January 2019 - keycloak-user - Jboss List Archives

RestEasy Client doesn't support logging in as a service account

by Marc Spehlmann

I have tried to configure the RestEasy client to use a service account for one of my confidential clients. The Java code to configure the client looks like: ``` import org.keycloak.admin.client.Keycloak; import org.keycloak.admin.client.KeycloakBuilder; class Scratch { public static void main(String[] args) { final String server = "localhost:8082"; final String realm = "master"; final String clientSecret = "00000000-0000-0000-0000-000000000000"; final String clientId = "MyClient"; Keycloak keycloak = KeycloakBuilder.builder() .serverUrl(server) .realm(realm) .clientId(clientId) .clientSecret(clientSecret) .build(); keycloak.realm("master") .clients() .findAll(); } } ``` This will fail with the exception: ``` Exception in thread "main" java.lang.IllegalStateException: username required at org.keycloak.admin.client.KeycloakBuilder.build(KeycloakBuilder.java:131) at Scratch.main(scratch_41.java:17) ``` I have a workaround, but my question is, is there any plan to support service-accounts with the keycloak client?

5 years, 3 months

2
1
0 / 0

OTP only option Question

by Jason Prouty

I have my radius working to Keycloak with Username/PW. I would like to use OTP only. When configure the OTP settings I still get prompted for password then the OTP. is it possilble to do OTP only and no password.

5 years, 3 months

1
0
0 / 0

How can I disable the user caching?

by Chandrashekhar, Nithin

Hello, Keycloak version: 4.8.0.Final Login as user ‘X’ who belongs to 10 groups in openldap. I can see that user with 10 groups in the keycloak dashboard. I make this user part of one more group in openldap server. But in the keycloak dashboard, I don’t see this new group getting added for the user. I know that the new group not getting updated behavior is due to the caching. When I tried to invalidate the cache using Cache Policy under User Federation, I see that groups for the user ‘X’ gets updated but in the overall groups, the new group gets duplicated. I saw some posts online where I can disable user cache by setting userCache attribute in standalone.xml to false and restarting keycloak (using ./jboss-cli.sh --connect and reload). But when I try to reload keycloak, I see Failed to establish connection in 6033ms. So I am not very sure if keycloak reloaded and the changes I made had any effect or not. Please advise me on how I can disable user caching or if I am doing something wrong. Thanks Nithin

5 years, 3 months

1
0
0 / 0

Use a docker secret in wildfly config

by James Campbell

Hi all-- Is it possible to use a docker secret (i.e. contents of a file mounted in /run/secrets) in the wildfly/standalone.xml config to store a database password? I saw the vault option, but if there's another way to take care of that, it seemed preferable. James

5 years, 3 months

1
0
0 / 0

Keycloak events related to token/session expiry

by Vineet Reynolds

My goal is to implement the event listener SPI to listen for logout and session expiration events so that I could update a custom attribute in the user model. Does Keycloak generate any events that can be listened to, in order to detect if the token or associated session has expired? I've looked at the events listed in the EventType enumeration, and none of them seem to be related to the specific expiration event. I also enabled event logging, and no events related to expiry seemed to appear in the Keycloak administration console; logout events were generated when users signed out of the client app, but no event appeared to generated on expiry. I'm using Keycloak 3.4.3, but I suppose an answer for Keycloak 4.8 will be good enough for me. Thanks, Vineet

5 years, 3 months

2
1
0 / 0

Multi Tenancy

by James Pridmore

Hi, I wonder if you could offer some advice. We 're writing a React application and we are going to use keycloak for the security. We have no prior experience using keycloak and we need to figure out the best way of representing our security model. We have users and contracts, users might need to access different contracts and have different levels of security in each contract. At the minute, we've set up each contract as a client, and granted a user permissions in each contract. When we log in, a user receives all permissions from every client in the JWT. I switched on Client Scope for each contract, and now we only get permissions for the individual client whose client_id I pass in when logging in. I'm having trouble switching between clients without having to re-log in (I was hoping to use the refresh token endpoint with a different client_ id for this). I'd like to avoid sending all the permissions down in the token if possible. Is there a better way of going about this, a better way of modelling out data within keycloak, what would you recommend? Kind regards, James

5 years, 3 months

1
0
0 / 0

Docker image http connection pool

by Lukasz Lech

Hello, Maybe it's a trivial question, but I've failed to find an answer.... What is the default http connection pool size in keycloak docker image, and how can I configure it? My keycloak instance fails by large number of requests, although it has enough CPU and RAM resources... so I suppose the connection pool size is too little... Best regards, Lukasz Lech

5 years, 3 months

2
1
0 / 0

use keycloak security proxy to proxy to external url

by Dimitris Charlaftis

Hello, I am using the following scheme in docker containers I use keycloak security proxy to proxy a test application (step 5) to an external url, which lies outside the host machine where the keycloak server and keycloak proxy lie. Keycloak uses ldap federation. Keykloak proxy.json is the following { "target-url": "yyyyy.yyyyyy (url of external application", "bind-address": "0.0.0.0", "send-access-token": true, "http-port": "8180", "https-port": "8443", "applications": [ { "base-path": "/", "adapter-config": { "realm": "internal_applications", "auth-server-url": "xxxxxx (url of keycloak auth server ", "resource": "test_app", "ssl-required": "external", "credentials": { "secret": "xxxxxxxxxxxxxxxxx" } }, "constraints": [ { "pattern": "/*", "authenticate": true } ], "proxy-address-forwarding": true } ] } inside the keycloak server, i have set up a client such that (look the image beow) this means that i want to proxy to www.google.com The problem is that after a successful login, user is redirected to the test application BUT in the browser address bar remains the host machine domain name and NOT the external url.... strange... if i change the "bind-address" parameter from 0.0.0.0 to the external IP or domain name where i want to proxy, the site is unavailable... Note that inside the proxy docker container i can curl http://www.google.com with success. I would be grateful for any help provided... Regards, Dimitris -- _____________________________ Dimitris Charlaftis Software Engineer National Documentation Center email: dharlaftis(a)ekt.gr _____________________________ --- This email has been checked for viruses by AVG. https://www.avg.com

5 years, 3 months

1
0
0 / 0

Kubernetes: found IPv4 multicast address in an IPv6 stack

by Lukasz Lech

Hello, I was succesfully running Keycloak as docker image (4.8.1), however, when I try to run in Kubernetes, I'm getting the following error: 07:53:34,742 ERROR [org.jboss.msc.service.fail] (ServerService Thread Pool -- 52) MSC000001: Failed to start service org.wildfly.clustering.jgroups.channel.ee: org.jboss.msc.service.StartException in service org.wildfly.clustering.jgroups.channel.ee: java.lang.IllegalStateException: java.lang.Exception: found IPv4 multicast address /230.0.0.4 in an IPv6 stack at org.wildfly.clustering.service.FunctionalService.start(FunctionalService.java:70) at org.wildfly.clustering.service.AsyncServiceConfigurator$AsyncService.lambda$start$0(AsyncServiceConfigurator.java:117) at org.jboss.threads.ContextClassLoaderSavingRunnable.run(ContextClassLoaderSavingRunnable.java:35) at org.jboss.threads.EnhancedQueueExecutor.safeRun(EnhancedQueueExecutor.java:1985) at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.doRunTask(EnhancedQueueExecutor.java:1487) at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1378) at java.lang.Thread.run(Thread.java:748) at org.jboss.threads.JBossThread.run(JBossThread.java:485) Caused by: java.lang.IllegalStateException: java.lang.Exception: found IPv4 multicast address /230.0.0.4 in an IPv6 stack at org.jboss.as.clustering.jgroups.subsystem.ChannelServiceConfigurator.get(ChannelServiceConfigurator.java:116) at org.jboss.as.clustering.jgroups.subsystem.ChannelServiceConfigurator.get(ChannelServiceConfigurator.java:58) at org.wildfly.clustering.service.FunctionalService.start(FunctionalService.java:67) ... 7 more Caused by: java.lang.Exception: found IPv4 multicast address /230.0.0.4 in an IPv6 stack at org.jgroups.stack.Configurator.setDefaultValues(Configurator.java:137) at org.jgroups.stack.ProtocolStack.init(ProtocolStack.java:829) at org.jgroups.JChannel.<init>(JChannel.java:200) at org.jboss.as.clustering.jgroups.JChannelFactory.createChannel(JChannelFactory.java:116) at org.jboss.as.clustering.jgroups.subsystem.ChannelServiceConfigurator.get(ChannelServiceConfigurator.java:96) ... 9 more Server seems to listen, going to / returns redirect to /auth, but going to /auth results in 404, no further error lands in logs... Anyone has any idea what it can be? Best regards, Lukasz Lech

5 years, 3 months

2
2
0 / 0

Fine Authorization on User Account Service

by Nikola Malenic

I am trying to disable access to the account service to all users by using js policy (I have a reason for this). So what I tried is to put just $evaluation.deny(); in the body of the policy, to restrict access to all users. In Evaluate tab I can see that this policy is denying access but when I access account service application via browser I get access. Anyone has an idea what could be wrong? Here is my Authorization config exported: { "allowRemoteResourceManagement": false, "policyEnforcementMode": "ENFORCING", "resources": [ { "name": "account_resource", "type": "urn:account:resources:accountresource", "ownerManagedAccess": false, "displayName": "account_resource", "attributes": {}, "_id": "778c2a62-4415-4cf1-a057-a60f0beeb0a4", "uris": [ "/*" ] } ], "policies": [ { "id": "4de5145d-4d34-411f-9b2a-d99cc361a08c", "name": "auth_method_policy", "description": "Policy based on authentication method used", "type": "js", "logic": "POSITIVE", "decisionStrategy": "UNANIMOUS", "config": { "code": "// var context = $evaluation.getContext();\r\n// var identity = context.getIdentity();\r\n// var attributes = identity.getAttributes();\r\n\r\n// if (attributes.getValue(\"chosen_authenticator\").asString(0).endsWith('userpas s')) {\r\n// $evaluation.deny();\r\n// } else {\r\n// $evaluation.deny();\r\n// }\r\n" } }, { "id": "e2567a26-aa46-4f0f-aba7-421e35b90615", "name": "auth_based_permission", "type": "resource", "logic": "POSITIVE", "decisionStrategy": "UNANIMOUS", "config": { "resources": "[\"account_resource\"]", "applyPolicies": "[\"auth_method_policy\"]" } } ], "scopes": [] }

5 years, 3 months

2
1
0 / 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

keycloak-user January 2019