May 2019 - keycloak-user - Jboss List Archives

use custom FormAction implementation on "edit account" page

by Markus Schulz

hello, I've implemented an "extended profile validation" FormAction provider which validates (required fields, field-format) some additional user attributes (contained in our custom theme). But now there is a major problem, i don't know how i can use this provider for the "edit account" page. Currently the user needs to enter some additional fields on the registration page, but after this, he can freely choose to edit/delete the content on the "edit account" page. How can i prevent this? regards, msc

4 years, 12 months

2
1
0 / 0

Review request: Arabic translation

by Stian Thorgersen

I need help from the community to review $sub: https://github.com/keycloak/keycloak/pull/5962

4 years, 12 months

1
0
0 / 0

Request for review: Chinese translation of email verification page

by Stian Thorgersen

I need help from the community to review: https://github.com/keycloak/keycloak/pull/5778

4 years, 12 months

1
0
0 / 0

Re: [keycloak-user] [keycloak-dev] HA mode with JDBC_PING shows warning in the logs after migration to 4.8.3 from 3.4.3

by pkboucher801＠gmail.com

In the meantime (before we switch to 5.0+), is there any way to automate recognition when the cluster hangs (or is about to hang) as in https://issues.jboss.org/browse/WFLY-10736?attachmentViewMode=list ? And is it reliable to un-hang the cluster by scaling it down to zero instances, and then scaling back up? Thanks! Regards, Peter From: Sebastian Laskawiec <slaskawi(a)redhat.com <mailto:slaskawi@redhat.com> > Date: Fri, Apr 26, 2019 at 6:11 PM Subject: Re: [keycloak-dev] HA mode with JDBC_PING shows warning in the logs after migration to 4.8.3 from 3.4.3 To: abhishek raghav <abhi.raghav007(a)gmail.com <mailto:abhi.raghav007@gmail.com> > Cc: keycloak-user <keycloak-user(a)lists.jboss.org <mailto:keycloak-user@lists.jboss.org> >, keycloak-dev <keycloak-dev(a)lists.jboss.org <mailto:keycloak-dev@lists.jboss.org> > There was a bunch of fixed to JGroups a while ago, including changes in JDBC_PING. Could you please rerun your setup with Keycloak >= 5.0.0? I believe some of the issues (or maybe even all of them) should be fixed. On Thu, Apr 25, 2019 at 7:19 PM abhishek raghav <abhi.raghav007(a)gmail.com <mailto:abhi.raghav007@gmail.com> > wrote: Hi After the migration of keycloak HA configurations from 3.4.3.Final to 4.8.3.Final, I am seeing some WARNINGS on one of the nodes of keycloak immediately after the keycloak is started with 2 nodes. This occurs after every time when the cluster is scaled up or whenever infinispan is trying to update the cluster member list. I am using JDBC_PING to achieve clustering in keycloak. Below is the stacktrace - 2019-04-24 12:20:43,687 WARN >> [org.infinispan.topology.ClusterTopologyManagerImpl] >> (transport-thread--p18-t2) [dcidqdcosagent08] KEYCLOAK DEV 1.5.RC >> ISPN000197: Error updating cluster member list: >> org.infinispan.util.concurrent.TimeoutException: ISPN000476: Timed out >> waiting for responses for request 1 from dcidqdcosagent02 > > at >> org.infinispan.remoting.transport.impl.MultiTargetRequest.onTimeout(MultiTargetRequest.java:167) > > at >> org.infinispan.remoting.transport.AbstractRequest.call(AbstractRequest.java:87) > > at >> org.infinispan.remoting.transport.AbstractRequest.call(AbstractRequest.java:22) > > at >> java.util.concurrent.FutureTask.run(FutureTask.java:266) > > at >> java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$201(ScheduledThreadPoolExecutor.java:180) > > at >> java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:293) > > at >> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) > > at >> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) > > at java.lang.Thread.run(Thread.java:748) > > Suppressed: org.infinispan.util.logging.TraceException > > at >> org.infinispan.remoting.transport.Transport.invokeRemotely(Transport.java:75) > > at >> org.infinispan.topology.ClusterTopologyManagerImpl.confirmMembersAvailable(ClusterTopologyManagerImpl.java:525) > > at >> org.infinispan.topology.ClusterTopologyManagerImpl.updateCacheMembers(ClusterTopologyManagerImpl.java:508) > > Now after I searched, I really did not see anyone reported such error on keycloak but there is similar bug reported in WILDLFY 14 and is categorized as a blocker in WILDLFY 14.This bug is already fixed in WILDLFY 15. https://issues.jboss.org/browse/WFLY-10736?attachmentViewMode=list Now since keycloak 4.8 is also based on WILDLFY 14, these WARNINGS could be because of this blocker in WILDFLY 14. What should I do to get rid this error. Is this really a problem in keycloak 4.8.3.Final. Did anyone notice any such issue while running keycloak 4.8.3 in HA mode. Is there a workaround to fix this. One more thing we noticed is - It is regarding a property in JDBC_PING protocol we are using in our 3.4.3 setup i.e. "clear_table_on_view_change" but it is no more supported in 4.8 version. and thus the JGROUPSPING table is filled up with lot of stale entries. Is there a workaround to clear the table after view change in 4.8 also. Thanks Abhishek _______________________________________________ keycloak-dev mailing list keycloak-dev(a)lists.jboss.org <mailto:keycloak-dev@lists.jboss.org> https://lists.jboss.org/mailman/listinfo/keycloak-dev

4 years, 12 months

2
1
0 / 0

help

by Mohamad KHAYAT

Hi all, I am trying to build an application which requires access to PostgreSQL DB and I don't want to use the hardcoded username and password in my code instead I want to rely on keycloak for authentication. Any idea if this is possible? Thanks, MK

4 years, 12 months

2
1
0 / 0

reset password procedure without email and non visible keycloak

by Dennis Knorr

Hi, we want to use keycloak as OIDC Provider and are not sure how to handle password reset (with temporary password/TOTP). But we have a few architectural constraints. Our constraints are the following: 1. we have no email system, where we send mails to the provider. We MIGHT have later in the process an SMS System, which could send TOTP Token to the use 2. Because of customer requirements we shall not expose Keycloak to users. My Question would be therefore, what is the best practice/standard way to to password reset? is there a proxy for that which handles that? are there REST Apis? Are there Authentication Flows for it? I did not see anything. Please enlighten me, i am not sure, if we do that right, Documentation and Examples are better than for other OIDC Providers, but the concept is still complex and complicated and i fear we could do stuff wrong.

4 years, 12 months

1
0
0 / 0

Setting X-Frame-Options in jobs/undertow

by Keats Kirsch

Posting in case anyone else has this issue. We were getting errors loading iframes in the KeyCloak console due to the X-Frame-Options being set to “deny” by default in our environment (Cloud Foundry). The fix was to set the X-Frame-Options explicitly in the undertow/jboss subsystem configuration in the configuration file (e.g., standalone.xml). We just added a response-header filter and pointed to it with a filter-ref under the default-host setting. Our XML looks like this: <subsystem xmlns="urn:jboss:domain:undertow:3.1"> <buffer-cache name="default" /> <server name="default-server"> <http-listener name="default" socket-binding="http" redirect-socket="https" enable-http2="true" /> <https-listener name="https" socket-binding="https" security-realm="ApplicationRealm" enable-http2="true" /> <host name="default-host"> <location name="/" handler="welcome-content" /> <filter-ref name="xFrameOptions" /> </host> </server> <servlet-container name="default" eager-filter-initialization="true"> <jsp-config /> <websockets /> </servlet-container> <handlers> <file name="welcome-content" path="${jboss.home.dir}/welcome-content" /> </handlers> <filters> <response-header name="xFrameOptions" header-name="X-Frame-Options" header-value="SAMEORIGIN" /> </filters> </subsystem> Hope this helps. -- Keats Kirsch Auth Lead Axle Informatics http://axleinfo.com/ Keats.Kirsch(a)axleinfo.com<mailto:Keats.Kirsch@axleinfo.com>

4 years, 12 months

1
0
0 / 0

Cannot get UMA photoz example working (keycloak quickstart 6.0.1)

by Olivier Rivat

Hi, I am not able to get the app-auth-photoz uma example working. I have followed the example instructions at https://github.com/keycloak/keycloak-quickstarts/tree/latest/app-authz-ph... When I ckik on the http://localhost:8080/photoz-html5-client I obtain the error message We're sorry... Page not foundhttps://github.com/keycloak/keycloak-quickstarts/tree/latest/app-aut... Landing URL in teh browser is: http://localhost:8180/auth/realms/photoz/protocol/openid-connect/auth?cli... I have enabled debug logs, but haven't found any further clue. I am wondering where this problem can originate ? Misconfiguration of mine (I've tried this example with diffrenet distribs and always falling in the same hurdle) Or is it a bug in with this example ? Regards, Olivier Rivat -- <http://www.janua.fr/images/logo-big-sans.png><http://www.janua.fr/images/LogoSignature.gif> <http://www.janua.fr/images/6g_top.gif> Olivier Rivat CTO orivat(a)janua.fr <mailto:dchikhaoui@janua.fr> Gsm: +33(0)682 801 609 Tél: +33(0)489 829 238 Fax: +33(0)955 260 370 http://www.janua.fr <http://www.janua.fr/> <http://www.janua.fr/images/6g_top.gif>

4 years, 12 months

2
3
0 / 0

Announcement: KeyConf19 - a community focused event

by Colin Morey - UKRI STFC

Hi All, I’m pleased to invite you to KeyConf19, a new open source identity and account management event focused primarily on Keycloak and its use-cases: part conference, part un-conference, all community driven. Its 2 days long on 12-13 June 2019, in (mostly) sunny Cheshire, in the north west of the UK and _free_to_attend_ (we’re even covering lunch and coffee during the day)! For more information and to register: https://www.hartree.stfc.ac.uk/Pages/KeyConf.aspx We will be fleshing out the agenda in the next few weeks, and if you’d like to present a short overview of how you’re using Keycloak or other related topics for discussion, please use the sign-up form to let us know. If you have any questions, please do let us know via hartree(a)stfc.ac.uk Hope to see some of you there, Colin Morey Systems Architect STFC Hartree Centre Daresbury Laboratory

4 years, 12 months

1
0
0 / 0

Fwd: Not properly closed connections in org.keycloak.adapters.ServerRequest

by Maksym Gendin

Dear Keycloak users/developers, I have noticed a potential problem with closing the connections in org.keycloak.adapters.ServerRequest#invokeClientManagementRequest method. I'm facing problems with number of opened files on a linux machine and trying to identify the source...querying the open connections with netstat I see a couple of connections in CLOSE_WAIT status from my microservice instances towards Keycloak... Can someone confirm me that the ServerRequest class closes the connections in a proper way? Best regards Maksym

4 years, 12 months

1
0
0 / 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

keycloak-user May 2019