May 2018 - keycloak-user - Jboss List Archives

How to integrate Keycloak with Payara Micro?

by Thomás Sousa Silva

Hello! How i can integrate the Keycloak <https://www.keycloak.org/> with Payara Micro <https://www.payara.fish/payara_micro>? I want create an stateless REST JAX-RS application that use the Keycloak as authentication and authorization server, but i unknown how do it. The Eclipse MicroProfile JWT Authentication API defines the @LoginConfig annotation: @LoginConfig(authMethod = "MP-JWT", realmName = "admin-realm")@ApplicationPath("/")public class MyApplication extends Application {...} And the java EE the @RolesAllowed annotation: @Path("/api/v1/books")public class BooksController { @GET @RolesAllowed("read-books") public Books findAll() {...} } How integrate these two things? -- *Thomás Sousa Silva*

7 years, 11 months

1
0
0 / 0

help with freeipa+keycloak+saml

by Yossi Baruch

Hi, I'm using KC to connect to FreeIPA and create a user federation, I'm mapping several attributes from FreeIPA, among them is eduPersonTargetedID (EPTID). This EPTID is used to connect to a saml client and then as one of the attributes used in the edugain federation. The issue is that EPTID should be an array and not a single value, I get errors from the inter-federation that this EPTID is not structured right, I think that usually this EPTID is generated whenever the saml client connects but I have no idea how to do so. Anyone has an opinion about this? Has mitigated this In the past? [https://ci3.googleusercontent.com/proxy/7W7WLuvZjirS7ZgZCSisfzJizY7_Rc_hU...] Sincerely Yours, Yossi Baruch, IT specialist office: +972-3-646-0569 fax: +972-3-646-0557 E-Mail: yossi.baruch(a)iucc.ac.il<mailto:yossi.baruch@iucc.ac.il> Website: www.iucc.ac.il<http://www.iucc.ac.il/> "May The Force Be With You." — Master Yoda "I'm trying to free your mind... But I can only show you the door. You're the one that has to walk through it." — Morpheus "We are continually faced with a series of great opportunities brilliantly disguised as insoluble problems." - John W. Gardner "Do not go gentle into that good night, Old age should burn and rave at close of day; Rage, rage against the dying of the light." - ‏Dylan Thomas

7 years, 11 months

1
0
0 / 0

Invalid request URI

by SaRoJ

Hello Team, I'm using Keycloak and then connecting to spring boot using the Keycloak Client Adapter. My keycloak auth server url is https://auth.avinash.com.np/auth/ and my spring boot application is running on http://localhost:9090. In the keycloak admin console, redirect_url is set to http://localhost:9090/*. Now when my application tries to authenticate via keycloak, the redirect_url is set to http://localhost:9090/sso/login but keycloak redirect it to https://auth.avinash.com.np/sso/login . We are not sure how to debug this behavior and have tried to investigate it but haven't found anything. Our keycloak server is behind a nginx proxy and the X-FORWARDED-FOR , X-FORWARDED-PROTO and Hosts headers are set appropriately. FYI, this setup seems to work locally agains a local keycloak instance. Any help regarding this would be appreciated. Best reagrds, Saroj Gautam

7 years, 11 months

1
0
0 / 0

keycloak password policy and ldap

by Sebastian Perkins - Hoist Group - Switzerland

Hello, We have integrated keycloak 3.2 with our ldap backend via 4 federations (different filters to extract users). Our next goal is to use keycloak as a central password reset : this also works fine. The next step is to enforce policy in keycloak and not use the ldap one. For this, we have created a simple policy (6 chars mini). 2 of the federations are blocked by this (if we add a non compliant password) but not the 2 others : they seem to ignore the policy, what I don't really understand as the system should store all the policy info locally. As the passwords get updated the federations are correctly set up (ldapsearch checked). I even tried to force a password reset to a user as described in the docs after a policy change, but it still gets through. Am I missing some configuration ? Thanks for the help and guidance ! Sebastian

7 years, 11 months

1
0
0 / 0

Re: [keycloak-user] [keycloak-dev] How to share a resource with a user via UMA 2.0 API

by Federico Michele Facca

hi, i did some tests using your example, and i don't think it is working as expcted. On 11 May 2018 at 18:04, Pedro Igor Silva <psilva(a)redhat.com> wrote: > > >> >> Also, out of curiosity is there are a way i can list all resources i can >> access thanks either to UMA permission or policies? >> That would be very handful. >> > > You can do that by asking all permissions. See https://www.keycloak.org/d > ocs/latest/authorization_services/index.html#_service_obtain > ing_permissions. > > There is an cURL example there similar to this: > > curl -X POST \ > http://${host}:${port}/auth/realms/${realm}/protocol/openid-connect/token \ > -H "Authorization: Bearer ${access_token}" \ > --data "grant_type=urn:ietf:params:oauth:grant-type:uma-ticket" > > > In the example above you are basically, saying that you want a RPT for any > resource/scope granted to the user as a result of evaluating permissions > associated with resources which the either the user or resource server is > the owner. But yeah, depending on how many resources you will get a huge > RPT which can take some time to be issued. > My set-up is a follows: 1. I have a policy that says that the owner of a resource is authorised with scope read, write and delete. Such policy is attached to a resource with a * path (e.g. /resource/*). 2. User A create a resource /resource/A 3. User A ask all permissions. He is returned he can do anything on /resource/A So far so good. Now it's the part that i believe is not working as i would expect. 4. User B create a resource /resource/B 5. User B share resource B with User A 6. User A ask all permissions. He is returned he can do anything on /resource/A but no information is returned about resource B, despite there is a permission granted. It looks like User A can check if he can access resource B only if I create a permission ticket and I specifically check that, but as a requester, I don't know in advance if i am authorised to access a resource via UMA ticket or via another policy. In fact, if ask if i have read permission using the permission parameter, i get not authorised: curl --request POST \ --url http://127.0.0.1:8080/auth/realms/master/protocol/openid-connect/token \ --header 'Authorization: Bearer xxx' \ --header 'Content-Type: application/x-www-form-urlencoded' \ --data 'grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Auma-ticket&permission=da2fdbf6-076e-4716-8b91-2c7feeda8bee%23read&audience=test' while if i create a ticket for that resource with permission read, i get authorised. It looks like when asking permissions, UMA permissions and policy based permissions are kept totally separated, which i don't think it should be the case. If not knowing which resources you can access becomes super complex. Federico -- *Dr. FEDERICO MICHELE FACCA* *Head of Martel Lab* 0041 78 807 58 38 *Martel Innovate* <https://www.martel-innovate.com/> - Professional support for innovation projects Click to download our innovators' insights! <https://www.martel-innovate.com/premium-content/> Follow Us on Twitter <https://twitter.com/Martel_Innovate>

7 years, 11 months

1
0
0 / 0

Re: [keycloak-user] [keycloak-dev] How to share a resource with a user via UMA 2.0 API

by Federico Michele Facca

As per request of Pedro, I am moving the discussion to user. PS: a PR for adding requester in the permission was landed On 11 May 2018 at 18:04, Pedro Igor Silva <psilva(a)redhat.com> wrote: > > > On Fri, May 11, 2018 at 10:19 AM, Federico Michele Facca < > federico.facca(a)martel-innovate.com> wrote: > >> Hi Pedro, >> >> Thanks a lot for your quick reply. >> >> On 11 May 2018, at 13:52, Pedro Igor Silva <psilva(a)redhat.com> wrote: >> >>> >>> >> We don't have API documented, something we should improve in the future. >> >> We have a quickstart that can help you to achieve what you want. See >> https://github.com/keycloak/keycloak-quickstarts/tree/ >> latest/app-authz-uma-photoz. >> >> If you look this method: >> >> https://github.com/keycloak/keycloak-quickstarts/blob/late >> st/app-authz-uma-photoz/photoz-restful-api/src/main/java/ >> org/keycloak/example/photoz/album/AlbumService.java#L100 >> >> >> I have been looking at the methods, and actually learned from the exact >> example you refer to. >> >> >> You will see that we are using the Permission Endpoint (the endpoint >> responsible for managing permission tickets) to obtain all resources >> *shared* with a specific user. In our AuthZ Java Client we have this method: >> >> https://github.com/keycloak/keycloak/blob/master/authz/cli >> ent/src/main/java/org/keycloak/authorization/client/resource >> /PermissionResource.java#L162 >> >> Which allows you to query for permission tickets using different filters. >> >> >> Maybe my examples were not clear enough. For question 2: >> >> >> Suppose that user "test" owns resource A and he want to see (like in the >> my account interface) a table with all the active and pending permissions >> including the identifier of the user that made the request. >> >> Shared resources-> >> >> Resource A user B scope read, write >> >> Pending requests-> >> >> Resource A user C scope read >> >> >> With the following query: >> >> curl --request GET \ >> --url 'http://127.0.0.1:8080/auth/realms/master/authz/protection/ >> permission?returnNames=true&owner=test' \ >> --header 'authorization: Bearer xxx' >> >> I get a list of the permissions (where granted = true are the authorised >> ones and granted = false the pending ones): >> >> [ >> { >> "id": "08dccaed-6dbb-47aa-a87c-55b35a6f2523", >> "owner": "567c20ad-7d42-4908-bb53-af26c64534e7", >> "resource": "218091a8-e5fc-460c-a306-a3a76775c784", >> "scope": "65e40351-bce4-4e3f-825d-7bca9d78d12e", >> "granted": true, >> "scopeName": "read", >> "resourceName": "8910" >> }, >> { >> "id": “xxxx", >> "owner": "567c20ad-7d42-4908-bb53-af26c64534e7", >> "resource": "218091a8-e5fc-460c-a306-a3a76775c784", >> "scope": "65e40351-bce4-4e3f-825d-7bca9d78d12e", >> "granted": false, >> "scopeName": "read", >> "resourceName": "8910" >> } >> ] >> >> so the result does not allow me to know who was the “requester” (which I >> don’t know apriori since the query is about all potential requesters) >> > >> >> so my idea was that when you use returnNames=true parameter you could add >> as well the requester, e.g.: >> >> { >> "id": "08dccaed-6dbb-47aa-a87c-55b35a6f2523", >> "owner": "567c20ad-7d42-4908-bb53-af26c64534e7", >> "resource": "218091a8-e5fc-460c-a306-a3a76775c784", >> "scope": "65e40351-bce4-4e3f-825d-7bca9d78d12e", >> "granted": true, >> "scopeName": "read", >> "resourceName": “8910”, >> “requester”:”xxxxx”, >> “requesterName”:”test” >> }, >> > > I see now. We are really missing *requester* in the response. Not sure why > it is not there already .... > > Created https://issues.jboss.org/browse/KEYCLOAK-7337. > > >> >> >> >> >> The type PermissionResource also provides methods for CRUD permission >> tickets. >> >> Note that this API is targeted for resource servers and part of the >> Protection API. >> >> >> >> We realised that by trying to create resources and seeing that using user >> authentication you get 500 error while using client authentication it works >> (even though UMA specs is not limiting the access to that). >> We found out by testing also that the permission endpoint works also with >> user access tokens. >> > > Yeah, as long as the access token is granted with uma_protection scope. > > >> >> Now the first question was how to “share” directly a resource with a user. >> >> Currently using the API, supposing I am user A and I want to access a >> resource Z from user B, we proceed as follow (i hope is the correct way… >> any correction or guidance will be appreciated): >> >> 1. We create a permission request on the API (to get the ticket). E.g. >> read resource x >> >> 2. We use the ticket to ask for a rtp token using a user token. >> >> curl --request POST \ >> --url http://127.0.0.1:8080/auth/realms/master/protocol/openid-con >> nect/token \ >> --header 'Authorization: Bearer xxx' \ >> --header 'Content-Type: application/x-www-form-urlencoded' \ >> --data 'grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Auma- >> ticket&ticket=xxxx' >> >> If the user has already access, then he gets the rtp, if not he gets: >> >> { >> "error": "access_denied", >> "error_description": "request_submitted" >> } >> >> Only in this moment the permission ticket i created at step 1 appears in >> the list of permissions. (I am not sure this is the intended behaviour >> though). >> > > Yeah, that is the expected behavior. But you can also use a request > parameter to tell to the token endpoint that you don't want to submit an > authorization request. See https://www.keycloak.org/ > docs/latest/authorization_services/index.html#_service_authorization_aat. > > >> >> Then is up to the owner to authorise access (via API we can do that by >> updating the permission and set granted to true) >> >> Now let’s suppose that I am the owner of the resource A, and I want to >> authorise directly (without the user asking access to the resource A) >> the user Z to access it. How can I do that? At the time being I could not >> figure it out. >> > > Similar to the update method, you can use the create method to create > permissions. Is that what you are looking for ? See org.keycloak.testsuite. > authz.PermissionManagementTest#testCreatePermissionTicketWithResourceName. > > >> >> Also, out of curiosity is there are a way i can list all resources i can >> access thanks either to UMA permission or policies? >> That would be very handful. >> > > You can do that by asking all permissions. See https://www.keycloak.org/ > docs/latest/authorization_services/index.html#_service_ > obtaining_permissions. > > There is an cURL example there similar to this: > > curl -X POST \ > http://${host}:${port}/auth/realms/${realm}/protocol/openid-connect/token \ > -H "Authorization: Bearer ${access_token}" \ > --data "grant_type=urn:ietf:params:oauth:grant-type:uma-ticket" > > > In the example above you are basically, saying that you want a RPT for any > resource/scope granted to the user as a result of evaluating permissions > associated with resources which the either the user or resource server is > the owner. But yeah, depending on how many resources you will get a huge > RPT which can take some time to be issued. > > >> >> Suppose that you have an API that with GET /resources list you all the >> resources, there should be a way to filter the returned resources >> only based on the one you can access. This could be done easily if you >> could get a list of the resources you can access. Otherwise, >> you would need for each resource returned in the list to generate a query >> asking if the user x can access the specific resource. Not very >> scalable. >> > > We don't have anything for data protection. You are not the first with > this requirement but I did not spend time thinking about this capability > yet. If you want to open a JIRA and start some discussion there I'm glad to > move this forward. > > >> >> Thanks! >> Federico >> >> >> >>> >>> In our understanding, to obtain 2. we should some how retrieve the >>> Requester from the TicketStore and attach the information to the response >>> (but this would "break" the UMA standard, as anyhow parameters as >>> "returnNames=true" do, so maybe when the request is using >>> "returnNames=true" >>> we could attach as well the requester name and it). >>> >>> For 1, we have no clear ideas, if not adding "requester" as well in the >>> ticket creation. >>> >>> Any hint would be highly appreciated, so that we can work up some >>> implementation to provide both features. >>> >>> Thanks, >>> Federico >>> >>> -- >>> *Dr. FEDERICO MICHELE FACCA* >>> *Head of Martel Lab* >>> 0041 78 807 58 38 >>> *Martel Innovate* <https://www.martel-innovate.com/> - Professional >>> support for innovation projects >>> Click to download our innovators' insights! >>> <https://www.martel-innovate.com/premium-content/> >>> Follow Us on Twitter <https://twitter.com/Martel_Innovate> >>> _______________________________________________ >>> keycloak-dev mailing list >>> keycloak-dev(a)lists.jboss.org >>> https://lists.jboss.org/mailman/listinfo/keycloak-dev >> >> >> *Dr. FEDERICO MICHELE FACCA* >> *Head of Martel Lab* >> 0041 78 807 58 38 >> *Martel Innovate* <https://www.martel-innovate.com> - Professional >> support for innovation projects >> Click to download our innovators' insights! >> <https://www.martel-innovate.com/premium-content/> >> Follow Us on Twitter <https://twitter.com/Martel_Innovate> >> >> > -- *Dr. FEDERICO MICHELE FACCA* *Head of Martel Lab* 0041 78 807 58 38 *Martel Innovate* <https://www.martel-innovate.com/> - Professional support for innovation projects Click to download our innovators' insights! <https://www.martel-innovate.com/premium-content/> Follow Us on Twitter <https://twitter.com/Martel_Innovate>

7 years, 11 months

1
0
0 / 0

keycloak api interfaces

by Christopher Schollar

Hi guys I was wondering if you can suggest any libraries which utilise the keycloak api. I am interested in seeing how people solve common issues like creating admins for groups, assigning roles etc. I could go through the effort of writing my own code, but I was wondering if there are any efforts that you would suggest I look at. Thanks Chris

7 years, 11 months

3
2
0 / 0

400 error behind nginx reverse proxy

by Evan Clark

I am attempting to setup the email notifications through keycloak and am getting a 400 error when I attempt to test connection. I looked at an older post and made sure my admin user has an email assigned to them. However, no matter which realm we use, test or master the same error occurs. The Debug output doesn't produce any useful either. We are running behind nginx with ssl termination.

7 years, 11 months

1
0
0 / 0

Mapping SAML response elements to OIDC token claims

by Matt Evans

Hi Is it possible to map SAML response elements from an IDP response to claims in the OIDC information? We're specifically looking to be able to extract the AuthenticatingAuthority, which I can see is returned in the AuthnContext element, but I'm not sure if the Attribute name or Friendly Attribute name in the SAML mapper will look for those. Thanks Matt

7 years, 11 months

1
0
0 / 0

Re: [keycloak-user] Custom registration attributes

by Bruno Palermo

Lukasz, I thought on something similar, but if the users don't go directly to the registration page the parameters gets lost. I will run some tests and try. Thanks for the help! -----Original Message----- From: Łukasz Dywicki <luke(a)code-house.org> Sent: quinta-feira, 10 de maio de 2018 19:48 To: Bruno Palermo <bruno(a)bpic.io> Subject: Re: [keycloak-user] Custom registration attributes Hi Bruno, Not an advice, but just an idea - you could do that with custom javascript injected into theme. This will be simplest thing to do which will move things from query string (visible to browser) to custom form fields. It's not reliable at all, but easy to get. I took a look on code and form parameters are passed around in few places BUT your user who gets redirected do not submit any form per say making it impossible to fill in any hidden fields. When someone visits your custom registration page its brower sends GET with text/html or similar content type, while form parameters are usually available with application/x-form-url-encoded. Maybe there is someone from the team to answer, this is just my custom rant which can be completely wrong. Cheers, Lukasz -- Code-House http://code-house.org On 10.05.2018 15:26, Bruno Palermo wrote: > Lukasz, > > Yes I know that. > > But what I'm trying to achieve is for those attributes to be pre-filled with query parameters. > > Thanks, > Bruno > > -----Original Message----- > From: keycloak-user-bounces(a)lists.jboss.org > <keycloak-user-bounces(a)lists.jboss.org> On Behalf Of Lukasz Dywicki > Sent: quarta-feira, 9 de maio de 2018 07:37 > To: keycloak-user(a)lists.jboss.org > Subject: Re: [keycloak-user] Custom registration attributes > > Hey Bruno, > You can pass additional attributes via registration form. You just need to add additional form fields with "user.attributes.<XYZ>". In your case you would need to copy them into hidden inputs. > Keycloak user will then have <XYZ> attribute with value sent over form. > > Kind regards, > Lukasz > -- > Code-House > http://code-house.org > > On 08.05.2018 21:33, Bruno Palermo wrote: >> Hi, >> >> I would like to track the source of users using user attributes. >> >> It's possible to pass query parameters like: utm_source, utm_medium, >> utm_campaing and add them as custom attributes? >> >> How can I access query parameters on a custom provider? >> >> Thanks, >> Bruno >> >> _______________________________________________ >> keycloak-user mailing list >> keycloak-user(a)lists.jboss.org >> https://lists.jboss.org/mailman/listinfo/keycloak-user >> > _______________________________________________ > keycloak-user mailing list > keycloak-user(a)lists.jboss.org > https://lists.jboss.org/mailman/listinfo/keycloak-user >

7 years, 11 months

1
0
0 / 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

keycloak-user May 2018