April 2019 - keycloak-user - Jboss List Archives

Is there a way to extend the "Create Realm" process?

by Michael Dailous

We need to add some additional processing that must be completed when a new realm is created. Is there a way to hook into the create realm process? If not, is there a way we can accomplish this? TIA, Michael

7 years, 1 month

1
0
0 / 0

Making it work with ZeroConf/Bonjour/Avahi addresses

by Brandon

I’m using KeyCloak to handle authentication for an application served over LAN at my office. The application is accessible at office-1.local using ZeroConf <https://en.wikipedia.org/wiki/Zero-configuration_networking> (it’s a Linux server, so it’s configured using Avahi). There is at least the problem that, after logging in with KeyCloak, one winds up in a redirect loop due to the following error: 2019-04-16 16:37:14.587 ERROR 1 --- [ XNIO-2 task-31] o.k.adapters.OAuthRequestAuthenticator : failed to turn code into token java.net.UnknownHostException: ces-oficina.local at java.net.InetAddress.getAllByName0(InetAddress.java:1281) ~[na:1.8.0_181] at java.net.InetAddress.getAllByName(InetAddress.java:1193) ~[na:1.8.0_181] at java.net.InetAddress.getAllByName(InetAddress.java:1127) ~[na:1.8.0_181] at org.apache.http.impl.conn.SystemDefaultDnsResolver.resolve(SystemDefaultDnsResolver.java:45) ~[httpclient-4.5.5.jar!/:4.5.5] at org.apache.http.impl.conn.DefaultClientConnectionOperator.resolveHostname(DefaultClientConnectionOperator.java:263) ~[httpclient-4.5.5.jar!/:4.5.5] at org.apache.http.impl.conn.DefaultClientConnectionOperator.openConnection(DefaultClientConnectionOperator.java:162) ~[httpclient-4.5.5.jar!/:4.5.5] at org.apache.http.impl.conn.AbstractPoolEntry.open(AbstractPoolEntry.java:144) ~[httpclient-4.5.5.jar!/:4.5.5] at org.apache.http.impl.conn.AbstractPooledConnAdapter.open(AbstractPooledConnAdapter.java:134) ~[httpclient-4.5.5.jar!/:4.5.5] at org.apache.http.impl.client.DefaultRequestDirector.tryConnect(DefaultRequestDirector.java:610) ~[httpclient-4.5.5.jar!/:4.5.5] at org.apache.http.impl.client.DefaultRequestDirector.execute(DefaultRequestDirector.java:445) ~[httpclient-4.5.5.jar!/:4.5.5] at org.apache.http.impl.client.AbstractHttpClient.doExecute(AbstractHttpClient.java:835) ~[httpclient-4.5.5.jar!/:4.5.5] at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:83) ~[httpclient-4.5.5.jar!/:4.5.5] at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:108) ~[httpclient-4.5.5.jar!/:4.5.5] at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:56) ~[httpclient-4.5.5.jar!/:4.5.5] at org.keycloak.adapters.ServerRequest.invokeAccessCodeToToken(ServerRequest.java:111) ~[keycloak-adapter-core-4.7.0.Final.jar!/:4.7.0.Final] ... So it seems like org.apache.http.impl.conn.SystemDefaultDnsResolver doesn’t understand ZeroConf. Can it be configured so that KeyCloak can be used with ZeroConf? Thanks, Brandon

7 years, 1 month

1
0
0 / 0

Account Management Rest API

by Gabriele Rabbiosi

Hi guys, I'd like more information about the AccountRestService class (https://github.com/keycloak/keycloak/blob/master/services/src/main/java/o...) 1. I noticed that there are still a couple of TODO (such as Identity Providers management), is there a roadmap for the development of this missing features? 2. Are these API public or for internal use only? I'd like to use them to implement a custom Account Management page for my application. 3. How stable are they? How likely is it that they will change or disappear in the (near) future? Thanky you. Best regards -- GABRIELE RABBIOSI BeePMN Software Engineer ESTECO | EXPLORE DESIGN PERFECTION AREA Science Park, Padriciano 99 - 34149 Trieste - ITALY Phone: +39 040 3755548 - Fax: +39 040 3755549 [Website] | [Twitter] | [Facebook] | [Linkedin] Pursuant to Legislative Decree No. 196/2003, you are hereby informed that this message contains confidential information intended only for the use of the addressee. If you are not the addressee, and have received this message by mistake, please delete it and immediately notify us. You may not copy or disseminate this message to anyone. Thank you. Please consider the environment before printing this email.

7 years, 1 month

2
3
0 / 0

Custom form-based authenticator in Identity Provider Post Login Flow

by Edgar Vonk - INFO

Hi all, We need to build a custom form-based authenticator/execution as part of our Identity Provider Post Login Authentication Flow. We already have our custom Post Login Flow set up and we know how to build and use custom Authenticators. But we cannot quite figure out how to implement custom form-based Authenticators. Basically what we need is: as the very last step of the post login flow (the user has authenticated to our external Identity Provider by this point) we need to present a simple form with a drop-down list to the user. The user needs to select one option and that option we then need to store as a user attribute in Keycloak. Somewhat akin to Review Profile maybe except that this needs to be done after every login. What is the best way to go about this? We know we can extend Keycloak forms relatively easily. E.g. looking at https://github.com/raptor-group/keycloak-login-recaptcha But for this it seems we would need to create our own login provider with our own form in it (somewhat similar to https://github.com/dteleguin/keycloak-dynamic-branding) or is there another way? There is also that ScriptBasedAuthenticator but to be honest we do not understand how to use that. It does not seem to be available as an executor in our custom Post Login Flow? thanks in advance!

7 years, 1 month

1
1
0 / 0

Re: [keycloak-user] Token Exchange AWS Cognito & Keycloak

by Matteo Restelli

Any news on that? Thank you! Matteo ============================= Hi all, We're using AWS Cognito as our Identity provider for our platform. We're trying to use an internal instance of Keycloak, in order to check the possibility to use KC for authorization purposes (this because Keycloak has a wonderful and powerful authorization system that fulfill our needs, and for that i want to say you "Thank you very much" :) ). For this reason we want to use the token exchange feature of Keycloak. More specifically we want to follow this flow: - User authenticates on AWS Cognito via SRP auth flow (which basically is not a standard OIDC/OAuth2 authentication flow) - User sends the access token to contact the backend service and, in the middle, this token is translated to an internal one, minted by Keycloak If we provide the AWS Cognito access token to the token exchange endpoint, with the subject_token_type parameter set to "urn:ietf:params:oauth:token-type:access_token", an error is returned stating that the access token doesn't contain the "openid" scope. Despite this we've tried another way, providing the id token to the token exchange endpoint with the subject_token_parameter set to "urn:ietf:params:oauth:token-type:id_token", and we discovered that this alternative way works. So, my questions are: - Is the "exchange with id token" approach a feasible and good one? Or is completely a bad approach? - From an OIDC point of view, can be a right approach accessing a backend resource from a single page application, using an id token? I've always read that if you want to access to a backend resource, from a client application, is better to use the access token, because the id token contains a lot of user informations and must be used only by the client application Thank you very much, Matteo PS: As a side note, i want to clarify that if we follow an authorization code grant flow, or an implicit flow, during the authentication against AWS Cognito, the access token exchange works as expected. So this means that the problem is related to the shape of the token released by Cognito. -- Like <https://www.facebook.com/cuebiq/> I Follow <https://twitter.com/Cuebiq>I Connect <https://www.linkedin.com/company/cuebiq> This email is reserved exclusively for sending and receiving messages inherent working activities, and is not intended nor authorized for personal use. Therefore, any outgoing messages or incoming response messages will be treated as company messages and will be subject to the corporate IT policy and may possibly to be read by persons other than by the subscriber of the box. Confidential information may be contained in this message. If you are not the address indicated in this message, please do not copy or deliver this message to anyone. In such case, you should notify the sender immediately and delete the original message. -- Like <https://www.facebook.com/cuebiq/> I Follow <https://twitter.com/Cuebiq>I Connect <https://www.linkedin.com/company/cuebiq> This email is reserved exclusively for sending and receiving messages inherent working activities, and is not intended nor authorized for personal use. Therefore, any outgoing messages or incoming response messages will be treated as company messages and will be subject to the corporate IT policy and may possibly to be read by persons other than by the subscriber of the box. Confidential information may be contained in this message. If you are not the address indicated in this message, please do not copy or deliver this message to anyone. In such case, you should notify the sender immediately and delete the original message.

7 years, 1 month

2
10
0 / 0

SMS Integration

by Namık Barış İDİL

Hi All, Is it possible to integrate an external SMS provider service to Keycloak (for user registration)? If it is, where can I find some documentation of how. Thanks in advance. Barış

7 years, 1 month

3
2
0 / 0

help

by Mohamad KHAYAT

Dear Sir/Madame, I was looking for a clear step by step document to install and configure keycloak in domain mode. The idea is to have a central configuration. I have six remote sites and one central site. Can you please help? Kind Regards, Mohamad

7 years, 1 month

1
0
0 / 0

Re: [keycloak-user] Import realm settings without removing users

by Vlasta Ramik

On 4/12/19 10:52 AM, Pavel Drankov wrote: > > if you've exported users as well those should be imported during > import > as well. > > I don't want to export/import users, just realm settings. Is it > possible to import realm settings without erasing _users?_ afaik it's not possible at the moment. V. > > > Best wishes, > Pavel > > > On Fri, 12 Apr 2019 at 09:48, Vlasta Ramik <vramik(a)redhat.com > <mailto:vramik@redhat.com>> wrote: > > Hey Pavel, > > if you've exported users as well those should be imported during > import > as well. > > When you use -Dkeycloak.migration.strategy=OVERWRITE_EXISTING the > existing realm is erased and then imported from file/dir [1] > > V. > > [1] > https://www.keycloak.org/docs/latest/server_admin/index.html#_export_import > > On 4/11/19 3:49 PM, Pavel Drankov wrote: > > Hi, > > > > Is there any command-line way to import realms settings without > erasing all > > the users? If import realm settings with OVERWRITE_EXISTING, > keycloak also > > removes all the users. > > > > Best wishes, > > Pavel > > _______________________________________________ > > keycloak-user mailing list > > keycloak-user(a)lists.jboss.org <mailto:keycloak-user@lists.jboss.org> > > https://lists.jboss.org/mailman/listinfo/keycloak-user >

7 years, 1 month

2
3
0 / 0

Duplicate ldap groups during group sync

by Chandrashekhar, Nithin

Hi Folks, Keycloak Version: 4.8.2.Final When the group sync is in progress and if a user tries to login, I see that those groups which the user belongs to are being duplicated. Is this a bug in keycloak or a mistake in any other configuration in keycloak? Thanks Nithin

7 years, 1 month

1
0
0 / 0

Keycloak Ldap Group Sync

by Chandrashekhar, Nithin

Hi Folks, Is there a way to bring in a new ldap group (without clearing the cache) which a user is made part of after the user has logged in. Thanks Nithin

7 years, 1 month

1
0
0 / 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

keycloak-user April 2019