July 2019 - keycloak-user - Jboss List Archives

How to configure my client for use ADMIN REST API [DELETE]: https://keycloaksrv.fr/auth/admin/realms/myclient/users/'

by Christophe Lehingue

Hello, how to configure a client so that the user can use the user removal API? [DELETE]: https://keycloaksrv.fr/auth/admin/realms/myclient/users/fdskgjdkdjkgjf-sd... Whenever I try to call this request REST => I get the following error message: "resulted in a 401/403 Unauthorized`" Can you help me ? Thank you

6 years, 4 months

4
4
0 / 0

Keycloak Offline User Sessions and Online User Sessions

by Nagendra Darla

Hello Keycloak experts, We have below challenges in out project where we are building User Access Management using Keycloak. 1. *Offline User Sessions:* When a Offline token is used from two different machines, There is only one Session that will be created and session will have the IP address of the machine from where the User Session is first created. Because of this we cannot suspect any suspicious activity by hackers. Should n't we create different sessions even though same offline token is used from different machines. 2. *Why there is no separate REST end point to get only Online User Sessions: *Below REST end point returns all the User Sessions ie., both Offline and Online User Sessions. GET /{realm}/clients/{id}/user-sessions You help is much appreciated ! Thank you, Nagendra Darla

6 years, 5 months

1
1
0 / 0

resource ids

by Corentin Dupont

Hi guys, I discovered that you can provide your own id when creating resources: curl -X POST " http://localhost:8080/auth/realms/waziup/authz/protection/resource_set" -H "Authorization: Bearer $CLIENTTOKEN" -H "Content-Type: application/json" -d '{*"_id": "123-456"*, "type": "test", "name":"test", "scopes":["sensors:create","sensors:view","sensors:update","sensors:delete"],"owner":"cdupont", "ownerManagedAccess": true}' This is very practical for synchronizing the resources with my own database. After some investigation, I found: - the ID should be unique - the name should be unique Is that correct? The resource type is not used in the unicity. In my application database, resources with different types are stored in different collections, so two resources with different types *can* have the same ID. How do you suggest to solve this in Keycloak? Providing a keycloak ID of the form <type>-<ID> for example? e.g. sensor-123 and project-123 would not collide. Cheers

6 years, 5 months

3
10
0 / 0

multiple reset credentials flows

by Arnault BESNARD

Hi, We're currently developing our own SPI authenticator. In case of authentication failure, we'd like allowing users to reset their credential following a specific scenario. Unfortunately, there is only one reset credentials flow per realm. So 'forgot password' and our SPI reset credential have to share the same scenario, which is not fit in our case. What is the best way to solve our issue? Thanks in advance, Arnault

6 years, 6 months

1
2
0 / 0

Prevent users from changing email address when email is used as username

by Ales Fuchs

Hello, We are using Keycloak version 4.8.3 and in our setting we have the option "Email as username" switched on and "Edit username" switched off. At the same time we need to let users to log in and change their name in the account console. Once the name and surname is editable, email can be changed too, which changes also the username. The input with email can be hidden, but whoever knows how Keycloak works can simply add this input and update the username. Does anyone have any idea how updating of username can be prevented? Best regards, Ales Fuchs

6 years, 8 months

3
7
0 / 0

Implementing Multi-tenancy through Keycloak

by Dhara Basida

Hi Team, We are currently planning to integrate our application with keycloak in order to achieve multi-tenancy. We have hierarchy like : 1) Super Admin : Who have access to eveything and will create tenant. 2) Tenant Admin : This admin can create their Members and one tenant admin cannot see the data of another tenant admin or Tenant. Also he could not able to see any details of Super Admin. 3) Members : Member are specific to Tenant. Member have rights to create their employees and roles which are applicable for their employees. But Member cannot see details of other Members or their Tenant Admin. 4) Employees : Employees are users who can only have view permissions for role applicable to them and manage their profile. He could not able to see any details of Member or Tenant. QUestions : I have created admin and tenant. I have link admin with Super Admin and Tenant Admin with Realm admin. For Member I linked it with Client but somehow I don't find the way to manage it. As I am not able to create Employees from member (Not able to get Add options for users and If I enable manage users or view users role from tenant admin than I can also see data of tenant which is wrong). Kindly provide the way to achieve these hierarchy. Thank you, Dhara Basida --- This email has been checked for viruses by Avast antivirus software. https://www.avast.com/antivirus

6 years, 8 months

2
1
0 / 0

OIDC protocol extension

by Karipineni, Neelima,M.D.

We have a use case where we’re trying to implement an OAuth2 profile which requires an extra claim on the access token when a certain auth request scope is used. The expected behavior is that when a certain scope is present in the auth endpoint request then during the Authorization flow the user is shown an extra screen where they input an identifier which ultimately is included as a claim in the access token. Details are at http://docs.smarthealthit.org/authorization/ (Standalone launch sequence) for reference. Any suggestions on how to accomplish this in keycloak? I considered using an ActionToken like in the quickstarts external action token example, but the additional execution needs to happen even when the user has previously authenticated. It’s like an additional consent step after user and client authentication rather than an additional authentication step. My current thought is to implement a custom LoginProtocol that wraps OIDCLoginProtocol, as shown in https://github.com/keycloak/keycloak/tree/openshift-integration/services/..., and have an additional redirect in the authenticated method that functions similarly to the external action token example. The callback endpoint would persist the extra claim against the client session until the access token is requested. I’m not sure it’s possible to extend the OIDC protocol within a new protocol. Preliminarily after installing a shell wrapper protocol, it’s missing the OIDC configuration properties and mappers in the admin console. Is something like this possible without copying/recreating large chunks of the OIDC code? If not, any suggestions on alternative ways to accomplish this? As an additional wrench, we’re still on v3.3.0 and upgrade is not on the schedule as of now. The information in this e-mail is intended only for the person to whom it is addressed. If you believe this e-mail was sent to you in error and the e-mail contains patient information, please contact the Partners Compliance HelpLine at http://www.partners.org/complianceline . If the e-mail was sent to you in error but does not contain patient information, please contact the sender and properly dispose of the e-mail.

6 years, 8 months

3
4
0 / 0

Custom Social Login, cache access_token, Enterprise Wechat

by kkzxak47

Hi, I'm building a SSO service for my company (~1000 employee). After investigation I decided to adopt Keycloak as the core component. We are using Wechat Work as IM tool (https://work.weixin.qq.com/), employee DB is based on its Contacts. So it's natural to integrate it as a social login into Keycloak SSO service. In the process of implementing the 'WechatIdentityProvider' and 'WechatIdentityProviderFactory' classes I encountered some trouble. Just like Twitter / Google and other providers, some of Wechat Work's OAuth2 flow is not aligned with standards. For example, the processing of retrieving the access_token is relatively independent of other OAuth2 code flow, the access_token is valid for 7200 seconds, its API is limited to be called 2000 times per day for a single client. We are forced to cache a global access_token for each client. I noticed that Keycloak is heavily using Infinispan. My question is can I use it for caching access_token too? Is it safe to do so? What is your recommendation? And I'm working based on version 6.0.1 in standalone mode, is it appropriate? My main programming language is not Java by the way. I learned it ~10 years ago and Spring is new to me. So I'm still learning. It's of great help to give relevant document links or code snippets, thanks! Victor

6 years, 8 months

1
3
0 / 0

Question about CBAC + Pushing Claims + Authorization Scopes

by Álvaro Gómez

Hi, We are applying RBAC and CBAC models to evaluate permissions in a multi-tenant UMA application. We are using Pushing Claims to let custom policies determine if an user has an specific role in a provided context (tenant) via Pushing Claims. Everything works fine if we use non-scoped resources but things get a bit confusing when we use scoped ones since the pushing-claims (representing the tenants) end up mixed in the RPT permission claim without leaving any trace of the scopes with which they were pushed along. Consider the following example: We have an application which manages products (represented by resources). There are profiles (represented by roles) which allow users to sell, modify or delete products (represented by scopes). A certain user may interact with one product in the context of a tenant (Determined by the Pushing claim) with an specific role and with some different role from other tenant. - Resource: * product (With scopes sell and update) - Roles: * Seller * Product-Manager - Policies: * Is-Seller (In the Tenant specified in the Pushing Claim "tenant") * Is-Product-Manager (In the Tenant specified in the Pushing Claim "tenant") - Permissions: * product:sell -> Provides the "sell" scope of the resource "product" if the "Is-Seller" policy evaluates to grant. * product:update -> Provides the "update" scope of the resource "product" if the "Is-Product-Manager" policy evaluates to grant. - Users: * Alice -> Alice is "Seller" in the tenant "Organization-1" and is "Product-Manager" in the tenant "Organization 2" so she should be able to sell products in the context of the tenant "Organization-1" and update products in the context of "Organization-2" but neither "update" products in the context of "Organization-1" or sell products in the context of "Organization-2". 1.- Alice requests an RPT using the following ticket: { "resource": "product", "resource_scopes": ["sell"], "claims": { "tenant": ["Organization-1"] } } Since Alice is "Seller" in the "Organization-1" (meaning the Policy "Is-Seller" will evaluate to "grant" if the provided claim value is "Organization-1" and the evaluated Identity is Alice) an RPT is emitted with the following "permission" claim: [{ "resource": "product", "resource_scopes": ["sell"], "claims": { "tenant": ["Organization-1"] } }] 2.- Alice upgrades the previous RPT with the following ticket: { "resource": "product", "resource_scopes": ["update"], "claims": { "tenant": ["Organization-2"] } } Here is were things get confusing to us. We'd expect Alice to be granted when requesting the scope "update" in the context of "Organization-2" since Alice has the role "Product-Manager" in that tenant. That would be what happened if Alice was requesting the RPT for the first time instead of upgrading a previous one. However, since we are upgrading the RPT obtained in Step 1, when the policy "Is-Product-Manager" is evaluated, the claim "tenant" is mixed with the one in Step 1 (Since they are not grouped by scope) resulting in the following permission: { "resource": "product", "resource_scopes": ["sell", "update"], "claims": { "tenant": ["Organization-1", "Organization-2"] } } The policy can't evaluate to grant since Alice is not "Product-Manager" in both tenants "Organization-1" and "Organization-2" (Obtained through $evaluation.getPermission().getClaims()). When evaluating this policy we would only be interested in the pushing-claim `{ "tenant": ["Organization-2"] }` which was pushed along with the scope "update" (which is the one being evaluated by the permission "product:update" associated with this Policy). Shouldn't the claims be grouped by the scopes which with they were pushed along? (See example at the end of this text), Are we missing something? Example: { "resource": "product", "resource_scopes": [ { "name": "sell", "claims": { "tenant": ["Organization-1"] } }, { "name": "update", "claims": { "tenant": ["Organization-2"] } }, ] Thanks in advance, Álvaro.

6 years, 8 months

2
7
0 / 0

CDI Support in keycloak

by Christian Froehlich

Hi, CDI (Weld subsystem) is deactivated inside the keycloak server if I understood it right in the documentation. Is there a specific reason why you explicitly deactivate CDI? Regards Christian

6 years, 8 months

2
1
0 / 0

Keycloak self registration and Active Directory issues

by Chris Smith

My requirements are 1. Active Directory federation (really only as a Kerberos Server... I have a Windoze Only requirement imposed on me) 2. Keycloak self-regestration for users 3. Application and user maintenance done in as much Out Of Box Keycloak as possible 4. Application Admins should never have access to AD management. I've set as many AD password policies as I can easily find or google to be as permissive as possible Policy Enforce password history, 0 passwords remembered, 0 Maximum password age, 0 Minimum password age, 0 days Minimum password length, 1 characters Password must meet complexity requirements, Disabled Store passwords using reversible encryption, Not Defined I've set KC password policies Minimum Length 8 Uppercase Characters 1 Lowercase Characters 1 Expire Password 30 Special Characters 1 Not Username Not Recently Used 25 Digits 1 KC Authentication Required Action Update Password disabled So when a new user users self-registration, in AD, the user account is set to require password Change Any advice on how to Change that In Active Directory I remove the "Require password Change" on the user account The KC user login fails with "invalid User or Password" error If I try to Change the new Users Password in the KC Console, Error! Could not modify attribute for DN [CN=xxx.yyyy,CN=Users,DC=xxx-sso,DC=com] Any Advice on what is going on?

6 years, 8 months

1
1
0 / 0

IdentityProvider access to AuthenticationSession

by Ronaldo Hideki Yamada

Hi people, I was implementing a PKCE handshake with an OAUTH provider, everything works, but by now my codeVerifier is static! On method createAuthorizationUrl I can get a instance from request.getAuthenticationSession(), but on inner class I cant. I need access to a instance of AuthenticationSession on Endpoint inner class. to retrieve an random string. Some ideas? ==== Some parts of my code ====================== ... public class NeoIDProvider extends AbstractOAuth2IdentityProvider<OIDCIdentityProviderConfig> implements SocialIdentityProvider<OIDCIdentityProviderConfig> { public final static String codeVerifier = NeoIDUtil.S256("neoid"); public NeoIDProvider(KeycloakSession session, OIDCIdentityProviderConfig config) { super(session, config); } @Override protected UriBuilder createAuthorizationUrl(AuthenticationRequest request) { return super.createAuthorizationUrl(request).queryParam("code_challenge", NeoIDUtil.S256(codeVerifier)) .queryParam("code_challenge_method", "S256"); } @Override public Object callback(RealmModel realm, AuthenticationCallback callback, EventBuilder event) { return new Endpoint(callback, realm, event) { @Override public SimpleHttp generateTokenRequest(String authorizationCode) { return super.generateTokenRequest(authorizationCode) .param("code_verifier", codeVerifier); } }; } ... ====================================================== Ronaldo Hideki Yamada Analista Superintendência de Prod e Serviços-Eng de Infra de Tecnologia da Informação Diretoria de Operações (11)2173-1797 - "Esta mensagem do SERVIÇO FEDERAL DE PROCESSAMENTO DE DADOS (SERPRO), empresa pública federal regida pelo disposto na Lei Federal nº 5.615, é enviada exclusivamente a seu destinatário e pode conter informações confidenciais, protegidas por sigilo profissional. Sua utilização desautorizada é ilegal e sujeita o infrator às penas da lei. Se você a recebeu indevidamente, queira, por gentileza, reenviá-la ao emitente, esclarecendo o equívoco." "This message from SERVIÇO FEDERAL DE PROCESSAMENTO DE DADOS (SERPRO) -- a government company established under Brazilian law (5.615/70) -- is directed exclusively to its addressee and may contain confidential data, protected under professional secrecy rules. Its unauthorized use is illegal and may subject the transgressor to the law's penalties. If you're not the addressee, please send it back, elucidating the failure."

6 years, 8 months

1
0
0 / 0

Keycloak Kibana integration

by Joerg Lammerich

Hello, we are new in Keycloak and we want to integrate it in our Elasticsearch/Kibana. We read a lot of documentation, but we are not able to get it run! After the "login-Page" in Keycloak, we are redirect to the Kibana and we get a error like die sreenshot in the attachment. What can we do??? Regards, Joerg

6 years, 8 months

2
1
0 / 0

How do I integrate with a SAML federation

by BOOTH Stephen

I'm wanting configure keycloak to use authenticate against a SAML federation (externally curated set of IdPs) rather than a single SAML IdP. Specifically I want to support EduGAIN. Is this something that keycloak supports natively? The form for configuring a SAML Identity provider appears to assume a single IdP. If not, does anyone have any suggestions for the best approach to bridging a shibboleth SP into something keycloak can use as an Identity provider. Stephen -- ====================================================================== |epcc| Dr Stephen P Booth Principal Architect |epcc| |epcc| s.booth(a)epcc.ed.ac.uk Phone 0131 650 5746 |epcc| ====================================================================== -- The University of Edinburgh is a charitable body, registered in Scotland, with registration number SC005336.

6 years, 8 months

4
4
0 / 0

Having multiple admin realms

by chamila

Hello, I came across a requirement where we needed to allow a certain set of users to perform a limited set of admin tasks like realm creation, user creation etc. IIUC this is directly achievable by allocating those users to `create-realm` role in the `master` realm. However the requirement demands that the users should not be in the `master` realm itself. So the user model is something like the following. 0. super users - Ops, and other super admins that take care of the most privileged tasks like IdP federation, auth flows, etc - limited set of users in the `master` realm 1. organization root users - users who act as admins for their realm and are able to create other realms and add users to them, basically organization admins (ex: `org1` realm) 2. realm specific users - users confined to their own realms (ex: `deptx` realm) In this model, `organization root users` should be able to create realms but should not be part of the `master` realm itself. From the code I can see that this requirement is not something possible as org.keycloak.services.resources.admin.permissions.MgmtPermissions#canCreateRealm() checks the following. 1. Is current realm the administrative realm 2. Does current user has `create-realm` role However, is there a way to mark *multiple* realms other than `master` as administrative realms so that those realms could have a realm role named `create-realm` to be assigned to the above mentioned `organization root users`? Regards, Chamila Blog: medium.com/@chamilad

6 years, 8 months

1
0
0 / 0

Re: [keycloak-user] Keycloak as SP with ping federate

by Chris Stephens

Hello, Thanks for responding so quickly. I was not able to see the error in the logs. However, after setting up a local instance of Keycloak I was able to track it down. You are correct I was not using SP-initiated SSO. After changing the configurations in Keycloak the relay state was being passed correctly. The client id was no longer null and I was able to authenticate. Thanks again, Chris -- On 7/30/19, 2:27 PM, "Dmitry Telegin (Carretti Consulting)" <carretti.pro(a)gmail.com> wrote: at java.util.regex.Matcher.getTextLength(Matcher.java:1283) at java.util.regex.Matcher.reset(Matcher.java:309) at java.util.regex.Matcher.<init>(Matcher.java:229) at java.util.regex.Pattern.matcher(Pattern.java:1093) at java.util.regex.Pattern.split(Pattern.java:1206) at org.keycloak.broker.provider.util.IdentityBrokerState.encoded(IdentityBrokerState.java:41) at org.keycloak.services.resources.IdentityBrokerService.parseEncodedSessionCode(IdentityBrokerService.java:987) at org.keycloak.services.resources.IdentityBrokerService.authenticated(IdentityBrokerService.java:497) at org.keycloak.broker.saml.SAMLEndpoint$Binding.handleLoginResponse(SAMLEndpoint.java:465)

6 years, 8 months

1
0
0 / 0

Unable to log in with keycloak-js on localhost in Microsoft Edge

by Lukasz Lech

Hello, I'm unable to log-in on localhost (both using http://localhost and http://mylocalhostname ) using keycloak-js (https://www.npmjs.com/package/keycloak-js) on Microsoft Edge. The problem is , that no POST is made to /auth/realms/REALM/protocol/openid-connect/token , only GET. On other browsers, or when using the same Edge to access the same app deployed remotely, there's both POST and GET made (BTW, why?). The keycloak is deployed on remote machine. I've tested keycloak-js versions 4.5.0, 4.8.3 and 6.0.1 The keycloak server configuration is identical in both cases. Do anybody experience that behavior? Is this Edge blocking some requests on random criteria when the app is loaded from localhost? Best regards, Lukasz Lech

6 years, 8 months

1
0
0 / 0

Keycloak in Websphere

by Orth, Alexandra

Hello, I want to ask about the feasibility of getting Keycloak to run in Websphere instead of Wildfly. I found this link from 2018 (https://dzone.com/articles/deploying-keycloak-in-tomcat) describing how to deploy to Tomcat and was wondering if a similar approach might work now. Any advice and/or instructions would be appreciated! Thanks, Alexandra

6 years, 8 months

2
1
0 / 0

Keycloak process is killed during the booting-up and before the deployment of REST resources

by alhezmi＠yahoo.de

Hi, I managed to install locally the Keycloak as Standalone and tested with all required test cases fine. But when I tried to run it on another host available on the public Internet, the Keycloak process is killed after the Hibernat process is started "HHH000397: Using ASTQueryTranslatorFactory" and before the process: "RESTEASY002225: Deploying javax.ws.rs.core.Application: class org.keycloak.services.resources.KeycloakApplication", where I compare the log files of the local and remote processes. What could be the reason for such termination? The server log is attached as text file. I appreciate your feedback. Best Regards/viele Gruesse, Adel Al-Hezmi

6 years, 8 months

1
0
0 / 0

Keycloak session management

by anupa shah

Hello Sir, I am using keycloak with spring-adaptor approach with xml base. I am not able to get keycloak session in my project. So my application is not able to use keycloak session.Please guide me. Below is link where i posted my question. https://github.com/spring-projects/spring-security/issues/7152 Please guide me. Thanks, Anupa

6 years, 8 months

1
0
0 / 0

Cache invalidation Javascript policies - cluster mode

by Matteo Restelli

Hi all, We have a custom Javascript policy, and we're running 3 Keycloak instances in a Kubernetes cluster. Cluster configuration is based on DNS_PING and we've followed the Helm provided by Codecentric. The three Keycloak pods successfully joined the cluster (in standalone mode). We're seeing this from following log lines: 10:16:02,114 INFO [org.infinispan.CLUSTER] (MSC service thread 1-4) ISPN000094: Received new cluster view for channel ejb: [keycloak-2|13] (3) [keycloak-2, keycloak-1, keycloak-0] 10:16:02,114 INFO [org.infinispan.CLUSTER] (MSC service thread 1-3) ISPN000094: Received new cluster view for channel ejb: [keycloak-2|13] (3) [keycloak-2, keycloak-1, keycloak-0] 10:16:02,114 INFO [org.infinispan.CLUSTER] (MSC service thread 1-2) ISPN000094: Received new cluster view for channel ejb: [keycloak-2|13] (3) [keycloak-2, keycloak-1, keycloak-0] 10:16:02,114 INFO [org.infinispan.CLUSTER] (MSC service thread 1-1) ISPN000094: Received new cluster view for channel ejb: [keycloak-2|13] (3) [keycloak-2, keycloak-1, keycloak-0] 10:16:02,120 INFO [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service thread 1-4) ISPN000079: Channel ejb local address is keycloak-0, physical addresses are [10.71.10.170:7600] 10:16:02,120 INFO [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service thread 1-3) ISPN000079: Channel ejb local address is keycloak-0, physical addresses are [10.71.10.170:7600] 10:16:02,120 INFO [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service thread 1-1) ISPN000079: Channel ejb local address is keycloak-0, physical addresses are [10.71.10.170:7600] 10:16:02,120 INFO [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service thread 1-2) ISPN000079: Channel ejb local address is keycloak-0, physical addresses are [10.71.10.170:7600] 10:16:02,755 INFO [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service thread 1-3) ISPN000078: Starting JGroups channel ejb 10:16:02,756 INFO [org.infinispan.CLUSTER] (MSC service thread 1-3) ISPN000094: Received new cluster view for channel ejb: [keycloak-2|13] (3) [keycloak-2, keycloak-1, keycloak-0] 10:16:02,757 INFO [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service thread 1-3) ISPN000079: Channel ejb local address is keycloak-0, physical addresses are [10.71.10.170:7600] The problem can be reproduced by the following: - We update the code of our Javascript policy, adding a new "print" - We just see the new log line on one node, the others are not printing the new log Maybe is something related to cache invalidation? Thank you very much, Matteo Restelli -- Like <https://www.facebook.com/cuebiq/> I Follow <https://twitter.com/Cuebiq>I Connect <https://www.linkedin.com/company/cuebiq> This email is reserved exclusively for sending and receiving messages inherent working activities, and is not intended nor authorized for personal use. Therefore, any outgoing messages or incoming response messages will be treated as company messages and will be subject to the corporate IT policy and may possibly to be read by persons other than by the subscriber of the box. Confidential information may be contained in this message. If you are not the address indicated in this message, please do not copy or deliver this message to anyone. In such case, you should notify the sender immediately and delete the original message.

6 years, 8 months

2
3
0 / 0

XHRs resulting in 401 unauthorized

by Gianluca Diodato

Hi All, We have a problem in our platform configuration: Server 1: Apache 2.4.x mod_auth_openidc 2.3.11 Symfony 3.x application + Javascript & Ajax code (no headers into our xhr requests) Server 2: Keycloack 4.8.3 Final (client is confidential type) All work fine but after few minutes (about 4 minutes) any requests (XHRs)fails with error 401 unauthorized into browser. To bypass the error, we added this parameter into ssl.conf (attached file): OIDCSessionInactivityTimeout 1800 But we would find a definitive solution. We googled about this problem: https://github.com/zmartzone/mod_auth_openidc/wiki/Cookies https://github.com/zmartzone/mod_auth_openidc/wiki/Access-Tokens-and-Refr... but we not found anything help us. We missed something? Comments and suggestions are welcome. Bests Gianluca Diodato

6 years, 8 months

1
0
0 / 0

Delete all resources

by Corentin Dupont

Hi guys, is there an easy way to delete all resources? The UI doesn't seem to offer this functionality. It seems I need to create a small script with the API, right? Or can performing some DB commands (drop TABLE) could do it? Thanks Corentin

6 years, 8 months

2
2
0 / 0

Keycloak sign secret HS256 JWT

by Stef Graces

Hi, I’ve been trying to create a static website with role based access. To achieve this, I use a HS256 signed JSON-web token, which is verified by the site using the shared secret. However, I have been unable to find this secret. I have tried the method described in this email: https://lists.jboss.org/pipermail/keycloak-user/2018-December/016818.html <https://lists.jboss.org/pipermail/keycloak-user/2018-December/016818.html>, But I have been unable to verify the token I received from Keycloak using many different tools. Can I retrieve the secret somewhere else or is there a way for me to create a secret myself for signing JWT’s using the HS256 algorithm? Note: to host my website I am using a service that only supports HS256 signed JWT’s. Kind regards, Stef Graces

6 years, 8 months

1
0
0 / 0

Keycloak using Sql Server on Azure as db: stops working after few days

by Mario Giammarco

Hello, I have installed a Keycloak as an Azure virtual machine. As database I have chosen the Sql Server offered as an Azure service. I have configured it correctly because all works. But after some days it stops working. I get these exceptions: Caused by: org.hibernate.exception.GenericJDBCException: could not prepare statement at org.hibernate.exception.internal.StandardSQLExceptionConverter.convert(StandardSQLExceptionConverter.java:47) at org.hibernate.engine.jdbc.spi.SqlExceptionHelper.convert(SqlExceptionHelper.java:113) at org.hibernate.engine.jdbc.internal.StatementPreparerImpl$StatementPreparationTemplate.prepareStatement(StatementPreparerImpl.java:182) at org.hibernate.engine.jdbc.internal.StatementPreparerImpl.prepareQueryStatement(StatementPreparerImpl.java:148) at org.hibernate.loader.Loader.prepareQueryStatement(Loader.java:1984) at org.hibernate.loader.Loader.executeQueryStatement(Loader.java:1914) at org.hibernate.loader.Loader.executeQueryStatement(Loader.java:1892) at org.hibernate.loader.Loader.doQuery(Loader.java:937) at org.hibernate.loader.Loader.doQueryAndInitializeNonLazyCollections(Loader.java:340) at org.hibernate.loader.Loader.doList(Loader.java:2689) at org.hibernate.loader.Loader.doList(Loader.java:2672) at org.hibernate.loader.Loader.listIgnoreQueryCache(Loader.java:2506) at org.hibernate.loader.Loader.list(Loader.java:2501) at org.hibernate.loader.hql.QueryLoader.list(QueryLoader.java:504) at org.hibernate.hql.internal.ast.QueryTranslatorImpl.list(QueryTranslatorImpl.java:395) at org.hibernate.engine.query.spi.HQLQueryPlan.performList(HQLQueryPlan.java:220) at org.hibernate.internal.SessionImpl.list(SessionImpl.java:1507) at org.hibernate.query.internal.AbstractProducedQuery.doList(AbstractProducedQuery.java:1537) at org.hibernate.query.internal.AbstractProducedQuery.list(AbstractProducedQuery.java:1505) ... 13 more Caused by: com.microsoft.sqlserver.jdbc.SQLServerException: The connection is closed. at com.microsoft.sqlserver.jdbc.SQLServerException.makeFromDriverError(SQLServerException.java:234) at com.microsoft.sqlserver.jdbc.SQLServerConnection.checkClosed(SQLServerConnection.java:1088) at com.microsoft.sqlserver.jdbc.SQLServerConnection.prepareStatement(SQLServerConnection.java:3409) at org.jboss.jca.adapters.jdbc.BaseWrapperManagedConnection.doPrepareStatement(BaseWrapperManagedConnection.java:758) at org.jboss.jca.adapters.jdbc.BaseWrapperManagedConnection.prepareStatement(BaseWrapperManagedConnection.java:744) at org.jboss.jca.adapters.jdbc.WrappedConnection.prepareStatement(WrappedConnection.java:459) at org.hibernate.engine.jdbc.internal.StatementPreparerImpl$5.doPrepare(StatementPreparerImpl.java:146) at org.hibernate.engine.jdbc.internal.StatementPreparerImpl$StatementPreparationTemplate.prepareStatement(StatementPreparerImpl.java:172) It seems that, after some time, sql server refuses new connections. I have tried reducing max-pool-size and I have obtained that it now gives the problem some days before. I need help because the exception is not very informative. Thanks in advance for any hints. Mario

6 years, 8 months

2
1
0 / 0

General Question - Keycloak Configuration as SAML Service Provider

by Reid Watson

Hi Everyone, Were investigating “Keycloak” with oAuth2 / OIDC and SAML and I’m wondering does the application have the ability for users to configure an SP (Service Provider) within Keycloak . As I understand it Keycloak server plays the role of an Identity Provider (IDP) and provides means to authenticate a user for a Service Provider. There is no mention or guides for users to configuring a Service Provider but I might not be looking at the incorrect documentation. Cheers Reid

6 years, 8 months

2
1
0 / 0

Duplicate entry for key

by Corentin Dupont

Dear all, I often have this error: keycloak_1_c37c1c45aa45 | 12:28:02,524 ERROR [org.keycloak.services.error.KeycloakErrorHandler] (default task-10) Uncaught server error: org.keycloak.models.ModelDuplicateException: javax.persistence.PersistenceException: org.hibernate.exception.ConstraintViolationException: could not execute statement ... keycloak_1_c37c1c45aa45 | Caused by: com.mysql.jdbc.exceptions.jdbc4.MySQLIntegrityConstraintViolationException: Duplicate entry 'GW1-d9d54300-3791-443c-884c-0c52c43d64db-0892e431-5daf-413e-b4cf' for key 'UK_FRSR6T700S9V50BU18WS5HA6' For instance, I have this error when trying to create a resource. What does it mean? How to solve it? Thanks Corentin

6 years, 8 months

1
0
0 / 0

Java minor update missing files

by Hannah Short

Hi keycloak users, We are having issues with broken links in Keycloak each time Java is updated on our servers. Does anyone have advice? E.g. java.io.FileNotFoundException: /usr/lib/jvm/java-1.8.0… We would like to have minor updates included automatically, for security purposes, but they currently result in java runtime errors when trying to authenticate afterwards. Thanks in advance, Hannah

6 years, 8 months

3
5
0 / 0

Github Identity Provider does not allow restricting organizations

by Peter Braun

Hi, when setting up a Github Identity Provider it is currently (RHSSO 7.2) not possible to restrict access to certain Github organizations from the console. Github does support this and it is also documented in the identity providers section of the OpenShift docs: https://docs.openshift.com/container-platform/3.11/install_config/configu... It would be very useful to have this exposed in the UI, what are your thoughs? Regards, Peter

6 years, 8 months

1
0
0 / 0

Strange behaviour during RPT call - java.lang.RuntimeException: Error while reading attributes

by Matteo Restelli

Hi all, We're noticing a strange behaviour during RPT call performed by our adapter. More specifically, we're getting a 500 HTTP Error with the following description: "Unexpected error while evaluating permissions: java.lang.RuntimeException: Error while reading attributes" and with a NullPointerException. I had a keycloak access token with 5 hours of expiration time and "SSO Session Idle time", in Keycloak, was set to 30 minutes. I know, it's a strange configuration, but we've used it just for testing purposes of the RPT / Authorization part. Once i've received the error, i've started thinking that the problem was probably due to the fact that the user's session was expired (i've notice the error after lunch where i've left the pc alone for about 1 hour), so i've tried to reproduce the error in this way: - Login via Resource Owner Password grant flow (via Postman) - Getting the token and calling our test microservice where the adapter was configured - RPT Call worked - After that, logout the user's session from the user admin console - Retried the call to the microservice with the same token - Received the 500 HTTP Error We're using Keycloak 6.0.1. I've a question about: is it right that error? In my opinion we should receive a 401, not 500... At the bottom you can find the stacktrace. Thank you very much, Matteo 12:58:23,179 ERROR [org.keycloak.authorization.authorization.AuthorizationTokenService] (default task-784) Unexpected error while evaluating permissions: java.lang.RuntimeException: Error while reading attributes from security token. at org.keycloak.authorization.common.KeycloakIdentity.<init>(KeycloakIdentity.java:146) at org.keycloak.authorization.common.KeycloakIdentity.<init>(KeycloakIdentity.java:69) at org.keycloak.authorization.authorization.AuthorizationTokenService.lambda$static$1(AuthorizationTokenService.java:131) at org.keycloak.authorization.authorization.AuthorizationTokenService.createEvaluationContext(AuthorizationTokenService.java:379) at org.keycloak.authorization.authorization.AuthorizationTokenService.authorize(AuthorizationTokenService.java:160) at org.keycloak.protocol.oidc.endpoints.TokenEndpoint.permissionGrant(TokenEndpoint.java:1157) at org.keycloak.protocol.oidc.endpoints.TokenEndpoint.processGrantRequest(TokenEndpoint.java:196) at sun.reflect.GeneratedMethodAccessor811.invoke(Unknown Source) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.lang.reflect.Method.invoke(Method.java:498) at org.jboss.resteasy.core.MethodInjectorImpl.invoke(MethodInjectorImpl.java:139) at org.jboss.resteasy.core.ResourceMethodInvoker.internalInvokeOnTarget(ResourceMethodInvoker.java:510) at org.jboss.resteasy.core.ResourceMethodInvoker.invokeOnTargetAfterFilter(ResourceMethodInvoker.java:400) at org.jboss.resteasy.core.ResourceMethodInvoker.lambda$invokeOnTarget$0(ResourceMethodInvoker.java:364) at org.jboss.resteasy.core.interception.PreMatchContainerRequestContext.filter(PreMatchContainerRequestContext.java:355) at org.jboss.resteasy.core.ResourceMethodInvoker.invokeOnTarget(ResourceMethodInvoker.java:366) at org.jboss.resteasy.core.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:338) at org.jboss.resteasy.core.ResourceLocatorInvoker.invokeOnTargetObject(ResourceLocatorInvoker.java:137) at org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorInvoker.java:106) at org.jboss.resteasy.core.ResourceLocatorInvoker.invokeOnTargetObject(ResourceLocatorInvoker.java:132) at org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorInvoker.java:100) at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:439) at org.jboss.resteasy.core.SynchronousDispatcher.lambda$invoke$4(SynchronousDispatcher.java:229) at org.jboss.resteasy.core.SynchronousDispatcher.lambda$preprocess$0(SynchronousDispatcher.java:135) at org.jboss.resteasy.core.interception.PreMatchContainerRequestContext.filter(PreMatchContainerRequestContext.java:355) at org.jboss.resteasy.core.SynchronousDispatcher.preprocess(SynchronousDispatcher.java:138) at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:215) at org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.service(ServletContainerDispatcher.java:227) at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:56) at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:51) at javax.servlet.http.HttpServlet.service(HttpServlet.java:791) at io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:74) at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:129) at org.keycloak.services.filters.KeycloakSessionServletFilter.doFilter(KeycloakSessionServletFilter.java:90) at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61) at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131) at io.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.java:84) at io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:62) at io.undertow.servlet.handlers.ServletChain$1.handleRequest(ServletChain.java:68) at io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36) at org.wildfly.extension.undertow.security.SecurityContextAssociationHandler.handleRequest(SecurityContextAssociationHandler.java:78) at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) at io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:132) at io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:57) at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) at io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:46) at io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64) at io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:60) at io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:77) at io.undertow.security.handlers.NotificationReceiverHandler.handleRequest(NotificationReceiverHandler.java:50) at io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43) at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) at org.wildfly.extension.undertow.security.jacc.JACCContextIdHandler.handleRequest(JACCContextIdHandler.java:61) at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) at org.wildfly.extension.undertow.deployment.GlobalRequestControllerHandler.handleRequest(GlobalRequestControllerHandler.java:68) at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) at io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:292) at io.undertow.servlet.handlers.ServletInitialHandler.access$100(ServletInitialHandler.java:81) at io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:138) at io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:135) at io.undertow.servlet.core.ServletRequestContextThreadSetupAction$1.call(ServletRequestContextThreadSetupAction.java:48) at io.undertow.servlet.core.ContextClassLoaderSetupAction$1.call(ContextClassLoaderSetupAction.java:43) at org.wildfly.extension.undertow.security.SecurityContextThreadSetupAction.lambda$create$0(SecurityContextThreadSetupAction.java:105) at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502) at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502) at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502) at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502) at io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:272) at io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:81) at io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:104) at io.undertow.server.Connectors.executeRootHandler(Connectors.java:364) at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:830) at org.jboss.threads.ContextClassLoaderSavingRunnable.run(ContextClassLoaderSavingRunnable.java:35) at org.jboss.threads.EnhancedQueueExecutor.safeRun(EnhancedQueueExecutor.java:1982) at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.doRunTask(EnhancedQueueExecutor.java:1486) at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1377) at java.lang.Thread.run(Thread.java:748) Caused by: java.lang.NullPointerException -- Like <https://www.facebook.com/cuebiq/> I Follow <https://twitter.com/Cuebiq>I Connect <https://www.linkedin.com/company/cuebiq> This email is reserved exclusively for sending and receiving messages inherent working activities, and is not intended nor authorized for personal use. Therefore, any outgoing messages or incoming response messages will be treated as company messages and will be subject to the corporate IT policy and may possibly to be read by persons other than by the subscriber of the box. Confidential information may be contained in this message. If you are not the address indicated in this message, please do not copy or deliver this message to anyone. In such case, you should notify the sender immediately and delete the original message.

6 years, 8 months

2
2
0 / 0

Keycloak as SP with ping federate

by Chris Stephens

I am having issues integrating keycloak with ping federate. We are using keycloak version 5.0.0. Ping federate is the idp and keycloak is the service provider. Keycloak gives me a generic error "An internal server error has occurred”. When I dive deeper into the logs I see this stack trace. [0m[31m15:59:02,925 ERROR [org.keycloak.services.error.KeycloakErrorHandler] (default task-341) Uncaught server error: org.keycloak.broker.provider.IdentityBrokerException: Could not process response from SAML identity provider. at org.keycloak.broker.saml.SAMLEndpoint$Binding.handleLoginResponse(SAMLEndpoint.java:469) at org.keycloak.broker.saml.SAMLEndpoint$Binding.handleSamlResponse(SAMLEndpoint.java:504) at org.keycloak.broker.saml.SAMLEndpoint$Binding.execute(SAMLEndpoint.java:244) at org.keycloak.broker.saml.SAMLEndpoint.postBinding(SAMLEndpoint.java:160) at sun.reflect.GeneratedMethodAccessor1101.invoke(Unknown Source) ... at java.lang.Thread.run(Thread.java:748) Caused by: java.lang.NullPointerException There is no line number on the above null pointer exception. I only know it is happening in handleLoginResponse. Here is the formatted xml from the /endpoint response in the browser": <?xml version="1.0"?> <samlp:Response xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" Version="2.0" ID="J8RPRFTJWzphQNpjsdDMOBAzanc" IssueInstant="2019-07-28T15:47:20.101Z" Destination="https://access-dev.myedlogics.com/auth/realms/intervent/broker/intervent/..."> <saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">localhost:default:entityId</saml:Issuer> <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"> <ds:SignedInfo> <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/> <ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/> <ds:Reference URI="#J8RPRFTJWzphQNpjsdDMOBAzanc"> <ds:Transforms> <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/> <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/> </ds:Transforms> <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/> <ds:DigestValue>nhnAGsnEubW52HlCQIQ6X9aRQvsiKt2QMxu82hqka3E=</ds:DigestValue> </ds:Reference> </ds:SignedInfo> <ds:SignatureValue>Z2zn8MXkhPk8iw4AXmFV/qK+UbyKQhYT5faq9yyPzF2OCS7joaboMm29/qtZhBHBrFNf0113f3jeAG6mX9RvOYOsoI9k0aLNvH42UDSZw9Iwv8AOIBxa06bqVw7VfJpxwNp4spJgvMRme61OnJd57sqF8V7CNe4X8VMm6L1DDDkvrpL1WieN8OrEjMOm7F3HtlIBTAfy3WvFn2P/Ly3ofSM4CFb9pOgyG0Ypi9KWVaCOQ0qVvaOXu97HpOY4+fp9kg/fMq3UlxJ93WTLiZ8/hXgz9x+Of6DXqY/+XjjRUPdhH2dSXwg7vpXCIc1q5JyG79uNHotLQoDhbO21Osp/QQ==</ds:SignatureValue> </ds:Signature> <samlp:Status> <samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/> </samlp:Status> <saml:Assertion xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="fCWnVphoi6J6jBnD.Ohe_UTtf1D" IssueInstant="2019-07-28T15:47:20.158Z" Version="2.0"> <saml:Issuer>localhost:default:entityId</saml:Issuer> <saml:Subject> <saml:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified">joe</saml:NameID> <saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"> <saml:SubjectConfirmationData Recipient="https://access-dev.myedlogics.com/auth/realms/intervent/broker/intervent/..." NotOnOrAfter="2019-07-28T15:52:20.162Z"/> </saml:SubjectConfirmation> </saml:Subject> <saml:Conditions NotBefore="2019-07-28T15:42:20.162Z" NotOnOrAfter="2019-07-28T15:52:20.162Z"> <saml:AudienceRestriction> <saml:Audience>https://access-dev.myedlogics.com/auth/realms/intervent</saml:Audience> </saml:AudienceRestriction> </saml:Conditions> <saml:AuthnStatement SessionIndex="fCWnVphoi6J6jBnD.Ohe_UTtf1D" AuthnInstant="2019-07-28T15:47:20.136Z"> <saml:AuthnContext> <saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:Password</saml:AuthnContextClassRef> </saml:AuthnContext> </saml:AuthnStatement> <saml:AttributeStatement> <saml:Attribute Name="email" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"> <saml:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">chris.stephens+1(a)edlogics.net</saml:AttributeValue> </saml:Attribute> </saml:AttributeStatement> </saml:Assertion> </samlp:Response> Does anyone see any obvious mistakes I am making? Is the xml invalid and messing with keycloak? Thanks, Chris

6 years, 8 months

1
0
0 / 0

Keycloak session management

by anupa shah

Hello Sir, I am using keycloak with spring-adaptor approach with xml base. I am not able to get keycloak session in my project. So my application is not able to use keycloak session.Please guide me. Below is link where i posted my question. https://github.com/spring-projects/spring-security/issues/7152 Please guide me. Thanks, Anupa

6 years, 8 months

1
0
0 / 0

Is quorum needed in Keycloak Standalone Clustered Configuration?

by Roman Ok

6 years, 8 months

1
0
0 / 0

invalid_grant (Code not valid) error

by Philip Lowman

Hi, I'm playing around with integrating KeyCloak 6.0.1 with the Tomcat 8 Adapter <https://www.keycloak.org/docs/latest/securing_apps/index.html#_tomcat_ada...> (Open ID Connect). I'm running into a problem where the Tomcat adapter redirects to KeyCloak just fine, authentication in Keycloak works, and it redirects back to the application, but subsequently the Tomcat adapter gets a 400 error response from the Keycloak server trying to turn the Access Code into a Token. The error returned from Keycloak is: {"error":"invalid_grant","error_description":"Code not valid"} Here's the code that is logging an error. The error isn't intermittent, happens on every request. protected AuthChallenge resolveCode(String code) { ... try { String httpSessionId = this.deployment.getTokenStore() == TokenStore.SESSION ? this.reqAuthenticator.changeHttpSessionId(true) : null; tokenResponse = ServerRequest.invokeAccessCodeToToken(this.deployment, code, this.strippedOauthParametersRequestUri, httpSessionId); } catch (HttpFailure var6) { log.error("failed to turn code into token"); log.error("status from server: " + var6.getStatus()); I've grabbed TRACE logs for org.keycloak category on the server and included them below, but don't see a smoking gun. I suspect I have something misconfigured somewhere in Keycloak, as this is my first time configuring this. Just wondering if anyone has some suggestions for what I should be doing to troubleshoot this further? Thanks! keycloak.json (effectively copy/paste from KeyCloak Admin UI) { "realm" : "myrealm", "auth-server-url" : "http://myhost.example.org:8080/auth", "ssl-required" : "external", "resource" : "myclient", "verify-token-audience" : true, "credentials" : { "secret" : "a41c8c84-ac43-43ae-bf9a-0241e24ce56f" }, "use-resource-role-mappings": true, "confidential-port" : 0 } keycloak server.log w/org.keyloak at TRACE <logger category="org.keycloak"> <level name="TRACE"/> </logger> 2019-07-26 18:11:26,865 TRACE [org.keycloak.events] (default task-1) type= *LOGIN*, realmId=308af72f-9f89-4fae-a583-b508d07b521a, clientId=myclient, userId=19c4c859-e062-4528-b176-3a17caf443af, ipAddress=10.192.226.126, auth_method=openid-connect, auth_type=code, redirect_uri= http://localhost:7700/myapp/Foo.do, consent=no_consent_required, code_id=9634b07b-6191-4a09-85b3-507ff9dcead1, username=myuser, requestUri= http://myhost.example.org:8080/auth/realms/myrealm/login-actions/authenti..., cookies=[KC_RESTART=eyJhbGciOiJIUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICIyZjc5NzQyZS1jZTA1LTQ3ZGEtYmFhZS05ZTkwMmMyYWUzYmYifQ.eyJjaWQiOiJXVG5BIiwicHR5Ijoib3BlbmlkLWNvbm5lY3QiLCJydXJpIjoiaHR0cDovL2xvY2FsaG9zdDo3NzAwL3dvcmtmb3JjZS9Ib21lLmRvP2FjdGlvbj1zdGFydCIsImFjdCI6IkFVVEhFTlRJQ0FURSIsIm5vdGVzIjp7InNjb3BlIjoib3BlbmlkIiwiaXNzIjoiaHR0cDovL3VzNGxhdGNhczAwMS51c2Rldi53ZnNhYXMubmV0OjgwODAvYXV0aC9yZWFsbXMvcGxvd21hbiIsInJlc3BvbnNlX3R5cGUiOiJjb2RlIiwiY29kZV9jaGFsbGVuZ2VfbWV0aG9kIjoicGxhaW4iLCJyZWRpcmVjdF91cmkiOiJodHRwOi8vbG9jYWxob3N0Ojc3MDAvd29ya2ZvcmNlL0hvbWUuZG8_YWN0aW9uPXN0YXJ0Iiwic3RhdGUiOiIyYzIwYzM0OC04M2Q0LTQ3YzQtOWZlOS0yZWUzZTE5ZjFjNDMiLCJjbGllbnRfcmVxdWVzdF9wYXJhbV9sb2dpbiI6InRydWUifX0.lol6rrM0GZpLxNY8tbMwPQt8_HBPnDSqHzGKvHU9zeY, AUTH_SESSION_ID=9634b07b-6191-4a09-85b3-507ff9dcead1.myhost] 2019-07-26 18:11:26,865 TRACE [org.keycloak.models.cache.infinispan.UserCacheSession] (default task-1) getuserById 19c4c859-e062-4528-b176-3a17caf443af 2019-07-26 18:11:26,865 TRACE [org.keycloak.models.cache.infinispan.UserCacheSession] (default task-1) return managedusers 2019-07-26 18:11:26,865 TRACE [org.keycloak.models.cache.infinispan.UserCacheSession] (default task-1) getuserById 19c4c859-e062-4528-b176-3a17caf443af 2019-07-26 18:11:26,865 TRACE [org.keycloak.models.cache.infinispan.UserCacheSession] (default task-1) return managedusers 2019-07-26 18:11:26,865 TRACE [org.keycloak.keys.DefaultKeyManager] (default task-1) Active key found: realm=myrealm kid=2f79742e-ce05-47da-baae-9e902c2ae3bf algorithm=HS256 use=SIG 2019-07-26 18:11:26,865 DEBUG [org.keycloak.services.managers.AuthenticationManager] (default task-1) Create login cookie - name: KEYCLOAK_IDENTITY, path: /auth/realms/myrealm/, max-age: -1 2019-07-26 18:11:26,866 DEBUG [org.keycloak.services.managers.AuthenticationManager] (default task-1) Expiring remember me cookie 2019-07-26 18:11:26,866 DEBUG [org.keycloak.services.managers.AuthenticationManager] (default task-1) Expiring cookie: KEYCLOAK_REMEMBER_ME path: /auth/realms/myrealm/ 2019-07-26 18:11:26,866 DEBUG [org.keycloak.protocol.oidc.OIDCLoginProtocol] (default task-1) redirectAccessCode: state: 2c20c348-83d4-47c4-9fe9-2ee3e19f1c43 2019-07-26 18:11:26,866 DEBUG [org.keycloak.models.sessions.infinispan.InfinispanCodeToTokenStoreProviderFactory] (default task-1) Not having remote stores. Using normal cache 'actionTokens' for single-use cache of code 2019-07-26 18:11:26,866 DEBUG [org.keycloak.transaction.JtaTransactionWrapper] (default task-1) JtaTransactionWrapper commit 2019-07-26 18:11:26,867 DEBUG [org.keycloak.transaction.JtaTransactionWrapper] (default task-1) JtaTransactionWrapper end 2019-07-26 18:11:26,867 TRACE [org.keycloak.connections.jpa.DefaultJpaConnectionProvider] (default task-1) DefaultJpaConnectionProvider close() 2019-07-26 18:11:26,982 DEBUG [org.keycloak.transaction.JtaTransactionWrapper] (default task-1) new JtaTransactionWrapper 2019-07-26 18:11:26,982 DEBUG [org.keycloak.transaction.JtaTransactionWrapper] (default task-1) was existing? false 2019-07-26 18:11:26,982 TRACE [org.keycloak.models.cache.infinispan.RealmCacheSession] (default task-1) realm by name cache hit: myrealm 2019-07-26 18:11:26,982 TRACE [org.keycloak.models.cache.infinispan.RealmCacheSession] (default task-1) by id cache hit: myrealm 2019-07-26 18:11:26,984 DEBUG [org.keycloak.authentication.AuthenticationProcessor] (default task-1) AUTHENTICATE CLIENT 2019-07-26 18:11:26,985 TRACE [org.keycloak.authentication.ClientAuthenticationFlow] (default task-1) Using executions for client authentication: [abb870f0-a067-47db-8ff9-38812ccfadb0, 29a6449f-2624-461d-ae61-a099a4086428, ed974344-8b7c-4ff8-85ea-c61289ef23f0, 1ddbb0e6-5e92-45e6-b8fd-a82ba6b2b0a9] 2019-07-26 18:11:26,985 DEBUG [org.keycloak.authentication.ClientAuthenticationFlow] (default task-1) client authenticator: client-secret 2019-07-26 18:11:26,985 TRACE [org.keycloak.models.cache.infinispan.RealmCacheSession] (default task-1) client by name cache hit: myclient 2019-07-26 18:11:26,985 TRACE [org.keycloak.models.cache.infinispan.RealmCacheSession] (default task-1) client by id cache hit: myclient 2019-07-26 18:11:26,985 DEBUG [org.keycloak.authentication.ClientAuthenticationFlow] (default task-1) client authenticator SUCCESS: client-secret 2019-07-26 18:11:26,985 DEBUG [org.keycloak.authentication.ClientAuthenticationFlow] (default task-1) Client myclient authenticated by client-secret 2019-07-26 18:11:26,985 TRACE [org.keycloak.models.cache.infinispan.RealmCacheSession] (default task-1) by id cache hit: myrealm 2019-07-26 18:11:26,985 TRACE [org.keycloak.models.cache.infinispan.RealmCacheSession] (default task-1) client by id cache hit: myclient 2019-07-26 18:11:26,985 TRACE [org.keycloak.models.cache.infinispan.RealmCacheSession] (default task-1) by id cache hit: myrealm 2019-07-26 18:11:26,985 DEBUG [org.keycloak.models.sessions.infinispan.InfinispanUserSessionProvider] (default task-1) getUserSessionWithPredicate(9634b07b-6191-4a09-85b3-507ff9dcead1): found in local cache 2019-07-26 18:11:26,985 TRACE [org.keycloak.models.cache.infinispan.RealmCacheSession] (default task-1) client by id cache hit: myclient 2019-07-26 18:11:26,985 TRACE [org.keycloak.protocol.oidc.utils.OAuth2CodeParser] (default task-1) Successfully verified code '124e5aba-eb17-4eee-b435-6faf7aaf92ae'. User session: '9634b07b-6191-4a09-85b3-507ff9dcead1', client: 'd6cce783-5559-48c1-b1b8-7f20d2fcf166' 2019-07-26 18:11:26,985 TRACE [org.keycloak.models.cache.infinispan.UserCacheSession] (default task-1) getuserById 19c4c859-e062-4528-b176-3a17caf443af 2019-07-26 18:11:26,985 TRACE [org.keycloak.models.cache.infinispan.UserCacheSession] (default task-1) getuserById 19c4c859-e062-4528-b176-3a17caf443af 2019-07-26 18:11:26,986 TRACE [org.keycloak.models.cache.infinispan.UserCacheSession] (default task-1) return managedusers 2019-07-26 18:11:26,986 DEBUG [org.keycloak.protocol.oidc.endpoints.TokenEndpoint] (default task-1) Adapter Session '562F91F71B1FFDABD7E0EE2761BA03CE-n1' saved in ClientSession for client 'myclient'. Host is 'mybox' 2019-07-26 18:11:26,986 TRACE [org.keycloak.connections.jpa.DefaultJpaConnectionProviderFactory] (default task-1) Create JpaConnectionProvider 2019-07-26 18:11:26,986 TRACE [org.keycloak.models.cache.infinispan.RealmCacheSession] (default task-1) client by id cache hit: myclient 2019-07-26 18:11:26,987 TRACE [org.keycloak.models.cache.infinispan.UserCacheSession] (default task-1) getuserById 19c4c859-e062-4528-b176-3a17caf443af 2019-07-26 18:11:26,987 TRACE [org.keycloak.models.cache.infinispan.UserCacheSession] (default task-1) return managedusers 2019-07-26 18:11:26,992 TRACE [org.keycloak.models.cache.infinispan.UserCacheSession] (default task-1) getuserById 19c4c859-e062-4528-b176-3a17caf443af 2019-07-26 18:11:26,992 TRACE [org.keycloak.models.cache.infinispan.UserCacheSession] (default task-1) return managedusers 2019-07-26 18:11:26,992 TRACE [org.keycloak.models.cache.infinispan.UserCacheSession] (default task-1) getuserById 19c4c859-e062-4528-b176-3a17caf443af 2019-07-26 18:11:26,992 TRACE [org.keycloak.models.cache.infinispan.UserCacheSession] (default task-1) return managedusers 2019-07-26 18:11:26,992 TRACE [org.keycloak.models.cache.infinispan.UserCacheSession] (default task-1) getuserById 19c4c859-e062-4528-b176-3a17caf443af 2019-07-26 18:11:26,993 TRACE [org.keycloak.models.cache.infinispan.UserCacheSession] (default task-1) return managedusers 2019-07-26 18:11:26,993 TRACE [org.keycloak.models.cache.infinispan.UserCacheSession] (default task-1) getuserById 19c4c859-e062-4528-b176-3a17caf443af 2019-07-26 18:11:26,993 TRACE [org.keycloak.models.cache.infinispan.UserCacheSession] (default task-1) return managedusers 2019-07-26 18:11:26,993 TRACE [org.keycloak.models.cache.infinispan.UserCacheSession] (default task-1) getuserById 19c4c859-e062-4528-b176-3a17caf443af 2019-07-26 18:11:26,993 TRACE [org.keycloak.models.cache.infinispan.UserCacheSession] (default task-1) return managedusers 2019-07-26 18:11:26,993 TRACE [org.keycloak.models.cache.infinispan.UserCacheSession] (default task-1) getuserById 19c4c859-e062-4528-b176-3a17caf443af 2019-07-26 18:11:26,993 TRACE [org.keycloak.models.cache.infinispan.UserCacheSession] (default task-1) return managedusers 2019-07-26 18:11:26,993 TRACE [org.keycloak.models.cache.infinispan.UserCacheSession] (default task-1) getuserById 19c4c859-e062-4528-b176-3a17caf443af 2019-07-26 18:11:26,993 TRACE [org.keycloak.models.cache.infinispan.UserCacheSession] (default task-1) return managedusers 2019-07-26 18:11:26,993 TRACE [org.keycloak.models.cache.infinispan.UserCacheSession] (default task-1) getuserById 19c4c859-e062-4528-b176-3a17caf443af 2019-07-26 18:11:26,993 TRACE [org.keycloak.models.cache.infinispan.UserCacheSession] (default task-1) return managedusers 2019-07-26 18:11:26,993 TRACE [org.keycloak.models.cache.infinispan.UserCacheSession] (default task-1) getuserById 19c4c859-e062-4528-b176-3a17caf443af 2019-07-26 18:11:26,993 TRACE [org.keycloak.models.cache.infinispan.UserCacheSession] (default task-1) return managedusers 2019-07-26 18:11:26,993 TRACE [org.keycloak.models.cache.infinispan.UserCacheSession] (default task-1) getuserById 19c4c859-e062-4528-b176-3a17caf443af 2019-07-26 18:11:26,993 TRACE [org.keycloak.models.cache.infinispan.UserCacheSession] (default task-1) return managedusers 2019-07-26 18:11:26,993 TRACE [org.keycloak.models.cache.infinispan.UserCacheSession] (default task-1) getuserById 19c4c859-e062-4528-b176-3a17caf443af 2019-07-26 18:11:26,993 TRACE [org.keycloak.models.cache.infinispan.UserCacheSession] (default task-1) return managedusers 2019-07-26 18:11:27,021 TRACE [org.keycloak.keys.DefaultKeyManager] (default task-1) Active key found: realm=myrealm kid=YWkA3p3uFbmG1gsE_9bUAVCz0K_vZjkU8U4Q-WeN4Do algorithm=RS256 use=SIG 2019-07-26 18:11:27,023 TRACE [org.keycloak.keys.DefaultKeyManager] (default task-1) Active key found: realm=myrealm kid=YWkA3p3uFbmG1gsE_9bUAVCz0K_vZjkU8U4Q-WeN4Do algorithm=RS256 use=SIG 2019-07-26 18:11:27,025 TRACE [org.keycloak.keys.DefaultKeyManager] (default task-1) Active key found: realm=myrealm kid=2f79742e-ce05-47da-baae-9e902c2ae3bf algorithm=HS256 use=SIG 2019-07-26 18:11:27,025 TRACE [org.keycloak.models.cache.infinispan.UserCacheSession] (default task-1) getuserById 19c4c859-e062-4528-b176-3a17caf443af 2019-07-26 18:11:27,025 TRACE [org.keycloak.models.cache.infinispan.UserCacheSession] (default task-1) return managedusers 2019-07-26 18:11:27,025 TRACE [org.keycloak.models.cache.infinispan.UserCacheSession] (default task-1) getuserById 19c4c859-e062-4528-b176-3a17caf443af 2019-07-26 18:11:27,025 TRACE [org.keycloak.models.cache.infinispan.UserCacheSession] (default task-1) return managedusers 2019-07-26 18:11:27,025 TRACE [org.keycloak.events] (default task-1) type= *CODE_TO_TOKEN*, realmId=308af72f-9f89-4fae-a583-b508d07b521a, clientId=myclient, userId=19c4c859-e062-4528-b176-3a17caf443af, ipAddress=10.192.226.126, client_session_host=mybox, token_id=0773e6dc-8da1-4241-9fa8-081e95916042, grant_type=authorization_code, refresh_token_type=Refresh, scope='openid profile email', client_session_state=562F91F71B1FFDABD7E0EE2761BA03CE-n1, refresh_token_id=57801953-87a2-4d3e-a4fb-5d91f2ed262f, code_id=9634b07b-6191-4a09-85b3-507ff9dcead1, client_auth_method=client-secret, requestUri= http://myhost.example.org:8080/auth/realms/myrealm/protocol/openid-connec..., cookies=[] 2019-07-26 18:11:27,025 TRACE [org.keycloak.services.resources.Cors] (default task-1) No origin header ignoring 2019-07-26 18:11:27,026 DEBUG [org.keycloak.transaction.JtaTransactionWrapper] (default task-1) JtaTransactionWrapper commit 2019-07-26 18:11:27,026 DEBUG [org.keycloak.transaction.JtaTransactionWrapper] (default task-1) JtaTransactionWrapper end 2019-07-26 18:11:27,037 TRACE [org.keycloak.connections.jpa.DefaultJpaConnectionProvider] (default task-1) DefaultJpaConnectionProvider close() 2019-07-26 18:11:27,409 DEBUG [org.keycloak.transaction.JtaTransactionWrapper] (default task-1) new JtaTransactionWrapper 2019-07-26 18:11:27,409 DEBUG [org.keycloak.transaction.JtaTransactionWrapper] (default task-1) was existing? false 2019-07-26 18:11:27,410 TRACE [org.keycloak.models.cache.infinispan.RealmCacheSession] (default task-1) realm by name cache hit: myrealm 2019-07-26 18:11:27,410 TRACE [org.keycloak.models.cache.infinispan.RealmCacheSession] (default task-1) by id cache hit: myrealm 2019-07-26 18:11:27,410 TRACE [org.keycloak.protocol.oidc.endpoints.AuthorizationEndpoint] (default task-1) Processing @GET request 2019-07-26 18:11:27,410 TRACE [org.keycloak.models.cache.infinispan.RealmCacheSession] (default task-1) client by name cache hit: myclient 2019-07-26 18:11:27,410 TRACE [org.keycloak.models.cache.infinispan.RealmCacheSession] (default task-1) client by id cache hit: myclient 2019-07-26 18:11:27,410 DEBUG [org.keycloak.protocol.oidc.endpoints.AuthorizationEndpoint] (default task-1) PKCE non-supporting Client 2019-07-26 18:11:27,410 DEBUG [org.keycloak.services.managers.AuthenticationSessionManager] (default task-1) Not found AUTH_SESSION_ID cookie 2019-07-26 18:11:27,410 DEBUG [org.keycloak.services.managers.AuthenticationSessionManager] (default task-1) Not found AUTH_SESSION_ID cookie 2019-07-26 18:11:27,410 TRACE [org.keycloak.models.sessions.infinispan.InfinispanKeycloakTransaction] (default task-1) Adding cache operation: ADD on 93ca18a6-fea5-42d5-bad9-125fd97906af 2019-07-26 18:11:27,410 DEBUG [org.keycloak.services.managers.AuthenticationSessionManager] (default task-1) Set AUTH_SESSION_ID cookie with value 93ca18a6-fea5-42d5-bad9-125fd97906af.myhost 2019-07-26 18:11:27,411 TRACE [org.keycloak.models.sessions.infinispan.InfinispanKeycloakTransaction] (default task-1) Adding cache operation: REPLACE on 93ca18a6-fea5-42d5-bad9-125fd97906af 2019-07-26 18:11:27,411 DEBUG [org.keycloak.protocol.AuthorizationEndpointBase] (default task-1) Sent request to authz endpoint. Created new root authentication session with ID '93ca18a6-fea5-42d5-bad9-125fd97906af' . Client: myclient . New authentication session tab ID: uG3knkEjbEE 2019-07-26 18:11:27,411 TRACE [org.keycloak.models.sessions.infinispan.InfinispanKeycloakTransaction] (default task-1) Adding cache operation: REPLACE on 93ca18a6-fea5-42d5-bad9-125fd97906af 2019-07-26 18:11:27,411 TRACE [org.keycloak.models.sessions.infinispan.InfinispanKeycloakTransaction] (default task-1) Adding cache operation: REPLACE on 93ca18a6-fea5-42d5-bad9-125fd97906af 2019-07-26 18:11:27,411 TRACE [org.keycloak.models.sessions.infinispan.InfinispanKeycloakTransaction] (default task-1) Adding cache operation: REPLACE on 93ca18a6-fea5-42d5-bad9-125fd97906af 2019-07-26 18:11:27,411 TRACE [org.keycloak.models.sessions.infinispan.InfinispanKeycloakTransaction] (default task-1) Adding cache operation: REPLACE on 93ca18a6-fea5-42d5-bad9-125fd97906af 2019-07-26 18:11:27,411 TRACE [org.keycloak.models.sessions.infinispan.InfinispanKeycloakTransaction] (default task-1) Adding cache operation: REPLACE on 93ca18a6-fea5-42d5-bad9-125fd97906af 2019-07-26 18:11:27,411 TRACE [org.keycloak.models.sessions.infinispan.InfinispanKeycloakTransaction] (default task-1) Adding cache operation: REPLACE on 93ca18a6-fea5-42d5-bad9-125fd97906af 2019-07-26 18:11:27,411 TRACE [org.keycloak.models.sessions.infinispan.InfinispanKeycloakTransaction] (default task-1) Adding cache operation: REPLACE on 93ca18a6-fea5-42d5-bad9-125fd97906af 2019-07-26 18:11:27,411 TRACE [org.keycloak.models.sessions.infinispan.InfinispanKeycloakTransaction] (default task-1) Adding cache operation: REPLACE on 93ca18a6-fea5-42d5-bad9-125fd97906af 2019-07-26 18:11:27,411 TRACE [org.keycloak.models.sessions.infinispan.InfinispanKeycloakTransaction] (default task-1) Adding cache operation: REPLACE on 93ca18a6-fea5-42d5-bad9-125fd97906af 2019-07-26 18:11:27,411 TRACE [org.keycloak.models.sessions.infinispan.InfinispanKeycloakTransaction] (default task-1) Adding cache operation: REPLACE on 93ca18a6-fea5-42d5-bad9-125fd97906af 2019-07-26 18:11:27,411 TRACE [org.keycloak.models.sessions.infinispan.InfinispanKeycloakTransaction] (default task-1) Adding cache operation: REPLACE on 93ca18a6-fea5-42d5-bad9-125fd97906af 2019-07-26 18:11:27,411 TRACE [org.keycloak.models.cache.infinispan.RealmCacheSession] (default task-1) client by id cache hit: myclient 2019-07-26 18:11:27,411 TRACE [org.keycloak.models.sessions.infinispan.InfinispanKeycloakTransaction] (default task-1) Adding cache operation: REPLACE on 93ca18a6-fea5-42d5-bad9-125fd97906af 2019-07-26 18:11:27,411 TRACE [org.keycloak.models.cache.infinispan.RealmCacheSession] (default task-1) client by id cache hit: myclient 2019-07-26 18:11:27,411 TRACE [org.keycloak.keys.DefaultKeyManager] (default task-1) Active key found: realm=myrealm kid=2f79742e-ce05-47da-baae-9e902c2ae3bf algorithm=HS256 use=SIG 2019-07-26 18:11:27,411 DEBUG [org.keycloak.authentication.AuthenticationProcessor] (default task-1) AUTHENTICATE 2019-07-26 18:11:27,411 DEBUG [org.keycloak.authentication.AuthenticationProcessor] (default task-1) AUTHENTICATE ONLY 2019-07-26 18:11:27,411 TRACE [org.keycloak.models.sessions.infinispan.InfinispanKeycloakTransaction] (default task-1) Adding cache operation: REPLACE on 93ca18a6-fea5-42d5-bad9-125fd97906af 2019-07-26 18:11:27,411 TRACE [org.keycloak.models.cache.infinispan.RealmCacheSession] (default task-1) client by id cache hit: myclient 2019-07-26 18:11:27,411 DEBUG [org.keycloak.authentication.DefaultAuthenticationFlow] (default task-1) processFlow 2019-07-26 18:11:27,411 DEBUG [org.keycloak.authentication.DefaultAuthenticationFlow] (default task-1) check execution: auth-cookie requirement: ALTERNATIVE 2019-07-26 18:11:27,411 DEBUG [org.keycloak.authentication.DefaultAuthenticationFlow] (default task-1) authenticator: auth-cookie 2019-07-26 18:11:27,411 DEBUG [org.keycloak.authentication.DefaultAuthenticationFlow] (default task-1) invoke authenticator.authenticate: auth-cookie 2019-07-26 18:11:27,411 DEBUG [org.keycloak.services.managers.AuthenticationManager] (default task-1) Could not find cookie: KEYCLOAK_IDENTITY 2019-07-26 18:11:27,411 DEBUG [org.keycloak.authentication.DefaultAuthenticationFlow] (default task-1) authenticator ATTEMPTED: auth-cookie 2019-07-26 18:11:27,411 TRACE [org.keycloak.models.sessions.infinispan.InfinispanKeycloakTransaction] (default task-1) Adding cache operation: REPLACE on 93ca18a6-fea5-42d5-bad9-125fd97906af 2019-07-26 18:11:27,411 DEBUG [org.keycloak.authentication.DefaultAuthenticationFlow] (default task-1) check execution: auth-spnego requirement: DISABLED 2019-07-26 18:11:27,411 DEBUG [org.keycloak.authentication.DefaultAuthenticationFlow] (default task-1) execution is processed 2019-07-26 18:11:27,411 DEBUG [org.keycloak.authentication.DefaultAuthenticationFlow] (default task-1) check execution: identity-provider-redirector requirement: ALTERNATIVE 2019-07-26 18:11:27,411 DEBUG [org.keycloak.authentication.DefaultAuthenticationFlow] (default task-1) authenticator: identity-provider-redirector 2019-07-26 18:11:27,411 DEBUG [org.keycloak.authentication.DefaultAuthenticationFlow] (default task-1) invoke authenticator.authenticate: identity-provider-redirector 2019-07-26 18:11:27,411 TRACE [org.keycloak.authentication.authenticators.browser.IdentityProviderAuthenticator] (default task-1) No default provider set or kc_idp_hint query parameter provided 2019-07-26 18:11:27,411 DEBUG [org.keycloak.authentication.DefaultAuthenticationFlow] (default task-1) authenticator ATTEMPTED: identity-provider-redirector 2019-07-26 18:11:27,411 TRACE [org.keycloak.models.sessions.infinispan.InfinispanKeycloakTransaction] (default task-1) Adding cache operation: REPLACE on 93ca18a6-fea5-42d5-bad9-125fd97906af 2019-07-26 18:11:27,411 DEBUG [org.keycloak.authentication.DefaultAuthenticationFlow] (default task-1) check execution: null requirement: ALTERNATIVE 2019-07-26 18:11:27,411 DEBUG [org.keycloak.authentication.DefaultAuthenticationFlow] (default task-1) execution is flow 2019-07-26 18:11:27,412 DEBUG [org.keycloak.authentication.DefaultAuthenticationFlow] (default task-1) processFlow 2019-07-26 18:11:27,412 DEBUG [org.keycloak.authentication.DefaultAuthenticationFlow] (default task-1) check execution: auth-username-password-form requirement: REQUIRED 2019-07-26 18:11:27,412 DEBUG [org.keycloak.authentication.DefaultAuthenticationFlow] (default task-1) authenticator: auth-username-password-form 2019-07-26 18:11:27,412 DEBUG [org.keycloak.authentication.DefaultAuthenticationFlow] (default task-1) invoke authenticator.authenticate: auth-username-password-form 2019-07-26 18:11:27,412 TRACE [org.keycloak.models.sessions.infinispan.InfinispanKeycloakTransaction] (default task-1) Adding cache operation: REPLACE on 93ca18a6-fea5-42d5-bad9-125fd97906af 2019-07-26 18:11:27,412 TRACE [org.keycloak.models.sessions.infinispan.InfinispanKeycloakTransaction] (default task-1) Adding cache operation: REPLACE on 93ca18a6-fea5-42d5-bad9-125fd97906af 2019-07-26 18:11:27,412 TRACE [org.keycloak.models.cache.infinispan.RealmCacheSession] (default task-1) client by id cache hit: myclient 2019-07-26 18:11:27,416 DEBUG [org.keycloak.authentication.DefaultAuthenticationFlow] (default task-1) authenticator CHALLENGE: auth-username-password-form 2019-07-26 18:11:27,416 TRACE [org.keycloak.models.sessions.infinispan.InfinispanKeycloakTransaction] (default task-1) Adding cache operation: REPLACE on 93ca18a6-fea5-42d5-bad9-125fd97906af 2019-07-26 18:11:27,416 TRACE [org.keycloak.models.sessions.infinispan.InfinispanKeycloakTransaction] (default task-1) Adding cache operation: REPLACE on 93ca18a6-fea5-42d5-bad9-125fd97906af 2019-07-26 18:11:27,416 DEBUG [org.keycloak.transaction.JtaTransactionWrapper] (default task-1) JtaTransactionWrapper commit 2019-07-26 18:11:27,416 DEBUG [org.keycloak.transaction.JtaTransactionWrapper] (default task-1) JtaTransactionWrapper end -- Philip Lowman

6 years, 8 months

1
0
0 / 0

Keycloak with Ping Identity OpenID Connect Provider

by Mitchell S Bowers

Hello, Is there any documentation on configuring Keycloak to use Ping as an external OIDC provider? I've used the documentation provided for Okta, which should be essentially the same. However, we are experiencing issues (specifically token issuance and logout). Any info would be greatly appreciated. https://ultimatesecurity.pro/post/okta-oidc/ Thanks - Mitchell NOTICE TO RECIPIENT: If you are not the intended recipient of this e-mail, you are prohibited from sharing, copying, or otherwise using or disclosing its contents. If you have received this e-mail in error, please notify the sender immediately by reply e-mail and permanently delete this e-mail and any attachments without reading, forwarding or saving them. Thank you.

6 years, 8 months

2
5
0 / 0

API to evict user cache

by Shetty, Shweta

Is there an admin api to evict just a single user-cache ? Shweta

6 years, 8 months

2
6
0 / 0

Configuring signing keys on a per-client basis?

by Jared Blashka

We're in the process of rotating one of our realm certificates. I'm aware that Keycloak can have multiple active and/or passive key providers configured but it looks like Keycloak will only ever use the single active key provider with the highest priority for signing. I'm pretty sure the answer is no but is there any way of configuring Keycloak to use a specific active key provider when signing for a specific client? Having that feature would make the key rotation process slightly easier if you have to coordinate the rotation timing with multiple clients that can only hardcode a single certificate/public key to trust. Jared

6 years, 8 months

1
0
0 / 0

Keycloak Google IDP Broken & wont be fixed!

by Nick Powers

I ran into an issue with Google IDP & Keycloak, where offline access cannot be requested and therefore refresh tokens cannot be received from Google. I then started researching to see if this problem have been previously identified and resolved. Although I did find find many people identifying the problem who were looking for an answer in both this mailing list and in the keycloak dev mailing list, there was no solutions in any of those messages. These questions spanned 4 years, and yet Google IDP remains broken. When the question is posed to the user group the messages are either not answered at all or don't provide any solutions. In the Keycloak dev mailing list it is discussed but in general they are dismissed, along the line of "Why would you need to use offline access?" dismissing it as a useless feature. This is a difficult answer to swallow if you need to use Google offline access with Keycloak. Especially when all it would take is to add "access_type=offline" to the Google auth UR. To be absolutely clear they devs could easily fix this, they just don't want to. So, if you have found this message, now or in the future, hoping to find a way to obtain refresh tokens from Google using Keycloak all I can do is try and spare you any more time wasted on this pursuit. Keycloak does NOT offline access for Google IDP and therefore you cannot receive refresh tokens from Google with Keycloak, and chances are that it will NEVER support it. I wish I was wrong but it doesn't appear that way. Good Luck! Nick

6 years, 8 months

2
4
0 / 0

(no subject)

by Konstantinos Dafopoulos

6 years, 8 months

1
0
0 / 0

Keycloak Gatekeeper Custom Header/Cookie

by Danny Opitz

Hi, I have Keycloak and Keycloak-Gatekeeper set up in OpenShift and it's acting as a proxy for an application. I have successfully configured Gatekeeper to redirect to Keycloak and set the access token correctly. The application that Keycloak Gatekeeper is proxying requires a custom cookie to be set so I figured I could use the Gatekeeper's custom header configuration to set this however I'm running into issues. Configuration looks like: discovery-url: https://keycloak-url.com/auth/realms/MyRealm client-id: MyClient client-secret: MyClientSecret cookie-access-name: my.token encryption_key: MY_KEY listen: :3000 redirection-url: https://gatekeeper-url.com upstream-url: https://app-url.com verbose: true resources: - uri: /home/* roles: - MyClient:general-access headers: Set-Cookie: isLoggedIn=true After re-deploying and running through the auth flow, the upstream URL/application is not receiving the custom header. I tried with multiple headers (key/value) but can't seem to get it working or find where that header is being injected in the flow. Any suggestions/ideas on how to get this working? Thanks, Dan

6 years, 8 months

1
0
0 / 0

Keycloak Registration Flow: do not expose "Email already exists."

by Borislav Sirakov

Hi, My purpose is to entirely remove the "Email already exists." validation from the registration flow. That way I want to prevent exposing any information (to the other users) who is registered and who is not. So, when the user tries to register with an existing email I want to redirect him to the email validation template immediately, that way I want to make him think that he is registered. Meanwhile keycloak must not create a new user or update the user profile at all, it has to skip these steps. I have tried the FormActionFactory and FormAction interfaces, but just changing the validation and success methods doesn't seem enough. Any suggestions how to override the last step which actually sets the user into the storage and sends a verification email and instead of that just redirect the user to the verify email page? Is it possible? Other suggestions, solutions how to achieve described effect (or other way to prevent exposing that info) are welcomed. Thank you! Regards, Borislav

6 years, 8 months

1
0
0 / 0

Support for MongoDB

by Federico Punzo

Hi, I'm evaluating using MongoDB as the persistence database for a big KeyCloak deployment. However, it appears that currently MongoDB is not supported. Would you please confirm? Thanks! Federico Punzo | Tech Director - BigData Studio GLOBANT UY: +598 2 927 2270 ext. 37071 | US: +1 877 215 5230 ext. 37071 <https://www.facebook.com/Globant> <http://www.twitter.com/globant> <http://www.linkedin.com/company/globant> <http://www.globant.com/> -- The information contained in this e-mail may be confidential. It has been sent for the sole use of the intended recipient(s). If the reader of this message is not an intended recipient, you are hereby notified that any unauthorized review, use, disclosure, dissemination, distribution or copying of this communication, or any of its contents, is strictly prohibited. If you have received it by mistake please let us know by e-mail immediately and delete it from your system. Many thanks. La información contenida en este mensaje puede ser confidencial. Ha sido enviada para el uso exclusivo del destinatario(s) previsto. Si el lector de este mensaje no fuera el destinatario previsto, por el presente queda Ud. notificado que cualquier lectura, uso, publicación, diseminación, distribución o copiado de esta comunicación o su contenido está estrictamente prohibido. En caso de que Ud. hubiera recibido este mensaje por error le agradeceremos notificarnos por e-mail inmediatamente y eliminarlo de su sistema. Muchas gracias.

6 years, 8 months

1
0
0 / 0

On the gateway, the Keycloak adapter (KeycloakWebSecurityConfigurerAdapter) skips the token after the user logs off

by Al

On the gateway, the Keycloak adapter (KeycloakWebSecurityConfigurerAdapter) skips the token after the user logs off: 1. User entered the application. Session is active. Remember the token (Authorization: bearer) 2. The user exits the application (keycloak.logout()). No session in keycloak. 3. Make a request to auth/realms/realm/account with the saved token. No access. Good. 4. Make a request to the resource through the gateway (KeycloakWebSecurityConfigurerAdapter) with the saved token - there is access. Bug!? Shouldn't this check the KeycloakWebSecurityConfigurerAdapter by default? How to make gateway not to pass the token after keycloak.logout()? ----------------

6 years, 8 months

1
0
0 / 0

Fwd: Keycloak 4.4.0 - WFLYSRV0056: Server boot has failed in an unrecoverable manner

by Gerard Habchi

Hey All, I'm running into a strange issue trying to run keycloak version 4.4.0 in docker... Please see errors below; I'm not really sure why this is occurring ¯\_(ツ)_/¯ 2019-07-24 05:59:44,892 DEBUG [org.jboss.as.config] (MSC service thread 1-1) VM Arguments: -D[Standalone] -Xms64m -Xmx512m -XX:MetaspaceSize=96M -XX:MaxMetaspaceSize=256m -Djava.net.preferIPv4Stack=true -Djboss.modules.system.pkgs=org.jboss.byteman -Djava.awt.headless=true -Dorg.jboss.boot.log.file=/opt/jboss/keycloak/standalone/log/server.log -Dlogging.configuration=file:/opt/jboss/keycloak/standalone/configuration/logging.properties 2019-07-24 05:59:45,105 INFO [org.jboss.vfs] (MSC service thread 1-3) VFS000002: Failed to clean existing content for temp file provider of type temp. Enable DEBUG level log to find what caused this 2019-07-24 05:59:46,976 INFO [org.jboss.as.controller] (Controller Boot Thread) OPVDX002: Failed to pretty print validation error: null 2019-07-24 05:59:46,978 ERROR [org.jboss.as.server] (Controller Boot Thread) WFLYSRV0055: Caught exception during boot: org.jboss.as.controller.persistence.ConfigurationPersistenceException: WFLYCTL0085: Failed to parse configuration at org.jboss.as.controller.persistence.XmlConfigurationPersister.load(XmlConfigurationPersister.java:143) at org.jboss.as.server.ServerService.boot(ServerService.java:377) at org.jboss.as.controller.AbstractControllerService$1.run(AbstractControllerService.java:372) at java.lang.Thread.run(Thread.java:748) Caused by: javax.xml.stream.XMLStreamException: WFLYCTL0083: Failed to load module org.jboss.as.clustering.infinispan at org.jboss.as.controller.parsing.DeferredExtensionContext.load(DeferredExtensionContext.java:100) at org.jboss.as.server.parsing.StandaloneXml_5.readServerElement(StandaloneXml_5.java:203) at org.jboss.as.server.parsing.StandaloneXml_5.readElement(StandaloneXml_5.java:124) at org.jboss.as.server.parsing.StandaloneXml.readElement(StandaloneXml.java:111) at org.jboss.as.server.parsing.StandaloneXml.readElement(StandaloneXml.java:52) at org.jboss.staxmapper.XMLMapperImpl.processNested(XMLMapperImpl.java:122) at org.jboss.staxmapper.XMLMapperImpl.parseDocument(XMLMapperImpl.java:76) at org.jboss.as.controller.persistence.XmlConfigurationPersister.load(XmlConfigurationPersister.java:126) ... 3 more Caused by: java.util.concurrent.ExecutionException: javax.xml.stream.XMLStreamException: WFLYCTL0083: Failed to load module at java.util.concurrent.FutureTask.report(FutureTask.java:122) at java.util.concurrent.FutureTask.get(FutureTask.java:192) at org.jboss.as.controller.parsing.DeferredExtensionContext.load(DeferredExtensionContext.java:92) ... 10 more Caused by: javax.xml.stream.XMLStreamException: WFLYCTL0083: Failed to load module at org.jboss.as.controller.parsing.DeferredExtensionContext.loadModule(DeferredExtensionContext.java:129) at org.jboss.as.controller.parsing.DeferredExtensionContext.access$000(DeferredExtensionContext.java:44) at org.jboss.as.controller.parsing.DeferredExtensionContext$1.call(DeferredExtensionContext.java:74) at org.jboss.as.controller.parsing.DeferredExtensionContext$1.call(DeferredExtensionContext.java:71) at java.util.concurrent.FutureTask.run(FutureTask.java:266) at org.jboss.threads.ContextClassLoaderSavingRunnable.run(ContextClassLoaderSavingRunnable.java:35) at org.jboss.threads.EnhancedQueueExecutor.safeRun(EnhancedQueueExecutor.java:1985) at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.doRunTask(EnhancedQueueExecutor.java:1487) at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1349) at java.lang.Thread.run(Thread.java:748) at org.jboss.threads.JBossThread.run(JBossThread.java:485) Caused by: org.jboss.modules.ModuleLoadException: Error loading module from /opt/jboss/keycloak/modules/system/layers/base/org/jgroups/main/module.xml at org.jboss.modules.xml.ModuleXmlParser.parseModuleXml(ModuleXmlParser.java:314) at org.jboss.modules.xml.ModuleXmlParser.parseModuleXml(ModuleXmlParser.java:270) at org.jboss.modules.xml.ModuleXmlParser.parseModuleXml(ModuleXmlParser.java:231) at org.jboss.modules.LocalModuleFinder.parseModuleXmlFile(LocalModuleFinder.java:250) at org.jboss.modules.LocalModuleFinder.lambda$findModule$1(LocalModuleFinder.java:195) at java.security.AccessController.doPrivileged(Native Method) at org.jboss.modules.LocalModuleFinder.findModule(LocalModuleFinder.java:195) at org.jboss.modules.ModuleLoader.findModule0(ModuleLoader.java:693) at org.jboss.modules.ModuleLoader.findModule(ModuleLoader.java:686) at org.jboss.modules.ModuleLoader.loadModuleLocal(ModuleLoader.java:496) at org.jboss.modules.DelegatingModuleLoader.preloadModule(DelegatingModuleLoader.java:57) at org.jboss.modules.Module.addPaths(Module.java:1252) at org.jboss.modules.Module.link(Module.java:1622) at org.jboss.modules.Module.relinkIfNecessary(Module.java:1650) at org.jboss.modules.ModuleLoader.loadModule(ModuleLoader.java:296) at org.jboss.modules.ModuleLoader.loadModule(ModuleLoader.java:280) at org.jboss.as.controller.parsing.DeferredExtensionContext.loadModule(DeferredExtensionContext.java:111) ... 10 more Caused by: org.jboss.modules.xml.XmlPullParserException: Failed to add resource root 'jgroups-3.6.13.Final.jar' at path 'jgroups-3.6.13.Final.jar' (position: END_TAG seen ...esources>\n <resource-root path="jgroups-3.6.13.Final.jar"/>... @32:57) caused by: java.io.FileNotFoundException: /opt/jboss/keycloak/modules/system/layers/base/org/jgroups/main/jgroups-3.6.13.Final.jar (No such file or directory) at org.jboss.modules.xml.ModuleXmlParser.parseResourceRoot(ModuleXmlParser.java:1091) at org.jboss.modules.xml.ModuleXmlParser.parseResources(ModuleXmlParser.java:906) at org.jboss.modules.xml.ModuleXmlParser.parseModuleContents(ModuleXmlParser.java:680) at org.jboss.modules.xml.ModuleXmlParser.parseDocument(ModuleXmlParser.java:441) at org.jboss.modules.xml.ModuleXmlParser.parseModuleXml(ModuleXmlParser.java:312) ... 26 more Caused by: java.io.FileNotFoundException: /opt/jboss/keycloak/modules/system/layers/base/org/jgroups/main/jgroups-3.6.13.Final.jar (No such file or directory) at java.util.zip.ZipFile.open(Native Method) at java.util.zip.ZipFile.<init>(ZipFile.java:225) at java.util.zip.ZipFile.<init>(ZipFile.java:155) at java.util.jar.JarFile.<init>(JarFile.java:166) at java.util.jar.JarFile.<init>(JarFile.java:145) at org.jboss.modules.xml.JDKSpecific.getJarFile(JDKSpecific.java:33) at org.jboss.modules.xml.ModuleXmlParser$DefaultResourceRootFactory.createResourceLoader(ModuleXmlParser.java:1591) at org.jboss.modules.LocalModuleFinder.lambda$new$0(LocalModuleFinder.java:103) at org.jboss.modules.xml.ModuleXmlParser.parseResourceRoot(ModuleXmlParser.java:1089) ... 30 more 2019-07-24 05:59:46,982 FATAL [org.jboss.as.server] (Controller Boot Thread) WFLYSRV0056: Server boot has failed in an unrecoverable manner; exiting. See previous messages for details. 2019-07-24 05:59:47,028 INFO [org.jboss.as] (MSC service thread 1-2) WFLYSRV0050: Keycloak 4.4.0.Final (WildFly Core 5.0.0.Final) stopped in 15ms Gerard Habchi *DevOps Engineer* ghabchi(a)console.com.au | 1300 131 311 AU 1300 131 311 | NZ 0508 641 199 Console| console.com.au <http://www.console.com.au?utm_source=signaturesatori&utm_medium=email&utm...> Head Office Level 2 200 Adelaide Street Brisbane QLD 4000 <http://www.twitter.com/consoleau> <http://www.facebook.com/consoleau> <https://www.linkedin.com/company/console-australia-new-zealand> ------------------------------ <https://consolegroup.zoom.us/webinar/register/9715590027745/WN_FrkgwzGvQ7...>

6 years, 8 months

1
0
0 / 0

CORS Headers not present on OPTIONS request

by David Leonard

Hello everyone, We're running a Keycloak 6.0.1 cluster running in kubernetes, and we're running into issues with CORS requests by Kibana as a part of refreshing the access token. Here is the situation 1. User logs into the SP and is able to successfully authenticate. 2. The users token expires in the background. 3. The SP notices this expired token, and attempts to refresh the token starting to issue an auth request to Keycloak. It issues an 'OPTIONS' request to determine what it can perform, and this request is missing headers. Here is the full output sample from curl: [jboss@keycloak-dev-0 ~]$ curl ' http://127.0.0.1:8080/auth/realms/globalauth/protocol/openid-connect/auth...' -X OPTIONS -H 'User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0' -H 'Accept: */*' -H 'Accept-Language: en- US,en;q=0.5' --compressed -H 'Access-Control-Request-Method: GET' -H 'Access-Control-Request-Headers: content-type,kbn-version' -H 'Referer: https://kibana.[[SPURL]]/app/kibana' -H 'Origin: https://[[SPURL]]' -H 'Connection: keep-alive' -H 'Host: [[IDPURL]]' -v * About to connect() to 127.0.0.1 port 8080 (#0) * Trying 127.0.0.1... * Connected to 127.0.0.1 (127.0.0.1) port 8080 (#0) > OPTIONS /auth/realms/globalauth/protocol/openid- connect/auth?client_id=fps- demo&response_type=code&redirect_uri=https%3A%2F%2F[[SPURL]]%2Fauth%2Fo penid%2Flogin&state=hP95iVphOxSnWk0tkjE2rg&scope=openid%20profile%20ema il%20address%20phone HTTP/1.1 > Accept-Encoding: deflate, gzip > User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0 > Accept: */* > Accept-Language: en-US,en;q=0.5 > Access-Control-Request-Method: GET > Access-Control-Request-Headers: content-type,kbn-version > Referer: https://[[SPURL]]/app/kibana > Origin: https://[[SPURL]] > Connection: keep-alive > Host: [[IDPURL]] > < HTTP/1.1 204 No Content < Date: Tue, 23 Jul 2019 20:38:39 GMT < * Connection #0 to host 127.0.0.1 left intact [jboss@keycloak-dev-0 ~]$ Here is the configuration of the client, the "Web Origins" item has been set to the specific origin, +, and *. The result is the same across all. { "clientId": "fps-demo", "surrogateAuthRequired": false, "enabled": true, "clientAuthenticatorType": "client-secret", "redirectUris": [ "https://kibana.[[SPURL]]" ], "webOrigins": [ "+" ], "notBefore": 0, "bearerOnly": false, "consentRequired": false, "standardFlowEnabled": true, "implicitFlowEnabled": false, "directAccessGrantsEnabled": true, "serviceAccountsEnabled": false, "publicClient": false, "frontchannelLogout": false, "protocol": "openid-connect", "attributes": { "saml.assertion.signature": "false", "saml.multivalued.roles": "false", "saml.force.post.binding": "false", "saml.encrypt": "false", "saml.server.signature": "false", "saml.server.signature.keyinfo.ext": "false", "exclude.session.state.from.auth.response": "false", "saml_force_name_id_format": "false", "saml.client.signature": "false", "tls.client.certificate.bound.access.tokens": "false", "saml.authnstatement": "false", "display.on.consent.screen": "false", "saml.onetimeuse.condition": "false" }, "authenticationFlowBindingOverrides": {}, "fullScopeAllowed": false, "nodeReRegistrationTimeout": -1, "protocolMappers": [ { "name": "client roles", "protocol": "openid-connect", "protocolMapper": "oidc-usermodel-client-role-mapper", "consentRequired": false, "config": { "multivalued": "true", "userinfo.token.claim": "false", "id.token.claim": "true", "access.token.claim": "true", "claim.name": "roles", "jsonType.label": "String", "usermodel.clientRoleMapping.clientId": "fps-demo" } }, { "name": "allowed web origins", "protocol": "openid-connect", "protocolMapper": "oidc-allowed-origins-mapper", "consentRequired": false, "config": {} } ], "defaultClientScopes": [ "web-origins", "role_list", "profile", "roles", "email" ], "optionalClientScopes": [ "address", "phone", "offline_access" ], "access": { "view": true, "configure": true, "manage": true } } Help is appreciated. We've tried multiple different combinations of configs with no success. Thanks! David This message contains information that may be confidential, privileged or otherwise protected by law from disclosure. It is intended for the exclusive use of the addressee(s) and only the addressee or authorized agent of the addressee may review, copy, distribute or disclose to anyone the message or any information contained within. If you are not the addressee, please contact the sender by electronic reply and immediately delete all copies of the message. This message is not an offer capable of acceptance, does not create an obligation of any kind and no recipient may rely on this message.

6 years, 8 months

2
1
0 / 0

Questions about scope-permissions and resource types

by Álvaro Gómez

Hi, We are using UMA and scope-permissions to manage fine grained access to resources. We've noticed that we can specify a set of involved resources when defining scope-permissions (The UI only supports specifying a single resource but the API allows defining a set of resources). Referencing the involved resources in a scope-permission using a fixed list could be problematic if the size of that list is big enough. We think it would be useful to group all the resources using a resource-type and specify that resource-type in the scope-permission as one can do in a resource-permission. Is there any reason why this is not supported in a scope-permission? Having a resource type reference available in scope-permissions would be useful solving the following scenario: * Given a large amount of bank accounts, each one represented by a resource (associated with some scopes like read, update or delete) in the Resource Server and owned by an specific user. * Users can manage their own accounts following the UMA rules (Sharing specific scopes of their accounts with other users). * Some user with an Administrator role should be able to read ALL accounts without having them shared with him and without needing to update any permission when a new bank account is created. We would like to "group" all accounts using a resource-type and define a single permission "can-read-bank-account" which grants access to the scope read of all bank accounts to the owner (via JS policy) and to any administrator user (using a role policy). If we protect the following endpoint: GET /accounts/3273af-544b3940-211da3 , using the resource "bank-account-3273af-544b3940-211da3" and the scope "read", both the resource owner and the Administrator user must be granted when evaluating the permission "can-read-bank-account".

6 years, 8 months

2
4
0 / 0

Uncaught server error: java.lang.NoClassDefFoundError: org/keycloak/services/validation/Validation

by Bo.Y＠dell.com

Hi Experts, When I follow https://www.keycloak.org/docs/latest/server_development/index.html#packag... step by step to do customize the validation in keycloak. After I throw my jar into standalone/deployment, it creates a deployed file and the log shows the jar is deployed. I can found my execution in keycloak admin console which shows in the screen shot below. But when it comes to register page, after I click register button with my filled content I got exception in keycloak log file. I also checked `standalone.xml` and `jboss-deployment-structure.xml` which seems fine too which means it include "keycloak-services-4.7.0.Final.jar". I don't find any useful information in the search. So could anyone help to have a look please? Keycloak version: compile group: 'org.keycloak', name: 'keycloak-core', version: '4.7.0.Final' compile group: 'org.keycloak', name: 'keycloak-server-spi', version: '4.7.0.Final' compile group: 'org.keycloak', name: 'keycloak-server-spi-private', version: '4.7.0.Final' compile group: 'org.keycloak', name: 'keycloak-services', version: '4.7.0.Final' [Screen Shot] [cid:image003.jpg@01D53D9A.DBB94DF0] [Exception] 09:04:01,128 ERROR [org.keycloak.services.error.KeycloakErrorHandler] (default task-35) Uncaught server error: java.lang.NoClassDefFoundError: org/keycloak/services/validation/Validation at com.xxxxxx.registerformcustom.validate(registerformcustom.java:51) at org.keycloak.authentication.FormAuthenticationFlow.processAction(FormAuthenticationFlow.java:214) at org.keycloak.authentication.DefaultAuthenticationFlow.processAction(DefaultAuthenticationFlow.java:97) at org.keycloak.authentication.AuthenticationProcessor.authenticationAction(AuthenticationProcessor.java:873) at org.keycloak.services.resources.LoginActionsService.processFlow(LoginActionsService.java:292) at org.keycloak.services.resources.LoginActionsService.processRegistration(LoginActionsService.java:627) at org.keycloak.services.resources.LoginActionsService.registerRequest(LoginActionsService.java:681) at org.keycloak.services.resources.LoginActionsService.processRegister(LoginActionsService.java:661) at sun.reflect.GeneratedMethodAccessor1030.invoke(Unknown Source) at sun.reflect.DelegatingMethodAccessorImpl.invoke(Delegati

6 years, 8 months

2
3
0 / 0

Forbidden 403

by Nicola Messina

Hi, i'm trying to recreate the photoz-uma-example, so, on keycloak i created two client, resource and assigned permission, created JAX-RS server and created an HTML5 & plain Javascript client (not AngularJS, i dont know angular), so, if i use the policy based on user role, everything goes well, i can create resource, view resource, view shared resource, but wen i use the "Owner only policy" in javascript, i obtain ever the 403 Forbidden. what am I doing wrong? I think I'm wrong in the client, but I don't understand what I have to send to keycloak server. I'm doing this, should be enough? authorizationRequest.ticket = ticket; // send the authorization request, if successful retry the request identity.authorization.authorize(authorizationRequest).then(function (rpt) I'll have some stupid things wrong Thanks in advance.

6 years, 8 months

1
0
0 / 0

Define custom roles for different companies

by jim lim

Hi, I'm currently evaluating whether or not Keycloak's authorization service is a good option for us. My question is regarding RBAC. I want to allow users to be able to define custom roles. There are two models - companies and users. Each company has their own set of users. Is there a way to separate the roles by company? I want to display a list of roles defined by a company so that when an admin needs to assign a role to a user, they won't be assigning roles defined by another company. For example, if role1 were defined by company1 and role2 were defined by company2, I can only assign role1 to users from company1 and role2 to users from company2.

6 years, 8 months

1
0
0 / 0

Trust between two standalone Keycloak Instances

by Aditya Bhole

Hello, I’m new to Keycloak and building a prototype SSO framework for my company. The use case is that my company has 3 clients; A, B and C. Now each client is going to have its own Keycloak instance; KA, KB and KC. Now what I want is when I login through client A I should be logged into client B and C as well. And same goes for all the clients. So for this to happen, is there a way of establishing trust between these three Keycloak instances KA, KB and KC? I’ve successfully established an SSO by using KA as a broker and KB as an IDP. But this is only a master slave kind-of an architecture. When I log in to A, I’m automatically logged into B. But if I log into B, I won’t be automatically logged into A. Is it possible for KA to be a broker for KB and KB to be a broker for KA at the same time? TL;DR : Is there a way where Keycloak only acts as a broker and trust is established between multiple such Keycloak instances? I hope my question makes sense. Please point me in the right direction if I’m looking at this in the wrong way. Thanks, Aditya

6 years, 8 months

3
6
0 / 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

keycloak-user July 2019