January 2019 - keycloak-user - Jboss List Archives

Re: [keycloak-user] Keycloak Identity provider SAML LogoutRequest not working with NetIQ Access Manager because it is not signed?

by Hans Zandbelt

Hi Ed :-), >From a quick peek at the code [1] it looks like Keycloak re-uses the per-identity provider setting for signing authentication requests for the logout requests as well. By setting "Want AuthnRequests Signed" in the configuration for NetIQ Keycloak should start signing the logout requests as well. I believe you are right that the spec requires sending signed logout requests when using the POST binding. Let me know if that works, Hans. [1] https://github.com/keycloak/keycloak/blob/master/services/src/main/java/o... On Mon, Jan 28, 2019 at 12:41 PM <keycloak-user-request(a)lists.jboss.org> wrote: > ------------------------------ > > Message: 2 > Date: Mon, 28 Jan 2019 11:10:53 +0000 > From: "Edgar Vonk - Info.nl" <Edgar(a)info.nl> > Subject: [keycloak-user] Keycloak Identity provider SAML LogoutRequest > not working with NetIQ Access Manager because it is not signed? > To: keycloak-user <keycloak-user(a)lists.jboss.org> > Message-ID: <82603569-9670-44FD-8D01-9BA5F1998CEF(a)info.nl> > Content-Type: text/plain; charset="utf-8" > > hi all, > > We are trying to set up Keycloak to act as a federated identity provider > between our (OAuth2-enabled) application and the external SAML 2.0-enabled > NetIQ Acces Manager identity provider using: > https://www.keycloak.org/docs/latest/server_admin/index.html#saml-v2-0-id... > > The basic setup including authentication works fine. However logging out > does not. When attempting to logout from our application Keycloak sends a > SAML LogoutRequest to NetIQ Access Manager but NetIQ does not accept this > request because, from what we understand from NetIQ, this request is not > signed. > > It seems that Keycloak does not support sending signed LogoutRequests from > SAML Identity Providers? Is this indeed the case and how could we go about > solving this? Maybe create a custom IdentityProvider or possibly send a > SAML LogoutRequest to NetIQ from our application directly? > > Example of SAML LogoutRequest send by Keycloak: > > <samlp:LogoutRequest Destination="https://dummyhost.net/nidp/saml2/slo" > ID="ID_7b7e1700-235b-403d-af08-a0c77dd7f26d" > IssueInstant="2019-01-28T10:43:56.896Z" Version="2.0" > xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" > xmlns="urn:oasis:names:tc:SAML:2.0:assertion"> > <saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"> > http://localhost:8080/auth/realms/our-realm</saml:Issuer> > <saml:NameID > Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" > > xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">00001234</saml:NameID> > <samlp:SessionIndex>id05SkNYJwvT2uGPaCu5PvQvT5Dmg</samlp:SessionIndex> > </samlp:LogoutRequest> > > > I am no expert on SAML at all but this is from the SAML 2.0 specs ( > https://www.oasis-open.org/committees/download.php/56782/sstc-saml-profil... > ): > > 4.4.4.1 <LogoutRequest> Usage: > "The requester MUST authenticate itself to the responder and ensure > message integrity, either by signing the message or using a > binding-specific mechanism.? > > Should Keycloak not support signing SAML LogoutRequests? > > cheers > > Edgar > > -- hans.zandbelt(a)zmartzone.eu ZmartZone IAM - www.zmartzone.eu

7 years, 3 months

1
0
0 / 0

FW: Get a GSSCredential when user browser is not in Active Directory domain

by Chris Smith

Thank you Dmitry My Keycloak realm is setup for LDAP/Kerberos authentication with a Windows Active Directory domain. So I am getting a delegated GSSCredential in my AccessToken when I access my Web App from a properly configured browser (SPNEGO) on a workstation in the Windows Active Directory Domain. If the browser is not configured for SPNEGO or the workstation is not a member of the Windows Active Directory Domain, The browser is redirected to the Keycloak log in page After entering a correct user and password, the browser is redirected back to the Web App. This step is what I need to successfully authenticate a Windows AD User ID/password combination and it works. My problem is there is no claim in the AccessToken for a GSSCredential. I have an absolute requirement for a GSSCredential for that Windows AD User ID/Password. The GSSCredential is to be used in the web app to connect to an IBM i (aka AS/400) for calling RPG and COBOL programs. The IBM i is Configured to accept the GSSCredential and it works when the workstation is a member of the Windows AD domain and the browser is configured for SPNEGO. Can Keycloak be configured to put a GSSCredential in the AccessToken when Keycloak authenticates the Windows AD User id/Password? If not, would it be a large effort to add a plugin that would put a GSSCredential in the AccessToken? -----Original Message----- From: Dmitry Telegin <dt(a)acutus.pro> Sent: Monday, January 28, 2019 2:21 PM To: Chris Smith <chris.smith(a)cmfirstgroup.com>; keycloak-user(a)lists.jboss.org Subject: Re: [keycloak-user] Get a GSSCredential when user browser is not in Active Directory domain Hello Chris, AFAIK GSSCredential is something very specific to Kerberos, so I'm not sure it's possible at all to obtain it outside of Kerberos context, like e.g. via pure LDAP authentication. Cheers, Dmitry On Mon, 2019-01-28 at 03:04 +0000, Chris Smith wrote: > Does anyone have feedback about getting a delegated GSSCredential? > > -----Original Message----- > > From: keycloak-user-bounces(a)lists.jboss.org > > <keycloak-user-bounces(a)lists.jboss.org> On Behalf Of Chris Smith > Sent: Wednesday, January 23, 2019 10:12 PM > To: keycloak-user(a)lists.jboss.org > Subject: Re: [keycloak-user] Get a GSSCredential when user browser is > not in Active Directory domain > > Here is a Diagram of what I'm trying to do > > From: Chris Smith > Sent: Wednesday, January 23, 2019 8:08 AM > > > To: 'keycloak-user(a)lists.jboss.org' > > > <keycloak-user(a)lists.jboss.org> > Subject: Get a GSSCredential when user browser is not in Active > Directory domain > > I have setup my servlet to authenticate a user my web app using > Keycloak Active Directory ldap user federation > > I can get a Delegated GSSCredential when the SPNEGO enabled browser runs on a workstation in the AD domain. > When the browser workstation is not a member of the AD Domain, Keycloak will authenticate the user id and password entered on the keycloak login page, but there will not be a Delegated GSSCredential in the Access Token in my servlet. > > I have a requirement to use the GSSCredential to call programs on an IBM i (AS/400) and JDBC to the IBM i. My IBM i is configured to accept a Kerberos Ticket from Active Directory as an authenticated credential (aka EIM, Enterprise Identity Mapping). > > Less than 1% of the users will be using browsers on workstations in the Active Directory domain. > > Can Keycloak put a GSSCredential for the logged in user in the Access Token when SPNEGO is not available from the browser? > > > > _______________________________________________ > keycloak-user mailing list > keycloak-user(a)lists.jboss.org > https://lists.jboss.org/mailman/listinfo/keycloak-user

7 years, 3 months

1
0
0 / 0

Server Admin: Ship master realm with ssl disabled / set to none

by Bruce Wings

I am using reverse proxy with keycloak server which is SSL protected. I have also shipped default configuration for my custom realm with SSL set to "none". But what is the way to ship master realm with ssl set to none? By default it's getting shipped with ssl set to "external requests"

7 years, 3 months

1
0
0 / 0

[docker] Enabling SSL/HTTPS in Keycloak 4.8.3.Final

by Pavel Maslov

Hi all, I am trying to import a custom jks keystore into keycloak in a Dockerfile [1]. The problem is Wildfly uses the default self-signed certificate instead. Everything worked fine with Keycloak 4.1.0.Final. Something might have broken in the latest version (I suspect the new Undertow server). Perhaps, the documentation [2] should be updated. Any help would be appreciated. Thanks in advance. Regards, Pavel Maslov, MS [1] https://github.com/maslick/keycloak-docker [2] https://www.keycloak.org/docs/latest/server_installation/index.html#enabl...

7 years, 3 months

2
4
0 / 0

SAML SSO logout invalid destination error

by Martin Duží

Hello, our team is using SAML SSO via Keycloak with several 3rd party applications. After updating Keycloak version from 4.2.1 to 4.8.2, we started having problem with logout from JFrog Artifactory, which ends up on page "We're sorry ... Invalid Request". Keycloak prints following error in server.log: 2019-01-18 19:02:44,198 WARN [org.keycloak.events] (default task-1) type=LOGOUT_ERROR, realmId=fea322ef-a93e-c7db-aa08-c4eea81b38ff, clientId=null, userId=null, ipAddress=(null), error=invalid_logout_request, reason=invalid_destination Which seems to indicate problem with destination attribute in logout request and it is indeed missing from the xml sent by Artifactory: <saml2p:LogoutRequest xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol" ID="add9d022-12da-40a2-80bd-f1d5b042a595" IssueInstant="2019-01-18T07:23:50.822Z" Version="2.0"><saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">artifactory.example.com</saml2:Issuer><saml2:NameID xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">logout user</saml2:NameID><saml2p:SessionIndex>a8ec478f-a05c-4feb-8ec2-4dd9015eabe9::37dcf7a4-0a11-4cfe-9a23-6d4d3cd4e9e0</saml2p:SessionIndex></saml2p:LogoutRequest> Looking at SAML specs and also recent code changes in Keycloak, destination should be optional. Client Signature Required is turned off. Other applications that actually send destination attribute can logout without issues. Anyone has idea what could be the problem here? BR Martin Duzi

7 years, 3 months

1
0
0 / 0

Adding multiple custom REST endpoints

by Walker, Charles

The documentation states that if you want to add a custom endpoint, you need to implement the RealmResourceProviderFactory and RealmResourceProvider interfaces. Then the examples show that you create an "org.keycloak.services.resource.RealmResourceProviderFactory" file in the "META-INF/services" directory that references the implementation. But what if I want to have multiple implementations? would these implementations be just listed in the above file "org.keycloak.services.resource.RealmResourceProviderFactory" as comma separated, space separated or what? Thanks for your help, Charles Walker

7 years, 3 months

2
1
0 / 0

adding translations to theme leads to NullPointerException

by Eugen Stan

Hello, We have translated keycloak into multiple languages, available at [1]. I've copied those translations into our custom theme and build the docker image. I updated the iimage and it fails to start with the following exception. Just the files being there causes the above exception. Any ideas how to fix this ? Regards, ``` 15:47:17,655 ERROR [org.keycloak.services.error.KeycloakErrorHandler] (default task-6) Failed to create error page: java.lang.NullPointerException at org.keycloak.theme.ExtendingThemeManager.loadTheme(ExtendingThemeManager.java:117) at org.keycloak.theme.ExtendingThemeManager.getTheme(ExtendingThemeManager.java:95) at org.keycloak.theme.DefaultThemeManager.getTheme(DefaultThemeManager.java:26) at org.keycloak.theme.DefaultThemeManager.getTheme(DefaultThemeManager.java:21) at org.keycloak.services.error.KeycloakErrorHandler.toResponse(KeycloakErrorHandler.java:71) at org.jboss.resteasy.core.ExceptionHandler.executeExceptionMapper(ExceptionHandler.java:102) at org.jboss.resteasy.core.ExceptionHandler.unwrapException(ExceptionHandler.java:131) at org.jboss.resteasy.core.ExceptionHandler.handleApplicationException(ExceptionHandler.java:76) at org.jboss.resteasy.core.ExceptionHandler.handleException(ExceptionHandler.java:222) at org.jboss.resteasy.core.SynchronousDispatcher.writeException(SynchronousDispatcher.java:197) at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:459) at org.jboss.resteasy.core.SynchronousDispatcher.lambda$invoke$4(SynchronousDispatcher.java:233) at org.jboss.resteasy.core.SynchronousDispatcher.lambda$preprocess$0(SynchronousDispatcher.java:139) at org.jboss.resteasy.core.interception.PreMatchContainerRequestContext.filter(PreMatchContainerRequestContext.java:358) at org.jboss.resteasy.core.SynchronousDispatcher.preprocess(SynchronousDispatcher.java:142) at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:219) at org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.service(ServletContainerDispatcher.java:227) at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:56) at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:51) at javax.servlet.http.HttpServlet.service(HttpServlet.java:791) at io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:74) at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:129) at org.keycloak.services.filters.KeycloakSessionServletFilter.doFilter(KeycloakSessionServletFilter.java:90) at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61) at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131) at io.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.java:84) at io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:62) at io.undertow.servlet.handlers.ServletChain$1.handleRequest(ServletChain.java:68) at io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36) at org.wildfly.extension.undertow.security.SecurityContextAssociationHandler.handleRequest(SecurityContextAssociationHandler.java:78) at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) at io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:132) at io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:57) at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) at io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:46) at io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64) at io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:60) at io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:77) at io.undertow.security.handlers.NotificationReceiverHandler.handleRequest(NotificationReceiverHandler.java:50) at io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43) at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) at org.wildfly.extension.undertow.security.jacc.JACCContextIdHandler.handleRequest(JACCContextIdHandler.java:61) at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) at org.wildfly.extension.undertow.deployment.GlobalRequestControllerHandler.handleRequest(GlobalRequestControllerHandler.java:68) at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) at io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:292) at io.undertow.servlet.handlers.ServletInitialHandler.access$100(ServletInitialHandler.java:81) at io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:138) at io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:135) at io.undertow.servlet.core.ServletRequestContextThreadSetupAction$1.call(ServletRequestContextThreadSetupAction.java:48) at io.undertow.servlet.core.ContextClassLoaderSetupAction$1.call(ContextClassLoaderSetupAction.java:43) at org.wildfly.extension.undertow.security.SecurityContextThreadSetupAction.lambda$create$0(SecurityContextThreadSetupAction.java:105) at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502) at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502) at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502) at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502) at io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:272) at io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:81) at io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:104) at io.undertow.server.Connectors.executeRootHandler(Connectors.java:360) at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:830) at org.jboss.threads.ContextClassLoaderSavingRunnable.run(ContextClassLoaderSavingRunnable.java:35) at org.jboss.threads.EnhancedQueueExecutor.safeRun(EnhancedQueueExecutor.java:1985) at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.doRunTask(EnhancedQueueExecutor.java:1487) at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1378) at java.lang.Thread.run(Thread.java:748) ```` [1] https://github.com/GreatPeopleInside/keycloak

7 years, 3 months

1
0
0 / 0

SAML on Tomcat using keyclaok .

by Sandeep Muddamsetty

Hi , We have an requirement to implement SSO on Tomcat . After referring to many blogs and threads we came to know that here is no direct solution in Tomcat like other application servers like WebLogic and WebSphere . And few blogs suggested Key cloak but not full documentation . Can any one help on this to implement SSO on tomcat using Keycloak with guidance or any documentation . Thanks , Sandeep . This e-mail message and any files transmitted with it may contain confidential and proprietary information and are intended solely for the use of the individual or entity to which they are addressed. Any unauthorized review, use, disclosure or distribution is strictly prohibited. If you have received this e-mail in error please notify the sender by reply email and destroy all copies of the original message. Thank you for your cooperation.

7 years, 3 months

1
0
0 / 0

Changing the link in emails sent

by Edmund Loh

Hi In my current implementation, my application makes an api call to Keycloak's REST API to send an email to alert the user to reset their password. The URL in the email would look like this: http://<internal ip address and port>/auth/realms/MyRealm/login-actions/action-token?key=... However, since it is an internal address, the user is enable to access it from his environment. I need the URL in the email to be using an external address instead. Is there a way this can be done? https://<external address>/auth/realms/MyRealm/login-actions/action-token?key=...

7 years, 3 months

2
1
0 / 0

reverse proxy nginx before keycloak

by Greet Robijns

Hi, I am having some trouble configuring my nginx server before my keycloak server. I read the documentation at: https://www.keycloak.org/docs/latest/server_installation/index.html#_sett... . The problem is that the layout files are not loading and after logging in, the redirection is incorrect: it goes to /auth/.... instead of /test/aa/auth. I am really stuck here? Should I change something in my keycloak configuration? my nginx: worker_processes 1; events { worker_connections 1024; } http { sendfile on; server { listen 8080; location /test/aa/ { resolver 127.0.0.11; proxy_pass http://mc:4000/; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header Host $host; } } } Kind Regards, Greet Robijns

7 years, 3 months

3
2
0 / 0

Domain per Realm

by Peter S

I'm currently using several realms. Is there any way at all (or was it ever asked) to have ability to setup a realm on a completely different domain? My services are domain based hence redirect to master domain for signin is somewhat out of sync with the experience. Peter

7 years, 3 months

1
0
0 / 0

Keycloak non-interactive SAML login

by Tom Barber

Hi folks, I have 2 apps, the UI which is authenticated using the Keycloak NodeJS OIDC connector and provides a user UI login. This works fine. Then I have a Java based app that is legacy and uses the Spring SAML connector and when you go to its UI Keycloak also logs you in fine, but we’re trying to connect to its API without a user having to manually open its landing page to login. When you try and use a service on the Java app having authenticated on the client app you get: Note: Since your browser does not support JavaScript, you must press the Continue button once to proceed. In the javascript console. Both these apps are in the same realm. Is there anything I’m missing on the Keycloak side I can do to resolve this issue or do I have to find the Java code and jump in with two feet there? Thanks Tom -- Spicule Limited is registered in England & Wales. Company Number: 09954122. Registered office: First Floor, Telecom House, 125-135 Preston Road, Brighton, England, BN1 6AF. VAT No. 251478891. All engagements are subject to Spicule Terms and Conditions of Business. This email and its contents are intended solely for the individual to whom it is addressed and may contain information that is confidential, privileged or otherwise protected from disclosure, distributing or copying. Any views or opinions presented in this email are solely those of the author and do not necessarily represent those of Spicule Limited. The company accepts no liability for any damage caused by any virus transmitted by this email. If you have received this message in error, please notify us immediately by reply email before deleting it from your system. Service of legal notice cannot be effected on Spicule Limited by email.

7 years, 3 months

2
7
0 / 0

Keyclaok Integration with SAML+ADFS+Tomcat

by Sandeep Muddamsetty

HI , I need assistance in setting up the SSO for my tomcat application using Keycloak . Can any one suggest me on this . Actually my requirement is to use SAML which should redirect to my tomcat application after successful authentication of my ADFS . Can any one suggest a good work around for this or any documentation . Thanks in Advance . Thanks , Sandeep . This e-mail message and any files transmitted with it may contain confidential and proprietary information and are intended solely for the use of the individual or entity to which they are addressed. Any unauthorized review, use, disclosure or distribution is strictly prohibited. If you have received this e-mail in error please notify the sender by reply email and destroy all copies of the original message. Thank you for your cooperation.

7 years, 3 months

1
0
0 / 0

Keycloak - Email-verify Issue

by Parth Kakadiya

I am working with the JHipster built Application where we authenticate via Keycloak(version 4.4.0 final). During verify email, I am receiving email with confirmation link to confirm email. In few situation the verification link is not working. Below I have mention the steps that I did and problems. Steps: 1. Registration with chrome 2. Get mail for email verification 3. Close the chrome and restart 4. Try to use verification link Problem: 1. If I closed the current browser window/ open link in private window/ open link in different browser, the link is not working anymore. Cause of the problem: This problem is accrued because of the cookies that keyclaok creating during registration. AUTH_SESSION_ID and KC_RESTART Because when I close the browser window this cookies are no more in browser. If i try to use verifcation link is the same browser window that i used for Registration than it’s working fine. Becuse in this browser window those two Cookies are stored. Sent from Mail for Windows 10

7 years, 3 months

1
0
0 / 0

keycloak-gatekeeper and token refresh

by Alex Chatziparaskewas

Hi All, We are using keycloak-gatekeeper to secure some server side application, however, we are having troubles with refreshing its access token. Keycloak-gatekeeper stores its access/refresh tokens in server side cookies (kc-access / kc-state). Information about the access token can be obtained via the /oauth/token service. I have now added logging to the client to show for how long the access token is valid. What I see: the number is slowly getting negative, /oauth/expired even says that the access token is expired. Regardless of the 'enable-refresh-tokens' setting, the access token is not refreshed by the keycloak-gatekeeper. Instead after some additional time - the expiry time long showing negative numbers, maybe once the refresh token is also almost expired - the application is delegated to the login sequence at which time (the refresh token still seems to be valid) a new access token is created and the application ends up on its 'home screen'. Question: how to explicitely ask keycloak-gatekeeper to refresh the access token? As the access token is kept in some server side cookie keycloak-gatekeeper must do this. Thanks & Regards, Alex

7 years, 3 months

1
0
0 / 0

Add dynamically resolved token claim

by Vagelis Savvas

Hello, I have an authenticator script and a mapper script and I would like to attach a piece of information during login in the authenticator script then retrieve it in the mapper script and set it as a token claim. (background: this piece of information originates from an extra input field of a custom login page and I want it to appear in the user's access token in order to differentiate users based on it). So, I can't use the user object to attach my info because its not fully reliable. What would work best is to use an object that is unique per authentication session and available in both scripts. The user object is both unique and available but is also a singleton. Thus I've tried via keycloakSession.setAttribute('myInfo', value) in auth script and then keycloakSession.getAttribute('myInfo') in mapper script but it doesn't work (why isn't the keycloakSession object the same in the two scripts?). I've also tried in auth script authenticationSession.setUserSessionNote('myInfo',value) and then userSession.getNote('myInfo') in mapper script but it doesn't work as well. Any further ideas on how to solve this in a reliable way? Cheers, Vagelis

7 years, 3 months

2
3
0 / 0

Timeout value for DEFAULT cache policy

by Chandrashekhar, Nithin

Hello, 1. What is the timeout value for DEFAULT cache policy under user federation? 2. How can this DEFAULT value be configured? Thanks Nithin

7 years, 3 months

1
0
0 / 0

how to access user details.

by Khyati Kataria

Hi, Is there a way to retrieve the last login time of a given user? I would like to store some other user attribute like last successful login time, login attempts, user name etc. Please let me know best possible way to fulfill this requirement. Thanks in advance. Regards, Khyati

7 years, 3 months

2
1
0 / 0

configure keycloak nbf value in jwt token

by Xiaoling Chen

Hi, I am trying to use keycloak as our authentication server in the google cloud endpoints. But looks the google cloud endpoints required nbf > 0. In the jwt token I get from keycloak, the nbf is always 0. Is there a way I can configure the nbf value in the keycloak jwt token? I search the documentation and the internet but did not get any result. Thanks in advanced Xiaoling

7 years, 3 months

2
1
0 / 0

Error controller is not invoked if authentication failed

by Aliaksei Lahachou

Hello, I'm migrating our application from Spring Boot 1.5.19 / Keycloak 3.4.3 to Spring Boot 2.1.2 / Keycloak 4.8.3. I'm currently facing the problem that if authentication fails (invalid token), the error controller is not invoked (BasicErrorController by default). The reason is that when authentication fails, the request is redirected to error controller, and the security filters are invoked again. Because the authorization header is still there, KeycloakAuthenticationProcessingFilter fails again. In older versions of Spring Boot / Keycloak security filters are not invoked after request is redirected to error controller. Basic authentication works as expected in both old and new versions, seemingly because BasicAuthenticationFilter extends OncePerRequestFilter, which skips filter for error URI (skipDispatch method). I created example applications with tests that reproduce the problem, see [1] and [2]. Am I missing some configuration? Or is this a bug? [1] https://github.com/htfv/examples/tree/master/spring-boot-1-keycloak [2] https://github.com/htfv/examples/tree/master/spring-boot-2-keycloak Regards, Aliaksei

7 years, 3 months

1
1
0 / 0

OIDC login URLs, how to hide them from the user??

by Max Allan

Hi, When a user hits a (Keycloak gatekeeper) protected site, they get redirected to the keycloak server login page, a URL like this : https://auth.website.org.uk/auth/realms/saturn/protocol/openid-connect/au... So, a typical new user journey looks like "type in https colon slash *which slash was it? oh that one* and another slash ww dot website dot com *oops no, www and dot org dot uk ENTER" *I don't want to type _that_ in again : Click Bookmark button QUICK* So they've now bookmarked a login page that includes a state of 7103.... The session they have works and if they don't use their bookmark, it works. If they come back to it later, and use the bookmark, get asked to login and then get a "403 authorisation denied" error. The gatekeeper logs say : 1.5481603986412873e+09 error State parameter mismatch 1.5481603986665585e+09 error unable to exchange code for access token {"error": "invalid_grant: Incorrect redirect_uri"} So, how can I make this user journey easier with keycloak? Ideally I'd like to hide the auth urls completely, their browser doesn't need to know they're authenticating on different site. I tried a "sign-in-page" with a frame containing the login page from keycloak : <html> <frameset cols="100%"> <frame src="{{ .redirect }}"> </frameset> </html> (and change the security settings for frame-ancestors ) And when you've logged in, you get an empty page with a 403 error. Gatekeeper says "unable to exchange code for access token {"error": "invalid_grant: Incorrect redirect_uri"}" again. Keycloak says : type=CODE_TO_TOKEN_ERROR, realmId=86979f4f-7314-4fb6-86bc-3516fcb0c3ae, clientId=alb, userId=01cf3b8f-498e-46b8-815e-6a9a5c2dda1c, ipAddress=180.430.597.666, error=invalid_code, grant_type=authorization_code, code_id=02221f30-faa5-48ad-aae6-a5adec6a705a, client_auth_method=client-secret (ip address etc. has been obfuscated) IF the user is clever, they can then remove the oauth/authorize?state=ba4fcb0d-6ecf-4afe-8b98-e0fbcbc4ca25 from the URL in the browser and the session carries on quite happily. Is there a setting I'm getting wrong in keycloak somewhere that is breaking this? In this first instance, we are returning to an old "state". I can imagine that not working. But the second setup, I'm just logging in to keycloak, in a frame, nothing else has changed from a "working" setup, just the login page is in a frame. (I also need to figure out how to escape the frame!!) Thanks, Max

7 years, 3 months

1
0
0 / 0

Gatekeeper docker configuration question

by Dimitris Charlaftis

Hello, I use the following gatekeeper docker image https://hub.docker.com/r/keycloak/keycloak-gatekeeper/ In the gatekeeper-config.yaml file --- client-id: test_app client-secret: xxxxxxxxxxxxxxxxxxxxxxxxxxxx discovery-url: http://dev.server:8202/auth/realms/internal_applications listen: 127.0.0.1:3000 secure-cookie: false enable-default-deny: false redirection-url: http://site.gr upstream-url: 127.0.0.1:80 resources: - uri: /* white-listed: true --- (keycloak server runs at http://dev.server:8202) I run the gatekeeper container as following docker run --name=keycloak_gatekeeper --rm -it -v /home/dharlaftis/docker/gatekeeper:/tmp -p 8213:3000 keycloak/keycloak-gatekeeper --config /tmp/gatekeeper-config.yaml As i have a port mapping 8213:3000, i expect the following sxcenatio 1. I hit the host machine through http at 8213 port http://dev.server:8213 2. will end up to the listening interface 127.0.0.1:3000 of the gatekeeper which in turn 3. will redirect the request to http://site.gr correct? none of the above happens... when i hit http://dev.server:8213 nothing happens (site unavailable). Also, what is the difference between redirection-url and upstream-url? How is this configured? Thank you in advance!!! please help... Dimitris -- _____________________________ Dimitris Charlaftis Software Engineer National Documentation Center email: dharlaftis(a)ekt.gr _____________________________

7 years, 3 months

1
0
0 / 0

User federation via AD/LDAP - how to handle deleted users?

by Thomas Darimont

Hello, currently, Keycloak (up to 4.8.2) does not handle the case where a user is deleted in the federated user-store when the built-in LDAP / AD federation provider is used. The relevant code is located within the LDAPStorageProviderFactory: https://github.com/keycloak/keycloak/blob/c4a46a5591471893db8428a5707c2d9... There is a TODO which reads: // TODO: Remove all existing Keycloak users, which have federation links, but are not in LDAP. Perhaps don't check users, which were just added or updated during this sync? I wonder what would be the right thing to do in this case.. If the federated user-store dictates the truth, then IMHO the right thing to do would be to also delete the user that is associated with the user-storage provider federation link in Keycloak, if the linked AD / LDAP user was deleted. How do you handle this situation in your systems? Cheers, Thomas

7 years, 3 months

2
2
0 / 0

Re: [keycloak-user] Shared datastore?

by Sebastian Laskawiec

Yes, I think that could be case, I see a plenty of places where we use SKIP_CACHE_STORE. Let me ask Marek for help here since it has been implemented long before I joined the team and I don't know the history behind it... On Thu, Nov 8, 2018 at 8:48 PM William Burns <wburns(a)redhat.com> wrote: > > > ----- Original Message ----- > > From: "Sebastian Laskawiec" <slaskawi(a)redhat.com> > > To: "Nicolas Ocquidant" <nocquidant(a)gmail.com> > > Cc: keycloak-user(a)lists.jboss.org, "Will Burns Rosenquist Burns" < > wburns(a)redhat.com> > > Sent: Thursday, November 8, 2018 12:33:47 PM > > Subject: Re: [keycloak-user] Shared datastore? > > > > So I think there are at least two ways to address this problem. This > first > > one is to use Offline Tokens [1]. I'm not sure if that fits into your > > application since it requires your client applications to store the > token. > > In other words you can simply delegate this problem one layer below in > your > > system. > > > > If that doesn't work for you, yes passivation is a way to go. Frankly, I > > haven't used passivation but from the manual I see it works hand in hand > > with eviction [2][3]. Will (on CC) can probably correct me here, but my > > understanding is that whenever an entry gets evicted, the passivation > > mechanism picks it up and stores somewhere. > > It does and it works, the problem is that passivation doesn't play well > with shared stores in Infinispan. We prevent this configuration in 9.4 or > newer even. > > I recommended that Nicolas just use eviction and a shared store without > passivation. However it seems that entries are not written to the store in > this configuration. My guess is that KeyCloak performs write operations > with the SKIP_CACHE_STORE flag and assumes entries will only be written to > the store due to passivation. Is there a reason for that? > > > > > [1] http://blog.keycloak.org/2015/12/offline-tokens-in-keycloak.html > > [2] > > > http://infinispan.org/docs/stable/user_guide/user_guide.html#cache_passiv... > > [3] > > > https://github.com/infinispan/infinispan/blob/master/core/src/test/java/o... > > > > On Thu, Nov 8, 2018 at 5:40 PM Nicolas Ocquidant <nocquidant(a)gmail.com> > > wrote: > > > > > My requirements are the following: store tokens emitted by KC during > one > > > year. > > > > > > I don't know how many users there are, but here are the number I get: > > > * the number of connections a week is about 700k. > > > * the number of session refresh a week is about 200k. > > > > > > I approximated around 1M of sessions a week, thus 52M a year. > > > In memory, a user session has been estimated around 4KB (about 1KB in > > > file/DB). > > > > > > But I guess a refresh does not create another session isn't it? And > maybe > > > it's possible to ask KC to delete previous emitted tokens when a new > one is > > > created for a same user? > > > > > > If yes, my estimation is probably a little bit too high here, but I > > > certainly have several millions of tokens to keep (and maybe dozens of > > > millions). > > > > > > Thanks > > > --nick > > > > > > Le mer. 7 nov. 2018 à 18:17, Nicolas Ocquidant <nocquidant(a)gmail.com> > a > > > écrit : > > > > > > > Hi, > > > > > > > > According to Infinispan, when passivation is disabled, every update > to > > > the > > > > cache should always write to the store. > > > > > > > > But I can't manage to get it work with Keycloak. If I disable > > > passivation, > > > > my SQL store (Postgres) stays empty, even if the cache is full. > > > > > > > > So, if passivation is needed for Keycloak to write to the DB, it > means > > > > that the use of a shared DB is not possible... > > > > > > > > But this leads to another issue for me. Enable passivation without a > > > > shared DB seems to imply that either 'fetch-state' or 'purge' should > be > > > > enabled on startup, in order for the cache to not contain stale > entries. > > > > > > > > 15:27:44,626 WARN > > > > > [org.infinispan.configuration.cache.AbstractStoreConfigurationBuilder] > > > (MSC > > > > service thread 1-6) ISPN000149: Fetch persistent state and purge on > > > startup > > > > are both disabled, cache may contain stale entries on startup > > > > > > > > As I need to keep millions of sessions, this will considerably slow > down > > > > the startup of my node (when started again after a crash for > instance). > > > > > > > > So, is shared datastore allowed in Keycloak? If yes, how to enable > it? > > > > Otherwise what other options do I have to improve my startup time, if > > > > millions of sessions are in the store? > > > > > > > > Thanks > > > > --nick > > > > > > > _______________________________________________ > > > keycloak-user mailing list > > > keycloak-user(a)lists.jboss.org > > > https://lists.jboss.org/mailman/listinfo/keycloak-user > > >

7 years, 3 months

4
3
0 / 0

Google login without automatic user registration

by Scott Thibault

Out-of-the-box, the First Broker Login flow automatically registers non-existing users authenticated by an identity provider. I would not like anyone with a valid Google account to be able to login, but only those with existing accounts. However, any attempt to create a custom flow without the "Create User If Unique" item leads to an error=invalid_user_credentials. Is there some solution that would allow me to prevent users without an existing account to login via the Google identity provider?

7 years, 3 months

3
7
0 / 0

Registration page and comboboxes

by Luca Stancapiano

I have a registration page in a Keycloak theme where the user has to choose from a list from a combobox. This list is dynamic, meaning it could be changed by an administrator at any time. What is the best way to manage this list with Keycloak? Can I use the administrative console to update this data? If you are on which component?

7 years, 3 months

2
2
0 / 0

Post profile update required actions

by Emilien Bondu

Hello, I am working on user's mobile phone number attribute validation with SMS code. To do this I created some required actions to send sms code and validate the user profile attribute. Everything is ok for user registration and post external providers login (Post Login Flow), however I would like to validate the mobile number with these required actions during user profile modification. I tried to implement an event listener to add required actions on user profile after the profile update but this actions will only be triggered during the next login (asynchronously). Is there any way to trigger required actions during user profile modification with a "Post Profile Update Flow" ? Here the link to the project : https://github.com/ebondu/keycloak-sms-authenticator-sns Thanks, Emilien

7 years, 3 months

1
0
0 / 0

Missing permissions

by Julien Deruere

I'm getting permissions from this request: curl -X POST \ http://${host}:${port}/auth/realms/${realm}/protocol/openid-connect/token \ -H "Authorization: Bearer ${access_token}" \ --data "grant_type=urn:ietf:params:oauth:grant-type:uma-ticket" \ --data "audience={resource_server_client_id}" \ --data "response_mode=permissions" Which give me the good results when I use Keycloak UI to share a resource. Then if I give permission user the Policy API: curl -X POST \ http://localhost:8180/auth/realms/photoz/authz/protection/uma-policy/{res... \ -H 'Authorization: Bearer '$access_token \ -H 'Cache-Control: no-cache' \ -H 'Content-Type: application/json' \ -d '{ "name": "Any people manager", "description": "Allow access to any people manager", "scopes": ["read"], "groups": ["/Managers/People Managers"] }' It works and I can see it in the Keycloak User panel or in the evaluate permission page, but first request does not I mention does not include this permission in the response. Any idea?

7 years, 3 months

3
6
0 / 0

User Federation

by James Pridmore

Hi all, I wonder if anyone could help me. I'm trying to set up a realm with user federation. I'd like that realm to point to another realm within the same instance of Keycloak. Is this possible and if so, how do I go about it? The reason for this is we have one application supporting different contracts, users have different permissions in different contracts. We think we can achieve this by setting up 1 client over multiple realms and using one set of users in all those realms but with different permissions in each realm. Any advice is much appreciated. Kind regards, James

7 years, 3 months

2
1
0 / 0

Keycloak Gatekeeper docker image yml file

by Dimitris Charlaftis

Hello, I want to deploy the following keycloak gatekeeper docker image https://hub.docker.com/r/keycloak/keycloak-gatekeeper I want to map a .yml file through the VOLUME command but i don't know the path of the configuration inside the docker container. Please can you provide where can i map the .yml file (the correct path inside the docker container) for the configuration? Documentation presents a sample yml file, but it does not say where tomap it inside the container... Thank you! Dimitris -- _____________________________ Dimitris Charlaftis Software Engineer National Documentation Center email: dharlaftis(a)ekt.gr _____________________________

7 years, 3 months

2
2
0 / 0

Has anyone installed keycloak using snap or juju

by Chris Smith

I created a new Ubuntu 18.10 Server VM During install It had a step about installing common snaps. Keycloak was one of them. I selected it and I have no idea about how or where it installed keycloak or how to start keycloak. I'm dubious as to it's usefulness as Java did not get installed. Googleing has informed me a bit about snapd (snappy) and juju, but my attempts at using them were futile. Are snap and juju based installation packages still half baked?

7 years, 3 months

1
0
0 / 0

Access user attributes in terms.ftl

by Sidney Beekhoven

Hello everyone, I am trying to access the user attributes in a custom theme that I am developing. Under theme_folder/login/terms.ftl I want to access some of the user attributes to display the respective Terms and Conditions for each user. Somehow user is always null in the terms.ftl. If i look in the source code where the freemarker template is processed i don’t see the user being set as freemarker model attribute so i guess it is not possible to access the user(’s attributes) from a required action template. Does anyone know of any way to reach the user attributes in terms.ftl? Best regards, Sidney Beekhoven

7 years, 3 months

1
0
0 / 0

Re: [keycloak-user] kcadm update client seems to ignore defaultClientScopes

by Marek Posolda

Yes, they are few places, where there are inconsistencies between creates and updates. And yes, there is plan to improve admin REST API in the future to improve and hopefully remove such inconsistencies. Thanks, Marek On 18/01/2019 05:38, Matt Evans wrote: > Hi Marek > > I took your advice and looked at what the console does. It seems that > you have to individually PUT or DELETE each client scope in the > defaultClientScopes and optionalClientScopes. > > e.g. PUT /clients/<client id>/defaultClientScopes/<scope id> > > I tried to PUT to the /clients/<client id>/defaultClientScopes > endpoint to set all the default client scopes in one go but the method > is not allowed. > > We currently have our clients deployed using ansible calling kcadm > with the json template, this works well for creating new clients, the > default client scopes are set correctly, but the update of an existing > client template ignores them if they are specified in the json. > > Whilst we can add more code to extract the scopes from the template > and individually call DELETE or PUT to adjust them it seems overly > complicated. I guess for now we will delete and create the whole > client if we need to update them. > > Are there plans to improve this in the future? It seems inconsistent > that the rest endpoint for the client just ignores those properties > for updates, but accepts them for creates. > > Thanks > > Matt > > > On Thu, 17 Jan 2019 at 22:20, Marek Posolda <mposolda(a)redhat.com > <mailto:mposolda@redhat.com>> wrote: > > There are separate REST API operations for add/remove default client > scope or optional client scope. I suggest to try admin console with > browser and inspect the REST request, which admin console is doing > for > add/remove client scopes for client. This may show you how the REST > request looks like and you should be able to "translate" this into > proper format for kcadm then. > > Marek > > On 17/01/2019 05:27, Matt Evans wrote: > > Has anyone noticed that updating a client using kcadm seems to > ignore the > > defaultClientScopes property? > > > > /opt/keycloak/bin/kcadm.sh update > > clients/366b5cb2-f4ac-4b81-9ccb-1e8198fec9f9 -r therealm -s > > 'defaultClientScopes=["web-origins"]' -s name=changedName > --no-config > > --server http://localhost:8080/auth --realm master --user admin > --client > > admin-cli --password xxxx > > > > We can update other properties ok, e.g. name, client id, > redirectUris all > > update ok, but defaultClientScopes doesn't change. Also I think > > optionalClientScopes doesn't change either. > > _______________________________________________ > > keycloak-user mailing list > > keycloak-user(a)lists.jboss.org <mailto:keycloak-user@lists.jboss.org> > > https://lists.jboss.org/mailman/listinfo/keycloak-user > >

7 years, 3 months

1
0
0 / 0

kcadm update client seems to ignore defaultClientScopes

by Matt Evans

Has anyone noticed that updating a client using kcadm seems to ignore the defaultClientScopes property? /opt/keycloak/bin/kcadm.sh update clients/366b5cb2-f4ac-4b81-9ccb-1e8198fec9f9 -r therealm -s 'defaultClientScopes=["web-origins"]' -s name=changedName --no-config --server http://localhost:8080/auth --realm master --user admin --client admin-cli --password xxxx We can update other properties ok, e.g. name, client id, redirectUris all update ok, but defaultClientScopes doesn't change. Also I think optionalClientScopes doesn't change either.

7 years, 3 months

2
2
0 / 0

Create initial access token from command line

by Puneeth M I

Hi, I want to create an initial access token with expiration=60 seconds and count=1 from command line using admin-cli through kcadm.sh script or a curl command and share with the clients to register(create clients) themselves at keycloak. I am using the following curl command as per the keycloak document but I am getting 401 unauthorized error. I am create an Initial access token from admin console but I don't want to expose it. *Please let me know on how to generate InitialAccessToken from CLI to register a client. * *# curl -i -H 'Content-Type: application/json' -X POST http://<keycloak-IP>:<port>/auth/admin/realms/master/clients-initial-access <http://10.91.96.30:8665/auth/admin/realms/master/clients-initial-access> -d "client_id=admin-cli&grant_type=password&username=admin&password=admin"* HTTP/1.1 401 Unauthorized Connection: keep-alive Content-Length: 0 Date: Tue, 15 Jan 2019 09:16:07 GMT *I am able to register a client using the access token obtained from below command but I cannot control it for number of client registrations.* # *curl -i -H 'Content-Type: application/x-www-form-urlencoded' -X POST http://<keycloak-ip>:<port>/auth/realms/master/protocol/openid-connect/token <http://10.91.96.30:8665/auth/realms/master/protocol/openid-connect/token> -d "client_id=admin-cli&grant_type=password&username=admin&password=admin"* 1. HTTP/1.1 200 OK Connection: keep-alive Cache-Control: no-store Set-Cookie: KC_RESTART=; Version=1; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Max-Age=0; Path=/auth/realms/master/; HttpOnly Pragma: no-cache Content-Type: application/json Content-Length: 1848 Date: Tue, 15 Jan 2019 06:37:47 GMT {"access_token":"eyJhbGciOiJSUzI1NiIs....","expires_in":60,"refresh_expires_in":1800,"refresh_token":"eyJhbGciOi.....","token_type":"bearer","not-before-policy":0,"session_state":"7af01cbb-f268-4263-bed2-c11a14008949","scope":"email profile"} I am using Keycloak - Version *4.5.0* in standalone-HA mode. Regards, Puneeth

7 years, 3 months

2
1
0 / 0

keycloak security proxy does not proxy to external application url

by Dimitris Charlaftis

Hello, I have built the architecture shown in the attached image. Step 1. A client authentication request reaches the keycloak security proxy docker container Step 2. Proxy asks the actual keycloak server docker container Step 3. Keycloak Server asks an external LDAP for user credentials Step 4. Keycloak server replies OK Step 5. Keycloak proxy replies OK and passes control to the external application url. THE PROBLEM IS that after successful authentication, the url of the host server (i.e. where the keycloak proxy container and keyclak authentication container lie) appears on the address bar of the browser instead of the actual external application url. For example, if the host machine where the keycloak containers lie is keycloak.containers.gr, and the external application domain name is www.external.application.gr, then, after a SUCCESSFUL login to the keycloak SSO login page, the url in the address bar appears to behttp://keycloak.containers.gr <http://keycloak.containers.gr/>instead ofhttp://www.external.application.gr <http://www.external.application.gr/>. This fact destroys all the relative css, js scripts, etc, attached to the site www.external.application.gr. KEYCLOAK SECURITY PROXY CONFIGURATION { "target-url": "http://www.external.application.gr", "bind-address": "0.0.0.0", "send-access-token": true, "http-port": "8180", "https-port": "8443", "applications": [{ "base-path": "/", "adapter-config": { "realm": "internal_applications", "auth-server-url": "http://keycloak.containers.gr:8202/auth", "resource": "test_app", "ssl-required": "external", "credentials": { "secret": "xxxxx-xxx-xxx-xxxx-xxxxxxxxxxx" } }, "constraints": [{ "pattern": "/*", "authenticate": true }], "proxy-address-forwarding": true }] } I use a proxy.json for the keycloak security proxy configuration NOTE: I have tried to change the "bind-address": "0.0.0.0" parameter, from 0.0.0.0 to the IP of the www.external.application.gr but with no luck... please... any help?? Thank you!! Dimitris -- _____________________________ Dimitris Charlaftis Software Engineer National Documentation Center email: dharlaftis(a)ekt.gr _____________________________

7 years, 3 months

2
1
0 / 0

gatekeeper and multiple realms per subdomain

by Clint Shuman

I have a multi-tenant application that has a keycloak realm per subdomain. Is there a recommended way to configure keycloak-gatekeeper for such a setup? Is there an interface that I could implement to dynamically select a keycloak realm given the subdomain of the origin? Thanks, Director of Systems Architecture REPAY Telephone:404.637.1680 Customer Service: 877.607.5468 Email:cshuman@repay.com Web:www.repay.com This email message is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply email and destroy all copies of the original message.

7 years, 3 months

1
0
0 / 0

Kerberos Credential Delagation

by Chris Smith

I have a web app that is secured by KC and uses Active Directory to authenticate users. I have a requirement to get a Kerberos ticket (GSSCredential) to connect to an IBM i Server. SSO/EIM is successfully setup on the IBM i. My Web app is following the instructions at https://www.keycloak.org/docs/latest/server_admin/index.html#credential-d... My servlet code KeycloakPrincipal<KeycloakSecurityContext> kcp = (KeycloakPrincipal<KeycloakSecurityContext>)request.getUserPrincipal(); AccessToken at = kcp.getKeycloakSecurityContext().getToken(); String username = at.getPreferredUsername(); System.out.println(at.getName()); wtr.append("Windows User: ").append(username).append('\n'); // Retrieve kerberos credential from accessToken and deserialize it Map<String, Object> otherClaims = at.getOtherClaims(); String otherClaim = (String)otherClaims.get(KerberosConstants.GSS_DELEGATION_CREDENTIAL); GSSCredential gssCredential = KerberosSerializationUtils.deserializeCredential(otherClaim); The otherClaims map is always empty. KerberosSerializationUtils.deserializeCredential(otherClaim); throws this exception since otherClaim is null; org.keycloak.common.util.KerberosSerializationUtils$KerberosSerializationException: Null credential given as input. Did you enable kerberos credential delegation for your web browser and mapping of gss credential to access token?, Java version: 1.8.0_192, runtime version: 1.8.0_192-b12, vendor: Oracle Corporation, os: 6.2 at org.keycloak.common.util.KerberosSerializationUtils.deserializeCredential(KerberosSerializationUtils.java:70) at testing.LogIn.doGet(LogIn.java:71) at javax.servlet.http.HttpServlet.service(HttpServlet.java:622) at javax.servlet.http.HttpServlet.service(HttpServlet.java:729) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:292) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:207) at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:240) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:207) at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:212) at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:94) at org.keycloak.adapters.tomcat.AbstractAuthenticatedActionsValve.invoke(AbstractAuthenticatedActionsValve.java:67) at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:604) at org.keycloak.adapters.tomcat.AbstractKeycloakAuthenticatorValve.invoke(AbstractKeycloakAuthenticatorValve.java:181) at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:141) at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:80) at org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:620) at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:88) at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:502) at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1152) at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:684) at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1539) at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.run(NioEndpoint.java:1495) at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) at java.lang.Thread.run(Thread.java:748) Kerbos delegation is enabled in the browser and mapping of gss credential to access token What am I missing?

7 years, 3 months

2
2
0 / 0

Download and import X.509 client certificate from Keycloak

by Wei He

Hello dear all, A question about the process to get the client X.509 certification: I set up the Keycloak 4.8.2-Final on my localhost and enabled the SSL as described in the documenthttps://www.keycloak.org/docs/latest/server_admin/index.html#_x509. The server could start but I could not open the server page on the localhost:8443 (openssl s_client -connect 127.0.0.1:8443) due to the SSL error code 42 (4566025836:error:1401E412:SSL routines:CONNECT_CR_FINISHED:sslv3 alert bad certificate:/BuildRoot/Library/Caches/com.apple.xbs/Sources/libressl/libressl-22.230.1/libressl-2.6/ssl/ssl_pkt.c:1205:SSL alert number 42), which means that the client certificate problem. But my imagination was that the server should redirect me to the login page. After I logged in, the server should generate the client certificate and ask me to download the certification and import it to my browser. After that I should be able to connect to the server without any further authentication, because I already had the client certificate trusted by the Keycloak. What did I do wrong? Or this process is not supported by the current keycloak yet? Thanks a lot! Wei He

7 years, 3 months

1
0
0 / 0

shared UMA 2.0 resource & scope based policies

by Marek Lindner

Hi, I am working on a keycloak setup trying to replicate the photoz example. The 'test' realm is configured as follows: * UMA enabled * has a client 'photoz' with Authorization enabled * 2 authorization scopes: album:view & album:modify * each scope has a scope-based 'only owner' permission associated (Javascript) * 2 users: alice and bob Alice creates a new album resouce with the following request: POST /auth/realms/test/authz/protection/resource_set {"name": "Amazing sunsets", "owner": "alice", "ownerManagedAccess": "true", "uri": "/albums/100", "type": "album", "resource_scopes": ["album:view", "album:modify"]} Simulating Bob accessing album "Amazing sunsets" using the authorization evaluation tab, returns permission denied for both scopes (view & modify) as expected. Now, Alice shares "Amazing sunsets" via the account management interface but limits the scope to 'view' by sharing 'album:view' only. Back to evaluating Bob's access: * Scope album:view on "Amazing sunsets" is granted (yay!). * Scope album:modify on "Amazing sunsets" also is granted ?? Why would Bob get full access if Alice only shared album:view ? The evaluation output even states that the granted album:view access was the reason why access to album:modify is granted too (see attached screenshot for details). Does anybody have a suggestion what I am missing here ? Thanks, Marek

7 years, 3 months

4
16
0 / 0

RestEasy Client doesn't support logging in as a service account

by Marc Spehlmann

I have tried to configure the RestEasy client to use a service account for one of my confidential clients. The Java code to configure the client looks like: ``` import org.keycloak.admin.client.Keycloak; import org.keycloak.admin.client.KeycloakBuilder; class Scratch { public static void main(String[] args) { final String server = "localhost:8082"; final String realm = "master"; final String clientSecret = "00000000-0000-0000-0000-000000000000"; final String clientId = "MyClient"; Keycloak keycloak = KeycloakBuilder.builder() .serverUrl(server) .realm(realm) .clientId(clientId) .clientSecret(clientSecret) .build(); keycloak.realm("master") .clients() .findAll(); } } ``` This will fail with the exception: ``` Exception in thread "main" java.lang.IllegalStateException: username required at org.keycloak.admin.client.KeycloakBuilder.build(KeycloakBuilder.java:131) at Scratch.main(scratch_41.java:17) ``` I have a workaround, but my question is, is there any plan to support service-accounts with the keycloak client?

7 years, 3 months

2
1
0 / 0

OTP only option Question

by Jason Prouty

I have my radius working to Keycloak with Username/PW. I would like to use OTP only. When configure the OTP settings I still get prompted for password then the OTP. is it possilble to do OTP only and no password.

7 years, 3 months

1
0
0 / 0

How can I disable the user caching?

by Chandrashekhar, Nithin

Hello, Keycloak version: 4.8.0.Final Login as user ‘X’ who belongs to 10 groups in openldap. I can see that user with 10 groups in the keycloak dashboard. I make this user part of one more group in openldap server. But in the keycloak dashboard, I don’t see this new group getting added for the user. I know that the new group not getting updated behavior is due to the caching. When I tried to invalidate the cache using Cache Policy under User Federation, I see that groups for the user ‘X’ gets updated but in the overall groups, the new group gets duplicated. I saw some posts online where I can disable user cache by setting userCache attribute in standalone.xml to false and restarting keycloak (using ./jboss-cli.sh --connect and reload). But when I try to reload keycloak, I see Failed to establish connection in 6033ms. So I am not very sure if keycloak reloaded and the changes I made had any effect or not. Please advise me on how I can disable user caching or if I am doing something wrong. Thanks Nithin

7 years, 3 months

1
0
0 / 0

Use a docker secret in wildfly config

by James Campbell

Hi all-- Is it possible to use a docker secret (i.e. contents of a file mounted in /run/secrets) in the wildfly/standalone.xml config to store a database password? I saw the vault option, but if there's another way to take care of that, it seemed preferable. James

7 years, 3 months

1
0
0 / 0

Keycloak events related to token/session expiry

by Vineet Reynolds

My goal is to implement the event listener SPI to listen for logout and session expiration events so that I could update a custom attribute in the user model. Does Keycloak generate any events that can be listened to, in order to detect if the token or associated session has expired? I've looked at the events listed in the EventType enumeration, and none of them seem to be related to the specific expiration event. I also enabled event logging, and no events related to expiry seemed to appear in the Keycloak administration console; logout events were generated when users signed out of the client app, but no event appeared to generated on expiry. I'm using Keycloak 3.4.3, but I suppose an answer for Keycloak 4.8 will be good enough for me. Thanks, Vineet

7 years, 3 months

2
1
0 / 0

Multi Tenancy

by James Pridmore

Hi, I wonder if you could offer some advice. We 're writing a React application and we are going to use keycloak for the security. We have no prior experience using keycloak and we need to figure out the best way of representing our security model. We have users and contracts, users might need to access different contracts and have different levels of security in each contract. At the minute, we've set up each contract as a client, and granted a user permissions in each contract. When we log in, a user receives all permissions from every client in the JWT. I switched on Client Scope for each contract, and now we only get permissions for the individual client whose client_id I pass in when logging in. I'm having trouble switching between clients without having to re-log in (I was hoping to use the refresh token endpoint with a different client_ id for this). I'd like to avoid sending all the permissions down in the token if possible. Is there a better way of going about this, a better way of modelling out data within keycloak, what would you recommend? Kind regards, James

7 years, 3 months

1
0
0 / 0

Docker image http connection pool

by Lukasz Lech

Hello, Maybe it's a trivial question, but I've failed to find an answer.... What is the default http connection pool size in keycloak docker image, and how can I configure it? My keycloak instance fails by large number of requests, although it has enough CPU and RAM resources... so I suppose the connection pool size is too little... Best regards, Lukasz Lech

7 years, 3 months

2
1
0 / 0

use keycloak security proxy to proxy to external url

by Dimitris Charlaftis

Hello, I am using the following scheme in docker containers I use keycloak security proxy to proxy a test application (step 5) to an external url, which lies outside the host machine where the keycloak server and keycloak proxy lie. Keycloak uses ldap federation. Keykloak proxy.json is the following { "target-url": "yyyyy.yyyyyy (url of external application", "bind-address": "0.0.0.0", "send-access-token": true, "http-port": "8180", "https-port": "8443", "applications": [ { "base-path": "/", "adapter-config": { "realm": "internal_applications", "auth-server-url": "xxxxxx (url of keycloak auth server ", "resource": "test_app", "ssl-required": "external", "credentials": { "secret": "xxxxxxxxxxxxxxxxx" } }, "constraints": [ { "pattern": "/*", "authenticate": true } ], "proxy-address-forwarding": true } ] } inside the keycloak server, i have set up a client such that (look the image beow) this means that i want to proxy to www.google.com The problem is that after a successful login, user is redirected to the test application BUT in the browser address bar remains the host machine domain name and NOT the external url.... strange... if i change the "bind-address" parameter from 0.0.0.0 to the external IP or domain name where i want to proxy, the site is unavailable... Note that inside the proxy docker container i can curl http://www.google.com with success. I would be grateful for any help provided... Regards, Dimitris -- _____________________________ Dimitris Charlaftis Software Engineer National Documentation Center email: dharlaftis(a)ekt.gr _____________________________ --- This email has been checked for viruses by AVG. https://www.avg.com

7 years, 3 months

1
0
0 / 0

Kubernetes: found IPv4 multicast address in an IPv6 stack

by Lukasz Lech

Hello, I was succesfully running Keycloak as docker image (4.8.1), however, when I try to run in Kubernetes, I'm getting the following error: 07:53:34,742 ERROR [org.jboss.msc.service.fail] (ServerService Thread Pool -- 52) MSC000001: Failed to start service org.wildfly.clustering.jgroups.channel.ee: org.jboss.msc.service.StartException in service org.wildfly.clustering.jgroups.channel.ee: java.lang.IllegalStateException: java.lang.Exception: found IPv4 multicast address /230.0.0.4 in an IPv6 stack at org.wildfly.clustering.service.FunctionalService.start(FunctionalService.java:70) at org.wildfly.clustering.service.AsyncServiceConfigurator$AsyncService.lambda$start$0(AsyncServiceConfigurator.java:117) at org.jboss.threads.ContextClassLoaderSavingRunnable.run(ContextClassLoaderSavingRunnable.java:35) at org.jboss.threads.EnhancedQueueExecutor.safeRun(EnhancedQueueExecutor.java:1985) at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.doRunTask(EnhancedQueueExecutor.java:1487) at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1378) at java.lang.Thread.run(Thread.java:748) at org.jboss.threads.JBossThread.run(JBossThread.java:485) Caused by: java.lang.IllegalStateException: java.lang.Exception: found IPv4 multicast address /230.0.0.4 in an IPv6 stack at org.jboss.as.clustering.jgroups.subsystem.ChannelServiceConfigurator.get(ChannelServiceConfigurator.java:116) at org.jboss.as.clustering.jgroups.subsystem.ChannelServiceConfigurator.get(ChannelServiceConfigurator.java:58) at org.wildfly.clustering.service.FunctionalService.start(FunctionalService.java:67) ... 7 more Caused by: java.lang.Exception: found IPv4 multicast address /230.0.0.4 in an IPv6 stack at org.jgroups.stack.Configurator.setDefaultValues(Configurator.java:137) at org.jgroups.stack.ProtocolStack.init(ProtocolStack.java:829) at org.jgroups.JChannel.<init>(JChannel.java:200) at org.jboss.as.clustering.jgroups.JChannelFactory.createChannel(JChannelFactory.java:116) at org.jboss.as.clustering.jgroups.subsystem.ChannelServiceConfigurator.get(ChannelServiceConfigurator.java:96) ... 9 more Server seems to listen, going to / returns redirect to /auth, but going to /auth results in 404, no further error lands in logs... Anyone has any idea what it can be? Best regards, Lukasz Lech

7 years, 3 months

2
2
0 / 0

Fine Authorization on User Account Service

by Nikola Malenic

I am trying to disable access to the account service to all users by using js policy (I have a reason for this). So what I tried is to put just $evaluation.deny(); in the body of the policy, to restrict access to all users. In Evaluate tab I can see that this policy is denying access but when I access account service application via browser I get access. Anyone has an idea what could be wrong? Here is my Authorization config exported: { "allowRemoteResourceManagement": false, "policyEnforcementMode": "ENFORCING", "resources": [ { "name": "account_resource", "type": "urn:account:resources:accountresource", "ownerManagedAccess": false, "displayName": "account_resource", "attributes": {}, "_id": "778c2a62-4415-4cf1-a057-a60f0beeb0a4", "uris": [ "/*" ] } ], "policies": [ { "id": "4de5145d-4d34-411f-9b2a-d99cc361a08c", "name": "auth_method_policy", "description": "Policy based on authentication method used", "type": "js", "logic": "POSITIVE", "decisionStrategy": "UNANIMOUS", "config": { "code": "// var context = $evaluation.getContext();\r\n// var identity = context.getIdentity();\r\n// var attributes = identity.getAttributes();\r\n\r\n// if (attributes.getValue(\"chosen_authenticator\").asString(0).endsWith('userpas s')) {\r\n// $evaluation.deny();\r\n// } else {\r\n// $evaluation.deny();\r\n// }\r\n" } }, { "id": "e2567a26-aa46-4f0f-aba7-421e35b90615", "name": "auth_based_permission", "type": "resource", "logic": "POSITIVE", "decisionStrategy": "UNANIMOUS", "config": { "resources": "[\"account_resource\"]", "applyPolicies": "[\"auth_method_policy\"]" } } ], "scopes": [] }

7 years, 3 months

2
1
0 / 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

keycloak-user January 2019