October 2019 - keycloak-user - Jboss List Archives

by Sebastian Perkins - Hoist Group - Switzerland

6 years, 7 months

1
0
0 / 0

How to migrate all users from one realm to another on the same instance of Keycloak

by Benjamin Huskic

Hello everybody, I have created a couple of realms for development in our environment. Now we need to move/copy all created users from UAT to UAT2. A simple task, as I assumed, but I am now struggling for a couple of hours to find a solution on the web. Can someone give me a hint how this is done? Thank you in advance Kind regards, Benjamin [cid:image001.png@01D4D841.19FC8380] Benjamin Huskić Founder & Solution Director mobile: +971-5444-9-4664 email: benjamin.huskic(a)thequalitygate.com<mailto:benjamin.huskic@thequalitygate.com> web: http://www.thequalitygate.com<http://www.thequalitygate.com/>

6 years, 7 months

2
4
0 / 0

Keycloak-SAML server integration

by pavlos kaimakis

Hello, Currently I’m using keycloak as an IDP connected to an Active Directory server and some bespoke tool I’ve created as an SP (Keycloak client) and everything works as expected. I recently got a request to use SAML for authentication purposes I was thinking if I could use Keycloak as an Identity broker (instead of changing my code to be able to integrate it with the SAML server right away) So the flow would be ‘my_tool (keycloak client)’ -> Keycloak -> Saml Server -> LDAP. What I did on the keycloak side was to add an Identity Provider using SAML, having taken some metadata from the SAML server. At the same time I connected this SAML server with my Active Directory. Now on the keycloak login page I get a button reading ‘saml’ next to the username/password fields. I click it and i get redirected to my SAMLserver and if I login with my AD credentials , I get a ‘success screen’. Nonetheless, each time I try to relogin I get an ‘update profile’ page, although I use the same username/password. I’ve observed that the ID changes and this ID seems to be related to the identity_provider_identity field (according to the Keycloak logs). This ID is an alpanumeric string (first column under the ‘users’ tab). Any ideas what I’m doing wrong? Just to note, that under the SAML Identity Provider I’ve created mappers for the AD attributes, but I haven’t created any mapper under the client option. Any ideas would be more than welcome. Regards Pavlos

6 years, 7 months

1
0
0 / 0

Http2 setup

by Hammad Haqqani

Hi Folks I was wondering if any one can share steps on how to enable http2 Hammad Haqqani Sr Devops Engineer M 832-795-2013 Email: hammad.haqqani(a)xome.com<mailto:hammad.haqqani@xome.com> [signature_620025509] This e-mail communication and any attachments may contain confidential, copyrighted, and legally privileged information for use solely by the designated recipients to which this e-mail is addressed. If you are not the intended recipient, you are hereby notified that you have received this communication in error, and that any review, disclosure, dissemination, distribution, or copying of this message or its contents is prohibited and may be subject to governing laws protecting its disclosure. If you have received this communication in error, please destroy all copies of this communication and any attachments.

6 years, 7 months

1
0
0 / 0

Need help to properly use the prompt=none option to check if a user has an active session or not

by Gilbert FERNANDES

Hello to All I have a little problem crafting a JMeter to make a call to the authorization endpoint in order to use the prompt=none option. I have set up a Keycloak. With one realm and one client. Client is set as public, direct grants enabled, implicit flow on, standard flow enabled In Keycloak I go into the client -> sessions and Logout everyone 0 sessions, 0 offlines First JMeter scripts does a complete connection : 1. Call to /auth 2. Sends me a web page with form 3. I extract the "action" from the HTML form 4. I go a POST on the action URL + insert login and password 5. Keycloak does the 302 Redirect with code in URL 6. I call the token endpoint with the code and get the JWT Json Back If I check in Keycloak, the session appears. it is set to last 30 days. Now comes my problem : I want to check if the user is connected, or not, using the prompt=none option. So I create a second JMX script that does a GET on /auth/realms/${realm}/protocol/openid-connect/auth (realm is replaced by the realm I use which is test ; my client is also called test) I inject the following fields : response_type = code client_id = test redirect_url = www.google.fr (I only care about what KC adds to the URL) scope = openid state = ebd16dfa-dc7e-4524-a87c-fcb138d2af8b prompt = none id_token_hint = id token contents found in the JWT The ebd16dfa-dc7e-4524-a87c-fcb138d2af8b is the value I found in the JWT token in the field session_state I pasted into the id_token_hint the contents of the id_token from the JWT in its URLEncoded form If the user is not connected and if the user is connected I always get the same answer : Response code: 302 Response message: Found Location: http://www.google.fr?error=login_required&state=ebd16dfa-dc7e-4524-a87c-f... I get the login_required all the time. I have tried after doing a Logout all And after connecting myself and checking I have an active session for the client in the realm in the web console Tried to search online Tried various response_type codes I could see (with Keycloak saying they are invalid) I tried token_id%20 for example, no change I don’t know what I'm doing wrong. I only work on the back part of it and I have to check what happens when the front people use the prompt=none And I'm then doing JMeter scripts to emulate what they do But this is the first time I'm trying to use prompt=none And I'm failing miserably at it ☹ -- Gilbert ----------------------------- Disclaimer ------------------------------ --- Ce message ainsi que les éventuelles pièces jointes constituent une correspondance privée et confidentielle à l'attention exclusive du destinataire désigné ci-dessus. Si vous n'êtes pas le destinataire du présent message ou une personne susceptible de pouvoir le lui délivrer, il vous est signifié que toute divulgation, distribution ou copie, totale ou partielle, sur un quelconque support de cette transmission est strictement interdite. Si vous avez recu ce message par erreur, nous vous remercions d'en informer l'expéditeur par téléphone ou de lui retourner le présent message, puis d'effacer immédiatement ce message de votre systeme. Tout message électronique est susceptible d'altération. Le "groupement des Mousquetaires" décline toute responsabilité au titre de ce message s'il a été altéré, déformé ou falsifié.--- --- This e-mail and any attachments is a confidential correspondence intended only for use of the individual or entity named above. If you are not the intended recipient or the agent responsible for delivering the message to the intended recipient, you are hereby notified that any disclosure, distribution or copying, either whole or partial, in any medium of this communication is strictly prohibited. If you have received this communication by mistake, please notify the sender by phone or by replying this message, and then delete this message from your system. E-mails are susceptible of alteration. The "Mousquetaires' group" shall not therefore be liable for the message if altered, changed or falsified.--- -----------------------------------------------------------------------

6 years, 7 months

1
0
0 / 0

Where to store the refresh token? Can we avoid refresh token and rely on SSO cookie for access token renewal?

by Paul Luk

from various document, it seems storing refresh token is not recommended for browser based web application that cannot safely keep the refresh token. So, i am wonder whether i can configure keycloak to achieve the following (authorization code grant): 1. response with the access token only (token endpoint) 2. when the access token expired, rely on the SSO cookie, to invoke method/endpoint in keycloak to obtain a new access token via ajax. can you please share your way to cater for refresh token? And comment on my idea? thanks

6 years, 7 months

1
0
0 / 0

Authoritazion Policies Keycloak

by Alfonso Vidal García

Hi everyone! I have a doubt. I am trying to apply to my server an authorization policy that depending the role of the user, that user will be granted to access to determinate resources of the app. How could it be possible with Keycloak? Thanks in advance! P Please consider the environment before printing this e-mail.

6 years, 7 months

2
1
0 / 0

Welcome Theme Customization

by Talat Zaitoun

Hi, I am trying to customize the welcome screen theme but my changes are not taken into effect. I am following the instructions at https://www.keycloak.org/docs/latest/server_development/index.html#config... section 3.2. I have created my theme in this path keycloak/themes/custom-theme/welcome and I change the welcomeTheme tag in the standalone.xml to “custom-theme” but it still doesn’t work. With this file structure, I was able to change the themes of all other modules such as email, account, login and by selecting the theme in the admin portal. However, the current instructions for the welcome theme do not seem to work for me. I must be missing something obvious. Thank you for your help.

6 years, 7 months

1
0
0 / 0

Last connection between 2 navigator when souscribe

by Christophe Lehingue

Hello, When I register via the keycloak new user creation interface, I generate an email to verify the user email: OK. When I’m on the browser in which I realized all phases of connection => everything is ok. By cons, when I copy the email verification link in another browser (in which no phase of co-connection was made) => I fall on the following screen “return to the application” and when I come back to the application I am no longer authenticated. Can you tell me how? Keycloak version : 6.0.1 or 7.0.1 and latest keycloak-js version. Thanks. === EN FRANCAIS ==== Bonjour, Quand je m’inscris via l’interface de création de nouvel utilisateur de keycloak, je génére un mail pour verifier l’email utilisateur: OK. Quand je suis sur le navigateur dans lequel j’ai réalisé toute les phases de connexion => tout est ok. Par contre, quand je copie le lien de vérification d’email dans un autre navigateur (dans lequel aucune phase de coonnexion n’a été réalisé) => je tombe sur l’écran suivant "revenir à l’application " et quand je reviens à l’application je ne suis plus authentifié. Pouvez-vous me dire comment faire ? Keycloak version : 6.0.1 or 7.0.1 and latest keycloak-js version. Merci à vous.

6 years, 7 months

1
0
0 / 0

Where login-status-iframe.html on keycloak source code?

by Christophe Lehingue

Hello, I need to modify the file “/login-status-iframe.html”: on the other hand in the sources keycloak => I can not find it. Do you know where this file is located? Thank you

6 years, 7 months

1
0
0 / 0

When is keycloak 8 release date

by Shiva Prasad Thagadur Prakash

Hi Guys, Could you please tell when Keycloak 8 would be released? Thanks & regards, Shiva

6 years, 7 months

1
0
0 / 0

Can't add second admin user of realm Keycloak

by Roman Ok

There are realms in Keycloak: master and custom. Both have admin users. Custom realm admin adds new user new_admin and assigns role admin to him via admin console. The user can access his account details at auth/realms/custom/account/. However, error Forbidden You don't have access to the requested resource pops when new_admin user tries to enter realm administration console at auth/admin/custom/console/. The same issue happens even when master realm admin adds new admin user to custom realm. I'm using Keycloak 4.3.0. Is it a bug or realm can't have two admins?

6 years, 7 months

1
0
0 / 0

Can't add second admin user of realm Keycloak

by User

6 years, 7 months

1
0
0 / 0

Re: [keycloak-user] [keycloak-dev] Keycloak 7.0.1 Released

by Stian Thorgersen

We only include CVEs and major regressions in micro releases. We simply don't have the capacity to backport all bug fixes. The next release will be Keycloak 8.0.0, which should be out in a few weeks. On Wed, 16 Oct 2019 at 18:27, Jon Koops <jonkoops(a)gmail.com> wrote: > Hi Stian, > > I've been working on getting the update in for Keycloak Angular and I > noticed that an essential commit with a fix for the TypeScript definitions > has not been included in the JavaScript Adapter. I am referring > specifically to the following commit: > https://github.com/keycloak/keycloak/commit/bc5b4de79e4d30630042216d686a2... > . > > The TypeScript definition as before this commit incorrectly defaults to a > native PromiseType instead of legacy promises. This results in broken > builds for any application using TypeScript with what is perfectly > functioning code. > > [image: image.png] > > Regards, > Jon > > On Wed, Oct 16, 2019 at 5:07 PM Stian Thorgersen <sthorger(a)redhat.com> > wrote: > >> This release contains a number of CVE fixes as well as 3 items worthy >> highlighting: >> >> * Container image base image has changed due to lack of CVE fixes in >> previous base image >> * Fixes keycloak.js issue when used in module environment >> * Removes support for uploading custom JavaScript providers over REST. >> Custom JavaScript providers now have to be uploaded to the Keycloak server >> directly >> _______________________________________________ >> keycloak-dev mailing list >> keycloak-dev(a)lists.jboss.org >> https://lists.jboss.org/mailman/listinfo/keycloak-dev >> >

6 years, 7 months

1
0
0 / 0

Keycloak 7.0.1 Released

by Stian Thorgersen

This release contains a number of CVE fixes as well as 3 items worthy highlighting: * Container image base image has changed due to lack of CVE fixes in previous base image * Fixes keycloak.js issue when used in module environment * Removes support for uploading custom JavaScript providers over REST. Custom JavaScript providers now have to be uploaded to the Keycloak server directly

6 years, 7 months

2
1
0 / 0

Facebook Indentity provider cause error: different_user_authenticated

by Mariusz Chruscielewski - INFO

Hi, we have an error on website that is secured by Keycloak Tomcat adapter, Prerequsites: - 2 facebook accounts, both linked to website Steps: - Remove all cookies for website – start as clean new user - Login to facebook - Login to website using facebook identity provider - All works fine - Logout from facebook (Don't logout from website) - Close browser tab with website and do not reopen for at least 1 hour - Wait some time (above 1 hour) so browser session is gone, and only Keycloak remembers that you were logged - go back to website - you will be redirected to facebook login page - login with ANOTHER Account - BANG ! 500 error - Keycloak logs: 2019-10-16 10:43:12,214 WARN [org.keycloak.events] (default task-1441) type=IDENTITY_PROVIDER_LOGIN_ERROR, realmId=vi, clientId=vinl, userId=9c865fb5-531a-4bec-9589-254c89234b8f, ipAddress=88.88.888.8, error=different_user_authenticated, identity_provider=facebook, consent=no_consent_required, previous_user=7e516fef-7d06-4f74-8816-b6519eb86b75, identity_provider_identity=tomlxxxxxx(a)xxxxxx.xx, code_id=39284d1d-1ad8-4710-bb8e-520dace03a7e Looks like Keycloak has problem because of not logged out session before, and changed account of identity provider. Can we do anything about it? We have set “remember me” to true, and made a redirect filter so if user has remember me set and should be logged into keycloak, website will redirect him to place where adapter can perform login. Apparently at that step, Keycloak detects that FB session has been terminated, so redirects you to login screen. I also got information that this might happen for the same FB account, when user doesn’t use PC for few days and then tries to visit our website. Is that anything we can fix in Keycloak configuration? Kind regards Mariusz Chruścielewski

6 years, 7 months

1
0
0 / 0

Keycloak multi-tenancy implementation idea

by Vinay Matam

Hi, We are an opensource company with an ERP based system built in microservices approach. We want to implement a SSO and RBAC for our system (for cloud/on-premise) both. Earlier we were thinking of running one instance per customer but that would be an overkill and too difficult to manage. Second, we decided to create one realm/customer but that hits a ceiling in adding more realms in one instance. So, we were trying and came up with an idea of creating one database per customer and dynamically link it with the Keycloak instance based in the subdomain of the authentication URL. By default, Keycloak uses a datasource to store different data like user information etc and this is configured in the standalone.xml configuration file. Our idea is to have a custom datasource configured here instead of the actual database. This custom datasource can be a microservice or some application or a custome provider which handles the part of pointing to different datasources (one per customer) based on a unique parameter. This way we can achieve a clear separation between mutliple customers and implement multi-tenancy. Could someone who has worked on something similar before let us know if this is something possible ? and put us in the right direction ? Thank you!

6 years, 7 months

1
0
0 / 0

Custom SPI does not appear in list

by Alfonso Vidal García

Hello everyone! I deployed an Custom SPI Provider into my Keycloak Server, but it does not appears in the list to configure it on the Admin Console. Anyone knows what it is happening? Thanks in advance! P Please consider the environment before printing this e-mail.

6 years, 7 months

4
10
0 / 0

Springboot adapter/Undertow/Tomcat + Authz with request.body claim

by Błażej Adamczyk

Hello everyone, Has anyone tried to read and push {request.body} as a claim in one of the following adapters: Springboot/Undertow/Tomcat? Trying Springboot with different containers I get the same result: the inputstream/channel is being read at an early stage in the flow and is not wrapped (buffered) what makes the body inaccessible for further application logic (parsers etc.). I've created an issue here: https://issues.jboss.org/browse/KEYCLOAK-11712 Maybe I'm doing something wrong? Maybe there is some easy way to make the inputstream buffered in undertow or tomcat?? -- Kind regards, Blazej

6 years, 7 months

2
1
0 / 0

Keycloak Master Password & Query String

by Namık Barış İDİL

Hello All, Is there any way to have a master password which can enter all users account? Another thing I would like to ask if there is any way to have something in a query string in the login page. I mean, I would like to redirect a user from another page to login page and I would like to embed some information to the redirect link. Thanks in advance. Barış

6 years, 7 months

4
3
0 / 0

Re: [keycloak-user] Question

by Lilian BENOIT

Okay... and which version of Keycloak do you use ? A+, Lilian. Le 15/10/2019 15:00, Christophe Lehingue a écrit : > Hello, > > I use the latest version of keycloak-js (with silent SSo) : > > https://github.com/keycloak/keycloak/blob/master/adapters/oidc/js/src/mai... > > Le mar. 15 oct. 2019 à 14:47, Lilian BENOIT > <lilian.benoit(a)lbenoit.fr> a écrit : > >> Hi Christophe, >> >> I think a old issue. Which version do you use ? >> >> A+, >> Lilian. >> >> Le 15/10/2019 14:04, Christophe Lehingue a écrit : >>> Hello, >>> >>> When I register via the keycloak new user creation interface, I >>> generate an email to verify the user email: OK. >>> When I'm on the browser in which I realized all phases of >> connection >>> => everything is ok. >>> By cons, when I copy the email verification link in another >> browser >>> (in which no phase of co-connection was made) => I fall on the >>> following screen "return to the application" and when I come back >> to >>> the application I am no longer authenticated. >>> Can you tell me how? >>> >>> === EN FRANCAIS ==== >>> >>> Bonjour, >>> >>> Quand je m'inscris via l'interface de création de nouvel >> utilisateur >>> de keycloak, je génére un mail pour verifier l'email >> utilisateur: OK. >>> Quand je suis sur le navigateur dans lequel j'ai réalisé toute >> les >>> phases de connexion => tout est ok. >>> Par contre, quand je copie le lien de vérification d'email dans >> un >>> autre navigateur (dans lequel aucune phase de coonnexion n'a été >>> réalisé) >>> => je tombe sur l'écran suivant "revenir à l'application " et >> quand je >>> reviens à l'application je ne suis plus authentifié. >>> Pouvez-vous me dire comment faire ? >>> >>> >>> Thanks. >>> _______________________________________________ >>> keycloak-user mailing list >>> keycloak-user(a)lists.jboss.org >>> https://lists.jboss.org/mailman/listinfo/keycloak-user

6 years, 7 months

1
0
0 / 0

Question

by Christophe Lehingue

Hello, When I register via the keycloak new user creation interface, I generate an email to verify the user email: OK. When I'm on the browser in which I realized all phases of connection => everything is ok. By cons, when I copy the email verification link in another browser (in which no phase of co-connection was made) => I fall on the following screen "return to the application" and when I come back to the application I am no longer authenticated. Can you tell me how? === EN FRANCAIS ==== Bonjour, Quand je m'inscris via l'interface de création de nouvel utilisateur de keycloak, je génére un mail pour verifier l'email utilisateur: OK. Quand je suis sur le navigateur dans lequel j'ai réalisé toute les phases de connexion => tout est ok. Par contre, quand je copie le lien de vérification d'email dans un autre navigateur (dans lequel aucune phase de coonnexion n'a été réalisé) => je tombe sur l'écran suivant "revenir à l'application " et quand je reviens à l'application je ne suis plus authentifié. Pouvez-vous me dire comment faire ? Thanks.

6 years, 7 months

2
1
0 / 0

Kerberos login and multinode clustered mode

by Daniel Fernández Rodríguez

Hello everyone, I followed the steps described in the docs (https://www.keycloak.org/docs/latest/server_admin/index.html#_kerberos) to configure Kerberos login (Active Directory as LDAP Federation Provider) with Keycloak 7.0.0. All good til here Recently we enabled clustered mode for Keycloak, so now we have some haproxy servers loadbalancing all traffic to our Keycloak servers (configured with proxy-address-forwarding="true"). All Keycloak servers share the same MySQL database. If we only have ONE Keycloak server (even if it is configured as clustered), Kerberos **works** fine. If we add more servers under the haproxy, Kerberos starts failing with a generic: "Failed to make identity provider oauth callback: org.keycloak.broker.provider.IdentityBrokerException: No access_token from server." This is is the actual trace of why I am getting [*] So it seems that the actual SPNEGO flow works fine but then Keycloak does not know how to proceed. Any ideas/suggestions will be much appreciated! Thanks! Daniel. [*] standalone.sh[3887]: 09:39:59,704 INFO [stdout] (default task-2) principal is keycloakbind(a)PLACEHOLDER.COM standalone.sh[3887]: 09:39:59,704 INFO [stdout] (default task-2) Will use keytab standalone.sh[3887]: 09:39:59,705 INFO [stdout] (default task-2) Commit Succeeded standalone.sh[3887]: 09:39:59,705 INFO [stdout] (default task-2) standalone.sh[3887]: 09:39:59,721 INFO [stdout] (default task-2) Found KeyTab /var/keycloak/keycloakbind.keytab for keycloakbind(a)PLACEHOLDER.COM standalone.sh[3887]: 09:39:59,721 INFO [stdout] (default task-2) Found KeyTab /var/keycloak/keycloakbind.keytab for keycloakbind(a)PLACEHOLDER.COM standalone.sh[3887]: 09:39:59,724 INFO [stdout] (default task-2) Found KeyTab /var/keycloak/keycloakbind.keytab for keycloakbind(a)PLACEHOLDER.COM standalone.sh[3887]: 09:39:59,724 INFO [stdout] (default task-2) Found KeyTab /var/keycloak/keycloakbind.keytab for keycloakbind(a)PLACEHOLDER.COM standalone.sh[3887]: 09:39:59,728 INFO [stdout] (default task-2) Entered SpNegoContext.acceptSecContext with state=STATE_NEW standalone.sh[3887]: 09:39:59,734 INFO [stdout] (default task-2) SpNegoContext.acceptSecContext: receiving token = a0 82 0d 20 30 82 0d 1c a0 0d 30 0b 06 09 2a 86 48 86 f7 12 01 02 02 a2 89 .......... (truncated) standalone.sh[3887]: 09:39:59,735 INFO [stdout] (default task-2) SpNegoToken NegTokenInit: reading Mechanism Oid = 1.2.840.113554.1.2.2 standalone.sh[3887]: 09:39:59,735 INFO [stdout] (default task-2) SpNegoToken NegTokenInit: reading Mech Token standalone.sh[3887]: 09:39:59,735 INFO [stdout] (default task-2) SpNegoContext.acceptSecContext: received token of type = SPNEGO NegTokenInit standalone.sh[3887]: 09:39:59,736 INFO [stdout] (default task-2) SpNegoContext: negotiated mechanism = 1.2.840.113554.1.2.2 standalone.sh[3887]: 09:39:59,737 INFO [stdout] (default task-2) Entered Krb5Context.acceptSecContext with state=STATE_NEW standalone.sh[3887]: 09:39:59,751 INFO [stdout] (default task-2) Java config name: null standalone.sh[3887]: 09:39:59,751 INFO [stdout] (default task-2) Native config name: /etc/krb5.conf standalone.sh[3887]: 09:39:59,753 INFO [stdout] (default task-2) Loaded from native config standalone.sh[3887]: 09:39:59,756 INFO [stdout] (default task-2) >>> KeyTabInputStream, readName(): PLACEHOLDER.COM standalone.sh[3887]: 09:39:59,757 INFO [stdout] (default task-2) >>> KeyTabInputStream, readName(): keycloakbind standalone.sh[3887]: 09:39:59,757 INFO [stdout] (default task-2) >>> KeyTab: load() entry length: 58; type: 23 standalone.sh[3887]: 09:39:59,758 INFO [stdout] (default task-2) >>> KeyTabInputStream, readName(): PLACEHOLDER.COM standalone.sh[3887]: 09:39:59,758 INFO [stdout] (default task-2) >>> KeyTabInputStream, readName(): keycloakbind standalone.sh[3887]: 09:39:59,758 INFO [stdout] (default task-2) >>> KeyTab: load() entry length: 74; type: 18 standalone.sh[3887]: 09:39:59,758 INFO [stdout] (default task-2) Looking for keys for: keycloakbind(a)PLACEHOLDER.COM standalone.sh[3887]: 09:39:59,760 INFO [stdout] (default task-2) Added key: 18version: 1 standalone.sh[3887]: 09:39:59,760 INFO [stdout] (default task-2) Added key: 23version: 1 standalone.sh[3887]: 09:39:59,761 INFO [stdout] (default task-2) >>> EType: sun.security.krb5.internal.crypto.ArcFourHmacEType standalone.sh[3887]: 09:39:59,771 INFO [stdout] (default task-2) Using builtin default etypes for permitted_enctypes standalone.sh[3887]: 09:39:59,772 INFO [stdout] (default task-2) default etypes for permitted_enctypes: 18 17 16 23. standalone.sh[3887]: 09:39:59,772 INFO [stdout] (default task-2) >>> EType: sun.security.krb5.internal.crypto.ArcFourHmacEType standalone.sh[3887]: 09:39:59,775 INFO [stdout] (default task-2) MemoryCache: add 1571125199/647271/3627E91725D84CEF5E2AEDF8FE669315/danielfr(a)PLACEHOLDER.COM to danielfr@PLACEHOLDER.COM|HTTP/kc-loadbalancer-XX.placeholder.com(a)PLACEHOLDER.COM standalone.sh[3887]: 09:39:59,776 INFO [stdout] (default task-2) >>> KrbApReq: authenticate succeed. standalone.sh[3887]: 09:39:59,778 INFO [stdout] (default task-2) Krb5Context setting peerSeqNumber to: 193114067 standalone.sh[3887]: 09:39:59,779 INFO [stdout] (default task-2) Krb5Context setting mySeqNumber to: 193114067 standalone.sh[3887]: 09:39:59,783 INFO [stdout] (default task-2) >>> Constrained deleg from GSSCaller{UNKNOWN} standalone.sh[3887]: 09:39:59,785 INFO [stdout] (default task-2) SPNEGO Negotiated Mechanism = 1.2.840.113554.1.2.2 Kerberos V5 standalone.sh[3887]: 09:39:59,785 INFO [stdout] (default task-2) SpNegoContext.acceptSecContext: mechanism wanted = 1.2.840.113554.1.2.2 standalone.sh[3887]: 09:39:59,785 INFO [stdout] (default task-2) SpNegoContext.acceptSecContext: negotiated result = ACCEPT_COMPLETE standalone.sh[3887]: 09:39:59,786 INFO [stdout] (default task-2) SpNegoContext.acceptSecContext: sending token of type = SPNEGO NegTokenTarg standalone.sh[3887]: 09:39:59,786 INFO [stdout] (default task-2) SpNegoContext.acceptSecContext: sending token = a1 14 30 12 a0 03 0a 01 00 a1 0b 06 09 2a 86 48 86 f7 12 01 02 02 standalone.sh[3887]: 09:39:59,787 INFO [stdout] (default task-2) [Krb5LoginModule]: Entering logout standalone.sh[3887]: 09:39:59,788 INFO [stdout] (default task-2) [Krb5LoginModule]: logged out Subject standalone.sh[3887]: 09:39:59,970 WARN [org.keycloak.connections.httpclient.DefaultHttpClientFactory] (default task-2) Truststore is disabled standalone.sh[3887]: 09:40:00,286 ERROR [org.keycloak.broker.oidc.AbstractOAuth2IdentityProvider] (default task-2) Failed to make identity provider oauth callback: org.keycloak.broker.provider.IdentityBrokerException: No access_token from server. standalone.sh[3887]: at org.keycloak.broker.oidc.OIDCIdentityProvider.verifyAccessToken(OIDCIdentityProvider.java:482) standalone.sh[3887]: at org.keycloak.broker.oidc.OIDCIdentityProvider.getFederatedIdentity(OIDCIdentityProvider.java:350) standalone.sh[3887]: at org.keycloak.broker.oidc.AbstractOAuth2IdentityProvider$Endpoint.authResponse(AbstractOAuth2IdentityProvider.java:420) standalone.sh[3887]: at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) standalone.sh[3887]: at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) standalone.sh[3887]: at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) standalone.sh[3887]: at java.lang.reflect.Method.invoke(Method.java:498) standalone.sh[3887]: at org.jboss.resteasy.core.MethodInjectorImpl.invoke(MethodInjectorImpl.java:138) standalone.sh[3887]: at org.jboss.resteasy.core.ResourceMethodInvoker.internalInvokeOnTarget(ResourceMethodInvoker.java:517) standalone.sh[3887]: at org.jboss.resteasy.core.ResourceMethodInvoker.invokeOnTargetAfterFilter(ResourceMethodInvoker.java:406) standalone.sh[3887]: at org.jboss.resteasy.core.ResourceMethodInvoker.lambda$invokeOnTarget$0(ResourceMethodInvoker.java:370) standalone.sh[3887]: at org.jboss.resteasy.core.interception.PreMatchContainerRequestContext.filter(PreMatchContainerRequestContext.java:355) standalone.sh[3887]: at org.jboss.resteasy.core.ResourceMethodInvoker.invokeOnTarget(ResourceMethodInvoker.java:372) standalone.sh[3887]: at org.jboss.resteasy.core.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:344) standalone.sh[3887]: at org.jboss.resteasy.core.ResourceLocatorInvoker.invokeOnTargetObject(ResourceLocatorInvoker.java:137) standalone.sh[3887]: at org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorInvoker.java:106) standalone.sh[3887]: at org.jboss.resteasy.core.ResourceLocatorInvoker.invokeOnTargetObject(ResourceLocatorInvoker.java:132) standalone.sh[3887]: at org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorInvoker.java:100) standalone.sh[3887]: at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:440) standalone.sh[3887]: at org.jboss.resteasy.core.SynchronousDispatcher.lambda$invoke$4(SynchronousDispatcher.java:229) standalone.sh[3887]: at org.jboss.resteasy.core.SynchronousDispatcher.lambda$preprocess$0(SynchronousDispatcher.java:135) standalone.sh[3887]: at org.jboss.resteasy.core.interception.PreMatchContainerRequestContext.filter(PreMatchContainerRequestContext.java:355) standalone.sh[3887]: at org.jboss.resteasy.core.SynchronousDispatcher.preprocess(SynchronousDispatcher.java:138) standalone.sh[3887]: at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:215) standalone.sh[3887]: at org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.service(ServletContainerDispatcher.java:227) standalone.sh[3887]: at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:56) standalone.sh[3887]: at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:51) standalone.sh[3887]: at javax.servlet.http.HttpServlet.service(HttpServlet.java:791) standalone.sh[3887]: at io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:74) standalone.sh[3887]: at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:129) standalone.sh[3887]: at org.keycloak.services.filters.KeycloakSessionServletFilter.doFilter(KeycloakSessionServletFilter.java:90) standalone.sh[3887]: at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61) standalone.sh[3887]: at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131) standalone.sh[3887]: at io.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.java:84) standalone.sh[3887]: at io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:62) standalone.sh[3887]: at io.undertow.servlet.handlers.ServletChain$1.handleRequest(ServletChain.java:68) standalone.sh[3887]: at io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36) standalone.sh[3887]: at org.wildfly.extension.undertow.security.SecurityContextAssociationHandler.handleRequest(SecurityContextAssociationHandler.java:78) standalone.sh[3887]: at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) standalone.sh[3887]: at io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:132) standalone.sh[3887]: at io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:57) standalone.sh[3887]: at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) standalone.sh[3887]: at io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:46) standalone.sh[3887]: at io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64) standalone.sh[3887]: at io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:60) standalone.sh[3887]: at io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:77) standalone.sh[3887]: at io.undertow.security.handlers.NotificationReceiverHandler.handleRequest(NotificationReceiverHandler.java:50) standalone.sh[3887]: at io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43) standalone.sh[3887]: at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) standalone.sh[3887]: at org.wildfly.extension.undertow.security.jacc.JACCContextIdHandler.handleRequest(JACCContextIdHandler.java:61) standalone.sh[3887]: at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) standalone.sh[3887]: at org.wildfly.extension.undertow.deployment.GlobalRequestControllerHandler.handleRequest(GlobalRequestControllerHandler.java:68) standalone.sh[3887]: at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) standalone.sh[3887]: at io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:292) standalone.sh[3887]: at io.undertow.servlet.handlers.ServletInitialHandler.access$100(ServletInitialHandler.java:81) standalone.sh[3887]: at io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:138) standalone.sh[3887]: at io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:135) standalone.sh[3887]: at io.undertow.servlet.core.ServletRequestContextThreadSetupAction$1.call(ServletRequestContextThreadSetupAction.java:48) standalone.sh[3887]: at io.undertow.servlet.core.ContextClassLoaderSetupAction$1.call(ContextClassLoaderSetupAction.java:43) standalone.sh[3887]: at org.wildfly.extension.undertow.security.SecurityContextThreadSetupAction.lambda$create$0(SecurityContextThreadSetupAction.java:105) standalone.sh[3887]: at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502) standalone.sh[3887]: at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502) standalone.sh[3887]: at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502) standalone.sh[3887]: at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502) standalone.sh[3887]: at io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:272) standalone.sh[3887]: at io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:81) standalone.sh[3887]: at io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:104) standalone.sh[3887]: at io.undertow.server.Connectors.executeRootHandler(Connectors.java:364) standalone.sh[3887]: at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:830) standalone.sh[3887]: at org.jboss.threads.ContextClassLoaderSavingRunnable.run(ContextClassLoaderSavingRunnable.java:35) standalone.sh[3887]: at org.jboss.threads.EnhancedQueueExecutor.safeRun(EnhancedQueueExecutor.java:1982) standalone.sh[3887]: at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.doRunTask(EnhancedQueueExecutor.java:1486) standalone.sh[3887]: at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1377) standalone.sh[3887]: at java.lang.Thread.run(Thread.java:748)

6 years, 7 months

1
0
0 / 0

Can I use Keycloak as a key store like Hashicorp Vault for an example?

by Malik Zakarneh

Hello I have four questions: 1) Can I use Keycloak as a key store like Hashicorp Vault for an example? Keycloak has realm keys, can I use this feature as a secure key store and use it to encrypt and hash data in my web application? 2) Is there an API that I can use to read those keys to use them in my web application? 3) Are those keys stored securely on disk? 4) If Keycloak is not built for that purpose, what should I use in combination with it? Can I integrate Keycloak with some other key vault? Thanks

6 years, 7 months

1
0
0 / 0

NPE problem with admin-cli Java client

by Tero Ahonen

Hi, I have Java code running on Wildfly 16 that uses Keycloak admin-cli java library to interact with Keycloak. Code works fine from command line, it works fine when use thru REST interface. But it doesn’t work when used from @Scheduled EJB …. Code is really simple Keycloak kc = KeycloakBuilder.builder() .serverUrl(“foo") .realm(“bar") .grantType(OAuth2Constants.PASSWORD) .clientId(“foo") .username(“bar") .password(“foo") .build(); List<UserRepresentation> users = kc.realm(“realm").users().search(email, 0, 1); This fails to code https://github.com/keycloak/keycloak/blob/e6a274ea0e31c6572e795f3372f006c... <https://github.com/keycloak/keycloak/blob/e6a274ea0e31c6572e795f3372f006c...> It seems that that token string is empty kc.getTokenManager() is not null kc.getTokenManager().getAccessToken() is not null kc.getTokenManager().getAccessTokenString() IS NULL Br, Tero

6 years, 7 months

1
0
0 / 0

Can a user modify his own attributes?

by Corentin Dupont

Hi guys, is it possible for a simple user to modify his own attributes using the API? I would like the user to get a Token with his login/password, and use this to change his own attributes. Of source he should not be able to change other peoples details. Is that possible? I found the role "manage_users" but no "manage_user_self". Thanks and cheers! Corentin

6 years, 7 months

1
0
0 / 0

warn about node-identifier

by pavel.kokush

Hello, I am running keycloak in cluster. I see following warn on start: WARN [org.jboss.as.txn] (ServerService Thread Pool -- 49) WFLYTX0013: The node-identifier attribute on the /subsystem=transactions is set to the default value. This is a danger for environments running multiple servers. Please make sure the attribute value is unique Should I care about it? I guess it is about distributed transaction? Keycloak does not use it?

6 years, 7 months

1
0
0 / 0

Password expiration warning

by Seth F

Is there any configuration (out-of-the-box) so that if a user's expiration is close to expiration, that some message displays when they login that informs them and gives them an opportunity to reset it preemptively?

6 years, 7 months

1
0
0 / 0

Keycloak does not found SPI User Storage provider

by Alfonso Vidal García

Good morning, I have configured a Spring Boot project with connection to Keycloak, and also I want to install a Custom SPI User Provider external to Keycloak. I did all the steps to do the Provider and ProviderFactory, and also the file in META-INF/services, and when I try to deploy on Wildfly to connect with Keycloak, fails, 12:52:26,079 ERROR [org.jboss.msc.service.fail] (MSC service thread 1-1) MSC000001: Failed to start service jboss.deployment.unit."focusoc-0.0.1-SNAPSHOT.jar".POST_MODULE: org.jboss.msc.service.StartException in service jboss.deployment.unit."focusoc-0.0.1-SNAPSHOT.jar".POST_MODULE: WFLYSRV0153: Failed to process phase POST_MODULE of deployment "focusoc-0.0.1-SNAPSHOT.jar" at org.jboss.as.server@9.0.2.Final//org.jboss.as.server.deployment.DeploymentUnitPhaseService.start(DeploymentUnitPhaseService.java:183)<mailto:org.jboss.as.server@9.0.2.Final//org.jboss.as.server.deployment.DeploymentUnitPhaseService.start(DeploymentUnitPhaseService.java:183)> at org.jboss.msc@1.4.8.Final//org.jboss.msc.service.ServiceControllerImpl$StartTask.startService(ServiceControllerImpl.java:1737)<mailto:org.jboss.msc@1.4.8.Final//org.jboss.msc.service.ServiceControllerImpl$StartTask.startService(ServiceControllerImpl.java:1737)> at org.jboss.msc@1.4.8.Final//org.jboss.msc.service.ServiceControllerImpl$StartTask.execute(ServiceControllerImpl.java:1699)<mailto:org.jboss.msc@1.4.8.Final//org.jboss.msc.service.ServiceControllerImpl$StartTask.execute(ServiceControllerImpl.java:1699)> at org.jboss.msc@1.4.8.Final//org.jboss.msc.service.ServiceControllerImpl$ControllerTask.run(ServiceControllerImpl.java:1557)<mailto:org.jboss.msc@1.4.8.Final//org.jboss.msc.service.ServiceControllerImpl$ControllerTask.run(ServiceControllerImpl.java:1557)> at org.jboss.threads@2.3.3.Final//org.jboss.threads.ContextClassLoaderSavingRunnable.run(ContextClassLoaderSavingRunnable.java:35)<mailto:org.jboss.threads@2.3.3.Final//org.jboss.threads.ContextClassLoaderSavingRunnable.run(ContextClassLoaderSavingRunnable.java:35)> at org.jboss.threads@2.3.3.Final//org.jboss.threads.EnhancedQueueExecutor.safeRun(EnhancedQueueExecutor.java:1982)<mailto:org.jboss.threads@2.3.3.Final//org.jboss.threads.EnhancedQueueExecutor.safeRun(EnhancedQueueExecutor.java:1982)> at org.jboss.threads@2.3.3.Final//org.jboss.threads.EnhancedQueueExecutor$ThreadBody.doRunTask(EnhancedQueueExecutor.java:1486)<mailto:org.jboss.threads@2.3.3.Final//org.jboss.threads.EnhancedQueueExecutor$ThreadBody.doRunTask(EnhancedQueueExecutor.java:1486)> at org.jboss.threads@2.3.3.Final//org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1377)<mailto:org.jboss.threads@2.3.3.Final//org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1377)> at java.base/java.lang.Thread.run(Thread.java:834) Caused by: org.jboss.as.server.deployment.DeploymentUnitProcessingException: java.lang.ClassNotFoundException: gcs.fds.focusoc.keycloak.spi.LoginStorageProvider from [Module "deployment.focusoc-0.0.1-SNAPSHOT.jar" from Service Module Loader] at org.jboss.as.ejb3@17.0.1.Final//org.jboss.as.ejb3.deployment.processors.BusinessViewAnnotationProcessor.getEjbClass(BusinessViewAnnotationProcessor.java:240)<mailto:org.jboss.as.ejb3@17.0.1.Final//org.jboss.as.ejb3.deployment.processors.BusinessViewAnnotationProcessor.getEjbClass(BusinessViewAnnotationProcessor.java:240)> at org.jboss.as.ejb3@17.0.1.Final//org.jboss.as.ejb3.deployment.processors.BusinessViewAnnotationProcessor.deploy(BusinessViewAnnotationProcessor.java:89)<mailto:org.jboss.as.ejb3@17.0.1.Final//org.jboss.as.ejb3.deployment.processors.BusinessViewAnnotationProcessor.deploy(BusinessViewAnnotationProcessor.java:89)> at org.jboss.as.server@9.0.2.Final//org.jboss.as.server.deployment.DeploymentUnitPhaseService.start(DeploymentUnitPhaseService.java:176)<mailto:org.jboss.as.server@9.0.2.Final//org.jboss.as.server.deployment.DeploymentUnitPhaseService.start(DeploymentUnitPhaseService.java:176)> ... 8 more Caused by: java.lang.ClassNotFoundException: gcs.fds.focusoc.keycloak.spi.LoginStorageProvider from [Module "deployment.focusoc-0.0.1-SNAPSHOT.jar" from Service Module Loader] at org.jboss.modules.ModuleClassLoader.findClass(ModuleClassLoader.java:255) at org.jboss.modules.ConcurrentClassLoader.performLoadClassUnchecked(ConcurrentClassLoader.java:410) at org.jboss.modules.ConcurrentClassLoader.performLoadClass(ConcurrentClassLoader.java:398) at org.jboss.modules.ConcurrentClassLoader.loadClass(ConcurrentClassLoader.java:116) at org.jboss.as.ejb3@17.0.1.Final//org.jboss.as.ejb3.deployment.processors.BusinessViewAnnotationProcessor.getEjbClass(BusinessViewAnnotationProcessor.java:238)<mailto:org.jboss.as.ejb3@17.0.1.Final//org.jboss.as.ejb3.deployment.processors.BusinessViewAnnotationProcessor.getEjbClass(BusinessViewAnnotationProcessor.java:238)> ... 10 more 12:52:26,081 ERROR [org.jboss.as.controller.management-operation] (management-handler-thread - 8) WFLYCTL0013: Operation ("add") failed - address: ([("deployment" => "focusoc-0.0.1-SNAPSHOT.jar")]) - failure description: {"WFLYCTL0080: Failed services" => {"jboss.deployment.unit.\"focusoc-0.0.1-SNAPSHOT.jar\".POST_MODULE" => "WFLYSRV0153: Failed to process phase POST_MODULE of deployment \"focusoc-0.0.1-SNAPSHOT.jar\" Caused by: org.jboss.as.server.deployment.DeploymentUnitProcessingException: java.lang.ClassNotFoundException: gcs.fds.focusoc.keycloak.spi.LoginStorageProvider from [Module \"deployment.focusoc-0.0.1-SNAPSHOT.jar\" from Service Module Loader] Caused by: java.lang.ClassNotFoundException: gcs.fds.focusoc.keycloak.spi.LoginStorageProvider from [Module \"deployment.focusoc-0.0.1-SNAPSHOT.jar\" from Service Module Loader]"}} 12:52:26,082 ERROR [org.jboss.as.server] (management-handler-thread - 8) WFLYSRV0021: Deploy of deployment "focusoc-0.0.1-SNAPSHOT.jar" was rolled back with the following failure message: {"WFLYCTL0080: Failed services" => {"jboss.deployment.unit.\"focusoc-0.0.1-SNAPSHOT.jar\".POST_MODULE" => "WFLYSRV0153: Failed to process phase POST_MODULE of deployment \"focusoc-0.0.1-SNAPSHOT.jar\" Caused by: org.jboss.as.server.deployment.DeploymentUnitProcessingException: java.lang.ClassNotFoundException: gcs.fds.focusoc.keycloak.spi.LoginStorageProvider from [Module \"deployment.focusoc-0.0.1-SNAPSHOT.jar\" from Service Module Loader] Caused by: java.lang.ClassNotFoundException: gcs.fds.focusoc.keycloak.spi.LoginStorageProvider from [Module \"deployment.focusoc-0.0.1-SNAPSHOT.jar\" from Service Module Loader]"}} I try to search in all internet about solutions about that, and I am blocked, so If you could tell if anything is missing. Thank you. Alfonso Vidal. P Please consider the environment before printing this e-mail.

6 years, 7 months

2
3
0 / 0

AuthorizationContext is returning null

by Alfonso Vidal García

Hi everyone! I am with the app-authz-spring-security example from Keycloak Quickstarts, and all works but when I login into the app this error appears: FreeMarker template error (DEBUG mode; use RETHROW in production!): Java method "gcs.fds.focusoc.keycloak.web.model.Identity.hasResourcePermission(String)" threw an exception when invoked on gcs.fds.focusoc.keycloak.web.model.Identity object "gcs.fds.focusoc.keycloak.web.model.Identity@49ac4771"; see cause exception in the Java stack trace. ---- FTL stack trace ("~" means nesting-related): - Failed at: #if identity.hasResourcePermission("A... [in template "home.ftl" at line 19, column 6] ---- Java stack trace (for programmers): ---- freemarker.core._TemplateModelException: [... Exception message was already printed; see it above ...] at freemarker.ext.beans._MethodUtil.newInvocationTemplateModelException(_MethodUtil.java:289) at freemarker.ext.beans._MethodUtil.newInvocationTemplateModelException(_MethodUtil.java:252) at freemarker.ext.beans.SimpleMethodModel.exec(SimpleMethodModel.java:77) at freemarker.core.MethodCall._eval(MethodCall.java:65) at freemarker.core.Expression.eval(Expression.java:83) at freemarker.core.Expression.evalToBoolean(Expression.java:161) at freemarker.core.Expression.evalToBoolean(Expression.java:147) at freemarker.core.ConditionalBlock.accept(ConditionalBlock.java:48) at freemarker.core.Environment.visit(Environment.java:330) at freemarker.core.Environment.visit(Environment.java:336) at freemarker.core.Environment.process(Environment.java:309) at freemarker.template.Template.process(Template.java:384) at org.springframework.web.servlet.view.freemarker.FreeMarkerView.processTemplate(FreeMarkerView.java:396) at org.springframework.web.servlet.view.freemarker.FreeMarkerView.doRender(FreeMarkerView.java:309) at org.springframework.web.servlet.view.freemarker.FreeMarkerView.renderMergedTemplateModel(FreeMarkerView.java:257) at org.springframework.web.servlet.view.AbstractTemplateView.renderMergedOutputModel(AbstractTemplateView.java:165) at org.springframework.web.servlet.view.AbstractView.render(AbstractView.java:314) at org.springframework.web.servlet.DispatcherServlet.render(DispatcherServlet.java:1325) at org.springframework.web.servlet.DispatcherServlet.processDispatchResult(DispatcherServlet.java:1069) at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:1008) at org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:925) at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:974) at org.springframework.web.servlet.FrameworkServlet.doGet(FrameworkServlet.java:866) at javax.servlet.http.HttpServlet.service(HttpServlet.java:635) at org.springframework.web.servlet.FrameworkServlet.service(FrameworkServlet.java:851) at javax.servlet.http.HttpServlet.service(HttpServlet.java:742) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:231) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) at org.keycloak.adapters.springsecurity.filter.KeycloakAuthenticatedActionsFilter.doFilter(KeycloakAuthenticatedActionsFilter.java:57) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) at org.keycloak.adapters.springsecurity.filter.KeycloakSecurityContextRequestFilter.doFilter(KeycloakSecurityContextRequestFilter.java:54) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) at org.keycloak.adapters.springsecurity.filter.KeycloakPreAuthActionsFilter.doFilter(KeycloakPreAuthActionsFilter.java:86) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) at org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter.doFilter(AbstractAuthenticationProcessingFilter.java:200) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:320) at org.springframework.security.web.access.intercept.FilterSecurityInterceptor.invoke(FilterSecurityInterceptor.java:127) at org.springframework.security.web.access.intercept.FilterSecurityInterceptor.doFilter(FilterSecurityInterceptor.java:91) at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) at org.springframework.security.web.access.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:119) at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) at org.springframework.security.web.session.SessionManagementFilter.doFilter(SessionManagementFilter.java:137) at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) at org.springframework.security.web.authentication.AnonymousAuthenticationFilter.doFilter(AnonymousAuthenticationFilter.java:111) at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) at org.keycloak.adapters.springsecurity.filter.KeycloakAuthenticatedActionsFilter.doFilter(KeycloakAuthenticatedActionsFilter.java:74) at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) at org.keycloak.adapters.springsecurity.filter.KeycloakSecurityContextRequestFilter.doFilter(KeycloakSecurityContextRequestFilter.java:77) at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) at org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter.doFilter(SecurityContextHolderAwareRequestFilter.java:170) at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) at org.springframework.security.web.savedrequest.RequestCacheAwareFilter.doFilter(RequestCacheAwareFilter.java:63) at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) at org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter.doFilter(AbstractAuthenticationProcessingFilter.java:200) at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) at org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:116) at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) at org.keycloak.adapters.springsecurity.filter.KeycloakPreAuthActionsFilter.doFilter(KeycloakPreAuthActionsFilter.java:86) at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) at org.springframework.security.web.csrf.CsrfFilter.doFilterInternal(CsrfFilter.java:100) at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) at org.springframework.security.web.header.HeaderWriterFilter.doFilterInternal(HeaderWriterFilter.java:66) at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:105) at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) at org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter.doFilterInternal(WebAsyncManagerIntegrationFilter.java:56) at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:215) at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:178) at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:357) at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:270) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) at org.springframework.web.filter.RequestContextFilter.doFilterInternal(RequestContextFilter.java:99) at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) at org.springframework.web.filter.HttpPutFormContentFilter.doFilterInternal(HttpPutFormContentFilter.java:109) at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) at org.springframework.web.filter.HiddenHttpMethodFilter.doFilterInternal(HiddenHttpMethodFilter.java:93) at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:200) at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:198) at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:96) at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:496) at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:140) at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:81) at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:87) at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:342) at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:803) at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:66) at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:790) at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1468) at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49) at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) at java.lang.Thread.run(Thread.java:748) Caused by: java.lang.NullPointerException at gcs.fds.focusoc.keycloak.web.model.Identity.hasResourcePermission(Identity.java:51) at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.lang.reflect.Method.invoke(Method.java:498) at freemarker.ext.beans.BeansWrapper.invokeMethod(BeansWrapper.java:1505) at freemarker.ext.beans.SimpleMethodModel.exec(SimpleMethodModel.java:72) ... 113 more I have the same configuration as the example. I researched a little bit and the NullPointer comes from the getAuthorizationContext in KeycloakSecurityContext that it is null. Anyone knows what it is happeing? Thanks in advance! P Please consider the environment before printing this e-mail.

6 years, 7 months

2
4
0 / 0

volume for hdb content of container?

by Joachim Lindenberg

Hello, I am experimenting with keycloak using https://hub.docker.com/r/jboss/keycloak and default database, i.e. h2. Is there a means to have h2 persist the database to a file on a docker volume and load at startup instead of starting configuration from scratch? My environment does not need to support lots of users and afai understood the database is primarily for configuration when not replication ldap users. Using any of the other databases looks overkill to me. Or if that perception is wrong, I am wondering why my configuration was lost after trivial reconfiguration of my docker-compose.yml.. Any suggestion? Thanks, Joachim

6 years, 7 months

1
0
0 / 0

ldaps from keycloak container

by Joachim Lindenberg

Hello, I am trying to set up keycloak using a container and configure authentication against my ldap (a samba active directory). I configured ldaps://ldap.example.dom:636 in the user interface and test connection succeeds. However authentication of the bind user fails with the following exception: Caused by: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target at sun.security.ssl.Alerts.getSSLException(Alerts.java:192) at sun.security.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1946) at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:316) at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:310) at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1639) at sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:223) at sun.security.ssl.Handshaker.processLoop(Handshaker.java:1037) at sun.security.ssl.Handshaker.process_record(Handshaker.java:965) at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1064) at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1367) at sun.security.ssl.SSLSocketImpl.writeRecord(SSLSocketImpl.java:750) at sun.security.ssl.AppOutputStream.write(AppOutputStream.java:123) at java.io.BufferedOutputStream.flushBuffer(BufferedOutputStream.java:82) at java.io.BufferedOutputStream.flush(BufferedOutputStream.java:140) at com.sun.jndi.ldap.Connection.writeRequest(Connection.java:443) at com.sun.jndi.ldap.Connection.writeRequest(Connection.java:416) at com.sun.jndi.ldap.LdapClient.ldapBind(LdapClient.java:359) at com.sun.jndi.ldap.LdapClient.authenticate(LdapClient.java:214) ... 88 more Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:397) at sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:302) at sun.security.validator.Validator.validate(Validator.java:262) at sun.security.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:330) at sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:237) at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:132) at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1621) ... 101 more Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target at sun.security.provider.certpath.SunCertPathBuilder.build(SunCertPathBuilder.java:141) at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:126) at java.security.cert.CertPathBuilder.build(CertPathBuilder.java:280) at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:392) ... 107 more I was expecting that I have to import a CA and therefore configured environment variable X509_CA_BUNDLE to point to a cert as described in https://hub.docker.com/r/jboss/keycloak/ “Setting up TLS(SSL)”, but the section is not really clear whether it also applies for trust to LDAPs. Any suggestion? Thanks, Joachim

6 years, 7 months

1
0
0 / 0

Retrieving user permissions with client_id and client_secret alone

by Akhil Lawrence

Hi Folks, I am trying to write my own policy enforcement point in pythton. I am able to retrieve permissions of a user if *username* and *password* is provided. But is there a way by which I can retrieve the user permissions only using my *client_id* and *client_secret* Thanks.

6 years, 8 months

1
0
0 / 0

Query on application integration for SAML flow (IDP initiated flow)

by abhijeet chauhan

Hi, We have integrated our app so that app acts as oauth client to Keycloak and keycloak is acting as Identity broker for incoming SSO flows (SAML). APP (oauth client) <- > Keycloak <-> SAML Identity Providers. Here we generate the SSO url in app so that we select the SAML identity providers using kc_idp_hint that points the SAML IDP configured in Keycloak (this is SAML SP SSO flow) and it is working perfectly well. However I have questions how can I get this SSO integration working for SAML IDP initiated flow, I tried doing IDP initiated flow with this and I see Keycloak generating exceptions / errors. I know oauth / oidc are always initiated at RP (relying party) here APP, however if Keycloak can create user session and create Identity of user (for IDP initiated flow) and send browser to a specific url (specified on IDP through RelayState) than APP can initiate the SSO flow and as user will have the session on Keycloak, keycloak can redirect user to redirect_uri on app to have the session . Any thoughts how to get it working. ?. Thanks, Vijay

6 years, 8 months

1
1
0 / 0

Password Policies do not Work When There is a User Federation

by İlhan Subaşı

I have build an custom user storage provider using this example https://github.com/thomasdarimont/keycloak-user-storage-provider-demo/tre... Unfortunately when you activate this user federation then password policies do not work. For example under Authentication -> Password Policy -> Add policy... -> Minimum Length. This does not work. Is there any workaround to activate password policies?

6 years, 8 months

2
2
0 / 0

Hide Keycloak codes exchange from the URL

by Corentin Dupont

Hi guys, is it possible to hide the complex URL Keycloak redirects to when login? For example Keycloak redirects to: https://auth.website.org.uk/auth/realms/saturn/protocol/openid-connect/au... Which looks complicated (it was criticized by the users). I use Keycloak-JS wrapper. I came across the option 'silentCheckSsoRedirectUri': https://github.com/keycloak/keycloak-documentation/blob/master/securing_a... But I'm not sure it's working. Thanks, Corentin PS. I copy below a similar message posted on the mailing list for reference. [keycloak-user] OIDC login URLs, how to hide them from the user?? *Max Allan* max.allan+keycloak at surevine.com <keycloak-user%40lists.jboss.org?Subject=Re:%20%5Bkeycloak-user%5D%20OIDC%20login%20URLs%2C%20how%20to%20hide%20them%20from%20the%20user%3F%3F&In-Reply-To=%3CCADNp1BbVc6A-HsiTszRV_TJY%2BQHH4q%2BQyFeSfqhPWc-dVD1jLw%40mail.gmail.com%3E> *Tue Jan 22 10:36:05 EST 2019* - Previous message: [keycloak-user] Gatekeeper docker configuration question <https://lists.jboss.org/pipermail/keycloak-user/2019-January/017009.html> - Next message: [keycloak-user] Error controller is not invoked if authentication failed <https://lists.jboss.org/pipermail/keycloak-user/2019-January/017011.html> - *Messages sorted by:* [ date ] <https://lists.jboss.org/pipermail/keycloak-user/2019-January/date.html#17010> [ thread ] <https://lists.jboss.org/pipermail/keycloak-user/2019-January/thread.html#...> [ subject ] <https://lists.jboss.org/pipermail/keycloak-user/2019-January/subject.html...> [ author ] <https://lists.jboss.org/pipermail/keycloak-user/2019-January/author.html#...> ------------------------------ Hi, When a user hits a (Keycloak gatekeeper) protected site, they get redirected to the keycloak server login page, a URL like this : https://auth.website.org.uk/auth/realms/saturn/protocol/openid-connect/au... So, a typical new user journey looks like "type in https colon slash *which slash was it? oh that one* and another slash ww dot website dot com *oops no, www and dot org dot uk ENTER" *I don't want to type _that_ in again : Click Bookmark button QUICK* So they've now bookmarked a login page that includes a state of 7103.... The session they have works and if they don't use their bookmark, it works. If they come back to it later, and use the bookmark, get asked to login and then get a "403 authorisation denied" error. The gatekeeper logs say : 1.5481603986412873e+09 error State parameter mismatch 1.5481603986665585e+09 error unable to exchange code for access token {"error": "invalid_grant: Incorrect redirect_uri"} So, how can I make this user journey easier with keycloak? Ideally I'd like to hide the auth urls completely, their browser doesn't need to know they're authenticating on different site. I tried a "sign-in-page" with a frame containing the login page from keycloak : <html> <frameset cols="100%"> <frame src="{{ .redirect }}"> </frameset> </html> (and change the security settings for frame-ancestors ) And when you've logged in, you get an empty page with a 403 error. Gatekeeper says "unable to exchange code for access token {"error": "invalid_grant: Incorrect redirect_uri"}" again. Keycloak says : type=CODE_TO_TOKEN_ERROR, realmId=86979f4f-7314-4fb6-86bc-3516fcb0c3ae, clientId=alb, userId=01cf3b8f-498e-46b8-815e-6a9a5c2dda1c, ipAddress=180.430.597.666, error=invalid_code, grant_type=authorization_code, code_id=02221f30-faa5-48ad-aae6-a5adec6a705a, client_auth_method=client-secret (ip address etc. has been obfuscated) IF the user is clever, they can then remove the oauth/authorize?state=ba4fcb0d-6ecf-4afe-8b98-e0fbcbc4ca25 from the URL in the browser and the session carries on quite happily. Is there a setting I'm getting wrong in keycloak somewhere that is breaking this? In this first instance, we are returning to an old "state". I can imagine that not working. But the second setup, I'm just logging in to keycloak, in a frame, nothing else has changed from a "working" setup, just the login page is in a frame. (I also need to figure out how to escape the frame!!) Thanks, Max

6 years, 8 months

1
1
0 / 0

Authenticate unix users

by Ajinkya Thakare

Hi all, Is there any way to authenticate local Unix users via Keycloak for a client application? The user can be on the server machine where Keycloak is hosted. Regards, Ajinkya Thakare

6 years, 8 months

1
0
0 / 0

Callbacks when I rotate my keys or revoke my JWT tokens

by Daniel Souza

Hi, In my implementation, I am validating the JWT tokens locally, keeping the public keys in a local cache to avoid making multiple calls to the Keycloak server. I won't know when a key in the server is no longer enabled or valid, therefore I could end up validating an invalid JWT token locally. I would like to know if Keycloak has a way to configure callbacks when I rotate my keys. Does it have? Then I can update my keys in the cache… In the case of JWT token revocation, can tokens be individually revoked in Keycloak? Is this feature available? Are there callbacks implemented in case I have JWT tokens revoked? Thank you in advance. Regards, Daniel.

6 years, 8 months

1
0
0 / 0

Keycloack Multi -Tenancy question

by Litom Segal

We are considering using Keycloack in a multi-tenant fashion. Each of our customer's account has its own users, and applications installed, and we also provide services API's consumed by various clients. We will have a large number of tenants. I found an open issue from 2017 that mentions that Keycloak may have some scalability issues with a large number of realms. https://issues.jboss.org/browse/KEYCLOAK-4593 And also this thread from 2016, https://lists.jboss.org/pipermail/keycloak-user/2016-October/008033.html, that states that "Keycloak was not designed to support multi-tenancy directly."..."In that regards we have never tested with high amounts of realms as we expect there to be few realms (up to 10 most likely)." I was wonder if there was any progress on the multi-tenancy use case, and are there any best practices on how to setup Keycloack to support it. On the other hand, is there any other approach to handle our use-case? Thanks, Litom -- Litom Segal Software Engineer T: +972-74-700-4097 <https://www.linkedin.com/company/164748> <https://twitter.com/liveperson> <https://www.facebook.com/liveperson/?ref=bookmarks> Our mission is to make life easier by transforming how people communicate with brands. <https://liveperson.docsend.com/view/drieh2u> -- This message may contain confidential and/or privileged information. If you are not the addressee or authorized to receive this on behalf of the addressee you must not use, copy, disclose or take action based on this message or any information herein. If you have received this message in error, please advise the sender immediately by reply email and delete this message. Thank you.

6 years, 8 months

4
6
0 / 0

Websockets with Keycloak

by Wolfgang Ederer

Hi, we are building an app with keycloak. The backend uses nodeJS the frontend is also written in JavaScript. Is there a recommended way how to secure a websocket channel with Keycloak? e.g. Heartbeats vs sending Token with each message? Thanks! Best Regards Wolfgang Ederer

6 years, 8 months

1
0
0 / 0

Gerrit + Keycloak (OAuth2)

by Sergio Durigan Junior

Hello, I have been trying to set up a Gerrit instance (latest version, running in a local VM) with OAuth2 authentication using Keycloak (also running at the same VM), and I'm seeing some strange errors. I posted a message like this one to repo-discuss, but I'm now thinking it may have something to do with a misconfiguration of Keycloak, so I decided to give it a try here. First, some information about my setup. I'm running Debian 10 (buster) with OpenJDK 11 installed. I was trying to run Keycloak "by hand", but am now trying the docker image provided by you guys. Gerrit is running on http://192.168.122.32/gerrit, and Keycloak is running on http://192.168.122.32:8877. I am using the "master" realm. There, I created the "gerrit" client, which uses "openid-connect" as the client protocol, and "confidential" as access type. Here are the other parameters that I think are useful for you: - Root URL: http://192.168.122.32/gerrit - Valid Redirect URIs: http://192.168.122.32/gerrit/* - Base URL: empty - Admin URL: http://192.168.122.32/gerrit - Web Origins: http://192.168.122.32/gerrit The problem happens when I try to log in. I go to http://192.168.122.32/gerrit/login, which takes me to Keycloak login page. I enter the correct user/pass, and get redirected to a URL like: <http://192.168.122.32/gerrit/oauth?state=4ZnqJHotq9Ul51sjdFtREk7hHlFXP7pB...> This URL seems correct. However, I see a "Server Error" on Gerrit: [2019-10-10 00:14:46,542] [HTTP-81] ERROR com.google.gerrit.pgm.http.jetty.HiddenErrorHandler : Error in GET /gerrit/oauth?state=4ZnqJHotq9Ul51sjdFtREk7hHlFXP7pBD8YaMvFgP2Q&session_state=86de8bed-870e-48b5-9627-954786c83c4b&code=c639f041-40b1-4205-a7d4-07f923e0e27b.86de8bed-870e-48b5-9627-954786c83c4b.b0086d87-e5ca-48d0-b2af-16b6b3ed8b47 org.scribe.exceptions.OAuthException: Cannot extract an access token. Response was: {"error":"invalid_grant","error_description":"Code not valid"} When I look at Keycloak's logs, I see: 04:14:46,539 WARN [org.keycloak.protocol.oidc.utils.OAuth2CodeParser] (default task-14) Code 'c639f041-40b1-4205-a7d4-07f923e0e27b' already used for userSession '86de8bed-870e-48b5-9627-954786c83c4b' and client 'b0086d87-e5ca-48d0-b2af-16b6b3ed8b47'. 04:14:46,540 WARN [org.keycloak.events] (default task-14) type=CODE_TO_TOKEN_ERROR, realmId=master, clientId=gerrit, userId=null, ipAddress=192.168.122.32, error=invalid_code, grant_type=authorization_code, code_id=86de8bed-870e-48b5-9627-954786c83c4b, client_auth_method=client-secret I tried searching for these warnings messages online, and found a few references. Most of them (on this same list) did not offer any useful hints. I'm pretty new to this whole authentication thing, so any advice is welcome. Thanks in advance! -- Sergio GPG key ID: 237A 54B1 0287 28BF 00EF 31F4 D0EB 7628 65FC 5E36 Please send encrypted e-mail if possible http://sergiodj.net/

6 years, 8 months

1
0
0 / 0

Account Management Rest API

by Corentin Dupont

Hello, I wanted know the status of the new account Console and API (see message copied bellow)? I have an application developed in ReactJS, which is using Keycloak account pages generated by Keycloak (4.4.0). I would like to add additional elements to the account page, that are not controlled by Keycloak. Notably, I need to access the Redux store and make some HTTP requests to an eternal API. What do you suggest? I was thinking to re-do completely the account pages with React, and retrieve the data from Keycloak using API. However I'm not sure the account management API is ready on Keycloak side. Thanks Corentin Stan Silvert wrote on Mon Apr 15 12:32:07 EDT 2019: Right now this API is in development and subject to change at any time. We are hoping to have it completed in the next few months. Also, we are working on a new Account Console that will use PatternFly 4 and React. It will be easy to extend, so you can add your own pages. It will work better on mobile devices. And of course, you will be able to change it around with different themes and such. So building your own console from this new Account Console might be a better option than building the whole thing from scratch. If you are interested, the code is here along with a readme that tells how to build and run. It's very much a work in progress:https://github.com/keycloak/keycloak/tree/master/themes/src/main... I still need to document how to create extensions, so let me know if you are interested in that. Stan On 4/15/2019 11:23 AM, Gabriele Rabbiosi wrote: >* Hi guys, *>* I'd like more information about the AccountRestService class *>* (https://github.com/keycloak/keycloak/blob/master/services/src/main/java/o... <https://github.com/keycloak/keycloak/blob/master/services/src/main/java/o...>) *>>* 1. I noticed that there are still a couple of TODO (such as Identity *>* Providers management), is there a roadmap for the development of this *>* missing features? *>* 2. Are these API public or for internal use only? I'd like to use them *>* to implement a custom Account Management page for my application. *>* 3. How stable are they? How likely is it that they will change or *>* disappear in the (near) future? *>>* Thanky you. *>* Best regards *>>* -- *>>* GABRIELE RABBIOSI *>>* BeePMN Software Engineer *>>

6 years, 8 months

3
5
0 / 0

Re: [keycloak-user] subflow issue on reset credentials

by Max Allan

Hi Arnault, I think with no "alternative" to alternate to or a "required" flow at the top level, you will not "require" anything other than choosing your user to gain a session. (You can use "choose a user" in a flow as a way to login without a password. So at that point in the process the user is logged in, with a login cookie.) I suppose you could consider it like this : you haven't completed all the required steps so the alternative flow hasn't completed yet, so you shouldn't be logged in. Maybe... I don't think this is a bug. But it does do the same for me. This makes me think : If you capture the cookie when using the normal reset process and replay a session with it and gain access to someone else's account, that would be a security bug. I might dig into that later if I have time/energy! Why would you want all the steps to be an "alternative" to reset credentials? You don't even need to try it twice, just enter your email/username and press submit when you see the "mail sent" message, click back. You're in. Max On Tue, 8 Oct 2019 at 16:54, <keycloak-user-request(a)lists.jboss.org> wrote: > > From: Arnault BESNARD <Arnault.BESNARD(a)b-com.com> > To: "keycloak-user(a)lists.jboss.org" <keycloak-user(a)lists.jboss.org> > Cc: > Bcc: > Date: Tue, 8 Oct 2019 15:41:49 +0000 > Subject: [keycloak-user] subflow issue on reset credentials > Hi all, > > > I got a very strange Keycloak behaviour on reset credentials. > > > > I set my reset credentials flow as follows: > > * I created a flow called "subflow" and set it as alternative > > Inside my subflow I created 3 execution providers: > > * choose user (required) > > * send Reset Email (required) > > * Reset Password (required) > > > The authentication flow is the default "browser" flow. > > > Now, I tried the following scenario: > > * On the login page, click on "forgot password" > > * Enter a valid email > > * A message told you that you should receive an email soon. > > * Click again on "forgot password" > > * Now, enter any valid user's email belonging to the realm > > * Again, a message told you that you should receive an email soon. > > * Now click on the browser back button. > > * You are connected with the credential belonging to the user's email ! > > > If you create your reset credentials without subform, this scenario > doesn't allow you to connect without the email link. > > > Before opening a bug case, can someone confirm he has the same behaviour ? > > > Thanks in advance, > > > Arnault > > > _______________________________________________ > keycloak-user mailing list > keycloak-user(a)lists.jboss.org > https://lists.jboss.org/mailman/listinfo/keycloak-user -- Max Allan phone +448454681066 email max.allan(a)surevine.com [image: Surevine 10th Anniversary] Participate | Collaborate | Innovate Surevine Limited, registered in England and Wales with number 06726289. PO Box 1136, Guildford GU1 9ND, UK If you think you have received this message in error, please notify us.

6 years, 8 months

2
3
0 / 0

Keycloak returns 403 after login

by Alfonso Vidal García

I have a Keycloak server and my web application. When I try login into the app, always Keycloak returns a 403 - Forbidden. This is my configuration from the web project, application.properties server.port = 38080 keycloak.realm=FocusocKeycloak keycloak.auth-server-url=http://localhost:8080/auth keycloak.ssl-required=external keycloak.resource=login-provider-web keycloak.public-client=false keycloak.credentials.secret=XXXX keycloak.securityConstraints[0].authRoles[0] = USER keycloak.securityConstraints[0].securityCollections[0].patterns[0] = /* # Turn off the logs logging.level.root=OFF logging.level.org.springframework.boot=OFF spring.main.banner-mode=OFF keycloak.json { "realm": "FocusocKeycloak", "auth-server-url": "http://127.0.0.1:8080/auth", "ssl-required": "external", "resource": "login-app", "verify-token-audience": true, "credentials": { "secret": "XXXX" }, "use-resource-role-mappings": true, "confidential-port": 0 } Here is the configuration of the Client, [enter image description here]<https://i.stack.imgur.com/fOWub.png> And I only have registered the role ROLE_USER. Anyone knows what it is happening? P Please consider the environment before printing this e-mail.

6 years, 8 months

1
0
0 / 0

Keycloak 7.0.0 and Spring Security adapter

by Tony Harris

As part of an application server deployment the root context is protected by a simple basic authentication application that lists the currently installed application on the server. If after accessing this secured page a user attempts to then access one of the Keycloak protected apps, a public client, on the same server the browser is sending the basic authorization header with the requests. This in turn seems to be causing the org.keycloak.adapters.springsecurity.filter.KeycloakAuthenticationProcessingFilter filter to return true from the AUTHORIZATION_HEADER request header request matcher that is setup by this filter which in turn then causes the redirect to Keycloak on the initial login to be the initially requested URL and not the /sso/login you normally get and we go round in a redirect loop. The adapter has the basic-auth property set to false and I can see that a change has been made in this area since 3.1.0.Final which is what we are currently on. https://issues.jboss.org/browse/KEYCLOAK-5499 Anyone have any ideas, other than sorting out the root context app to not use basic auth. ________________________________ Please consider the environment: Think before you print! This message has been scanned for malware by Websense. www.websense.com

6 years, 8 months

1
0
0 / 0

Execution Flow

by Stuart

Hi All, I'm trying to add a step in the the KC authentication flow that just has a notification/message page to say something like 'You're all setup' or 'you made it through registration, well done'. :-) I've tried creating an authentication provider which just display the message (via a ftl template) which works great. However.... during the registration process I want he users to set their password and set up OTP. Now, because (I guess) the PW reset and OTP forms are 'required actions' they are skipped for the actual user authentication. So once all authentication providers are successful, KC moves onto the required actions and displays the forms for them. This results in my 'message' provider showing before the PW and OTP setup pages. So I'm thinking that I should make the 'message' provider return success on authentication and add 'Required Actions'. Does that sound like the way to go? My only concern is that I still cannot get the PW (re)set page to appear before the OTP page (even if I change the order under the 'Required Actions' tab in the authentication setup), so I'm not sure how KC is making the decision on which page to show next. (I thought about using the T&C page for the message page, but I don't know how to tell KC that its a new user, as the user is added to KC before they get to login/register.) Any thoughts are appreciated. Stuart

6 years, 8 months

1
1
0 / 0

Keycloak 7.0 SAML IDP initiated flow

by abhijeet chauhan

Hi, We have couple of applications integrated with Keycloak as Oidc clients. Now we are using SAML brokers (Identity Providers under KC). SP initiated flow is working well such that app (oidc client) -> KC -> SAML IDP flow is working well. However when doing IDP initiated flow its not working as expected. I am testing with samltest.id and getting below error - 2019-10-08 19:12:50,515 TRACE [org.keycloak.saml.common] (default task-1) [Ref id=null:uri=#_ce8762784368ec6b6d323aedffa16001]validity status:true 2019-10-08 19:12:50,519 DEBUG [org.keycloak.saml.common] (default task-1) Verification failed for key null: javax.xml.crypto.dsig.XMLSignatureException: the keyselector did not find a validation key 2019-10-08 19:12:50,519 TRACE [org.keycloak.saml.common] (default task-1) the keyselector did not find a validation key: javax.xml.crypto.dsig.XMLSignatureException: the keyselector did not find a validation key at org.apache.jcp.xml.dsig.internal.dom.DOMXMLSignature$DOMSignatureValue.validate(DOMXMLSignature.java:558) at org.apache.jcp.xml.dsig.internal.dom.DOMXMLSignature.validate(DOMXMLSignature.java:264) at org.keycloak.saml.processing.core.util.XMLSignatureUtil.validateUsingKeySelector(XMLSignatureUtil.java:519) at org.keycloak.saml.processing.core.util.XMLSignatureUtil.validateSingleNode(XMLSignatureUtil.java:483) at org.keycloak.saml.processing.core.saml.v2.util.AssertionUtil.isSignatureValid(AssertionUtil.java:292) at org.keycloak.broker.saml.SAMLEndpoint$Binding.handleLoginResponse(SAMLEndpoint.java:390) at org.keycloak.broker.saml.SAMLEndpoint$Binding.handleSamlResponse(SAMLEndpoint.java:512) at org.keycloak.broker.saml.SAMLEndpoint$Binding.execute(SAMLEndpoint.java:249) at org.keycloak.broker.saml.SAMLEndpoint.postBinding(SAMLEndpoint.java:164) at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.lang.reflect.Method.invoke(Method.java:498) at org.jboss.resteasy.core.MethodInjectorImpl.invoke(MethodInjectorImpl.java:138) at org.jboss.resteasy.core.ResourceMethodInvoker.internalInvokeOnTarget(ResourceMethodInvoker.java:517) at org.jboss.resteasy.core.ResourceMethodInvoker.invokeOnTargetAfterFilter(ResourceMethodInvoker.java:406) at org.jboss.resteasy.core.ResourceMethodInvoker.lambda$invokeOnTarget$0(ResourceMethodInvoker.java:370) at org.jboss.resteasy.core.interception.PreMatchContainerRequestContext.filter(PreMatchContainerRequestContext.java:355) at org.jboss.resteasy.core.ResourceMethodInvoker.invokeOnTarget(ResourceMethodInvoker.java:372) at org.jboss.resteasy.core.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:344) at org.jboss.resteasy.core.ResourceLocatorInvoker.invokeOnTargetObject(ResourceLocatorInvoker.java:137) at org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorInvoker.java:106) at org.jboss.resteasy.core.ResourceLocatorInvoker.invokeOnTargetObject(ResourceLocatorInvoker.java:132) at org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorInvoker.java:100) at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:440) at org.jboss.resteasy.core.SynchronousDispatcher.lambda$invoke$4(SynchronousDispatcher.java:229) at org.jboss.resteasy.core.SynchronousDispatcher.lambda$preprocess$0(SynchronousDispatcher.java:135) at org.jboss.resteasy.core.interception.PreMatchContainerRequestContext.filter(PreMatchContainerRequestContext.java:355) at org.jboss.resteasy.core.SynchronousDispatcher.preprocess(SynchronousDispatcher.java:138) at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:215) at org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.service(ServletContainerDispatcher.java:227) at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:56) at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:51) at javax.servlet.http.HttpServlet.service(HttpServlet.java:791) at io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:74) at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:129) at org.keycloak.services.filters.KeycloakSessionServletFilter.doFilter(KeycloakSessionServletFilter.java:90) at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61) at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131) at io.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.java:84) at io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:62) at io.undertow.servlet.handlers.ServletChain$1.handleRequest(ServletChain.java:68) at io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36) at org.wildfly.extension.undertow.security.SecurityContextAssociationHandler.handleRequest(SecurityContextAssociationHandler.java:78) at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) at io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:132) at io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:57) at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) at io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:46) at io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64) at io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:60) at io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:77) at io.undertow.security.handlers.NotificationReceiverHandler.handleRequest(NotificationReceiverHandler.java:50) at io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43) at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) at org.wildfly.extension.undertow.security.jacc.JACCContextIdHandler.handleRequest(JACCContextIdHandler.java:61) at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) at org.wildfly.extension.undertow.deployment.GlobalRequestControllerHandler.handleRequest(GlobalRequestControllerHandler.java:68) at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) at io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:292) at io.undertow.servlet.handlers.ServletInitialHandler.access$100(ServletInitialHandler.java:81) at io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:138) at io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:135) at io.undertow.servlet.core.ServletRequestContextThreadSetupAction$1.call(ServletRequestContextThreadSetupAction.java:48) at io.undertow.servlet.core.ContextClassLoaderSetupAction$1.call(ContextClassLoaderSetupAction.java:43) at org.wildfly.extension.undertow.security.SecurityContextThreadSetupAction.lambda$create$0(SecurityContextThreadSetupAction.java:105) at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502) at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502) at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502) at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502) at io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:272) at io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:81) at io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:104) at io.undertow.server.Connectors.executeRootHandler(Connectors.java:364) at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:830) at org.jboss.threads.ContextClassLoaderSavingRunnable.run(ContextClassLoaderSavingRunnable.java:35) at org.jboss.threads.EnhancedQueueExecutor.safeRun(EnhancedQueueExecutor.java:1982) at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.doRunTask(EnhancedQueueExecutor.java:1486) at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1377) at java.lang.Thread.run(Thread.java:748) Now to test if end to end flow works, i disabled the SAML assertion validation on KC and then i got below error - 2019-10-08 19:19:46,222 TRACE [org.keycloak.saml.common] (default task-2) Set Attribute Namespace= http://www.w3.org/2000/xmlns/::Qual=:xmlns:ec::Value=http://www.w3.org/20... 2019-10-08 19:19:46,223 TRACE [org.keycloak.saml.common] (default task-2) Creating an Attribute Namespace=:Algorithm 2019-10-08 19:19:46,238 DEBUG [org.keycloak.saml.common] (default task-2) org.keycloak.saml.processing.core.saml.v2.util.XMLTimeUtil issueInstant: 2019-10-08T23:19:46.238Z 2019-10-08 19:19:46,238 DEBUG [org.keycloak.saml.validators.ConditionsValidator] (default task-2) Evaluating Conditions of Assertion _aa9bf8d729ea9129247b16a5e8a00a43. notBefore=2019-10-08T23:16:40.378Z, notOnOrAfter=2019-10-08T23:21:40.378Z, updatedNotBefore: 2019-10-08T23:16:40.378Z, updatedOnOrAfter=2019-10-08T23:21:40.378Z, now: 2019-10-08T23:19:46.238Z 2019-10-08 19:19:46,239 DEBUG [org.keycloak.saml.validators.ConditionsValidator] (default task-2) Assertion _aa9bf8d729ea9129247b16a5e8a00a43 validity is VALID 2019-10-08 19:19:46,240 WARN [org.keycloak.events] (default task-2) type=IDENTITY_PROVIDER_LOGIN_ERROR, realmId=dev, clientId=null, userId=null, ipAddress=127.0.0.1, error=invalidRequestMessage 2019-10-08 19:19:46,240 ERROR [org.keycloak.services.resources.IdentityBrokerService] (default task-2) invalidRequestMessage Attaching the log file first part shows when SAML signature validation is enabled on KC and second part is when SAML signature validation is disabled in KC. Any pointers will help.

6 years, 8 months

2
1
0 / 0

New Information Architecture proposal for Admin Console

by Stian Thorgersen

We are planning a re-design of the admin console in the future to make it easier to use and more consistent throughout. As a first step the team behind the design work has created a proposal for a new information architecture here: https://github.com/keycloak/keycloak-community/blob/master/design/admin-c... We would love feedback on the proposal.

6 years, 8 months

1
0
0 / 0

Re: [keycloak-user] SameSite and Secure

by Max Allan

Hi Matthew, I note that it is only cookies without "samesite" that are not "secure" that will be affected. I expect that you are running keycloak over http to a proxy and the proxy is not securing your cookies. You don't mention which proxy you are using. There is a module for nginx : nginx_cookie_flag However, I consider that to be mostly a bodge for masking other issues. Use it as last resort. You may need to ensure your proxy passes the correct headers for access to be detected as "SSL". I think if you fail to add "X-Forwarded-Proto" (and possibly Port) then keycloak sort of assumes your connection is over HTTP and does not secure cookies. You can maybe check by inspecting some of the redirects and if they include http URLs rather than https. Your proxy probably then redirects everyone to https anyway, but fixing it at source is better. This sort of thing often causes CORS errors as well because requests are going from one url (http....) to a different one (https....) And/Or, you can configure Keycloak' SSL policy: https://lists.jboss.org/pipermail/keycloak-user/2017-September/011888.html I think that is a case of setting "require SSL" for all/external in the Realm Settings. BUT IIRC that assumes you've got the header coming through correctly or it will reject ALL attempts to login. (Which is embarrassing because you cannot login to change the setting back! Always make sure you have a backup and know how to restore it before changing any settings!!) Also, if the proxy is on the same box, the connection appears to be local, so the "external" setting doesn't help! Max > ---------- Forwarded message ---------- > From: Matthew Broadhead <matthew.broadhead(a)nbmlaw.co.uk> > To: Bruno Oliveira <bruno(a)abstractj.org> > Cc: keycloak-user <keycloak-user(a)lists.jboss.org> > Bcc: > Date: Mon, 7 Oct 2019 16:41:44 +0200 > Subject: Re: [keycloak-user] SameSite and Secure > Hi Bruno, > > i see the warnings in exactly the same version of chrome as you Version > 77.0.3865.90 (Official Build) (64-bit) in fedora > > the same warning is showing in the console for a JSF application and > vue.js application and says the cookie originates from the domain where > my keycloak installation is located. > > i will continue to check if it is a problem with my httpd proxy i just > thought you should know about this message > > On 07/10/2019 11:31, Bruno Oliveira wrote: > > Hi Matthew, even though I agree that this is something we should > > consider to Keycloak, I don't see the warnings you mentioned in the > > latest release using Chrome 77.0.3865.90 (Official Build) (64-bit). > > > > Could you please provide the steps to reproduce the issue? > > > > > >

6 years, 8 months

3
2
0 / 0

Kecloak production container

by Ashwini Basavaraj

Hi, Can someone please help me with the best architecture for keycloak container to run in production. We are working on a small setup so don't want to use cluster yet. Is it good to run keycloak container on http and reroute requests to https using nginx. -- *Ashwini Basavaraj* *BOXARR* *| Operations* T: +44 7469554745 <+44%20117%20911%204762> <+44%20117%20911%204762> E: ashwini.basavaraj(a)boxarr.com W: www.boxarr.com LI: linkedin.com/company/boxarr @: twitter.com/boxarr This message is private and confidential. If you have received this message in error, please notify us immediately and remove it from your system. www.BOXARR.com/email-policy <http://www.boxarr.com/email-policy> BOXARR is a limited company registered in England and Wales. Company registration number: 04873279. Registered Office: The Wallbrook Building, 25 Wallbrook, London, EC4N 8AF, United Kingdom

6 years, 8 months

1
0
0 / 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

keycloak-user October 2019