March 2019 - keycloak-user - Jboss List Archives

Re: [keycloak-user] Give access to his account to a client

by François Gourrier

Hello Michal, Thank you for your answer which actually seems to be a very good track of resolution ! The version I'm using is 4.8, I'm going to deploy the last one. Best regards, François De: "Michal Hajas" <mhajas(a)redhat.com> À: "Francois Gourrier" <francois.gourrier(a)libre-logic.fr> Cc: keycloak-user(a)lists.jboss.org Envoyé: Vendredi 8 Mars 2019 10:55:56 Objet: Re: [keycloak-user] Give access to his account to a client Hi Francois, first of all, please make sure you are using the latest version of Keycloak. In upstream there was recently a bugfix [1] which may relate to your issue. I tried to follow your steps and it worked for me, so please check that group policy is correctly assigned to manage permission in Permissions tab and also check whether user really belongs to admin group. If you are sure that everything is set correctly and you are still not able to make it work, feel free to send me your realm exported to json and I can look at it. [2] My settings: I created client1 & client2 and user1 & user2 (passwords: pass). - User1 is able to manage client1 because he is part of admin group and Client1 has configured admin-group-membership policy. - User2 is able to manage Client1 because he is also part of admin-group and Client2 because it is configured with User policy which permits User2 to manage it. Best regards, Michal Hajas [1] https://issues.jboss.org/browse/KEYCLOAK-9489 [2] https://www.keycloak.org/docs/latest/server_admin/index.html#_export_import On Thu, Mar 7, 2019 at 6:09 PM François Gourrier < francois.gourrier(a)libre-logic.fr > wrote: Hello everyone, i find the anwser by myself to my question. I followed the instructions given for "fine grained permissions" here: https://www.keycloak.org/docs/latest/server_admin/index.html#_fine_grain_... But I do not have the expected result. Here is my configuration : - I created a group "admin" and gave it the role "query-client" on the client "realm-management" of the kingdom concerned - For the client "Test" for which I wish to give access (for management) to a dedicated user, I created a policy with the right to manage for the group concerned "admin", via the "permissions" tab. - I added the relevant user "Test" in this group "admin. And the result is: "Forbidden.You do not have access to the requested resource" ... If I add the role "view-ream" to the group "admin" on the client "realm-management" of the kingdom concerned, it's OK, but the user "test" also reads the whole configuration of the kingdom, which is not desirable. Did I miss something? thank you in advance ----- Mail original ----- De: "Francois Gourrier" < francois.gourrier(a)libre-logic.fr > À: keycloak-user(a)lists.jboss.org Envoyé: Mercredi 27 Février 2019 15:59:33 Objet: [keycloak-user] Give access to his account to a client Hello everyone, we are currently using keycloak. We created several clients on a realm. To simplify the management of URIs, we would like to give the management of his account to each client. T he REST API allows to modify the account but it is not necessary that a customer can go to see the configuration of the other customers, which is nevertheless possible if he has the rights of access to the service (unless one can restrict access to a client). Another track would be that a customer connects to his account via the back office. A track to meet the need? Thank you in advance. François GOURRIER _______________________________________________ keycloak-user mailing list keycloak-user(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/keycloak-user _______________________________________________ keycloak-user mailing list keycloak-user(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/keycloak-user

7 years, 1 month

1
0
0 / 0

Re: [keycloak-user] Give access to his account to a client

by François Gourrier

Hello everyone, i find the anwser by myself to my question. I followed the instructions given for "fine grained permissions" here: https://www.keycloak.org/docs/latest/server_admin/index.html#_fine_grain_... But I do not have the expected result. Here is my configuration : - I created a group "admin" and gave it the role "query-client" on the client "realm-management" of the kingdom concerned - For the client "Test" for which I wish to give access (for management) to a dedicated user, I created a policy with the right to manage for the group concerned "admin", via the "permissions" tab. - I added the relevant user "Test" in this group "admin. And the result is: "Forbidden.You do not have access to the requested resource" ... If I add the role "view-ream" to the group "admin" on the client "realm-management" of the kingdom concerned, it's OK, but the user "test" also reads the whole configuration of the kingdom, which is not desirable. Did I miss something? thank you in advance ----- Mail original ----- De: "Francois Gourrier" <francois.gourrier(a)libre-logic.fr> À: keycloak-user(a)lists.jboss.org Envoyé: Mercredi 27 Février 2019 15:59:33 Objet: [keycloak-user] Give access to his account to a client Hello everyone, we are currently using keycloak. We created several clients on a realm. To simplify the management of URIs, we would like to give the management of his account to each client. T he REST API allows to modify the account but it is not necessary that a customer can go to see the configuration of the other customers, which is nevertheless possible if he has the rights of access to the service (unless one can restrict access to a client). Another track would be that a customer connects to his account via the back office. A track to meet the need? Thank you in advance. François GOURRIER _______________________________________________ keycloak-user mailing list keycloak-user(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/keycloak-user

7 years, 1 month

2
1
0 / 0

Terms and coniditions on the registration page

by Андрей Ушаков

Hello, keycloak has a "terms and conditions" feature, but it depicted on the next page after registration. Is there a way to make it on the registration page as a checkbox using admin panel? If no, will security be impacted if I do it programmatically via js and editing register.ftl?

7 years, 1 month

1
0
0 / 0

Performance decrease after upgrade

by keycloak-user＠imber.wien

Hi, we're running nightly stress tests against our keycloak dev environment, to monitor maximum throughput rates and average response times of selected endpoints. After upgrading from KC 3.4.3 to 4.8.3, we noticed considerable dents in our curves. For example: Userinfo dropped from ~12k max. Requests per sec to ~7k; response times increased from ~30ms to 45ms Code flow (3 correlated requests): 1.5k -> 1k max. Requests per sec; 100ms -> 150ms response time Password Credentials Grant: 800 -> 600 max. Requests per sec; 300ms -> 500ms response time We have another system running KC 4.5.0, which does not seem to suffer from that performance decrease, so it was probably introduced with > 4.5. Are there any known developments that might be the reason for our observations? Thanks, Mario.

7 years, 1 month

3
3
0 / 0

Security Updates

by Johan Andrés Mateus Lamprea

Hi there, I'm a new user in Keycloak and I would like to know what is the alternative to install security updates, patches and fixes on my standalone installation? Thanks in advance. Best Regards.

7 years, 1 month

1
0
0 / 0

keycloak Nginx TLS problem

by Konsulent Thomas Isaksen (TNO)

Can anyone please help, I have spent all day searching for the answer but I'm not getting anywhere. I am trying to configure Nginx as a reverse-proxy to Keycloak and I'm getting close, access to keycloak console and such via https is working just fine. The problem is when I try to login to my app and return from the auth provider (azure) I get a 403 forbidden and the following message in the application log: 2019-03-07 14:50:45,831 ERROR [org.keycloak.adapters.OAuthRequestAuthenticator] (default task-9) Adapter requires SSL. Request: http://local.toyota.no/workBenchWeb/zul/main.zul?state=c23babe7-6637-48fe... My keycloak.json: { "realm": "TKS-TEST", "auth-server-url": "https://kct.toyota.no/auth", "ssl-required": "all", "resource": "tks-test-client", "public-client": true, "confidential-port": 443, "principal-attribute": "preferred_username" } ./t

7 years, 1 month

1
0
0 / 0

Mixed Content error because of Keyloack default login redirection

by Murat Doner

Hello, *INFORMATION NEEDED:* I use Keycloak (Docker version) behind a Spring project. (The client side of this project is React and communication between client and backend is provided by REST services.) The client side is secured and using "https" scheme. It is my Spring configuration: keycloak: auth-server-url: https://sso-ssoha.b9ad.pro-us-east-1.openshiftapps.com/auth realm: master resource: clientname public-client: true *THE ROOT OF THE PROBLEM:* When I click a link from client, it calls a Spring service normally. But before that, it redirects to default login page of Keycloak with adding this path *sso/login* to the current "https" url but changing scheme to "http". *But, redirecting from https to http create a problem like this:* Mixed Content: The page at 'https://www.helpful.army/contents/Problem' was loaded over HTTPS, but requested an insecure resource 'http://serviceha-helpfularmy.b9ad.pro-us-east-1.openshiftapps.com/sso/login'. This request has been blocked; the content must be served over HTTPS. Problem on StackOverFlow: https://stackoverflow.com/questions/55044623/mixed-content-error-because-...

7 years, 1 month

1
0
0 / 0

redirect_uri in token exchange redirect

by triton oidc

Hi, i did an account linking on two keycloak IDP my keycloak 4.8.3 on the two server When i do a token exchange, i get a error_description":"identity provider is not linked, can only link to current user session","account-link-url":" https://iMyIDP1:9443/auth/realms/Realm/broker/A_for2/link?nonce=32cb2809-... ","error":"not_linked" when i enter this url in a browser, i get an Invalid Request When i look at the error log, i see : type=TOKEN_EXCHANGE_ERROR, realmId=realm, clientId=realm-secure, userId=null, ipAddress=172.18.56.212, error=invalid_request, reason='requested_issuer has not linked', auth_method=token_exchange, grant_type=urn:ietf:params:oauth:grant-type:token-exchange, requested_issuer=1_for_2, client_auth_method=client-secret type=CLIENT_INITIATED_ACCOUNT_LINKING_ERROR, realmId=R1, clientId=R1-secure, userId=null, ipAddress=172.18.56.212, error=invalid_redirect_uri When i loot at the code : https://github.com/keycloak/keycloak/blob/master/services/src/main/java/o... line 213 the redirect_uri is mandatory, however it's not in the generated link. Is it a mistake, or did I missed something ? Thanks for any help, Amaury

7 years, 1 month

1
0
0 / 0

Fwd: keycloak - Twilio integration

by Victor Alejo

Hi, first, thank yoou in advance for reading this question, and sorry if this is not the appropiate channel, is the only link I have seen. We would like to use keycloak as our authentication SSO with Twilio Flex. We alredy have a realm set up and we are now in the configuration. Basically we have everything but the issuer ID. Certificate: OK SSO URL: OK https://sso.develop.stentle.com/auth/realms/customer-support/protocol/saml *Identity Provider Issuer: We tried everything but we get "unknown login requester".* *Url: http://sso.develop.stentle.com <http://sso.develop.stentle.com>* *realm: customer-support* Any help will be appreciated. Please let us know if you need any other information. Thank you very much Regards

7 years, 1 month

1
0
0 / 0

Remove permission to manage realm (but keep managing roles)

by Pavel Micka

Hi, Is it somehow possible to remove from user the permission to manage realm itself (example: client registration, tokens) but keep for the user role management in place (so he can create composite roles)? If it is possible with fine grained permissions, can you please send me howto, because I am unable to set it up (using docs)... Thanks for help, Pavel

7 years, 1 month

2
3
0 / 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

keycloak-user March 2019