May 2019 - keycloak-user - Jboss List Archives

How to configure my client for use ADMIN REST API [DELETE]: https://keycloaksrv.fr/auth/admin/realms/myclient/users/'

by Christophe Lehingue

Hello, how to configure a client so that the user can use the user removal API? [DELETE]: https://keycloaksrv.fr/auth/admin/realms/myclient/users/fdskgjdkdjkgjf-sd... Whenever I try to call this request REST => I get the following error message: "resulted in a 401/403 Unauthorized`" Can you help me ? Thank you

4 years, 5 months

4
4
0 / 0

multiple reset credentials flows

by Arnault BESNARD

Hi, We're currently developing our own SPI authenticator. In case of authentication failure, we'd like allowing users to reset their credential following a specific scenario. Unfortunately, there is only one reset credentials flow per realm. So 'forgot password' and our SPI reset credential have to share the same scenario, which is not fit in our case. What is the best way to solve our issue? Thanks in advance, Arnault

4 years, 6 months

1
2
0 / 0

OIDC protocol extension

by Karipineni, Neelima,M.D.

We have a use case where we’re trying to implement an OAuth2 profile which requires an extra claim on the access token when a certain auth request scope is used. The expected behavior is that when a certain scope is present in the auth endpoint request then during the Authorization flow the user is shown an extra screen where they input an identifier which ultimately is included as a claim in the access token. Details are at http://docs.smarthealthit.org/authorization/ (Standalone launch sequence) for reference. Any suggestions on how to accomplish this in keycloak? I considered using an ActionToken like in the quickstarts external action token example, but the additional execution needs to happen even when the user has previously authenticated. It’s like an additional consent step after user and client authentication rather than an additional authentication step. My current thought is to implement a custom LoginProtocol that wraps OIDCLoginProtocol, as shown in https://github.com/keycloak/keycloak/tree/openshift-integration/services/..., and have an additional redirect in the authenticated method that functions similarly to the external action token example. The callback endpoint would persist the extra claim against the client session until the access token is requested. I’m not sure it’s possible to extend the OIDC protocol within a new protocol. Preliminarily after installing a shell wrapper protocol, it’s missing the OIDC configuration properties and mappers in the admin console. Is something like this possible without copying/recreating large chunks of the OIDC code? If not, any suggestions on alternative ways to accomplish this? As an additional wrench, we’re still on v3.3.0 and upgrade is not on the schedule as of now. The information in this e-mail is intended only for the person to whom it is addressed. If you believe this e-mail was sent to you in error and the e-mail contains patient information, please contact the Partners Compliance HelpLine at http://www.partners.org/complianceline . If the e-mail was sent to you in error but does not contain patient information, please contact the sender and properly dispose of the e-mail.

4 years, 8 months

3
4
0 / 0

Single Logout in Identity brokering mode

by Leonid Rozenblyum

Hello! I'm working on Single Logout in Identity broker mode. App -> Keycloak (OpenIdConnect) Keycloak -> 3'd party (SAML) Documentation to keycloak states that there are 2 ways to execute logout. 1) HttpServletRequest.logout(). 2) redirect the browser to http://auth-server/auth/realms/{realm-name}/protocol/openid-connect/logou... If I execute 2) it indeed causes Keycloak send SAML Logout request to the 3'd party Idp. However if I execute 1) SAML logout request is not sent thus 3'd party session is still valid. (I see that by enabling trace logging in keycloak and by fact that user is still logged in) Is it something by design/misconfiguration at my side or a bug?

4 years, 9 months

1
1
0 / 0

Override "native" Keycloak providers

by Jerry Saravia

Hello, Disclaimer: This might be a keycloak dev mailing list question. We’ve been using version 3.4.3 for a while now and are attempting to upgrade to 4.8 and we’ve run into some issues. Summary: We have created our own providers with the same PROVIDER_ID as some of the built in providers. For example, PasswordCredentialProvider has a provider id of “keycloak-password” and we created our own with the same id that gets loaded after the native one. This worked because in 3.4.3 providers that were using the same id would still have their factories added to the factory map. See this link here for 3.4.3 changes: https://github.com/keycloak/keycloak/blob/3.4.3.Final/services/src/main/j... These are the 4.8 changes https://github.com/keycloak/keycloak/blob/4.8.3.Final/services/src/main/j... In 4.8, the fully qualified class name (FQCN) is not longer used. Instead it uses the provider id and the spi name. I can no longer use the same PROVIDER_ID as the native providers to ‘override’ them, but sometimes there is code that gets the provider specifically by id. For example, in the UpdatePassword required action we have this: PasswordCredentialProvider passwordProvider = (PasswordCredentialProvider)context.getSession().getProvider(CredentialProvider.class, PasswordCredentialProviderFactory.PROVIDER_ID); In 3.4.3 because our provider was loaded we were able to inject into code that normally isn’t overridable. We did the same for the OIDCLoginProtocolFactory to alter some token endpoint behavior even the UpdatePassword required action itself rather than making a brand new required action that is a “second rate” because it isn’t native to Keycloak. Is there a solution for this in 4.8.3? I see this change was made in 4.0.0.Beta1 according to some of the history. J Jerry Saravia Software Engineer T(516) 603-6914 M516-603-6914 virginpulse.com |virginpulse.com/global-challenge 492 Old Connecticut Path, Framingham, MA 01701, USA Australia | Bosnia and Herzegovina | Brazil | Canada | Singapore | Switzerland | United Kingdom | USA Confidentiality Notice: The information contained in this e-mail, including any attachment(s), is intended solely for use by the designated recipient(s). Unauthorized use, dissemination, distribution, or reproduction of this message by anyone other than the intended recipient(s), or a person designated as responsible for delivering such messages to the intended recipient, is strictly prohibited and may be unlawful. This e-mail may contain proprietary, confidential or privileged information. Any views or opinions expressed are solely those of the author and do not necessarily represent those of Virgin Pulse, Inc. If you have received this message in error, or are not the named recipient(s), please immediately notify the sender and delete this e-mail message. v2.48

4 years, 9 months

2
1
0 / 0

Configure Keycloak to be able to delegate authentication to other application

by Cécile Radix Saint-Martin

Hi, We wish to use Keycloak as our IDP for our application (frontend + REST micro services). We want to give users the possibility to authenticate using their credentials of another application (login + password). In the same time, our application needs to call this other application APIs and for this, needs the custom token returned by the application during authentication (this application is not OIDC compliant). First I wanted to implement a custom identity provider for Keycloak, as it enables to store token of external IDP. But there is very few documentation about that and only examples I found are for OIDC providers. So finally I decided to implement a custom authenticator (org.keycloak.authentication.Authenticator). I want to be sure that with a custom authenticator, I will be able to : - Store custom tokens of the other application, provide it to a client API and refresh it if expired - Create user in Keycloak if it does not exist (if authentication with the other application succeed) Anyone can confirm ? *Cécile RADIX SAINT-MARTIN* *mailto:cecile.saintmartin@gmail.com <cecile.saintmartin(a)gmail.com>*

4 years, 10 months

2
2
0 / 0

keycloak heathcheck with microprofile

by Meissa M'baye Sakho

Hello everyone, Have someone tried to crate health check with SmallRye and the new metrics extension? I've tried long ago Thomas darimont's following example [1] to implement health check, but would like to know is someone has started something. ´1]=https://github.com/thomasdarimont/keycloak-health-checks/tree/master thanks -- Meissa Sakho, RHCA Architect Red Hat EMEA <https://www.redhat.com/> msakho(a)redhat.com M: +33-6-9559-7778 <https://www.redhat.com/>

4 years, 10 months

2
6
0 / 0

Upgrade to 6.0.1 - Oracle driver failing to load

by David Paul

Hi, I have a working standalone 3.2.1 on linux using Oracle DB 12.1 as its data store that I'm upgrading to 6.0.1. I'm running into a problem getting it to load the oracle driver and I assume I'm missing a step but I have followed the guide here: https://www.keycloak.org/docs/latest/upgrading/index.html I have: unpacked 6.0.1 mv standalone directory to standalone.old cp -R 3.2.1/standalone to 6.0.1/ cp -R 3.2.1/modules/system/layers/keycloak/org/oracle 6.0.1/modules/system/layers/keycloak/org/ cp -R 3.2.1/themes/<our-themes> 6.0.1/themes/ 6.0.1/bin/jboss-cli.sh -file=bin/migrate-standalone.cli (feedback indicates success on all actions) Made sure migrationStrategy value="update" When I run 6.0.1/bin/standalone.sh I get: ... 09:26:10,588 ERROR [org.jboss.as.controller.management-operation] (ServerService Thread Pool -- 31) WFLYCTL0013: Operation ("add") failed - address: ([ ("subsystem" => "datasources"), ("jdbc-driver" => "oracle") ]) - failure description: "WFLYJCA0114: Failed to load datasource class: oracle.jdbc.driver.OracleDriver" Again, this works in my 3.2.1 on the same server, so I assume my datasource and driver declaration are correct in standalone.xml file as well as the module.xml and ojdbc8.jar. I also can confirm the datastore is in use for the 3.2.1 install through connecting to the DB store using TOAD for oracle. I have confirmed permissions on the entire Keycloak directory structure are identicle between the 3.2.1 and 6.0.1 locations. Is there another step or declaration of the driver or something that I must do? Thank you for your time, Dave Harriscomputer David Paul Manager, Application Development P: 403-218-2010 x79107 F: 403-218-2012 E: dpaul(a)cognera.com [cid:cognera_logo_214_d306d615-a7fa-4e98-bd69-dcc2e13056da.png] 530 - 8 Avenue SW Suite 920 Calgary, Alberta T2P 3S8 www.cognera.com<http://www.cognera.com> This message is intended exclusively for the individual or entity to which it is addressed. This communication may contain information that is proprietary, privileged or confidential or otherwise legally exempt from disclosure. If you are not the named addressee, you are not authorized to read, print, retain, copy or disseminate this message or any part of it. If you have received this message in error, please notify the sender immediately by e-mail and delete all copies of the message.

4 years, 10 months

3
4
0 / 0

Wildfly Client Adapter breaks session persistence

by Ryan Slominski

It seems session persistence is broken with the Wildfly Client Adapter. I have: <persistent-sessions/> in the standalone.xml file under: <servlet-container name="default"> This was set using the command: .jboss-cli.sh --connect --command="/subsystem=undertow/servlet-container=default/setting=persistent-sessions:add()" However, if I run the command: .jboss-cli.sh --connect --command="/deployment=myapp.war:redeploy()" My authenticated session is lost and I must re-login. Am I missing something or is this a bug? Ryan

4 years, 10 months

1
1
0 / 0

Policy Enforcing for nodejs REST Api

by Jahn, Lasse

Hello, It's the first time writing to keycloak mailing list (I hope this is the correct one?) so excuse if I forget to provide some information or any other mistakes .. Sorry for the text wall. Shortly what I try to do (maybe I got something completely wrong): I create a backend (node.js Bearer Only) which shall offer an REST api. Partially it is used via a frontend (keycloak-clients) or directly by some devices. In general I try to create an application with a lot of CRUD. User Management is done in keycloak and only I forward these requests to the admin REST Api. Other stuff like the devices ... I store in a separate database. So the backend is the abstraction layer for frontend and other use-cases. So far so good, but for the beginning it was enough to check weather the request comes from an authenticated person or not, so all handled via keycloak.protect() The Token from the authenticated person was passed But now I'd want to offer different authorization level (can differ due to reasons of multitenancy, why I want to solve this via policies and co in admin-console inside the client configuariton) because the normal user shall have access to only some routes and the management shall have full access to the api, but of course don't need the keycloak admin access. So I enabled the service account for my backend client and gave this one the realm-admin role so the client has access to everything and I can handle the authorization inside the backend client it self (using policies, permissions, .. inside the admin-console). (Just in case no one gets what I'm talking about. Fixing [1] should help me fixing my issue I guess) Setup - node.js application using express - registered as single client in keycloak admin-console (confidential, but config inside the code is bearer-only) - Keycloak is running in a docker-container (version 4.5) - all services are running in a docker-compose network and are behind a reverse proxy for common uri - enabled Authorization in client and changed the default policy to Negative to always deny => to see if it is enforced) My Problem I don't understand how to use the policies, permissions and Co I created in the admin-console inside the backend it self. How do I enforce that these are used? I tried to check different examples and documentation, but could get it working. The last thing I found was that the entitlement api was removed, but a policy-enforcer was added to the nodejs adapter. In the documentation for the policy-enforcer [2] I couldn't find a documentation of the middleware (keycloak.enforcer({}) [3][4]). My Code ***** app.js const express = require('express'); const app = express(); const Keycloak = require('keycloak-connect'); const session = require('express-session'); const routes = require('./routes/index'); const kcConfig = { 'realm': 'master', 'bearer-only': true, 'auth-server-url': `https://DOMAIN/auth<https://domain/auth>`, 'ssl-required': 'all', 'resource': 'fm-backend', 'credentials': { secret: 'SOME_SECRET', }, 'confidential-port': 0, 'policy-enforcer': { //tried with an without this, changed nothing 'enforcement-mode': 'ENFORCING', }, }; const memoryStore = new session.MemoryStore(); const keycloak = new Keycloak({ memoryStore }, kcConfig); app.use(keycloak.middleware({ logout: '/api/logout', protected: '/api/gates' })); // used before, worked for well for authentication app.use('/api', keycloak.protect(), routes); // now unfortunately I don't understand how to use keycloak.enforcer() middleware app.use('/api', keycloak.enforcer({WHAT_COMES_HERE}), routes); module.exports = app; ***** [1] https://stackoverflow.com/questions/53722033/how-to-enable-policy-enforci... [2] https://keycloak-docs.github.io/deploy-docs/dev/master/authorization_serv... [3] https://github.com/keycloak/keycloak-documentation/blob/master/securing_a... [4] https://github.com/keycloak/keycloak-nodejs-connect/blob/master/example/i... Any Help is appreciated :) With kind regards Lasse

4 years, 10 months

3
6
0 / 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

keycloak-user May 2019