September 2018 - keycloak-user - Jboss List Archives

by Corentin Dupont

Hello, I have a configuration working with docker, and I wonder how to change some parameter in standalone.xml (specifically for HTTPS). Where should I get the standalone.xml file with the correct version? From Github? How should I insert it in the docker image? I figured out: FROM jboss/keycloak:3.4.3.Final COPY standalone.xml /opt/jboss/keycloak/standalone/configuration/ Is that correct? Thanks a lot! Corentin

8 years

2
2
0 / 0

Group-Mapping

by Lahari Guntha

Hi All, We are using keycloak of version 3.3.0.CR2. I have my Keycloak integrated with LDAP. I have configured many applications to have SSO with Keycloak. I have done all the configuration to have LDAP integration with Keycloak. I have also configured Group mappers so that groups from LDAP are also synced to LDAP. eg: Users in LDAP: "user1" Groups in LDAP: "group1","group2" When i login into one of my application that is configured to have SSO with keycloak with user "user1" that is present in group "group1"...that user entry gets shown in the Keycloak UI page and we can also see the groups mapped to it. Now I add the user "user1" into another group "group2"... But now the newly added group is not reflected when click on User> Group Mapping. Why Is this happening?? What is the solution to continuously sync the users with the groups they are present in/added newly automatically???? Thanks, Lahari =====-----=====-----===== Notice: The information contained in this e-mail message and/or attachments to it may contain confidential or privileged information. If you are not the intended recipient, any dissemination, use, review, distribution, printing or copying of the information contained in this e-mail message and/or attachments to it are strictly prohibited. If you have received this communication in error, please notify us by reply e-mail or telephone and immediately and permanently delete the message and any attachments. Thank you

8 years

3
16
0 / 0

UMA 2.0 Implementations

by Paul Templeman

Hi Just wanting to connect with anyone using KeyCloak for a use case that requires User Managed Access (UMA) 2.0 support. Particularly interested in use cases that involve an ecosystem of platforms/applications and multiple organisations - not just a single organisation context. Particularly keen to hear from any Australian use cases. Thanks Paul...

8 years

1
0
0 / 0

Support authorization for dynamic resources not saved in Keycloak resources DB, and querying for additional information from "PIP" service inside of policy

by Marcel Német

It would be great to support dynamic resources using more complex Wildcards mechanism. It would be very useful for our company. But I will rather explain the use case on better-known use-case: Groups and Events on Facebook. Groups on Facebook have members and admins. Groups are created and deleted often, and one user can be member and admin of multiple groups. Example: Group for hikers Admins: Alice, Adam Members: Mark, Michelle Group for dancers: Admins: Antoni Members: Martin Admins can create and delete events e.g. Hiking in Himalayas event Members can subscribe and unsubscribe from events The REST API might look like: GET api/groups/{groupID}/events/ · Can be done by members or admins DELETE api/groups/{groupID}/events/{eventID} · Only by admins POST api/groups/{groupID}/events/{eventID}/subscribe · Here the danger is that Martin who is not a member of Group for hikers could manipulate the request and do: · POST api/groups/Group-for-dancers/events/Hiking-in-Himalayas/subscribe · So, it is not enough to check whether Martin is a member of the group in the request. It must also be checked that the Event belongs to that group. Or directly, without referencing the group POST api/events/{eventID}/subscribe In the second case, the system would have to check whether the user is a member of the group. This has to be queried from the facebook DB. POST api/groups/{groupID}/events/{eventID}/unsubscribe When the user subscribes to an event he can see it under GET api/user/{userID}/subscribedEvents/{eventID} And he can unsubscribe under POST api/events/{eventID}/unsubscribe ============================== Challenges in Keycloak: Currently, all the resources would have to be created in the Keycloak server one by one E.g. /groups/Group for hikers/events/Hiking in Himalayas · With scopes GET and DELETE /groups/Group for hikers/events/Hiking in Himalayas/subscribe /groups/Group for hikers/events/Hiking in Himalayas/unsubscribe And when the user subscribes to the event, another resource would need to be added /user/Mark/subscribedEvents/Hiking in Himalayas · With scopes GET /user/Mark/subscribedEvents/Hiking in Himalayas/unsubscribe /user/Michelle/subscribedEvents/Hiking in Himalayas · With scopes GET /user/Michelle/subscribedEvents/Hiking in Himalayas/unsubscribe And when the Mark and Michelle unsubscribe, the last resources should be removed. This adds additional overhead. The permissions can be then applied to the resource type if the resources are properly typed, this works well. If Keycloak supported dynamic URLs and multiple wildcards or parameters inside URI It would be possible to simply define general permissions for the API routes For example, it would be great to be able to define a resource with a wildcard parameter such as api/groups/{groupID}/events/{eventID} · With scope DELETE Then the permission could be added simply with a policy that permits the action if the user is admin of the group with ID {groupID}. Having to create resources in Keycloak resources DB is a drawback because it creates another single point of failure - we have a complicated system that is quite critical. Constantly creating and deleting resources is complicated. If at any time the synchronization between resource DB in Keycloak and our system fails, it would be very hard to recover. ====================================== At the moment I see a workaround of using different REST API routes such as DELETE api/groups/events?groupID={groupID}&eventID={eventID} But this forces us to use sub-optimal paths which do not conform to the usually recommended syntax of REST APIs. Then I can define a resource in keycloak as api/groups/events/* With scope DELTE And inside policy enforcer I can push claim such as "event-delete-claim"="eventID : {request.parameter['eventID']}" Or even use the whole relative URI as a claim - adding a unique claim to the RPT makes sure that the user gains access only to single resources or group fo resources and not to all resources that match api/groups/events/*. Then in a permission for the resource "api/groups/events/*" with scope "DELETE" I must check somehow whether the user who is trying to call this API is admin of a group where the event is hosted. It is hard to know whether the event belongs to a group from such request since we cannot trust the information in the HTTP request even if group ID was part of the request. Here I would need to query the system DB with the eventID and get the groupID or even better directly list of the admins of the group to which the event belongs. ========================================= Summary · It would be great to support dynamic resources with multiple wildcards/parameters so we do not need to sync all existing and newly created resources with the Keycloak DB · It would be great to be able to query external service from inside of a policy (e.g. something like Java Policy Provider (SPI?) with an ability to call a trusted Policy Information Point ("PIP") to get additional information necessary to make a decision) o For example, the Policy "Allow if the user is an administrator of the group of the event" would be applied to the resource "DELETE api/groups/*/events/*". The policy code would be able to query some backend service and check that the event really belongs to the group and that the user is admin of that group. I would love to hear your thoughts on this, or whether any of the two propositions could be added or whether another strategy to achieve this exists. -- Marcel Német marcel.nemet(a)gmail.com

8 years

2
1
0 / 0

Keycloak SAML response redirection stuck in loop after logging in

by x

Hello I am using Keycloak as IdP integrated with my application(SP) by using SAMLFilter adapter. After authentication is successful by checking the SAML assertion response from Keycloak containing the expected username, the redirect visited Keycloak again which resulted "You are already logged in" on my Chrome screen. The same question was asked on stackoverflow and we have same phenomenon. https://stackoverflow.com/questions/50681822/keycloak-saml-redirection-st... I see there is a Javascript code below with a response form together on my Chrome dev tool which likely redirects to Keycloak again instead of SP. <SCRIPT> if (typeof history.replaceState === 'function') { history.replaceState({}, "some title", " http://localhost:6161/auth/realms/UAAAltDemo/login-actions/authenticate?c..."); }</SCRIPT> Could some please help how to fix the problem? Where I need to configure to workaround this. Best Regards, Xj

8 years

2
1
0 / 0

Request to help install KeyCloak

by Rizwan Ashraf

Greetings, I am working for a non profit and need help to install KeyCloak. I do not have the expertise to setup the Keycloak hence asking if anyone can help setup the KeyCloak. Thank you sincerely, Riz

8 years

2
1
0 / 0

IdP selection based on email address

by Yann Jouanin

Hello, We are using keycloak with multiple IdP from our customers. Because we don't want to offer a list of Idp (customer A can't use the idp of customer B), I would like to prompt the user for the email address first and decide then to redirect to a specific IdP based on the domain as an example. Does somebody here can advise me on the greatest way to implement this behavior? My first thought was to use a custom flow with a script, but I can't find how to specify the idp to use using script. Best regards, Yann Jouanin

8 years

2
4
0 / 0

Need help getting authorization code flow working

by David Erie (US)

Hi, I am having trouble exchanging an OIDC auth code for an access token after logging in with Keycloak. I am getting this error back in the response: {error: "invalid_grant", error_description: "Code not valid"} The Keycloak log has these entries: WARN [org.keycloak.services.managers.CodeGenerateUtil] (default task-51) Code '6023c45e-c4de-4094-a29e-f8ef36b5a937' already used for userSession 'e8eb1e32-dbed-42d9-97f3-fc8e5be6e6ae' and client 'cb65bac8-abdb-4e55-b098-efa686127460'. WARN [org.keycloak.events] (default task-51) type=CODE_TO_TOKEN_ERROR, realmId=<snip>, clientId=<snip>, userId=null, ipAddress=<snip>, error=invalid_code, grant_type=authorization_code, code_id=e8eb1e32-dbed-42d9-97f3-fc8e5be6e6ae, client_auth_method=client-secret My request looks like this: http://<snip>/auth/realms/<snip>/protocol/openid-connect/token Headers: Authorization: Basic <snip> Content-Type: application/x-www-form-urlencoded Form data: grant_type=authorization_code&code=eyJhbGciOiJkaXIiLCJlbmMiOiJBMTI4Q0JDLUhTMjU2In0..Z5T9_-SBkuEy25gr8rUyrQ.L4_ZTTybr9vWOli6Yb42Qk1vfGGmCIk3hdNHF9-y7khYqoDG_MH8f9_qQqF83v9kjLOUT8vDNpH9Eu7QFB8hnWnVXbAuwJbJNz5b8ui_7fvZsxcr3PPzpaLEXLW16unghsLtToqXy8sWcFq-ceSJ8ebmyoFNkEUG_1sy0-02iK7s2TConuXTkhVeSvDj4sPz3TsllIP0ZxxfX3TSgrmgd7TfZnw4-JZy1M3blqC6i8Ba9F3t_XrER-HeaxHgpj6K.asPxD74Yr-k2wDeAsTRlZw&redirect_uri=<snip> I am not using the Keycloak JS adapter (it's a long story), but I'm using it as a guide for what to do after getting the code back in order to get the tokens. Any help would be appreciated. Thank you, Dave

8 years

1
0
0 / 0

Is it possible to direct a query to one active directory by user?

by Bloor, Alexander

Hello, I am planning a realm structure that may result in a large number of LDAP components (10+) in a single realm. When a user wants to authenticate, I would like Keycloak to query the AD where it lives without querying any others (except the first time the user authenticates). Is there a way to do this? Alex

8 years

1
0
0 / 0

Best Practice AWS+ECS implementation

by Carrasco, Jonathan J (173F)

Hello. I’m working on implementing Keycloak on ECS. The proposed architecture is: 2x – Keycloak Docker images (customized for Domain Mode) RDS Postgres Instance My question- and I’m open to comments- is what is best practice for Load Balancing and what is the community using? I was thinking of spinning up another docker instance with Nginx for load balancing instead of Amazon’s ALB. Is that something that makes sense or better to just use ALB? The reasoning that I want to have another instance for load balancing is because I want to separate the credential collector. Is there some docs on best way to execute separating the credential collector? -- Jonathan Carrasco (173F) Jet Propulsion Laboratory

8 years

3
4
0 / 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

keycloak-user September 2018