April 2018 - keycloak-user - Jboss List Archives

by Carrasco, Jonathan J (173F)

Hello Everyone, General question… does Keycloak support multiple certificates with different expirations. To allow for rolling client cert updates. For example, I have keycloak with “cert1”, and I registered Client1 with “cert1” and Client2 with “cert1”. Now “cert1” expires. Am I able to support two certificates, where I add/update Keycloak with “cert2”… so now there’s an old “cert1” and new “cert2” on Keycloak, and Client1 will reach Keycloak with old “cert1” and determine it needs the new “cert2”? And have this not break Client2 which will reach Keycloak at a later date with old “cert1” again. Or… do I have to update Keycloak cert and re-federate all client applications or else they will break until they have the updated cert? Thank you for your attention. -- Jonathan Carrasco (173F) Jet Propulsion Laboratory – California Institute of Technology

8 years

1
0
0 / 0

TypeScript Defs

by Jack Murphy

It looks like the TypeScript definitions have been removed for "keycloak-connect": "4.0.0-beta.1" Is this a bug or a deprecated feature? How should i resolve this? Thanks! ᐧ

8 years

1
0
0 / 0

keycloak-cli.bat failed to connect to the controller with SaslException DIGEST-MD5: Server rejected authentication

by Sébastien Vandamme

Hello, I am in the process of installing Keycloak 3.4.3.Final and customize it using scripts. I reuse scripts that I used on Keycloak 2.5.1 with success but, on the new version, I run into strange problems. All the command that I run that start with keycloak-cli.bat --connect --controller=localhost:9990 --user=root --password=somePwd doesn't work anymore and displays the following error Failed to connect to the controller: Unable to authenticate against controller at localhost:9990: Authentication failed: all available authentication mechanisms failed: DIGEST-MD5: javax.security.sasl.SaslException: DIGEST-MD5: Server rejected authentication When I run the same command without the credentials keycloak-cli.bat --connect --controller=localhost:9990 the connection work and I see [standalone@localhost:9990 /] When I connect directly via the browser on the url localhost:9990, it ask me for a login and a password, I enter the ones given in the first command and I can connect without any problem. I read a lot of stuff on similar problems on the web but nothing solved my problem. For example, my remoting configuration, that was a problem in some case, seems right <subsystem xmlns="urn:jboss:domain:remoting:4.0"> <endpoint/> <http-connector name="http-remoting-connector" connector-ref="default" security-realm="ApplicationRealm"/> </subsystem> In short, I'm stuck. Does someone has any idea to help me ? Thank you in advance for your help, Seb

8 years

1
0
0 / 0

"HTTPS Required"

by Lahari Guntha

Hi All, I am using Keycloak of version 3.3.0.CR2... I have launched keycloak as a container in a VM... Whenever I try to access the "http" port of keycloak...It is showing "HRTPS REQUIRED"... Even Setting of "Require SSL" to "none" Under Login tab of "Realm Settings" didnot help.... Is there any other solution we have to get this problem solved?? Thanks & Regards, Lahari G =====-----=====-----===== Notice: The information contained in this e-mail message and/or attachments to it may contain confidential or privileged information. If you are not the intended recipient, any dissemination, use, review, distribution, printing or copying of the information contained in this e-mail message and/or attachments to it are strictly prohibited. If you have received this communication in error, please notify us by reply e-mail or telephone and immediately and permanently delete the message and any attachments. Thank you

8 years

2
4
0 / 0

How to configure an haproxy load balancer in front of a single Keycloak server?

by Joe Vlcek

Brief: Are there any instructions for how to configure a load balancer in front of a singer keycloak server? Details: There is a Cloudforms customer that has 2 Cloudforms instance, cf-1 and cf-2 each of which are configured correctly to use keycloak/SAML for authentication. If one points a browser to cf-1 it is correctly redirected to the keycloak server, once valid credentials are entered the browser correctly redirects back to cf-1. The same is true for cf-2. The customer is attempting to set up a haproxy in front of cf-1 and cf-2, e.g.: cf-load-balancer. If the point their browser to cf-load-balancer they are redirected to their keycloak server but the redirect back fails. I have found the instructions for how to set up a load balancer in front of multiple keycloak servers which is a different configuration. Are there any instructions for how to configure a load balancer in front of a singer keycloak server? Thank you! Joe VLcek

8 years

1
0
0 / 0

Documentation for what properties are available on template pages (login.ftl, etc)?

by Jordan Keith

I have looked over the keycloak documentation, but I can't find out what properties are available when customizing the various keycloak template pages. For modifying login.ftl, I have resorted to inspecting the source code of FreeMarkerLoginFormsProvider.java to find out what attributes are added to the attributes hash map. Is there any documentation for this? Thanks, Jordan Keith

8 years

1
0
0 / 0

Could not obtain configuration from server

by Filip Kozjak

Hi everyone, I am having troubles obtaining access token for my Java EE REST service from Keycloak. I have started Keycloak server at *http://localhost <http://localhost>*, and I can access the admin console at *http://localhost:8081/auth/admin/master/console/#/realms/demo <http://localhost:8081/auth/admin/master/console/#/realms/demo>.* Next, I created a new realm "demo" and registered my REST service there. I've copied the generated *keycloak.json *to the WEB-INF of my service and added what was needed to web.xml. This successfully protected my endpoint. My REST service is up and running on *http://localhost:8080/ <http://localhost:8080/>.* However, now I want to set up a client that would be authorized to access the protected endpoint. The client is running at *http://localhost:9080 <http://localhost:9080>. *Again, it's a Java EE REST service that talks to the protected service. I registered it as *OAuth Client* in the admin console and again copied the *keycloak.json* to the resources of my app. I am trying to obtain the access token like this: AuthzClient authz = AuthzClient.create(); AccessTokenResponse tokenResponse = authzClient.obtainAccessToken(); This results in the following error: java.lang.RuntimeException: Could not obtain configuration from server [ http://localhost:8081/auth/realms/demo/.well-known/uma-configuration]. <div id="stack">at org.keycloak.authorization.client.AuthzClient.<init>(AuthzClient.java:92) at org.keycloak.authorization.client.AuthzClient.create(AuthzClient.java:60) at org.keycloak.authorization.client.AuthzClient.create(AuthzClient.java:53) at hr.assecosee.three_ds_2.risk.services.ProxyServiceImpl.invokeRiskLevelApi(ProxyServiceImpl.java:28) at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.lang.reflect.Method.invoke(Method.java:498) at com.ibm.ejs.container.EJSContainer.invokeProceed(EJSContainer.java:5316) ... 16 more </div>Caused by: org.keycloak.authorization.client.util.HttpResponseException: Unexpected response from server: 404 / Not Found I posted a question about it on StackOverflow too: https://stackoverflow.com/questions/49534589/404-not-found-while-requesti... Is there something I am missing?

8 years

2
3
0 / 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

keycloak-user April 2018