December 2019 - keycloak-user - Jboss List Archives

by obinnahenree

Hi we have two client representing two applications say clientA and clientB. We have noticed that when you login to clientA and click on a link to clientB, you are automaically logged in. How can we prevent this behavior. -- Sent from: http://keycloak-user.88327.x6.nabble.com/

4 years, 4 months

1
0
0 / 0

KEYCLOAK_FRONTEND_URL and KEYCLOAK_HOSTNAME

by EXTERNAL Thiele Frank (TNG, INST-CSS/BSV-OS2)

Hi, I am struggling with the introduction of the new KEYCLOAK_FRONTEND_URL env variable. As I was unable to find documentation about it within 5 minutes and we want to support a KC 7 and 8 in parallel, I simply tried to set both variables at the same time. This fails due to the following piece of code (server/tools/docker-entrypoint.sh): ... ############ # Hostname # ############ if [[ -n ${KEYCLOAK_FRONTEND_URL:-} ]]; then SYS_PROPS+="-Dkeycloak.frontendUrl=$KEYCLOAK_FRONTEND_URL" fi if [[ -n ${KEYCLOAK_HOSTNAME:-} ]]; then SYS_PROPS+="-Dkeycloak.hostname.provider=fixed -Dkeycloak.hostname.fixed.hostname=$KEYCLOAK_HOSTNAME" ... There is a space missing in the KEYCLOAK_HOSTNAME handling (SYS_PROPS+=" -Dkeycloak.hostname.provider=f") Due to that, the result is the following in KC logs: 2019-12-10 11:12:46,664 INFO [org.keycloak.url.DefaultHostnameProviderFactory] (ServerService Thread Pool -- 70) Frontend: myCustomHostname-Dkeycloak.hostname.provider=fixed, Admin: <frontend>, Backend: <request> So is setting both variables at the same time a way to go (assuming I set KEYCLOAK_FRONTEND_URL to "myCustomHostname " (space at the end)? Is this supported? Is there any documentation available, maybe also about the difference to KEYCLOAK_HOSTNAME? Mit freundlichen Grüßen / Best regards Frank Thiele Open Source Services 2 - Product Group Customer Success Services (INST-CSS/BSV-OS2) Bosch Software Innovations GmbH | Ullsteinstr. 128 | 12109 Berlin | GERMANY | www.bosch-si.com<http://www.bosch-si.com> Tel. +49 30 726112-0 | Fax +49 30 726112-100 | external.Frank.Thiele(a)bosch-si.com<mailto:external.Frank.Thiele@bosch-si.com> Sitz: Berlin, Registergericht: Amtsgericht Charlottenburg; HRB 148411 B Aufsichtsratsvorsitzender: Dr.-Ing. Thorsten Lücke; Geschäftsführung: Dr. Stefan Ferber, Michael Hahn, Dr. Aleksandar Mitrovic

4 years, 4 months

1
0
0 / 0

Re: [keycloak-user] create user via java api

by John Norris

Hi Michal and Tony, I think my confusion lays in the fact that I have an adminuser which is defined in the master realm because that was there during keycloak setup. Then I added a working realm and working client app. And I added users to the working realm and mapped them to a realm based role. And I do that by logging on to keycloak via a local browser, I have to use the admin user defined in master realm. And then I can create users in the working realm and add them to the realm based role. And all of that works. When I browse to a protected resource in my Spring app, I get redirected to keycloak login and after a successful login with an ordinary user, get sent to that resource. Success. So I assumed the same approach would work when using the java api. Builder object based on the admin user, saying that I would use the working realm and the client id. Because I want those new users to be added to the working realm, not the master realm. But obviously this does not work because the permissions are not right, hence the 401 error. I have been basing my code on https://gist.github.com/thomasdarimont/c4e739c5a319cf78a4cff3b87173a84b. As an aside, I am finding that that keycloak does not quite add up. For instance, I tried to use the self register feature in KC. They works in that it adds a user to the working realm but the user is unusable because it is not associated with a role. The answer could be to have a default role for new users. Or it could be to call some SB app code that added the role. Except that there is no post registration feature to redirect to a end point to run this code. And with the api, the Builder object can have completely the wrong information (non existent user, wrong password) and no exception is thrown. I realise that permissions can be caught before they are used (eg a user can look but not create) so it is only when a non permissible action is called that an exception is called. But the wrong authentication? So does the api have the same workflow as the browser admin? Regards, John ------ Original Message ------ From: "Michal Hajas" <mhajas(a)redhat.com> To: "John Norris" <johnnorris-10(a)outlook.com> Cc: "keycloak-user(a)lists.jboss.org" <keycloak-user(a)lists.jboss.org> Sent: 06/12/2019 09:33:41 Subject: Re: [keycloak-user] create user via java api Have you changed clientId to some from master realm? In testsuite we are using "admin-cli" client. Michal ------ Original Message ------ From: "Tony Harris" <Tony.Harris(a)oneadvanced.com<mailto:Tony.Harris@oneadvanced.com>> To: "John Norris" <johnnorris-10(a)outlook.com<mailto:johnnorris-10@outlook.com>> Sent: 06/12/2019 09:23:54 Subject: RE: Re[2]: create user via java api John, I will tell you what I did when I was playing in this very area. We have an app that allows some users to manager users and few other bits and pieces in the realm. We created a confidential client in the realm we want users to be able to manage. We did not assign realm management rights to any normal users. Instead we used Spring Security to restrict access to functions that allow user creation/maintence by saying users with role X can do this. Then we used the RestTemplate to obtain a server side bearer token for the service account that we enabled when we created the confidential client, the service account was assigned the realm management rights and can do the required realm management functions within out SpringBoot application. For us this meant that if any single normal user account was compromised or that user tried to gain access to the keycloak console, they could not be used to manage the realm. Back when we did want individual users able to manage a realm the user was created in that realm and given the rights based on the relam-management client roles.

4 years, 4 months

3
5
0 / 0

Re: [keycloak-user] Manage Access to Resources via own App

by David Sautter

Hi Pedor, thank you very much for your reply. I took a look at the endpoints and now wonder what the correct URL of each of those is: 1. show Resources shared with me: https://github.com/keycloak/keycloak/blob/master/services/src/main/java/o... 2. show Resources shared with others (and show with whom it is shared): https://github.com/keycloak/keycloak/blob/master/services/src/main/java/o... 3. Query Resource with specific attribute set to a specific value (not found) 4. Show waiting permission requests: https://github.com/keycloak/keycloak/blob/master/services/src/main/java/o... 5. Grant a new scope-based permission to another user on a specific Resource: is it this? https://www.keycloak.org/docs/latest/authorization_services/index.html#as... or rather this? https://www.keycloak.org/docs/latest/authorization_services/index.html#cr... which one is associated to the waiting permission requests from 4.? 6. Revoke a granted permission: correct? https://www.keycloak.org/docs/latest/authorization_services/index.html#de... It would be very nice, if you could clarify those points. Thank you very much! Mit freundlichen Grüßen/ Best Regards, David Sautter Rohde & Schwarz GmbH & Co. KG Postbox 80 14 69, D-81614 Muenchen Dept. 1DS5 Fon: +49 89 4129 15256 Email: David.Sautter(a)rohde-schwarz.com<mailto:David.Sautter@rohde-schwarz.com> Der Inhalt dieses E-Mails ist ausschliesslich für den/die beabsichtigten Adressaten bestimmt. Es kann Informationen enthalten, die vertraulich und/oder rechtlich geschützt sind. Jegliche Ansicht, Weiterleitung, Verbreitung oder Nutzung durch andere Personen oder Stellen als durch den beabsichtigten Adressaten ist verboten. Falls Sie diese E-Mail irrtümlicherweise erhalten haben, informieren Sie bitte den Absender und löschen Sie das Datenmaterial von Ihrem Computer. If you are not the intended recipient of this message, you are hereby notified that any dissemination, use or distribution of this message is unauthorized and prohibited. Please immediately notify the sender that you have received this mes-sage and destroy the original. Although this message has been checked for viruses, it is not guaranteed to be virus-free. You are strongly advised to perform another virus check of any attachment before opening it. Geschäftsführung / Executive Board: Christian Leicher (Vorsitzender / Chairman), Peter Riedel, Sitz der Gesellschaft / Company's Place of Business: München, Registereintrag / Commercial Register No.: HRA 16 270, Persönlich haftender Gesellschafter / Personally Liable Partner: RUSEG Verwaltungs-GmbH, Sitz der Gesellschaft / Company's Place of Business: München, Registereintrag / Commercial Register No.: HRB 7 534, Umsatzsteuer-Identifikationsnummer (USt-IdNr.) / VAT Identification No.: DE 130 256 683, Elektro-Altgeräte Register (EAR) / WEEE Register No.: DE 240 437 86 From: Pedro Igor Silva <psilva(a)redhat.com> Sent: Thursday, December 5, 2019 7:11 PM To: Sautter David 1DS5 <David.Sautter(a)rohde-schwarz.com> Cc: keycloak-user(a)lists.jboss.org Subject: *EXT* Re: [keycloak-user] Manage Access to Resources via own App Hi David, You can take a look at the work that has been done so far to the new account console, which now relies on an API [1] (documentation is a WIP) to manage resources. From our doc side, I would suggest you to look here: * https://www.keycloak.org/docs/latest/authorization_services/index.html#_s... * https://github.com/keycloak/keycloak-quickstarts/tree/latest/app-authz-ph... [1] https://github.com/keycloak/keycloak/tree/master/services/src/main/java/o... Regards. Pedro Igor On Thu, Dec 5, 2019 at 4:33 AM David Sautter <David.Sautter(a)rohde-schwarz.com<mailto:David.Sautter@rohde-schwarz.com>> wrote: Hello, I want to build an application, that looks like the “My-Resources” site which Keycloak provides. It should be possible to share access to different Resources defined on different clients and also list those sharings etc. I’m trying to find the relevant endpoints I would need to call from my application. Is there a place where I can see the exact requests that the “My-Resources” site is doing (it’s server rendered…)? Mit freundlichen Grüßen/ Best Regards, David Sautter Rohde & Schwarz GmbH & Co. KG Postbox 80 14 69, D-81614 Muenchen Dept. 1DS5 Fon: +49 89 4129 15256 Email: David.Sautter(a)rohde-schwarz.com<mailto:David.Sautter@rohde-schwarz.com><mailto:David.Sautter@rohde-schwarz.com<mailto:David.Sautter@rohde-schwarz.com>> Der Inhalt dieses E-Mails ist ausschliesslich für den/die beabsichtigten Adressaten bestimmt. Es kann Informationen enthalten, die vertraulich und/oder rechtlich geschützt sind. Jegliche Ansicht, Weiterleitung, Verbreitung oder Nutzung durch andere Personen oder Stellen als durch den beabsichtigten Adressaten ist verboten. Falls Sie diese E-Mail irrtümlicherweise erhalten haben, informieren Sie bitte den Absender und löschen Sie das Datenmaterial von Ihrem Computer. If you are not the intended recipient of this message, you are hereby notified that any dissemination, use or distribution of this message is unauthorized and prohibited. Please immediately notify the sender that you have received this mes-sage and destroy the original. Although this message has been checked for viruses, it is not guaranteed to be virus-free. You are strongly advised to perform another virus check of any attachment before opening it. Geschäftsführung / Executive Board: Christian Leicher (Vorsitzender / Chairman), Peter Riedel, Sitz der Gesellschaft / Company's Place of Business: München, Registereintrag / Commercial Register No.: HRA 16 270, Persönlich haftender Gesellschafter / Personally Liable Partner: RUSEG Verwaltungs-GmbH, Sitz der Gesellschaft / Company's Place of Business: München, Registereintrag / Commercial Register No.: HRB 7 534, Umsatzsteuer-Identifikationsnummer (USt-IdNr.) / VAT Identification No.: DE 130 256 683, Elektro-Altgeräte Register (EAR) / WEEE Register No.: DE 240 437 86 _______________________________________________ keycloak-user mailing list keycloak-user(a)lists.jboss.org<mailto:keycloak-user@lists.jboss.org> https://lists.jboss.org/mailman/listinfo/keycloak-user

4 years, 4 months

2
1
0 / 0

Configure resend timeout for registration email

by Lukasz Lech

Hello, I've found out a disturbing behaviour of registration process. After the email was sent, there's a screen where you can resend the registration email (which is not a problem), but each click sends a new email, without any timeout (which is a huge problem). I was looking where this timeout is configured but I've failed to find it. Is it configured on the server side, or you're expected to configure that in your theme? We've created our custom login theme, and maybe we've broken some things... But even if the theme can limit the resent ratio, it must be controlled somehow on the backend, to prevent turning keycloak into mailbomb zombie... Best regards, Lukasz Lech

4 years, 4 months

1
0
0 / 0

multiple keycloak accounts linked to 1 IdP identity

by Michal Hlavac

Hi, is it possible to have multiple keycloak users mapped to 1 identity from e.g. SAMLv2 Identity Provider. >From my understanding of entity model, findUserByFederatedIdentityAndRealm query and browser authentication flow, this is not possible. Using federated identity links you can have only 1 identity mapped to 1 keycloak user. Somethink like List<UserModel> users = UserProvider.getUsersByFederatedIdentity() does not exists. Question is, if it's possible to implement custom Authenticators and flow where authenticators will map provider identity to user attribute, then find users by attribute and provide account selector to choose one by this attribute value. And also if it is best way how to do that? thanks, m.

4 years, 4 months

1
0
0 / 0

client registration(application) with keycloak

by Yeramalla, Sharath

Hi There, Could you provide an sample client registration(an app) payload with keycloak? Regards Sharath | CISSP|IAM|APIC Developer|Middleware|cell:416 319 2482 DXC Technology Company -- This message is transmitted to you by or on behalf of DXC Technology Company or one of its affiliates. It is intended exclusively for the addressee. The substance of this message, along with any attachments, may contain proprietary, confidential or privileged information or information that is otherwise legally exempt from disclosure. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient of this message, you are not authorized to read, print, retain, copy or disseminate any part of this message. If you have received this message in error, please destroy and delete all copies and notify the sender by return e-mail. Regardless of content, this e-mail shall not operate to bind DXC Technology Company or any of its affiliates to any order or other contract unless pursuant to explicit written agreement or government initiative expressly permitting the use of e-mail for such purpose.

4 years, 4 months

2
1
0 / 0

[OT] list detected as spam

by GARDAIS Ionel

Hi, Am I the only one to have all list messages flagged as spam ? It looks like lists.jboss.org is relayed though redhat servers but there is a DNS misconfiguration that fails basic anti spam detection (helo dns not matching). Regards, IG -- 232 avenue Napoleon BONAPARTE 92500 RUEIL MALMAISON Capital EUR 219 300,00 - RCS Nanterre B 408 832 301 - TVA FR 09 408 832 301

4 years, 4 months

2
1
0 / 0

Migrating keycloak-user mailing list to Google Groups

by Stian Thorgersen

We are migrating the keycloak-user mailing list to Google Groups. This is mainly down to a long line of technical issues with lists.jboss.org, where recently a large number of subscribers have been removed from the mailing lists due to mail servers bouncing emails from the list. The latter being caused by issues with the mailing list as well. Please join the Google Groups either by sending an email to " keycloak-user+subscribe(a)googlegroups.com" or by going to https://groups.google.com/d/forum/keycloak-user.

4 years, 4 months

1
0
0 / 0

Notification on user add / delete

by Kodeeswaran Jeyakkannu

Hi, Is there any possible to get notification in angular application, when a new user is added / delete a user in keycloak. Kindly share the documents for the same.

4 years, 4 months

3
2
0 / 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

keycloak-user December 2019