycloak@sha256:cb5c24d06f22c51ca193e6d1e930d206ef0b841a745f8e475a08e33f10b38ad4
Ports: 8080/TCP, 8443/TCP
*State: Waiting*
* Reason: CrashLoopBackOff*
Last State: Terminated
Reason: Error
Exit Code: 1
Started: Thu, 25 Oct 2018 10:12:43 +0200
Finished: Thu, 25 Oct 2018 10:13:03 +0200
Ready: False
* Restart Count: 6*
Liveness: http-get http://:8080/auth/realms/master delay=60s
timeout=1s period=10s #success=1 #failure=3
Readiness: http-get http://:8080/auth/realms/master delay=30s
timeout=1s period=10s #success=1 #failure=10
Environment:
KEYCLOAK_USER: BokIm2Kl
KEYCLOAK_PASSWORD: o8QobI0D
PROXY_ADDRESS_FORWARDING: true
DB_VENDOR: MARIADB
JGROUPS_DISCOVERY_PROTOCOL: dns.DNS_PING
JGROUPS_DISCOVERY_PROPERTIES:
dns_query=keycloak.default.svc.cluster.local
DB_ADDR: max-scale
DB_DATABASE: keycloak
DB_PORT: 4408
DB_USER: <set to the key
'keycloakDatabaseUserName' in secret 'qa-complex-secret'> Optional:
false
DB_PASSWORD: <set to the key
'keycloakDatabaseUserPassword' in secret 'qa-complex-secret'> Optional:
false
Mounts:
/var/run/secrets/kubernetes.io/serviceaccount from
frame-2900-token-k8cwj (ro)
Conditions:
Type Status
Initialized True
Ready False
PodScheduled True
Volumes:
frame-2900-token-k8cwj:
Type: Secret (a volume populated by a Secret)
SecretName: frame-2900-token-k8cwj
Optional: false
QoS Class: BestEffort
Node-Selectors: node-role.kubernetes.io/compute=true
Tolerations: <none>
Events:
Type Reason Age From
Message
---- ------ ---- ----
-------
Normal Scheduled 11m default-scheduler
Successfully assigned
keycloak-787795bbcb-qng6j to ip-10-0-141-24.eu-west-1.compute.internal
Normal SuccessfulMountVolume 11m kubelet,
ip-10-0-141-24.eu-west-1.compute.internal MountVolume.SetUp succeeded for
volume "frame-2900-token-k8cwj"
Normal Pulled 7m (x4 over 9m) kubelet,
ip-10-0-141-24.eu-west-1.compute.internal Successfully pulled image
"jboss/keycloak"
Normal Created 7m (x4 over 9m) kubelet,
ip-10-0-141-24.eu-west-1.compute.internal Created container
Normal Started 7m (x4 over 9m) kubelet,
ip-10-0-141-24.eu-west-1.compute.internal Started container
Normal Pulling 6m (x5 over 10m) kubelet,
ip-10-0-141-24.eu-west-1.compute.internal pulling image "jboss/keycloak"
Warning BackOff 53s (x31 over 8m) kubelet,
ip-10-0-141-24.eu-west-1.compute.internal Back-off restarting failed
container
The pod is restarted several times it seems, but it does not start
correctly. I deleted the pod and it was recreated automatically by
Openshift and the new pod started correctly.
Then, there is a third issue that I've encountered while trying to login
into the deployed application. While entering some wrong credentials I got
an error page and noticed in the logs that there is still a database
connection error:
08:18:12,405 WARN [org.keycloak.services] (default task-2)
KC-SERVICES0013: Failed authentication:
javax.persistence.PersistenceException:
org.hibernate.exception.JDBCConnectionException: could not extract ResultSet
at
org.hibernate.jpa.spi.AbstractEntityManagerImpl.convert(AbstractEntityManagerImpl.java:1692)
at
org.hibernate.jpa.spi.AbstractEntityManagerImpl.convert(AbstractEntityManagerImpl.java:1602)
at org.hibernate.jpa.internal.QueryImpl.getResultList(QueryImpl.java:492)
at
org.keycloak.models.jpa.JpaUserProvider.getUserByUsername(JpaUserProvider.java:526)
at
org.keycloak.storage.UserStorageManager.getUserByUsername(UserStorageManager.java:390)
at
org.keycloak.models.cache.infinispan.UserCacheSession.getUserByUsername(UserCacheSession.java:253)
at
org.keycloak.models.utils.KeycloakModelUtils.findUserByNameOrEmail(KeycloakModelUtils.java:213)
at
org.keycloak.authentication.authenticators.browser.AbstractUsernameFormAuthenticator.validateUserAndPassword(AbstractUsernameFormAuthenticator.java:153)
at
org.keycloak.authentication.authenticators.browser.UsernamePasswordForm.validateForm(UsernamePasswordForm.java:55)
at
org.keycloak.authentication.authenticators.browser.UsernamePasswordForm.action(UsernamePasswordForm.java:48)
at
org.keycloak.authentication.DefaultAuthenticationFlow.processAction(DefaultAuthenticationFlow.java:113)
at
org.keycloak.authentication.DefaultAuthenticationFlow.processAction(DefaultAuthenticationFlow.java:97)
at
org.keycloak.authentication.AuthenticationProcessor.authenticationAction(AuthenticationProcessor.java:873)
at
org.keycloak.services.resources.LoginActionsService.processFlow(LoginActionsService.java:292)
at
org.keycloak.services.resources.LoginActionsService.processAuthentication(LoginActionsService.java:263)
at
org.keycloak.services.resources.LoginActionsService.authenticate(LoginActionsService.java:259)
at
org.keycloak.services.resources.LoginActionsService.authenticateForm(LoginActionsService.java:320)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at
sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
at
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:498)
at
org.jboss.resteasy.core.MethodInjectorImpl.invoke(MethodInjectorImpl.java:140)
at
org.jboss.resteasy.core.ResourceMethodInvoker.internalInvokeOnTarget(ResourceMethodInvoker.java:510)
at
org.jboss.resteasy.core.ResourceMethodInvoker.invokeOnTargetAfterFilter(ResourceMethodInvoker.java:401)
at
org.jboss.resteasy.core.ResourceMethodInvoker.lambda$invokeOnTarget$0(ResourceMethodInvoker.java:365)
at
org.jboss.resteasy.core.interception.PreMatchContainerRequestContext.filter(PreMatchContainerRequestContext.java:361)
at
org.jboss.resteasy.core.ResourceMethodInvoker.invokeOnTarget(ResourceMethodInvoker.java:367)
at
org.jboss.resteasy.core.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:339)
at
org.jboss.resteasy.core.ResourceLocatorInvoker.invokeOnTargetObject(ResourceLocatorInvoker.java:137)
at
org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorInvoker.java:100)
at
org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:441)
at
org.jboss.resteasy.core.SynchronousDispatcher.lambda$invoke$4(SynchronousDispatcher.java:231)
at
org.jboss.resteasy.core.SynchronousDispatcher.lambda$preprocess$0(SynchronousDispatcher.java:137)
at
org.jboss.resteasy.core.interception.PreMatchContainerRequestContext.filter(PreMatchContainerRequestContext.java:361)
at
org.jboss.resteasy.core.SynchronousDispatcher.preprocess(SynchronousDispatcher.java:140)
at
org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:217)
at
org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.service(ServletContainerDispatcher.java:227)
at
org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:56)
at
org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:51)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:790)
at
io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:74)
at
io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:129)
at
org.keycloak.services.filters.KeycloakSessionServletFilter.doFilter(KeycloakSessionServletFilter.java:90)
at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61)
at
io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
at
io.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.java:84)
at
io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:62)
at
io.undertow.servlet.handlers.ServletChain$1.handleRequest(ServletChain.java:68)
at
io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36)
at
org.wildfly.extension.undertow.security.SecurityContextAssociationHandler.handleRequest(SecurityContextAssociationHandler.java:78)
at
io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
at
io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:132)
at
io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:57)
at
io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
at
io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:46)
at
io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64)
at
io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:60)
at
io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:77)
at
io.undertow.security.handlers.NotificationReceiverHandler.handleRequest(NotificationReceiverHandler.java:50)
at
io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43)
at
io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
at
org.wildfly.extension.undertow.security.jacc.JACCContextIdHandler.handleRequest(JACCContextIdHandler.java:61)
at
io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
at
org.wildfly.extension.undertow.deployment.GlobalRequestControllerHandler.handleRequest(GlobalRequestControllerHandler.java:68)
at
io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
at
io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:292)
at
io.undertow.servlet.handlers.ServletInitialHandler.access$100(ServletInitialHandler.java:81)
at
io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:138)
at
io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:135)
at
io.undertow.servlet.core.ServletRequestContextThreadSetupAction$1.call(ServletRequestContextThreadSetupAction.java:48)
at
io.undertow.servlet.core.ContextClassLoaderSetupAction$1.call(ContextClassLoaderSetupAction.java:43)
at
org.wildfly.extension.undertow.security.SecurityContextThreadSetupAction.lambda$create$0(SecurityContextThreadSetupAction.java:105)
at
org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1514)
at
org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1514)
at
org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1514)
at
org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1514)
at
io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:272)
at
io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:81)
at
io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:104)
at io.undertow.server.Connectors.executeRootHandler(Connectors.java:360)
at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:830)
at
org.jboss.threads.ContextClassLoaderSavingRunnable.run(ContextClassLoaderSavingRunnable.java:35)
at
org.jboss.threads.EnhancedQueueExecutor.safeRun(EnhancedQueueExecutor.java:1985)
at
org.jboss.threads.EnhancedQueueExecutor$ThreadBody.doRunTask(EnhancedQueueExecutor.java:1487)
at
org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1378)
at java.lang.Thread.run(Thread.java:748)
Caused by: org.hibernate.exception.JDBCConnectionException: could not
extract ResultSet
at
org.hibernate.exception.internal.SQLExceptionTypeDelegate.convert(SQLExceptionTypeDelegate.java:48)
at
org.hibernate.exception.internal.StandardSQLExceptionConverter.convert(StandardSQLExceptionConverter.java:42)
at
org.hibernate.engine.jdbc.spi.SqlExceptionHelper.convert(SqlExceptionHelper.java:111)
at
org.hibernate.engine.jdbc.spi.SqlExceptionHelper.convert(SqlExceptionHelper.java:97)
at
org.hibernate.engine.jdbc.internal.ResultSetReturnImpl.extract(ResultSetReturnImpl.java:79)
at org.hibernate.loader.Loader.getResultSet(Loader.java:2122)
at org.hibernate.loader.Loader.executeQueryStatement(Loader.java:1905)
at org.hibernate.loader.Loader.executeQueryStatement(Loader.java:1881)
at org.hibernate.loader.Loader.doQuery(Loader.java:925)
at
org.hibernate.loader.Loader.doQueryAndInitializeNonLazyCollections(Loader.java:342)
at org.hibernate.loader.Loader.doList(Loader.java:2622)
at org.hibernate.loader.Loader.doList(Loader.java:2605)
at org.hibernate.loader.Loader.listIgnoreQueryCache(Loader.java:2434)
at org.hibernate.loader.Loader.list(Loader.java:2429)
at org.hibernate.loader.hql.QueryLoader.list(QueryLoader.java:501)
at
org.hibernate.hql.internal.ast.QueryTranslatorImpl.list(QueryTranslatorImpl.java:370)
at
org.hibernate.engine.query.spi.HQLQueryPlan.performList(HQLQueryPlan.java:216)
at org.hibernate.internal.SessionImpl.list(SessionImpl.java:1339)
at org.hibernate.internal.QueryImpl.list(QueryImpl.java:87)
at org.hibernate.jpa.internal.QueryImpl.list(QueryImpl.java:606)
at org.hibernate.jpa.internal.QueryImpl.getResultList(QueryImpl.java:483)
... 83 more
Caused by: java.sql.SQLNonTransientConnectionException: (conn=476)
Connection is closed
at
org.mariadb.jdbc.internal.util.exceptions.ExceptionMapper.get(ExceptionMapper.java:175)
at
org.mariadb.jdbc.internal.util.exceptions.ExceptionMapper.getException(ExceptionMapper.java:110)
at
org.mariadb.jdbc.MariaDbStatement.executeExceptionEpilogue(MariaDbStatement.java:228)
at
org.mariadb.jdbc.MariaDbPreparedStatementClient.executeInternal(MariaDbPreparedStatementClient.java:216)
at
org.mariadb.jdbc.MariaDbPreparedStatementClient.execute(MariaDbPreparedStatementClient.java:150)
at org.mariadb.jdb
c.MariaDbPreparedStatementClient.executeQuery(MariaDbPreparedStatementClient.java:164)
at
org.jboss.jca.adapters.jdbc.WrappedPreparedStatement.executeQuery(WrappedPreparedStatement.java:504)
at
org.hibernate.engine.jdbc.internal.ResultSetReturnImpl.extract(ResultSetReturnImpl.java:70)
... 99 more
Caused by: java.sql.SQLException: Connection is closed
at
org.mariadb.jdbc.internal.protocol.AbstractQueryProtocol.cmdPrologue(AbstractQueryProtocol.java:1711)
at
org.mariadb.jdbc.internal.protocol.AbstractQueryProtocol.executeQuery(AbstractQueryProtocol.java:237)
at
org.mariadb.jdbc.MariaDbPreparedStatementClient.executeInternal(MariaDbPreparedStatementClient.java:209)
... 103 more
After a couple of seconds, the issue dissapeared, probably because Keycloak
was able to get a valid connection from the connection pool.
Thanks in advance for your help.
Greetings,
Cristi
5 years, 2 months
- 2
- 1
Re: [keycloak-user] Shared datastore?
by Sebastian Laskawiec
Yes, I think that could be case, I see a plenty of places where we
use SKIP_CACHE_STORE.
Let me ask Marek for help here since it has been implemented long before I
joined the team and I don't know the history behind it...
On Thu, Nov 8, 2018 at 8:48 PM William Burns <wburns(a)redhat.com> wrote:
>
>
> ----- Original Message -----
> > From: "Sebastian Laskawiec" <slaskawi(a)redhat.com>
> > To: "Nicolas Ocquidant" <nocquidant(a)gmail.com>
> > Cc: keycloak-user(a)lists.jboss.org, "Will Burns Rosenquist Burns" <
> wburns(a)redhat.com>
> > Sent: Thursday, November 8, 2018 12:33:47 PM
> > Subject: Re: [keycloak-user] Shared datastore?
> >
> > So I think there are at least two ways to address this problem. This
> first
> > one is to use Offline Tokens [1]. I'm not sure if that fits into your
> > application since it requires your client applications to store the
> token.
> > In other words you can simply delegate this problem one layer below in
> your
> > system.
> >
> > If that doesn't work for you, yes passivation is a way to go. Frankly, I
> > haven't used passivation but from the manual I see it works hand in hand
> > with eviction [2][3]. Will (on CC) can probably correct me here, but my
> > understanding is that whenever an entry gets evicted, the passivation
> > mechanism picks it up and stores somewhere.
>
> It does and it works, the problem is that passivation doesn't play well
> with shared stores in Infinispan. We prevent this configuration in 9.4 or
> newer even.
>
> I recommended that Nicolas just use eviction and a shared store without
> passivation. However it seems that entries are not written to the store in
> this configuration. My guess is that KeyCloak performs write operations
> with the SKIP_CACHE_STORE flag and assumes entries will only be written to
> the store due to passivation. Is there a reason for that?
>
> >
> > [1] http://blog.keycloak.org/2015/12/offline-tokens-in-keycloak.html
> > [2]
> >
> http://infinispan.org/docs/stable/user_guide/user_guide.html#cache_passiv...
> > [3]
> >
> https://github.com/infinispan/infinispan/blob/master/core/src/test/java/o...
> >
> > On Thu, Nov 8, 2018 at 5:40 PM Nicolas Ocquidant <nocquidant(a)gmail.com>
> > wrote:
> >
> > > My requirements are the following: store tokens emitted by KC during
> one
> > > year.
> > >
> > > I don't know how many users there are, but here are the number I get:
> > > * the number of connections a week is about 700k.
> > > * the number of session refresh a week is about 200k.
> > >
> > > I approximated around 1M of sessions a week, thus 52M a year.
> > > In memory, a user session has been estimated around 4KB (about 1KB in
> > > file/DB).
> > >
> > > But I guess a refresh does not create another session isn't it? And
> maybe
> > > it's possible to ask KC to delete previous emitted tokens when a new
> one is
> > > created for a same user?
> > >
> > > If yes, my estimation is probably a little bit too high here, but I
> > > certainly have several millions of tokens to keep (and maybe dozens of
> > > millions).
> > >
> > > Thanks
> > > --nick
> > >
> > > Le mer. 7 nov. 2018 à 18:17, Nicolas Ocquidant <nocquidant(a)gmail.com>
> a
> > > écrit :
> > >
> > > > Hi,
> > > >
> > > > According to Infinispan, when passivation is disabled, every update
> to
> > > the
> > > > cache should always write to the store.
> > > >
> > > > But I can't manage to get it work with Keycloak. If I disable
> > > passivation,
> > > > my SQL store (Postgres) stays empty, even if the cache is full.
> > > >
> > > > So, if passivation is needed for Keycloak to write to the DB, it
> means
> > > > that the use of a shared DB is not possible...
> > > >
> > > > But this leads to another issue for me. Enable passivation without a
> > > > shared DB seems to imply that either 'fetch-state' or 'purge' should
> be
> > > > enabled on startup, in order for the cache to not contain stale
> entries.
> > > >
> > > > 15:27:44,626 WARN
> > > >
> [org.infinispan.configuration.cache.AbstractStoreConfigurationBuilder]
> > > (MSC
> > > > service thread 1-6) ISPN000149: Fetch persistent state and purge on
> > > startup
> > > > are both disabled, cache may contain stale entries on startup
> > > >
> > > > As I need to keep millions of sessions, this will considerably slow
> down
> > > > the startup of my node (when started again after a crash for
> instance).
> > > >
> > > > So, is shared datastore allowed in Keycloak? If yes, how to enable
> it?
> > > > Otherwise what other options do I have to improve my startup time, if
> > > > millions of sessions are in the store?
> > > >
> > > > Thanks
> > > > --nick
> > > >
> > > _______________________________________________
> > > keycloak-user mailing list
> > > keycloak-user(a)lists.jboss.org
> > > https://lists.jboss.org/mailman/listinfo/keycloak-user
> >
>
5 years, 3 months
- 4
- 3
Re : Setting authentication execution requirement via kcadm.sh?
by triton oidc
Hi Craig,
i'm not an expert, but here is what i did to set my execution value to
REQUIRED :
create a json with
{"id":[ID_OF_YOUR_EXECUTION],"requirement":"REQUIRED"}
put it in a file my_file.json
you can have the id of you execution using this command
./kcadm.sh get authentication/flows/[your_flow]/executions --format csv -r
$keycloak_new_realm --fields id | tr -d '\n'
and you can import the file using this command :
./kcadm.sh update authentication/flows/[your_flow]/executions -r
$keycloak_new_realm -f my_file.json
There is probably a better way but i didn't found it
hope it helps
Amaury
On Mon, Oct 15, 2018 at 1:07 PM <keycloak-user-request(a)lists.jboss.org>
wrote:
> Send keycloak-user mailing list submissions to
> keycloak-user(a)lists.jboss.org
>
> To subscribe or unsubscribe via the World Wide Web, visit
> https://lists.jboss.org/mailman/listinfo/keycloak-user
> or, via email, send a message with subject or body 'help' to
> keycloak-user-request(a)lists.jboss.org
>
> You can reach the person managing the list at
> keycloak-user-owner(a)lists.jboss.org
>
> When replying, please edit your Subject line so it is more specific
> than "Re: Contents of keycloak-user digest..."
>
>
> Today's Topics:
>
> 1. Setting authentication execution requirement via kcadm.sh?
> (Craig Setera)
> 2. org.keycloak.broker.oidc.mappers.ClaimToRoleMapper does not
> update user roles (Philippe Gauthier)
> 3. Re: Unrecognized field "authenticationFlowBindingOverrides"
> (Fabio Ebner)
>
>
> ----------------------------------------------------------------------
>
> Message: 1
> Date: Mon, 15 Oct 2018 07:21:30 -0500
> From: Craig Setera <craig(a)baseventure.com>
> Subject: [keycloak-user] Setting authentication execution requirement
> via kcadm.sh?
> To: keycloak-user(a)lists.jboss.org
> Message-ID:
> <
> CAPVdwjq1oyjCom4_A0TBJ8m3KBCgit5nOqMCGqKP4t2RU6zb5Q(a)mail.gmail.com>
> Content-Type: text/plain; charset="UTF-8"
>
> I'm trying to figure out if it is possible to set the "requirement" level
> of an execution that is created for an authentication flow via the kcadm
> tool. I have a shell script that I'm using to set up the Keycloak
> configuration that looks like the following:
>
>
> *echo "Creating new authentication flow..."AUTO_LINK_FLOW_ID=`${KCADM}
> create authentication/flows --id -r ${REALM_NAME} -s
> alias="FirstBrokerLoginAutoLink" -s providerId="basic-flow" -s
> topLevel=true`*
>
>
>
> *echo "Adding unique authenticator..."${KCADM} create
> authentication/flows/FirstBrokerLoginAutoLink/executions/execution --id -r
> ${REALM_NAME} \ -s provider=idp-create-user-if-unique -s
> requirement=ALTERNATIVE -s priority=10*
>
>
>
>
> *echo "Adding auto link authenticator..."${KCADM} create
> authentication/flows/FirstBrokerLoginAutoLink/executions/execution -r
> ${REALM_NAME} \ -s provider=idp-auto-link -s requirement=ALTERNATIVE -s
> priority=20*
> With this script, I'm seeing the flow and executions created, but the
> requirement seems to be ignored. In this case, the executions are always
> set to DISABLED. I've tried to follow that up with an update call that
> looks like this:
>
>
>
>
>
>
> *echo "Adding unique authenticator..."EXECUTION_ID=`${KCADM} create
> authentication/flows/FirstBrokerLoginAutoLink/executions/execution --id -r
> ${REALM_NAME} \ -s provider=idp-create-user-if-unique -s
> requirement=ALTERNATIVE -s priority=10`${KCADM} update
> authentication/flows/FirstBrokerLoginAutoLink/executions -r ${REALM_NAME}
> \ -s id=${EXECUTION_ID} -s requirement=ALTERNATIVE*
>
> However, that is failing with the following error:
>
>
>
> *HTTP request error: Can not deserialize instance of
> com.fasterxml.jackson.databind.node.ObjectNode out of START_ARRAY tokenat
> [Source: [B@527ee8a7; line: 1, column: 1]*
> Can anyone offer any suggestions on how to get this authentication flow
> properly configured so that the executions are set to ALTERNATIVE?
>
> Thanks!
> Craig
>
> =================================
> *Craig Setera*
>
> *Chief Technology Officer*
>
>
> ------------------------------
>
> Message: 2
> Date: Mon, 15 Oct 2018 12:45:04 +0000
> From: Philippe Gauthier <philippe.gauthier(a)inspq.qc.ca>
> Subject: [keycloak-user]
> org.keycloak.broker.oidc.mappers.ClaimToRoleMapper does not update
> user roles
> To: "keycloak-user(a)lists.jboss.org" <keycloak-user(a)lists.jboss.org>
> Cc: ?tienne Sadio <etienne.sadio(a)inspq.qc.ca>
> Message-ID:
> <
> YTOPR0101MB141798E50DFEF73BB8C32857B1FD0(a)YTOPR0101MB1417.CANPRD01.PROD.OUTLOOK.COM
> >
>
> Content-Type: text/plain; charset="iso-8859-1"
>
> Hi
>
>
> I saw a 2017 post from Simon Payne about ClaimToRoleMapper and I cannot
> find any answers for his question.
>
> http://lists.jboss.org/pipermail/keycloak-user/2017-October/012129.html
>
>
> This post was about ClaimToRoleMapper class of the OIDC broker component.
> This class search for a claim, check for its value and grant a role if the
> value is equals to the value specified in the configuration.
>
>
> If the user from the IdP is not known by Keycloak, it will be created by
> the First Broker Login Flow and the role will be granted.
>
>
> If the user is already known by Keycloak, he have the role specified by
> the mapper and he don't have the claim anymore, the role will be revocated.
>
>
> But. If the user is known by Keycloak, he don't have the role specified by
> the mapper and he have the claim, Keycloak does not grant him the role.
>
>
> It is clear why it does this in the code but it is not clear why this have
> been done that way:
>
>
> Here is the code.
>
> @Override
> public void importNewUser(KeycloakSession session, RealmModel realm,
> UserModel user, IdentityProviderMapperModel mapperModel,
> BrokeredIdentityContext context) {
> String roleName = mapperModel.getConfig().get(ConfigConstants.ROLE);
> if (hasClaimValue(mapperModel, context)) {
> RoleModel role = KeycloakModelUtils.getRoleFromString(realm,
> roleName);
> if (role == null) throw new IdentityBrokerException("Unable to
> find role: " + roleName);
> user.grantRole(role);
> }
> }
>
> @Override
> public void updateBrokeredUser(KeycloakSession session, RealmModel
> realm, UserModel user, IdentityProviderMapperModel mapperModel,
> BrokeredIdentityContext context) {
> String roleName = mapperModel.getConfig().get(ConfigConstants.ROLE);
> if (!hasClaimValue(mapperModel, context)) {
> RoleModel role = KeycloakModelUtils.getRoleFromString(realm,
> roleName);
> if (role == null) throw new IdentityBrokerException("Unable to
> find role: " + roleName);
> user.deleteRoleMapping(role);
> }
> /* Maybe we should add an else here that does what the importNewUser
> does.
> }
> Thankyou
>
> Philippe Gauthier.
>
>
>
> ------------------------------
>
> Message: 3
> Date: Mon, 15 Oct 2018 09:53:48 -0300
> From: Fabio Ebner <fabio.ebner(a)lumera.com.br>
> Subject: Re: [keycloak-user] Unrecognized field
> "authenticationFlowBindingOverrides"
> To: Marek Posolda <mposolda(a)redhat.com>
> Cc: keycloak-user(a)lists.jboss.org
> Message-ID:
> <
> CAFxMZba+qwDnfkrggWXn6U+iY_hZYpMJ0CzMYvrtYgMmL3rQ9g(a)mail.gmail.com>
> Content-Type: text/plain; charset="UTF-8"
>
> Marek tks I was using a old version in my pom. but after I put the correct
> 4.5.0.Final when I try to start my project throw an exception:
>
> Caused by: java.lang.NoClassDefFoundError:
> org/springframework/boot/web/server/WebServerFactoryCustomizer
>
> Look in the google say that class are only in springboot > 2 so I update my
> project to Springboot 2.0.5.Final, now my project start but when I try to
> access any url I got the error:
>
> in a loop:
>
>
>
> at
>
> org.keycloak.adapters.springboot.KeycloakSpringBootConfigResolver.resolve(KeycloakSpringBootConfigResolver.java:45)
> ~[keycloak-spring-boot-adapter-core-4.5.0.Final.jar:4.5.0.Final]
> at
>
> org.keycloak.adapters.springboot.KeycloakSpringBootConfigResolver.resolve(KeycloakSpringBootConfigResolver.java:45)
> ~[keycloak-spring-boot-adapter-core-4.5.0.Final.jar:4.5.0.Final]
> at
>
> org.keycloak.adapters.springboot.KeycloakSpringBootConfigResolver.resolve(KeycloakSpringBootConfigResolver.java:45)
> ~[keycloak-spring-boot-adapter-core-4.5.0.Final.jar:4.5.0.Final]
> at
>
> org.keycloak.adapters.springboot.KeycloakSpringBootConfigResolver.resolve(KeycloakSpringBootConfigResolver.java:45)
> ~[keycloak-spring-boot-adapter-core-4.5.0.Final.jar:4.5.0.Final]
>
> 2018-10-15 09:50:12.363 ERROR 20936 --- [nio-8081-exec-2]
> o.a.c.c.C.[Tomcat].[localhost] : Exception Processing
> /favicon.ico
>
> java.lang.StackOverflowError: null
> at
>
> org.keycloak.adapters.springboot.KeycloakSpringBootConfigResolver.resolve(KeycloakSpringBootConfigResolver.java:45)
> ~[keycloak-spring-boot-adapter-core-4.5.0.Final.jar:4.5.0.Final]
> at
>
> org.keycloak.adapters.springboot.KeycloakSpringBootConfigResolver.resolve(KeycloakSpringBootConfigResolver.java:45)
> ~[keycloak-spring-boot-adapter-core-4.5.0.Final.jar:4.5.0.Final]
> at or
>
> .....
> at
>
> org.keycloak.adapters.springboot.KeycloakSpringBootConfigResolver.resolve(KeycloakSpringBootConfigResolver.java:45)
> ~[keycloak-spring-boot-adapter-core-4.5.0.Final.jar:4.5.0.Final]
> at
>
> org.keycloak.adapters.springboot.KeycloakSpringBootConfigResolver.resolve(KeycloakSpringBootConfigResolver.java:45)
> ~[keycloak-spring-boot-adapter-core-4.5.0.Final.jar:4.5.0.Final]
> at
>
> org.keycloak.adapters.springboot.KeycloakSpringBootConfigResolver.resolve(KeycloakSpringBootConfigResolver.java:45)
> ~[keycloak-spring-boot-adapter-core-4.5.0.Final.jar:4.5.0.Final]
>
> 2018-10-15 09:50:12.387 ERROR 20936 --- [nio-8081-exec-2]
> o.a.c.c.C.[.[.[/].[dispatcherServlet] : Servlet.service() for servlet
> [dispatcherServlet] threw exception
>
> java.lang.StackOverflowError: null
> at
>
> org.keycloak.adapters.springboot.KeycloakSpringBootConfigResolver.resolve(KeycloakSpringBootConfigResolver.java:45)
> ~[keycloak-spring-boot-adapter-core-4.5.0.Final.jar:4.5.0.Final]
> at
>
> org.keycloak.adapters.springboot.KeycloakSpringBootConfigResolver.resolve(KeycloakSpringBootConfigResolver.java:45)
> ~[keycloak-spring-boot-adapter-core-4.5.0.Final.jar:4.5.0.Final]
> at
>
> org.keycloak.adapters.springboot.KeycloakSpringBootConfigResolver.resolve(KeycloakSpringBootConfigResolver.java:45)
> ~[keycloak-spring-boot-adapter-core-4.5.0.Final.jar:4.5.0.Final]
> at
>
> org.keycloak.adapters.springboot.KeycloakSpringBootConfigResolver.resolve(KeycloakSpringBootConfigResolver.java:45)
> ~[keycloak-spring-boot-adapter-core-4.5.0.Final.jar:4.5.0.Final]
> at
>
> org.keycloak.adapters.springboot.KeycloakSpringBootConfigResolver.resolve(KeycloakSpringBootConfigResolver.java:45)
> ~[keycloak-spring-boot-adapter-core-4.5.0.Final.jar:4.5.0.Final]
> at
>
> org.keycloak.adapters.springboot.KeycloakSpringBootConfigResolver.resolve(KeycloakSpringBootConfigResolver.java:45)
> ~[keycloak-spring-boot-adapter-core-4.5.0.Final.jar:4.5.0.Final]
> ......
>
> at
>
> org.keycloak.adapters.springboot.KeycloakSpringBootConfigResolver.resolve(KeycloakSpringBootConfigResolver.java:45)
> ~[keycloak-spring-boot-adapter-core-4.5.0.Final.jar:4.5.0.Final]
> at
>
> org.keycloak.adapters.springboot.KeycloakSpringBootConfigResolver.resolve(KeycloakSpringBootConfigResolver.java:45)
> ~[keycloak-spring-boot-adapter-core-4.5.0.Final.jar:4.5.0.Final]
> at
>
> org.keycloak.adapters.springboot.KeycloakSpringBootConfigResolver.resolve(KeycloakSpringBootConfigResolver.java:45)
> ~[keycloak-spring-boot-adapter-core-4.5.0.Final.jar:4.5.0.Final]
>
> 2018-10-15 09:50:12.399 ERROR 20936 --- [nio-8081-exec-2]
> o.a.c.c.C.[Tomcat].[localhost] : Exception Processing
> ErrorPage[errorCode=0, location=/error]
>
> javax.servlet.ServletException: Filter execution threw an exception
> at
>
> org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:200)
> ~[tomcat-embed-core-8.5.34.jar:8.5.34]
> at
>
> org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
> ~[tomcat-embed-core-8.5.34.jar:8.5.34]
> at
>
> org.apache.catalina.core.ApplicationDispatcher.invoke(ApplicationDispatcher.java:728)
> ~[tomcat-embed-core-8.5.34.jar:8.5.34]
> at
>
> org.apache.catalina.core.ApplicationDispatcher.processRequest(ApplicationDispatcher.java:472)
> ~[tomcat-embed-core-8.5.34.jar:8.5.34]
> at
>
> org.apache.catalina.core.ApplicationDispatcher.doForward(ApplicationDispatcher.java:395)
> ~[tomcat-embed-core-8.5.34.jar:8.5.34]
> at
>
> org.apache.catalina.core.ApplicationDispatcher.forward(ApplicationDispatcher.java:316)
> ~[tomcat-embed-core-8.5.34.jar:8.5.34]
> at
>
> org.apache.catalina.core.StandardHostValve.custom(StandardHostValve.java:395)
> [tomcat-embed-core-8.5.34.jar:8.5.34]
> at
>
> org.apache.catalina.core.StandardHostValve.status(StandardHostValve.java:254)
> [tomcat-embed-core-8.5.34.jar:8.5.34]
> at
>
> org.apache.catalina.core.StandardHostValve.throwable(StandardHostValve.java:349)
> [tomcat-embed-core-8.5.34.jar:8.5.34]
> at
>
> org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:155)
> [tomcat-embed-core-8.5.34.jar:8.5.34]
> at
>
> org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:81)
> [tomcat-embed-core-8.5.34.jar:8.5.34]
> at
>
> org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:87)
> [tomcat-embed-core-8.5.34.jar:8.5.34]
> at
> org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:342)
> [tomcat-embed-core-8.5.34.jar:8.5.34]
> at
> org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:800)
> [tomcat-embed-core-8.5.34.jar:8.5.34]
> at
>
> org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:66)
> [tomcat-embed-core-8.5.34.jar:8.5.34]
> at
>
> org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:806)
> [tomcat-embed-core-8.5.34.jar:8.5.34]
> at
> org.apache.tomcat.util.net
> .NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1498)
> [tomcat-embed-core-8.5.34.jar:8.5.34]
> at
> org.apache.tomcat.util.net
> .SocketProcessorBase.run(SocketProcessorBase.java:49)
> [tomcat-embed-core-8.5.34.jar:8.5.34]
> at
>
> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
> [na:1.8.0_162]
> at
>
> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
> [na:1.8.0_162]
> at
>
> org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
> [tomcat-embed-core-8.5.34.jar:8.5.34]
> at java.lang.Thread.run(Thread.java:748) [na:1.8.0_162]
> Caused by: java.lang.StackOverflowError: null
> at
>
> org.keycloak.adapters.springboot.KeycloakSpringBootConfigResolver.resolve(KeycloakSpringBootConfigResolver.java:45)
> ~[keycloak-spring-boot-adapter-core-4.5.0.Final.jar:4.5.0.Final]
> at
>
> org.keycloak.adapters.springboot.KeycloakSpringBootConfigResolver.resolve(KeycloakSpringBootConfigResolver.java:45)
> ~[keycloak-spring-boot-adapter-core-4.5.0.Final.jar:4.5.0.Final]
> at
>
> org.keycloak.adapters.springboot.KeycloakSpringBootConfigResolver.resolve(KeycloakSpringBootConfigResolver.java:45)
> ~[keycloak-spring-boot-adapter-core-4.5.0.Final.jar:4.5.0.Final]
> at
>
> org.keycloak.adapters.springboot.KeycloakSpringBootConfigResolver.resolve(KeycloakSpringBootConfigResolver.java:45)
> ~[keycloak-spring-boot-adapter-core-4.5.0.Final.jar:4.5.0.Final]
> at
>
> org.keycloak.adapters.springboot.KeycloakSpringBootConfigResolver.resolve(KeycloakSpringBootConfigResolver.java:45)
> ~[keycloak-spring-boot-adapter-core-4.5.0.Final.jar:4.5.0.Final]
> at
>
> org.keycloak.adapters.springboot.KeycloakSpringBootConfigResolver.resolve(KeycloakSpringBootConfigResolver.java:45)
> ~[keycloak-spring-boot-adapter-core-4.5.0.Final.jar:4.5.0.Final]
> at
>
> org.keycloak.adapters.springboot.KeycloakSpringBootConfigResolver.resolve(KeycloakSpringBootConfigResolver.java:45)
> ~[keycloak-spring-boot-adapter-core-4.5.0.Final.jar:4.5.0.Final]
> at
>
> org.keycloak.adapters.springboot.KeycloakSpringBootConfigResolver.resolve(KeycloakSpringBootConfigResolver.java:45)
> ~[keycloak-spring-boot-adapter-core-4.5.0.Final.jar:4.5.0.Final]
> at
>
> org.keycloak.adapters.springboot.KeycloakSpringBootConfigResolver.resolve(KeycloakSpringBootConfigResolver.java:45)
> ~[keycloak-spring-boot-adapter-core-4.5.0.Final.jar:4.5.0.Final]
> at
>
> org.keycloak.adapters.springboot.KeycloakSpringBootConfigResolver.resolve(KeycloakSpringBootConfigResolver.java:45)
> ~[keycloak-spring-boot-adapter-core-4.5.0.Final.jar:4.5.0.Final]
> at
>
> org.keycloak.adapters.springboot.KeycloakSpringBootConfigResolver.resolve(KeycloakSpringBootConfigResolver.java:45)
> ~[keycloak-spring-boot-adapter-core-4.5.0.Final.jar:4.5.0.Final]
> at
>
> org.keycloak.adapters.springboot.KeycloakSpringBootConfigResolver.resolve(KeycloakSpringBootConfigResolver.java:45)
> ~[keycloak-spring-boot-adapter-core-4.5.0.Final.jar:4.5.0.Final]
> at
>
> org.keycloak.adapters.springboot.KeycloakSpringBootConfigResolver.resolve(KeycloakSpringBootConfigResolver.java:45)
> ~[keycloak-spring-boot-adapter-core-4.5.0.Final.jar:4.5.0.Final]
> at
>
> org.keycloak.adapters.springboot.KeycloakSpringBootConfigResolver.resolve(KeycloakSpringBootConfigResolver.java:45)
> ~[keycloak-spring-boot-adapter-core-4.5.0.Final.jar:4.5.0.Final]
> at
>
> org.keycloak.adapters.springboot.KeycloakSpringBootConfigResolver.resolve(KeycloakSpringBootConfigResolver.java:45)
> ~[keycloak-spring-boot-adapter-core-4.5.0.Final.jar:4.5.0.Final]
> at
>
> org.keycloak.adapters.springboot.KeycloakSpringBootConfigResolver.resolve(KeycloakSpringBootConfigResolver.java:45)
> ~[keycloak-spring-boot-adapter-core-4.5.0.Final.jar:4.5.0.Final]
> at
>
> org.keycloak.adapters.springboot.KeycloakSpringBootConfigResolver.resolve(KeycloakSpringBootConfigResolver.java:45)
> ~[keycloak-spring-boot-adapter-core-4.5.0.Final.jar:4.5.0.Final]
> at
>
> org.keycloak.adapters.springboot.KeycloakSpringBootConfigResolver.resolve(KeycloakSpringBootConfigResolver.java:45)
> ~[keycloak-spring-boot-adapter-core-4.5.0.Final.jar:4.5.0.Final]
> at
>
> org.keycloak.adapters.springboot.KeycloakSpringBootConfigResolver.resolve(KeycloakSpringBootConfigResolver.java:45)
> ~[keycloak-spring-boot-adapter-core-4.5.0.Final.jar:4.5.0.Final]
> at
>
> org.keycloak.adapters.springboot.KeycloakSpringBootConfigResolver.resolve(KeycloakSpringBootConfigResolver.java:45)
> ~[keycloak-spring-boot-adapter-core-4.5.0.Final.jar:4.5.0.Final]
> at
>
> org.keycloak.adapters.springboot.KeycloakSpringBootConfigResolver.resolve(KeycloakSpringBootConfigResolver.java:45)
> ~[keycloak-spring-boot-adapter-core-4.5.0.Final.jar:4.5.0.Final]
> at
>
> org.keycloak.adapters.springboot.KeycloakSpringBootConfigResolver.resolve(KeycloakSpringBootConfigResolver.java:45)
> ~[keycloak-spring-boot-adapter-core-4.5.0.Final.jar:4.5.0.Final]
> at
>
> org.keycloak.adapters.springboot.KeycloakSpringBootConfigResolver.resolve(KeycloakSpringBootConfigResolver.java:45)
> ~[keycloak-spring-boot-adapter-core-4.5.0.Final.jar:4.5.0.Final]
> at
>
> org.keycloak.adapters.springboot.KeycloakSpringBootConfigResolver.resolve(KeycloakSpringBootConfigResolver.java:45)
> ~[keycloak-spring-boot-adapter-core-4.5.0.Final.jar:4.5.0.Final]
> at
>
> org.keycloak.adapters.springboot.KeycloakSpringBootConfigResolver.resolve(KeycloakSpringBootConfigResolver.java:45)
> ~[keycloak-spring-boot-adapter-core-4.5.0.Final.jar:4.5.0.Final]
> at
>
> org.keycloak.adapters.springboot.KeycloakSpringBootConfigResolver.resolve(KeycloakSpringBootConfigResolver.java:45)
> ~[keycloak-spring-boot-adapter-core-4.5.0.Final.jar:4.5.0.Final]
> at
>
> org.keycloak.adapters.springboot.KeycloakSpringBootConfigResolver.resolve(KeycloakSpringBootConfigResolver.java:45)
> ~[keycloak-spring-boot-adapter-core-4.5.0.Final.jar:4.5.0.Final]
> at
>
> org.keycloak.adapters.springboot.KeycloakSpringBootConfigResolver.resolve(KeycloakSpringBootConfigResolver.java:45)
> ~[keycloak-spring-boot-adapter-core-4.5.0.Final.jar:4.5.0.Final]
> at
>
> org.keycloak.adapters.springboot.KeycloakSpringBootConfigResolver.resolve(KeycloakSpringBootConfigResolver.java:45)
> ~[keycloak-spring-boot-adapter-core-4.5.0.Final.jar:4.5.0.Final]
> at
>
> org.keycloak.adapters.springboot.KeycloakSpringBootConfigResolver.resolve(KeycloakSpringBootConfigResolver.java:45)
> ~[keycloak-spring-boot-adapter-core-4.5.0.Final.jar:4.5.0.Final]
> at
>
> org.keycloak.adapters.springboot.KeycloakSpringBootConfigResolver.resolve(KeycloakSpringBootConfigResolver.java:45)
> ~[keycloak-spring-boot-adapter-core-4.5.0.Final.jar:4.5.0.Final]
> ....
> at
>
> org.keycloak.adapters.springboot.KeycloakSpringBootConfigResolver.resolve(KeycloakSpringBootConfigResolver.java:45)
> ~[keycloak-spring-boot-adapter-core-4.5.0.Final.jar:4.5.0.Final]
> at
>
> org.keycloak.adapters.springboot.KeycloakSpringBootConfigResolver.resolve(KeycloakSpringBootConfigResolver.java:45)
> ~[keycloak-spring-boot-adapter-core-4.5.0.Final.jar:4.5.0.Final]
> at
>
> org.keycloak.adapters.springboot.KeycloakSpringBootConfigResolver.resolve(KeycloakSpringBootConfigResolver.java:45)
> ~[keycloak-spring-boot-adapter-core-4.5.0.Final.jar:4.5.0.Final]
>
> 2018-10-15 09:50:12.425 ERROR 20936 --- [nio-8081-exec-2]
> o.a.c.c.C.[.[.[/].[dispatcherServlet] : Servlet.service() for servlet
> [dispatcherServlet] threw exception
>
> java.lang.StackOverflowError: null
> at
>
> org.keycloak.adapters.springboot.KeycloakSpringBootConfigResolver.resolve(KeycloakSpringBootConfigResolver.java:45)
> ~[keycloak-spring-boot-adapter-core-4.5.0.Final.jar:4.5.0.Final]
> at
>
> org.keycloak.adapters.springboot.KeycloakSpringBootConfigResolver.resolve(KeycloakSpringBootConfigResolver.java:45)
> ~[keycloak-spring-boot-adapter-core-4.5.0.Final.jar:4.5.0.Final]
> at
>
> org.keycloak.adapters.springboot.KeycloakSpringBootConfigResolver.resolve(KeycloakSpringBootConfigResolver.java:45)
> ~[keycloak-spring-boot-adapter-core-4.5.0.Final.jar:4.5.0.Final]
> at org.keycloak.ada
> ....
> at
>
> org.keycloak.adapters.springboot.KeycloakSpringBootConfigResolver.resolve(KeycloakSpringBootConfigResolver.java:45)
> ~[keycloak-spring-boot-adapter-core-4.5.0.Final.jar:4.5.0.Final]
>
> 2018-10-15 09:50:12.437 ERROR 20936 --- [nio-8081-exec-2]
> o.a.c.c.C.[Tomcat].[localhost] : Exception Processing
> ErrorPage[errorCode=0, location=/error]
>
> javax.servlet.ServletException: Filter execution threw an exception
> at
>
> org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:200)
> ~[tomcat-embed-core-8.5.34.jar:8.5.34]
> at
>
> org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
> ~[tomcat-embed-core-8.5.34.jar:8.5.34]
> at
>
> org.apache.catalina.core.ApplicationDispatcher.invoke(ApplicationDispatcher.java:728)
> ~[tomcat-embed-core-8.5.34.jar:8.5.34]
> at
>
> org.apache.catalina.core.ApplicationDispatcher.processRequest(ApplicationDispatcher.java:472)
> ~[tomcat-embed-core-8.5.34.jar:8.5.34]
> at
>
> org.apache.catalina.core.ApplicationDispatcher.doForward(ApplicationDispatcher.java:395)
> ~[tomcat-embed-core-8.5.34.jar:8.5.34]
> at
>
> org.apache.catalina.core.ApplicationDispatcher.forward(ApplicationDispatcher.java:316)
> ~[tomcat-embed-core-8.5.34.jar:8.5.34]
> at
>
> org.apache.catalina.core.StandardHostValve.custom(StandardHostValve.java:395)
> [tomcat-embed-core-8.5.34.jar:8.5.34]
> at
>
> org.apache.catalina.core.StandardHostValve.status(StandardHostValve.java:254)
> [tomcat-embed-core-8.5.34.jar:8.5.34]
> at
>
> org.apache.catalina.core.StandardHostValve.throwable(StandardHostValve.java:349)
> [tomcat-embed-core-8.5.34.jar:8.5.34]
> at
>
> org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:175)
> [tomcat-embed-core-8.5.34.jar:8.5.34]
> at
>
> org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:81)
> [tomcat-embed-core-8.5.34.jar:8.5.34]
> at
>
> org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:87)
> [tomcat-embed-core-8.5.34.jar:8.5.34]
> at
> org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:342)
> [tomcat-embed-core-8.5.34.jar:8.5.34]
> at
> org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:800)
> [tomcat-embed-core-8.5.34.jar:8.5.34]
> at
>
> org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:66)
> [tomcat-embed-core-8.5.34.jar:8.5.34]
> at
>
> org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:806)
> [tomcat-embed-core-8.5.34.jar:8.5.34]
> at
> org.apache.tomcat.util.net
> .NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1498)
> [tomcat-embed-core-8.5.34.jar:8.5.34]
> at
> org.apache.tomcat.util.net
> .SocketProcessorBase.run(SocketProcessorBase.java:49)
> [tomcat-embed-core-8.5.34.jar:8.5.34]
> at
>
> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
> [na:1.8.0_162]
> at
>
> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
> [na:1.8.0_162]
> at
>
> org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
> [tomcat-embed-core-8.5.34.jar:8.5.34]
> at java.lang.Thread.run(Thread.java:748) [na:1.8.0_162]
> Caused by: java.lang.StackOverflowError: null
> at
>
> org.keycloak.adapters.springboot.KeycloakSpringBootConfigResolver.resolve(KeycloakSpringBootConfigResolver.java:45)
> ~[keycloak-spring-boot-adapter-core-4.5.0.Final.jar:4.5.0.Final]
> at
>
> org.keycloak.adapters.springboot.KeycloakSpringBootConfigResolver.resolve(KeycloakSpringBootConfigResolver.java:45)
> ~[keycloak-spring-boot-adapter-core-4.5.0.Final.jar:4.5.0.Final]
> at
>
> org.keycloak.adapters.springboot.KeycloakSpringBootConfigResolver.resolve(KeycloakSpringBootConfigResolver.java:45)
> ~[keycloak-spring-boot-adapter-core-4.5.0.Final.jar:4.5.0.Final]
> at
>
> org.keycloak.adapters.springboot.KeycloakSpringBootConfigResolver.resolve(KeycloakSpringBootConfigResolver.java:45)
> ~[keycloak-spring-boot-adapter-core-4.5.0.Final.jar:4.5.0.Final]
> at org.key
>
>
>
> Em seg, 15 de out de 2018 ?s 04:19, Marek Posolda <mposolda(a)redhat.com>
> escreveu:
>
> > I think the field "authenticationFlowBindingOverrides" was added in some
> > Keycloak 4.X version. I suggest to update Keycloak dependencies versions
> > in your pom from 3.4.3.Final to same version, which your Keycloak server
> > is.
> >
> > Marek
> >
> > On 13/10/18 04:18, Fabio Ebner wrote:
> > > When I try to get my client wit this code:
> > >
> > > ClientRepresentation app1Client =
> > > realmResource.clients().findByClientId("central-api").get(0);
> > >
> > >
> > > that error return:
> > >
> > > javax.ws.rs.client.ResponseProcessingException:
> > > javax.ws.rs.ProcessingException:
> > > com.fasterxml.jackson.databind.exc.UnrecognizedPropertyException:
> > > Unrecognized field "authenticationFlowBindingOverrides" (class
> > > org.keycloak.representations.idm.ClientRepresentation), not marked as
> > > ignorable (38 known properties: "enabled", "clientAuthenticatorType",
> > > "redirectUris", "clientId", "authorizationServicesEnabled", "name",
> > > "implicitFlowEnabled", "registeredNodes", "nodeReRegistrationTimeout",
> > > "publicClient", "attributes", "protocol", "webOrigins",
> > "protocolMappers",
> > > "id", "baseUrl", "surrogateAuthRequired", "adminUrl",
> "fullScopeAllowed",
> > > "frontchannelLogout", "clientTemplate", "directGrantsOnly", "rootUrl",
> > > "secret", "useTemplateMappers", "notBefore", "useTemplateScope",
> > > "standardFlowEnabled", "description", "directAccessGrantsEnabled",
> > > "useTemplateConfig", "serviceAccountsEnabled", "consentRequired",
> > "access",
> > > "bearerOnly", "registrationAccessToken", "defaultRoles",
> > > "authorizationSettings"])
> > >
> > >
> > >
> > > this is my pom.
> > >
> > > <!--keycloak-->
> > > <dependency>
> > > <groupId>org.keycloak</groupId>
> > > <artifactId>keycloak-spring-security-adapter</artifactId>
> > > <version>3.4.3.Final</version>
> > > </dependency>
> > > <dependency>
> > > <groupId>org.keycloak</groupId>
> > > <artifactId>keycloak-spring-boot-starter</artifactId>
> > > <version>3.4.3.Final</version>
> > > </dependency>
> > > <dependency>
> > > <groupId>org.keycloak</groupId>
> > > <artifactId>keycloak-admin-client</artifactId>
> > > <version>3.4.3.Final</version>
> > > </dependency>
> > > <dependency>
> > > <groupId>javax.ws.rs</groupId>
> > > <artifactId>javax.ws.rs-api</artifactId>
> > > <version>2.1</version>
> > > </dependency>
> > > <!--resteasy-->
> > > <dependency>
> > > <groupId>org.jboss.resteasy</groupId>
> > > <artifactId>resteasy-client</artifactId>
> > > <version>3.1.3.Final</version>
> > > </dependency>
> > > <dependency>
> > > <groupId>org.jboss.resteasy</groupId>
> > > <artifactId>resteasy-jackson2-provider</artifactId>
> > > <version>3.1.3.Final</version>
> > > </dependency>
> > > _______________________________________________
> > > keycloak-user mailing list
> > > keycloak-user(a)lists.jboss.org
> > > https://lists.jboss.org/mailman/listinfo/keycloak-user
> >
> >
> >
>
>
> ------------------------------
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user(a)lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
> End of keycloak-user Digest, Vol 58, Issue 37
> *********************************************
>
5 years, 4 months
- 2
- 1
Magic Link feature removed?
by Stefan Hesse
Hello,
according to this issue: https://issues.jboss.org/browse/KEYCLOAK-1942
Magic Link was introduced in version 4.0.0.Beta1.
I am running 4.0.0.Beta.2, and I tried to follow the following tutorial
in order to implement it: https://www.youtube.com/watch?v=oyUsI3QgEq8
Strangely the option does not appear in the Beta2 anymore.
Was the feature removed again?
Regards
Stefan
5 years, 4 months
- 3
- 3
4.6.0 Upgrade disables client scopes
by Lamina, Marco
Hi,
I upgraded to 4.6.0 using the Kubernetes Helm chart. After the upgrade, token exchange stopped working, which I was able to fix thanks to [1]. Unfortunately, none of my client scopes are working anymore. Trying to get a token using client credentials succeeds, but anything I pass into the “scope” parameter is ignored and none of my default client scopes are applied. The “scope” claim in the token endpoint response is always empty.
Is that a feature that needs to be enabled similar to the token exchange?
[1] https://stackoverflow.com/questions/53367566/unable-to-setup-idp-token-ex...
Thanks,
Marco
5 years, 4 months
- 3
- 3
start up of keycloak nodes roughly increases two folds for every 100 tenants.
by Madhu
Hi I am using keycloak 4.5. i created about 600+ tenants with 50 users each for a performance testing.
Upon creating tenants the start up time of keycloak increases drastically. This seems to be due to pretty much all entities at start up..
I tried disabling realm cache, user cache and did not help.. can you suggest how to bring down the start up time?
Is it absolutely necessary for keycloak to load every thing at start up??
This is an extract from hibernate stat i got on a c4 xlarge ec2 instance ( 4 core 8 gig), keycloak configured with xms=xmx=5g.
018-11-24 10:33:19,998 INFO [org.hibernate.envers.boot.internal.EnversServiceImpl] (ServerService Thread Pool – 61) Envers integration enabled? : true
2018-11-24 10:33:20,499 INFO [org.hibernate.validator.internal.util.Version] (ServerService Thread Pool – 61) HV000001: Hibernate Validator 5.3.6.Final
2018-11-24 10:33:21,296 INFO [org.hibernate.hql.internal.QueryTranslatorFactoryInitiator] (ServerService Thread Pool – 61) HHH000397: Using ASTQueryTranslatorFactory
^C
[centos@ip-172-31-45-199 log]$ 11:10:45,750 INFO [org.hibernate.engi ne.internal.StatisticalLoggingSessionEventListener] (ServerService Th read Pool – 61) Session Metrics {
669457663 nanoseconds spent acquiring 92974 JDBC connections;
148185664 nanoseconds spent releasing 92974 JDBC connections;
1852958902 nanoseconds spent preparing 92974 JDBC statements;
35866600579 nanoseconds spent executing 92974 JDBC statements;
0 nanoseconds spent executing 0 JDBC batches;
0 nanoseconds spent performing 0 L2C puts;
0 nanoseconds spent performing 0 L2C hits;
0 nanoseconds spent performing 0 L2C misses;
543461113 nanoseconds spent executing 2 flushes (flushing a total of 227216 entities and 158902 collections);
2197548626817 nanoseconds spent executing 14139 partial-flushes ( flushing a total of* 1042012050 entities and 1042012050 collections*)
}
11:10:45,780 INFO [org.hibernate.engine.internal.StatisticalLoggingS essionEventListener] (ServerService Thread Pool – 61) Session Metric s
{ 7689387 nanoseconds spent acquiring 1 JDBC connections; 34263 nanoseconds spent releasing 1 JDBC connections; 8025969 nanoseconds spent preparing 1 JDBC statements; 909784 nanoseconds spent executing 1 JDBC statements; 0 nanoseconds spent executing 0 JDBC batches; 0 nanoseconds spent performing 0 L2C puts; 0 nanoseconds spent performing 0 L2C hits; 0 nanoseconds spent performing 0 L2C misses; 3525215 nanoseconds spent executing 3 flushes (flushing a total o f 3 entities and 0 collections); 0 nanoseconds spent executing 0 partial-flushes (flushing a total of 0 entities and 0 collections)}
11:10:45,795 INFO [org.hibernate.engine.internal.StatisticalLoggingS essionEventListener] (ServerService Thread Pool – 61) Session Metric s {
437680 nanoseconds spent acquiring 1 JDBC connections;
10539 nanoseconds spent releasing 1 JDBC connections;
465001 nanoseconds spent preparing 1 JDBC statements;
719260 nanoseconds spent executing 1 JDBC statements;
0 nanoseconds spent executing 0 JDBC batches;
0 nanoseconds spent performing 0 L2C puts;
0 nanoseconds spent performing 0 L2C hits;
0 nanoseconds spent performing 0 L2C misses;
0 nanoseconds spent executing 0 flushes (flushing a total of 0 en tities and 0 collections);
17455 nanoseconds spent executing 1 partial-flushes (flushing a total of 0 entities and 0 collections)
All My 600 +realms are pretty much same i.e. each realm has a client scope, a java script mapper (to get all the realm roles into resouce role),couple of attribute mappers, 2 users groups ( 1 for admins) and 1 for other users. i have about 50 users in each realm and all the user belongs to one of the 2 user groups ( no custom roles though)..
Also, I bench marked the start up time after creating 50 or 100 realms and the start up time increases as the number of realms increases .
I am able to manage as i have disabled the admin console and use rest endpoints.. but still the start up time and loading pretty much every thing seems little wiered.
Please correct my understanding if i am wrong here..
| No of Realms | Start up time in mins |
| 0 realms | 0.22 mins |
| 100 realms | 2.34 mins |
| 200 realms | 2.53 mins |
| 300 realms | 5.34 mins |
| 400 realms | 9.42 mins |
| 500 realms | 14.6 mins |
| 650 realms | 37 mins |
Like wise the time taken to create tenants too gradually increases ( i use import to create realms)
from about 3 seconds for first few realms to about 30 sec for 600th realm..
Any advise /help will be appreciated.
5 years, 4 months
- 2
- 5