November 2019 - keycloak-user - Jboss List Archives

Cannot build 8.0.0: Could not find artifact org.glassfish.jaxb:txw2:jar:2.4.0-b180608.0325

by Мартынов Илья

I've checked out 8.0.0 tag and try to build it. [ERROR] Failed to execute goal on project keycloak-saml-core-public: Could not resolve dependencies for project org.keycloak:keycloak-saml-core-public:jar:8.0.0: Could not find artifact org.glassfish.jaxb:txw2:jar:2.4.0-b180608.0325 in parallels ( http://ci.int.zone/nexus/content/groups/parallels/) -> [Help 1] Our repository is just a proxy for maven central repo, and there is no such version in it: https://mvnrepository.com/artifact/org.glassfish.jaxb/txw2 What have I missed? My build environment: [builder@imartynov-dev keycloak]$ java -version openjdk version "1.8.0_191" OpenJDK Runtime Environment (build 1.8.0_191-b12) OpenJDK 64-Bit Server VM (build 25.191-b12, mixed mode) [builder@imartynov-dev keycloak]$ javac -version javac 1.8.0_191 [builder@imartynov-dev keycloak]$ mvn -version Apache Maven 3.6.1 (d66c9c0b3152b2e69ee9bac180bb8fcc8e6af555; 2019-04-04T22:00:29+03:00) Maven home: /usr/local/apache-maven/apache-maven-3.6.1 Java version: 1.8.0_191, vendor: Oracle Corporation, runtime: /usr/lib/jvm/java-1.8.0-openjdk-1.8.0.191.b12-0.el7_5.x86_64/jre Default locale: en_US, platform encoding: UTF-8 OS name: "linux", version: "3.10.0-693.11.6.el7.x86_64", arch: "amd64", family: "unix"

5 years

3
2
0 / 0

Rescue codes support when using Two factor authentication

by Rafael Weingärtner

Hello Keycloakers, Is it possible to setup "rescue codes" when using two factor authentication in Keycloak (e.g. when using OTP)? -- Rafael Weingärtner

5 years

2
3
0 / 0

CODE_TO_TOKEN_ERROR and clustered mode

by Daniel Fernández Rodríguez

Hi guys, we have keycloak v7 configured to use clustered mode. For that I configured the service to start using standalone-ha.xml (we have puppet so all keycloaks should have identical config) and added 'proxy-address-forwarding="true" (I have one nginx as a reverse proxy taking care of the https) |<http-listener name="default" proxy-address-forwarding="true"socket-binding="http" redirect-socket="https" enable-http2="true"/>| | | In front of the keycloaks I have a couple of HAProxies configured to use tcp mode. Front time to time, some users complain that they cannot login. When I check the logs I see something like: {"loggerTimestamp":"2019-11-11T15:41:43.647+01:00","sequence":6354,"loggerClassName":"org.jboss.logging.Logger","loggerName":"org.keycloak.events","level":"WARN","message":"type=CODE_TO_TOKEN_ERROR, realmId=myrealm, clientId=myclient, userId=null, ipAddress=111.222.30.198, error=invalid_code, grant_type=authorization_code, code_id=e24eaa47-adfd-48bc-a3bb-4f1fbe4ba59b, client_auth_method=client-secret","threadName":"default task-45","threadId":327,"mdc":{},"ndc":"","hostName":"keycloak-59cd3c0b11.mycompany.com","processName":"jboss-modules.jar","processId":12591 } Do you know what might be happening? There is not a lot of documentation on how to properly configure clustered mode. Thanks a lot. Daniel.

5 years

2
1
0 / 0

Keycloak IE11 Support?

by Stan Silvert

Hi Keycloak Community, We are trying to make decisions around the future of the Account Console on IE11 and we really need your feedback. As we move to modern UI development frameworks like PatternFly 4, IE11 support becomes more and more difficult. Do you or your customers require support for IE11 today? Do you believe that you will require support for IE11 in the next two to three years? Thanks for your help, Stan Silvert

5 years

4
3
0 / 0

Transaction management in event/timer handlers

by Scott Elliott

Is there anything that should be done for transactions if updates are done in an event or timer handler? It seems that things work properly, and the changes to a UserModel object are saved, but I was wondering if this is more of a side-effect. I seem to recall something about this, but I cannot find it now.

5 years

1
0
0 / 0

HYPERSIGN - THE BLOCKCHAIN AUTHENTICATOR ON KEYCLOAK

by Vikram Bhushan

> Hi All, > > I am Vikram co-founder of Hypermine > > Are you looking for a simple and quick way to access blockchain features and applications? > We are a small team working out of Bangalore India creating protocols for SSOs to access decentralized environments quickly and securely. > > As you may already be aware, users cannot directly access Blockchains using their current credentials (username and password), since Blockchains only understand cryptographic key-pairs. In this case, the IDP has to manage another set of credentials (crypto key-pair) in order for users to interact with Blockchains. Therefore, there need to be multiple identities for per user which is cumbersome to manage. > > Obviously, enterprise users cannot give up on legacy systems overnight, but the need to move towards access decentralized environments is the way forward for the future. We would like to introduce you to our solution – Hypersign <https://github.com/hypermine-bc/hypersign/>, the protocol can be easily integrated with any SSO [including key-cloak] using our HypersignSign – Authenticator <https://github.com/hypermine-bc/hypersign/blob/master/docs/hs-products.md> [HSAuth]. HS-Auth helps users to login into any application [Webapp or Dapp] without the need to use their existing having username/password – i.e. Passwordless authentication. Once a user logs in, Hypersign helps to form and submit transactions using our Hypersign-SDK, making it simple to move between legacy centralized apps to decentralise environments. > > We are currently looking for partners to help test our solution, if you would be interested in partnering with us, please do contact myself or my teams irfan(a)hypermine.in <mailto:Vikram@hypersign.in> and vishwas(a)hypermine.in <mailto:vishwas@hypersign.in> > > > > > Thanks > Vikram A. Bhushan > M: +91-8867-116-216 > vikram(a)hypermine.in <mailto:vikram@hypermine.in> > www.hypermine.in >

5 years

1
0
0 / 0

SAML Idp initiated login / sp initiated login

by Manuel Waltschek

Hi, I am trying to setup Keycloak SAML with a third party IdP. ________________________________ Setup: Keycloak-Server Version 4.8.3.Final Wildfly Version 10.1.0.Final Wildfly Adapter Version keycloak-saml-wildfly-adapter-dist-4.8.3.Final ________________________________ I have followed these instructions: IDP Initiated Login IDP Initiated Login is a feature that allows you to set up an endpoint on the Keycloak server that will log you into a specific application/client. In the Settings tab for your client, you need to specify the IDP Initiated SSO URL Name. This is a simple string with no whitespace in it. After this you can reference your client at the following URL: root/auth/realms/{realm}/protocol/saml/clients/{url-name} The IDP initiated login implementation prefers POST over REDIRECT binding (check saml bindings<https://www.keycloak.org/docs/latest/server_admin/index.html#_saml> for more information). Therefore the final binding and SP URL are selected in the following way: 1. If the specific Assertion Consumer Service POST Binding URL is defined (inside Fine Grain SAML Endpoint Configuration section of the client settings) POST binding is used through that URL. 2. If the general Master SAML Processing URL is specified then POST binding is used again throught this general URL. 3. As the last resort, if the Assertion Consumer Service Redirect Binding URL is configured (inside Fine Grain SAML Endpoint Configuration) REDIRECT binding is used with this URL. If your client requires a special relay state, you can also configure this on the Settings tab in the IDP Initiated SSO Relay State field. Alternatively, browsers can specify the relay state in a RelayState query parameter, i.e. root/auth/realms/{realm}/protocol/saml/clients/{url-name}?RelayState=thestate. When using identity brokering<https://www.keycloak.org/docs/latest/server_admin/index.html#_identity_br...>, it is possible to set up an IDP Initiated Login for a client from an external IDP. The actual client is set up for IDP Initiated Login at broker IDP as described above. The external IDP has to set up the client for application IDP Initiated Login that will point to a special URL pointing to the broker and representing IDP Initiated Login endpoint for a selected client at the brokering IDP. This means that in client settings at the external IDP: * IDP Initiated SSO URL Name is set to a name that will be published as IDP Initiated Login initial point, * Assertion Consumer Service POST Binding URL in the Fine Grain SAML Endpoint Configuration section has to be set to the following URL: broker-root/auth/realms/{broker-realm}/broker/{idp-name}/endpoint/clients/{client-id}, where: * broker-root is base broker URL * broker-realm is name of the realm at broker where external IDP is declared * idp-name is name of the external IDP at broker * client-id is the value of IDP Initiated SSO URL Name attribute of the SAML client defined at broker. It is this client, which will be made available for IDP Initiated Login from the external IDP. Please note that you can import basic client settings from the brokering IDP into client settings of the external IDP - just use SP Descriptor<https://www.keycloak.org/docs/latest/server_admin/index.html#_identity_br...> available from the settings of the identity provider in the brokering IDP, and add clients/client-id to the endpoint URL. ________________________________ Configuration Issues There are following cases that I can't get my head around: * If I leave Assertion Consumer Service POST Binding URL in the Fine Grain SAML Endpoint Configuration blank, the IdP initiated login works, but the sp-initiated login does not work (no matter if I directly browse to myapp/context url or to https://host/auth/realms/myrealm/protocol/saml/clients/myapp * If I put broker-root/auth/realms/{broker-realm}/broker/{idp-name}/endpoint/clients/{client-id} in Assertion Consumer Service POST Binding URL, an IdP initiated login results in invalidFederatedIdentityActionMessage: ERROR [org.keycloak.broker.saml.SAMLEndpoint] (default task-300) validation failed: org.keycloak.common.VerificationException: Invalid signature on document at org.keycloak.protocol.saml.SamlProtocolUtils.verifyDocumentSignatureSamlProtocolUtils.java:83) at org.keycloak.broker.saml.SAMLEndpoint$PostBinding.verifySignature(SAMLEndpoint.java:557) at org.keycloak.broker.saml.SAMLEndpoint$Binding.handleSamlResponse(SAMLEndpoint.java:495) at org.keycloak.broker.saml.SAMLEndpoint$Binding.execute(SAMLEndpoint.java:244) at org.keycloak.broker.saml.SAMLEndpoint.postBinding(SAMLEndpoint.java:1 82) This is metadata in the external IdP: <EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" entityID="https://mybroker/auth/realms/MYREALM"> <SPSSODescriptor AuthnRequestsSigned="true" WantAssertionsSigned="true" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol urn:oasis:names:tc:SAML:1.1:protocol http://schemas.xmlsoap.org/ws/2003/07/secext"> <NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</NameIDFormat> <KeyDescriptor use="signing"> <dsig:KeyInfo xmlns:dsig="http://www.w3.org/2000/09/xmldsig#<http://www.w3.org/2000/09/xmldsig>"> <dsig:KeyName>*****</dsig:KeyName> <dsig:X509Data> <dsig:X509Certificate>*****</dsig:X509Certificate> </dsig:X509Data> </dsig:KeyInfo> </KeyDescriptor> <KeyDescriptor use="encryption"> <dsig:KeyInfo xmlns:dsig="http://www.w3.org/2000/09/xmldsig#<http://www.w3.org/2000/09/xmldsig>"> <dsig:KeyName>*****</dsig:KeyName> <dsig:X509Data> <dsig:X509Certificate>*****</dsig:X509Certificate> </dsig:X509Data> </dsig:KeyInfo> </KeyDescriptor> <SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://mybroker/auth/realms/MYREALM/broker/myidp/endpoint"/<https://mybroker/auth/realms/MYREALM/broker/myidp/endpoint>> <AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://mybroker/auth/realms/MYREALM/broker/myidp/endpoint/clients/myapp" index="1" isDefault="true" /> </SPSSODescriptor> </EntityDescriptor> ________________________________ Questions: * If you set up Idp Initiated login, should the SP initiated login work aswell? * If yes, where does the AssertionConsumerServiceURL in the AuthnRequest come from? (shouldn't it reference the same url: https://mybroker/auth/realms/MYREALM/broker/myidp/endpoint/clients/myapp (because it doesn't) * Does the logout URL have to reference the client SSO id aswell? * Is there more Information concerning FINE GRAIN SAML ENDPOINT CONFIGURATION? Best regards and thank you in advance, [Logo] Manuel Waltschek BSc. +43 660 86655 47<tel:+436608665547> manuel.waltschek(a)prisma-solutions.at<mailto:manuel.waltschek@prisma-solutions.at> https://www.prisma-solutions.com PRISMA solutions EDV-Dienstleistungen GmbH Klostergasse 18, 2340 Mödling, Austria Firmenbuch: FN 239449 g, Landesgericht Wiener Neustadt

5 years

1
0
0 / 0

Re: [keycloak-user] [keycloak-dev] Disabled issues section on keycloak github page.

by Bruno Oliveira

Hi Wojciech, I believe we have it described into our README files https://github.com/keycloak/keycloak#help-and-documentation, but if there's something that should be improved, please let us know. GitHub issues are disabled for all the repositories because it's really hard to watch issues on GH and keep up with Jiras. At the moment we don't have enough bandwidth for it and there's no way to sync between both. On Thu, Nov 28, 2019 at 9:12 AM Wojciech Trocki <wtrocki(a)redhat.com> wrote: > > ---------- Forwarded message --------- > From: Wojciech Trocki <wtrocki(a)gmail.com> > Date: Thu, 28 Nov 2019, 11:57 > Subject: Disabled issues section on keycloak github page. > To: keycloak-dev <keycloak-dev(a)lists.jboss.org> > > > Hi > > I have been at the conference recently and chatted with a couple of > developers about keycloak. > What really made me worried that one of the devs made claim that: > "Keycloak does not allow the community to log issues" > > Upon later explanation, I have found out that this was > misunderstanding related to the disabled issues section on the keycloak > GitHub page. > Is there any reason why GitHub issues are disabled for keycloak? > I know that the team is using Jira for issue tracking. > GitHub issues became an open-source standard over the couple of years. > > -- > _______________________________________________ > keycloak-dev mailing list > keycloak-dev(a)lists.jboss.org > https://lists.jboss.org/mailman/listinfo/keycloak-dev -- - abstractj

5 years

1
0
0 / 0

Using the amr claim in access token when brokering with Azure AD

by Philippe Gauthier

Hello Keycloak users. Did anybody tried to do something with the amr claim sent by an IdP to Keycloak on identity brokering? We did a POC using Azure AD as an IdP with Keycloak. Azure AD is configured to force user to do a multi factor authentication (MFA). When I log to my application secured by Keycloak using my Azure AD identity The access token recieved by Keycloak from Azure AD contains the following amr claim: "amr": [ "pwd", "mfa" ], This claim tell that I was authentified using a password and mfa. When I look to the access Token Keycloak gave me, there is no such amr claim? Is there a way other than creating an SPI to propagate this claim from Azure AD access token to Keycloak Access Token? What we want to do is to ask a user that was not authentified by an external multi factor authenticfiation to use the Keycloak OTP when accessing sensible applications. Thankyou.

5 years

1
0
0 / 0

Multiple sessions in the same realm

by Asier Aguado

Hi, I'm setting up a client that forces the user to log in even when he/she is already logged in. I'm doing this by editing the Browser authentication flow, as suggested here (https://stackoverflow.com/questions/53048205/how-to-force-login-per-clien...). When I try to log in with a different account to the one I'm already logged in, I get an error: "You are already authenticated as different user X in this session. Please logout first.". I would like to be able to log in with a different account just for this client, without logging out. Is this possible without moving the client to a different realm? Thank you, Asier

5 years

1
0
0 / 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

keycloak-user November 2019