July 2019 - keycloak-user - Jboss List Archives

Token store cookie too slow for large tokens?

by Erwin de Wolff

Hi, I've configured wildfly 16 with keycloak 6.0.1 with token-store cookie. Everything works fine, until the number of roles of increased to 30+. It appears that the check if the token exists fails direct after the successful authentication and a new authentication is started etc. Resulting in a too many redirections error in the browser. Is this a known issue? Using wildfly 10.1 and keycloak 4.8.3 results in an out of memory exception NIO. Best Regards

6 years, 9 months

2
1
0 / 0

realm-management client role "view-realm" needed to view/edit a user?

by EXTERNAL Weimer Benjamin (TNG, INST-CSS/BSV-OS2)

Hi all, we are using fine grain permissions in Keycloak to set the rights to edit certain users and have noticed that the roles "manage-users" and "query-realm" of the "realm-management" client are not sufficient to view and edit single users. The "view-realm" role seems to be needed for that. Can you explain me why this role is needed for this action? Best regards and thanks in advance Benjamin Weimer

6 years, 9 months

4
6
0 / 0

Create users in the imported real using helm

by Mathew George

Hello, I am using keycloak helm charts for installing keycloak in our cluster and I am able to import a custom realm as described in the documentation. Now I want to create some users in this custom realm. I tried using the 'prestartScript'. See the contents of my value.yaml extraVolumes: | - name: realm-secret secret: secretName: realm-secret extraVolumeMounts: | - name: realm-secret mountPath: "/realm/" readOnly: true extraArgs: -Dkeycloak.import=/realm/realmData.json preStartScript: | /opt/jboss/keycloak/bin/kcadm.sh create users -r MyCustomRealm -s username=admin -s enabled=true;/opt/jboss/keycloak/bin/kcadm.sh set-password -r MyCustomRealm --username admin --new-password admin; enabled: false But this is not working. I also tried the following command in the 'preStartScript'. ( This is also not working) /opt/jboss/keycloak/bin/add-user-keycloak.sh -r MyCustomRealm -u admin -p admin Kindly provide inputs. Best regards [cid:image001.png@01D54069.121BC050] Mathew George Experiment Software ECTA dSPACE GmbH Rathenaustraße 26 33102 Paderborn Tel.: +49 5251 1638-507 Fax: +49 5251 16198-0 Mail: mgeorge(a)dspace.de<mailto:mgeorge@dspace.de> Web: www.dspace.com<http://www.dspace.com> We comply with our obligation to inform you about data protection according to Art. 13-14 of the GDPR by publishing said information on our website. Read our data protection regulations here<https://www.dspace.com/en/pub/home/privacypolicy.cfm>.

6 years, 9 months

2
2
0 / 0

How to increase logging authenticating against remote IdP

by BOOTH Stephen

I'm trying to get keycloak to use an existing application as an Idp by writing just enough oidc to allow keycloak to authenticate but I'm having difficulty debugging as keycloak is not very informative when its not happy with a response from the IdP Pretty much the only info I'm getting is "Invalid Request" 13:06:51,042 WARN [org.keycloak.events] (default task-2) type=IDENTITY_PROVIDER_LOGIN_ERROR, realmId=openidctest, clientId=null, userId=null, ipAddress=127.0.0.1, error=invalidRequestMessage 13:06:51,042 ERROR [org.keycloak.services.resources.IdentityBrokerService] (default task-2) invalidRequestMessage I can see my authorization token and userinfo endpoints being called (userinfo is not called if I disable this in the keycloak settings) Does anyone have any tips on how to get more debugging info out of keycloak other than attaching a debugger and trying to single step through. Stephen -- ====================================================================== |epcc| Dr Stephen P Booth Principal Architect |epcc| |epcc| s.booth(a)epcc.ed.ac.uk Phone 0131 650 5746 |epcc| ====================================================================== -- The University of Edinburgh is a charitable body, registered in Scotland, with registration number SC005336.

6 years, 9 months

1
0
0 / 0

keycloak-nodejs-connect: ERR_TOO_MANY_REDIRECTS

by Hadidi, Lars

I set up a NodeJS Server to use the keycloak-connect module: // Setup keycloak to use the session memoryStore var memoryStore = new SESSION.MemoryStore(); var keycloak = new KEYCLOAK({ store: memoryStore }); // Set up a server instance and create a session middleware const APP = EXPRESS(); APP.use(SESSION({ secret: CRYPTO.randomBytes(512).toString('hex'), resave: false, saveUninitialized: true, store: memoryStore })); // Default route handler APP.get('/login', keycloak.protect(), function(req, res) { ...some custom logic, involving AXIOS XHR stuff ...getting tokens from REST endpoints res.redirect('/app/html/createCustomer?' + QUERYSTRING.encode({'tokenId': tokenID})); } APP.use(keycloak.middleware( { logout: '/logout'})); // Start servers HTTP.createServer(APP).listen(CONF.serverPort, CONF.serverInterface, () => console.log('Server listening on %s:%d', CONF.serverInterface, CONF.serverPort)); The CONF objects holds CONF.serverPort=9080 and CONF.serverInterface=127.0.0.1 The keycloak.json reads { "realm": "app-realm", "auth-server-url": "https://192.168.32.132/auth", "ssl-required": "external", "resource": "app-client", "public-client": true, "confidential-port": 0 } Both NodeJS and Keycloak Docker Container are binding to 127.0.0.1, living behind an nginx revrse proxy. The nginx reverse proxy uses TLS and terminates all HTTPS, sending all traffic to those upstream servers via plain HTTP. The configuration of nginx reads server { listen 80; listen [::]:80; server_name 192.168.32.132; return 301 https://$server_name$request_uri; } server { listen 443 ssl; listen [::]:443 ssl; server_name 192.168.32.132; ssl_certificate /etc/ssl/private/fullchain.pem; ssl_certificate_key /etc/ssl/private/privkey.pem; ssl_protocols TLSv1 TLSv1.1 TLSv1.2; location /login { proxy_pass http://127.0.0.1:9080; proxy_set_header Host $host; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; } location /auth { proxy_pass http://127.0.0.1:8080; proxy_set_header Host $host; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; } location /app { rewrite ^/app(.*)$ $1 last; proxy_pass http://127.0.0.1:7080; proxy_set_header Host $host; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; } } Additionally, the following lines are added for EVERY location block: proxy_set_header X-Forwarded-Host $host; proxy_set_header X-Forwarded-Server $host; proxy_set_header X-Forwarded-Port $server_port; proxy_buffer_size 128k; proxy_buffers 4 256k; proxy_busy_buffers_size 256k; There is a realm, a client with redirect URIs set to WILDCARD and one user. Accessing route /login always leads to a redirect loop. Following the HTTP stream via WireShark yields these results: GET /login HTTP/1.1 Host: 192.168.32.132 Upgrade-Insecure-Requests: 1 HTTP/1.1 301 Moved Permanently Server: nginx Location: https://192.168.32.132/login Strict-Transport-Security: max-age=31536000; includeSubdomains; GET /login?auth_callback=1&state=eb22b4f5-e262-4deb-8e7d-f483ec1af553&session_state=9759ce64-400e-4e53-8cf5-613b2409a1c1&code=854efde1-71dc-4052-a0ad-7503ea3af7e4.9759ce64-400e-4e53-8cf5-613b2409a1c1.c00e43ce-79c2-48ee-8b92-639a6c9ade44 HTTP/1.1 Host: 192.168.32.132 Cache-Control: max-age=0 Upgrade-Insecure-Requests: 1 Cookie: connect.sid=s%3AhkFnuXd3uHPZym3mvFd2v6v2_bEmOYCm.jAeQvvN%2FZP7%2F9hV77wBI80pi%2B7T9CJo4LENc9kF5eSc HTTP/1.1 301 Moved Permanently Server: nginx Location: https://192.168.32.132/login?auth_callback=1&state=eb22b4f5-e262-4deb-8e7... Strict-Transport-Security: max-age=31536000; includeSubdomains; GET /login?auth_callback=1&state=eb22b4f5-e262-4deb-8e7d-f483ec1af553&session_state=9759ce64-400e-4e53-8cf5-613b2409a1c1&code=854efde1-71dc-4052-a0ad-7503ea3af7e4.9759ce64-400e-4e53-8cf5-613b2409a1c1.c00e43ce-79c2-48ee-8b92-639a6c9ade44&auth_callback=1&state=30d7d290-e967-488d-887c-b6eec1cc5d27&session_state=9759ce64-400e-4e53-8cf5-613b2409a1c1&code=089d3ff9-702f-430c-9e97-f0aa5b9ae0a3.9759ce64-400e-4e53-8cf5-613b2409a1c1.c00e43ce-79c2-48ee-8b92-639a6c9ade44 HTTP/1.1 Host: 192.168.32.132 Cache-Control: max-age=0 Upgrade-Insecure-Requests: 1 Cookie: connect.sid=s%3AhkFnuXd3uHPZym3mvFd2v6v2_bEmOYCm.jAeQvvN%2FZP7%2F9hV77wBI80pi%2B7T9CJo4LENc9kF5eSc HTTP/1.1 301 Moved Permanently Server: nginx Location: https://192.168.32.132/login?auth_callback=1&state=eb22b4f5-e262-4deb-8e7... Strict-Transport-Security: max-age=31536000; includeSubdomains; GET /login?auth_callback=1&state=eb22b4f5-e262-4deb-8e7d-f483ec1af553&session_state=9759ce64-400e-4e53-8cf5-613b2409a1c1&code=854efde1-71dc-4052-a0ad-7503ea3af7e4.9759ce64-400e-4e53-8cf5-613b2409a1c1.c00e43ce-79c2-48ee-8b92-639a6c9ade44&auth_callback=1&state=30d7d290-e967-488d-887c-b6eec1cc5d27&session_state=9759ce64-400e-4e53-8cf5-613b2409a1c1&code=089d3ff9-702f-430c-9e97-f0aa5b9ae0a3.9759ce64-400e-4e53-8cf5-613b2409a1c1.c00e43ce-79c2-48ee-8b92-639a6c9ade44&auth_callback=1&state=d60d22a4-7098-4f6c-8974-0fd98d65d247&session_state=9759ce64-400e-4e53-8cf5-613b2409a1c1&code=27f41194-4dda-412c-b35c-f3e4ad9f987a.9759ce64-400e-4e53-8cf5-613b2409a1c1.c00e43ce-79c2-48ee-8b92-639a6c9ade44 HTTP/1.1 Host: 192.168.32.132 etc. What is the problem with the server setup ?

6 years, 9 months

1
0
0 / 0

Core Services Without UI & Local Unix Users

by Aditya Bhole

Hi, We are building an SSO framework for our company products using Keycloak and want to use our existing UI and flow for login. Is there a way to deploy Keycloak without using any of its UI components (Login Screen and Admin Console) and still use all the core services such as authentication, authorization, managing user storage etc. Also, we want to authenticate the Unix local users via Keycloak. Is there any way to do this? Or is there any workaround that you can suggest for the same? Regards, Aditya Bhole

6 years, 9 months

2
3
0 / 0

Can I get a google offline refresh tokens or not? PLEASE

by Nick Powers

Hello, I am setup with Keycloak & Gatekeeper and my users are able to authenticate with Google and I can retrieve the access token from Google but I cannot receive a refresh token, apparently because Keycloak is not adding ?access_type=offline to the Google authentication URL. Is it even possible to get a refresh token from Google while using Keycloak? It's is very difficult to search for Keycloak related items on Google because the results are littered with 404 pages from previous versions of Keycloak that I guess have since been deleted. But, most of what I have found related to getting refresh tokens from Google end up being frustrated people not getting an answer or people discussing how "someday" it "might" be implemented. These go back years. >From what little I have been able to find, It seems offline access to Google Identify Provider has never worked for Keycloak. I hope that is not true, it seems like a simple thing to add the option of appending ?access_type=offline to the Google authentication URL. I know it may sound like nothing to someone not needing this feature but for me if I cannot get the Google refresh tokens from Google with Keycloak then I cannot use Keycloak. I am not alone in wanting this, the archives of this mailing list and Google search results have LOTS of people looking to do the same thing. PLEASE PLEASE PLEASE can someone PLEASE tell me what I need to do to get a refresh token from Google???? I don't want to have to hard code ?access_type=offline into the URL in the source code if I don't have to. Do any RedHat people monitor this mailing list? Can I purchase a support ticket from RedHat to get support on KeyCloak? I really need to get this working. Thanks, Nick

6 years, 9 months

1
0
0 / 0

Reg: Multiple Login Behaviour.

by Prasad Kris

Greetings, How does KeyCloak oidc sessions behave if we sign in from more than one device on the same account? for example, I am logging in from my Laptop and Desktop using the same account, but I am getting logged out from the old device (it redirects to the login screen) soon after I sign-in from the second device, Is this an expected behaviour? If yes, Is there a way by which we can keep both sessions active so that we don't have to re-login frequently. Cheers, Prasad

6 years, 9 months

1
0
0 / 0

Identity Providers (Google) where are the tokens?

by Nick Powers

Hello, I have configured Keycloak to authenticate users using Google as an identity provider and it works for basic authentication. I have set Default Scopes to https://www.googleapis.com/auth/youtube.force-ssl, a Google scope for accessing the YouTube API. This is obviously getting communicated to Google because when I do authenticate Google prompts me for the YouTube permissions. But, I am not seeing the Google access/refresh tokens in the logs (I have configured logging for org.keycloak.social.user_profile_dump to DEBUG). Logs pasted below. My original plan was to examine the DEBUG logs to learn the structure of the data and then use a Mapper to gain access to that data but now I am at a loss because Google's access/refresh tokens are not in the log. I think I must be missing something. HELP! :) Below is what I am seeing in the logs. I get the user info but not the tokens. :( 23:19:50,259 DEBUG [org.keycloak.social.user_profile_dump] (default task-95) User Profile JSON Data for provider google: {"sub":"116437238580102652286","name":"Nick Powers","given_name":"Nick","family_name":"Powers","picture":" https://lh3.googleusercontent.com/-zeavnWWwmto/AAAAAAAAAAI/AAAAAAAAANE/BO... "} Thanks - Nick

6 years, 9 months

1
0
0 / 0

any vendor to provide a keycloak training?

by Masanobu Hatanaka

Hi, Does anyone knows any vendor to provide a keycloak training class through online/classes? I'm looking for a class training for Keycloak. Kind regards, Masanobu.

6 years, 9 months

1
0
0 / 0

CLI scripts

by Justin Williams

Hello, I'm mounting a volume containing CLI scripts to my Keycloak Docker container "startup-scripts" directory, and the scripts execute, however they do not take effect if a reload is required. I'm not seeing how I can get the server to reload after executing all of the scripts. Any suggestions? Example (request-logging.cli): embed-server --server-config=standalone.xml --std-out=echo echo SETUP: Enabling detailed request logging /subsystem=undertow/configuration=filter/custom-filter=request-logging-filter:add(class-name=io.undertow.server.handlers.RequestDumpingHandler, module=io.undertow.core) /subsystem=undertow/server=default-server/host=default-host/filter-ref=request-logging-filter:add stop-embedded-server

6 years, 9 months

2
2
0 / 0

Can only seem to use docker image 3.4.0.final

by Nick Powers

Sinykk, I think the main thing to focus on from your logs is this line: "keycloak | Caused by: java.lang.RuntimeException: Failed to connect to database" It looks like you are trying to setup Keycloak to use an external DB. I have not attempted that configuration. I built out a Postgres container in my docker-compose.yml. Below are the 2 files needed for that type of deployment, docker-compose.yml and .env, the docker-compose.yml includes a Nginx proxy container with a LetsEncrypt sidecar container and the Postgres DB container. This way, all I have to do is run docker-compose up -d to run all 3. The only thing that requires editing to get this to work is the .env file (which contains all the configuration items). The only things you should need to change in the .env file is DB_PASSWORD (since this will setup a new DB you can use whatever PW you want), KEYCLOAK_HOSTNAME (change to whatever domain is being protected by Keycloak), KEYCLOAK_HOSTNAME and LETSENCRYPT_HOST should both be set to the same value you set KEYCLOAK_HOSTNAME to. LETSENCRYPT_EMAIL should be set to an email address. I don't think letsencrypt checks the email just has to have an email there. I generally use certs(a)yourdomain.com where yourdomain is the same as KEYCLOAK_HOSTNAME. This configuration will setup a Nginx proxy container with a LetsEncrypt sidecar that automatically retrieves HTTPS certificates from LetsEncrypt and proxies HTTPS to the Keycloak container. The Keycloak container will use the Postgress DB container for all of it's DB needs. Below is my configuration, it may not be exactly what you want but hopefully will get you closer to your goal. Thanks - Nick docker-compose.yml FILE (below): version: '3' services: keycloak: container_name: keycloak image: jboss/keycloak container_name: keycloak restart: always ports: - 0.0.0.0:8080:8080 environment: DB_DATABASE: ${DB_DATABASE} DB_USER: ${DB_USER} DB_PASSWORD: ${DB_PASSWORD} JDBC_PARAMS: ${JDBC_PARAMS} KEYCLOAK_HOSTNAME: ${KEYCLOAK_HOSTNAME} KEYCLOAK_HTTP_PORT: ${KEYCLOAK_HTTP_PORT} KEYCLOAK_USER: ${KEYCLOAK_USER} KEYCLOAK_PASSWORD: ${KEYCLOAK_PASSWORD} VIRTUAL_HOST: ${VIRTUAL_HOST} VIRTUAL_PORT: ${VIRTUAL_PORT} PROXY_ADDRESS_FORWARDING: ${PROXY_ADDRESS_FORWARDING} LETSENCRYPT_HOST: ${LETSENCRYPT_HOST} LETSENCRYPT_EMAIL: ${LETSENCRYPT_EMAIL} depends_on: - postgres postgres: container_name: postgres image: postgres restart: always environment: POSTGRES_DB: ${DB_DATABASE} POSTGRES_USER: ${DB_USER} POSTGRES_PASSWORD: ${DB_PASSWORD} volumes: - data:/var/lib/postgresql/data nginx-proxy: image: jwilder/nginx-proxy:alpine container_name: nginx-proxy restart: always labels: com.github.jrcs.letsencrypt_nginx_proxy_companion.nginx_proxy: 'true' ports: - 80:80 - 443:443 volumes: - ./nginx/data/certs:/etc/nginx/certs:ro - ./nginx/data/conf.d:/etc/nginx/conf.d - ./nginx/data/vhost.d:/etc/nginx/vhost.d - ./nginx/data/html:/usr/share/nginx/html - /var/run/docker.sock:/tmp/docker.sock:ro letsencrypt: image: jrcs/letsencrypt-nginx-proxy-companion container_name: letsencrypt restart: always volumes: - ./nginx/data/vhost.d:/etc/nginx/vhost.d - ./nginx/data/certs:/etc/nginx/certs:rw - ./nginx/data/html:/usr/share/nginx/html - /var/run/docker.sock:/var/run/docker.sock:ro depends_on: - nginx-proxy volumes: data: DB_DATABASE=keycloak_db DB_USER=keycloak_db_user DB_PASSWORD="dF3d<Kv4(n'o%}C>" KEYCLOAK_HOSTNAME=auth.clearauth.com KEYCLOAK_HTTP_PORT=8080 KEYCLOAK_USER=admin KEYCLOAK_PASSWORD="*t3{$TnN&,Jfg@z" JDBC_PARAMS="ssl=false" PROXY_ADDRESS_FORWARDING=true VIRTUAL_HOST=auth.clearauth.com VIRTUAL_PORT=8080 LETSENCRYPT_HOST=auth.clearauth.com LETSENCRYPT_EMAIL=certs(a)clearauth.com .env FILE (below): DB_DATABASE=keycloak_db DB_USER=keycloak_db_user DB_PASSWORD="tops3cr3t" KEYCLOAK_HOSTNAME=yourdomain.com KEYCLOAK_HTTP_PORT=8080 KEYCLOAK_USER=admin KEYCLOAK_PASSWORD="*tops3cr3t" JDBC_PARAMS="ssl=false" PROXY_ADDRESS_FORWARDING=true VIRTUAL_HOST=auth.clearauth.com VIRTUAL_PORT=8080 LETSENCRYPT_HOST=yourdomain.com LETSENCRYPT_EMAIL=certs(a)yourdomain.com -----Original Message----- From: keycloak-user-bounces at lists.jboss.org <https://lists.jboss.org/mailman/listinfo/keycloak-user> [mailto:keycloak-user-bounces at lists.jboss.org <https://lists.jboss.org/mailman/listinfo/keycloak-user>] On Behalf Of Sinykk Skizm Sent: Wednesday, Jul 16, 2019 7:53 PM To: keycloak-user at lists.jboss.org <https://lists.jboss.org/mailman/listinfo/keycloak-user> Subject: [keycloak-user] Can only seem to use docker image 3.4.0.final > /I'm trying to run keycloak in docker and for whatever reason, it just won't. Except if I use the 3.4.0.Final tag, then keycloak spins up without any issues. > > This is my docker compose for jboss/keycloak > # KeyCloak - Open Source Identity and Access Management > keycloak: > image: jboss/keycloak > container_name: keycloak > restart: always > hostname: keycloak > ports: > - "8282:8080" > environment: > - DB_VENDOR=POSTGRES > - DB_ADDR=postgresdb > - DB_DATABASE=keycloak > - DB_PORT=54320 > - DB_USER=myuser > - DB_SCHEMA=public > - DB_PASSWORD=##mypassword$$ > - PROXY_ADDRESS_FORWARDING=true > - KEYCLOAK_LOGLEVEL=INFO > - KEYCLOAK_USER=admin > - KEYCLOAK_PASSWORD=##mypassword## > depends_on: > - postgresdb > command: > - "-b 0.0.0.0" > - "-Dkeycloak.profile.feature.docker=enabled" > This is is what's produced in the docker-compose logs. > > keycloak | ========================================================================= > keycloak | > keycloak | JBoss Bootstrap Environment > keycloak | > keycloak | JBOSS_HOME: /opt/jboss/keycloak > keycloak | > keycloak | JAVA: /usr/lib/jvm/java/bin/java > keycloak | > keycloak | JAVA_OPTS: -server -Xms64m -Xmx512m -XX:MetaspaceSize=96M -XX:MaxMetaspaceSize=256m -Djava.net.preferIPv4Stack=true -Djboss.modules.system.pkgs=org.jboss.byteman -Djava.awt.headless=true > keycloak | > keycloak | ========================================================================= > keycloak | > keycloak | 23:42:03,387 INFO [org.jboss.modules] (main) JBoss Modules version 1.9.0.Final > keycloak | 23:42:03,769 INFO [org.jboss.msc] (main) JBoss MSC version 1.4.5.Final > keycloak | 23:42:03,782 INFO [org.jboss.threads] (main) JBoss Threads version 2.3.3.Final > keycloak | 23:42:03,918 INFO [org.jboss.as] (MSC service thread 1-1) WFLYSRV0049: Keycloak 6.0.1 (WildFly Core 8.0.0.Final) starting > keycloak | 23:42:03,988 INFO [org.jboss.vfs] (MSC service thread 1-7) VFS000002: Failed to clean existing content for temp file provider of type temp. Enable DEBUG level log to find what caused this > keycloak | 23:42:04,586 INFO [org.wildfly.security] (ServerService Thread Pool -- 19) ELY00001: WildFly Elytron version 1.8.0.Final > keycloak | 23:42:05,261 INFO [org.jboss.as.controller.management-deprecated] (Controller Boot Thread) WFLYCTL0028: Attribute 'security-realm' in the resource at address '/core-service=management/management-interface=http-interface' is deprecated, and may be removed in a future version. See the attribute description in the output of the read-resource-description operation to learn more about the deprecation. > keycloak | 23:42:05,293 INFO [org.jboss.as.controller.management-deprecated] (ServerService Thread Pool -- 29) WFLYCTL0028: Attribute 'security-realm' in the resource at address '/subsystem=undertow/server=default-server/https-listener=https' is deprecated, and may be removed in a future version. See the attribute description in the output of the read-resource-description operation to learn more about the deprecation. > keycloak | 23:42:05,435 INFO [org.jboss.as.server] (Controller Boot Thread) WFLYSRV0039: Creating http management service using socket-binding (management-http) > keycloak | 23:42:05,450 INFO [org.xnio] (MSC service thread 1-4) XNIO version 3.6.5.Final > keycloak | 23:42:05,456 INFO [org.xnio.nio] (MSC service thread 1-4) XNIO NIO Implementation Version 3.6.5.Final > keycloak | 23:42:05,498 INFO [org.wildfly.extension.io] (ServerService Thread Pool -- 39) WFLYIO001: Worker 'default' has auto-configured to 16 core threads with 128 task threads based on your 8 available processors > keycloak | 23:42:05,501 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 38) WFLYCLINF0001: Activating Infinispan subsystem. > keycloak | 23:42:05,507 INFO [org.jboss.as.clustering.jgroups] (ServerService Thread Pool -- 42) WFLYCLJG0001: Activating JGroups subsystem. JGroups version 4.0.18 > keycloak | 23:42:05,501 INFO [org.jboss.as.connector.subsystems.datasources] (ServerService Thread Pool -- 33) WFLYJCA0004: Deploying JDBC-compliant driver class org.h2.Driver (version 1.4) > keycloak | 23:42:05,512 INFO [org.jboss.as.connector] (MSC service thread 1-3) WFLYJCA0009: Starting JCA Subsystem (WildFly/IronJacamar 1.4.12.Final) > keycloak | 23:42:05,518 INFO [org.jboss.as.connector.deployers.jdbc] (MSC service thread 1-1) WFLYJCA0018: Started Driver service with driver-name = h2 > keycloak | 23:42:05,519 INFO [org.jboss.as.jaxrs] (ServerService Thread Pool -- 40) WFLYRS0016: RESTEasy version 3.6.3.Final > keycloak | 23:42:05,536 INFO [org.jboss.as.connector.subsystems.datasources] (ServerService Thread Pool -- 33) WFLYJCA0005: Deploying non-JDBC-compliant driver class org.postgresql.Driver (version 42.2) > keycloak | 23:42:05,550 INFO [org.jboss.as.connector.deployers.jdbc] (MSC service thread 1-6) WFLYJCA0018: Started Driver service with driver-name = postgresql > keycloak | 23:42:05,565 INFO [org.jboss.remoting] (MSC service thread 1-4) JBoss Remoting version 5.0.8.Final > keycloak | 23:42:05,588 INFO [org.wildfly.extension.microprofile.config.smallrye._private] (ServerService Thread Pool -- 47) WFLYCONF0001: Activating WildFly MicroProfile Config Subsystem > keycloak | 23:42:05,607 WARN [org.jboss.as.txn] (ServerService Thread Pool -- 56) WFLYTX0013: The node-identifier attribute on the /subsystem=transactions is set to the default value. This is a danger for environments running multiple servers. Please make sure the attribute value is unique. > keycloak | 23:42:05,615 INFO [org.wildfly.extension.microprofile.metrics.smallrye] (ServerService Thread Pool -- 49) WFLYMETRICS0001: Activating Eclipse MicroProfile Metrics Subsystem > keycloak | 23:42:05,615 INFO [org.jboss.as.mail.extension] (MSC service thread 1-2) WFLYMAIL0002: Unbound mail session [java:jboss/mail/Default] > keycloak | 23:42:05,618 INFO [org.wildfly.extension.microprofile.health.smallrye] (ServerService Thread Pool -- 48) WFLYHEALTH0001: Activating Eclipse MicroProfile Health Subsystem > keycloak | 23:42:05,619 INFO [org.jboss.as.naming] (ServerService Thread Pool -- 51) WFLYNAM0001: Activating Naming Subsystem > keycloak | 23:42:05,747 INFO [org.jboss.as.security] (ServerService Thread Pool -- 54) WFLYSEC0002: Activating Security Subsystem > keycloak | 23:42:05,766 INFO [org.wildfly.extension.undertow] (MSC service thread 1-4) WFLYUT0003: Undertow 2.0.19.Final starting > keycloak | 23:42:05,767 INFO [org.jboss.as.connector.subsystems.datasources] (MSC service thread 1-5) WFLYJCA0010: Unbound data source [java:jboss/datasources/ExampleDS] > keycloak | 23:42:05,774 INFO [org.jboss.as.connector.subsystems.datasources] (MSC service thread 1-2) WFLYJCA0010: Unbound data source [java:jboss/datasources/KeycloakDS] > keycloak | 23:42:05,789 INFO [org.jboss.as.security] (MSC service thread 1-4) WFLYSEC0001: Current PicketBox version=5.0.3.Final > keycloak | 23:42:05,803 INFO [io.smallrye.metrics] (MSC service thread 1-6) Converted [2] config entries and added [4] replacements > keycloak | 23:42:05,810 INFO [io.smallrye.metrics] (MSC service thread 1-6) Converted [3] config entries and added [14] replacements > keycloak | 23:42:05,832 INFO [org.jboss.as.naming] (MSC service thread 1-2) WFLYNAM0003: Starting Naming Service > keycloak | 23:42:05,841 INFO [org.jboss.as.mail.extension] (MSC service thread 1-4) WFLYMAIL0001: Bound mail session [java:jboss/mail/Default] > keycloak | 23:42:05,858 INFO [org.jboss.as.ejb3] (MSC service thread 1-8) WFLYEJB0481: Strict pool slsb-strict-max-pool is using a max instance size of 128 (per class), which is derived from thread worker pool sizing. > keycloak | 23:42:05,860 INFO [org.jboss.as.ejb3] (MSC service thread 1-7) WFLYEJB0482: Strict pool mdb-strict-max-pool is using a max instance size of 32 (per class), which is derived from the number of CPUs on this host. > keycloak | 23:42:05,924 INFO [org.wildfly.extension.undertow] (ServerService Thread Pool -- 57) WFLYUT0014: Creating file handler for path '/opt/jboss/keycloak/welcome-content' with options [directory-listing: 'false', follow-symlink: 'false', case-sensitive: 'true', safe-symlink-paths: '[]'] > keycloak | 23:42:05,934 INFO [org.wildfly.extension.undertow] (MSC service thread 1-6) WFLYUT0012: Started server default-server. > keycloak | 23:42:05,953 INFO [org.wildfly.extension.undertow] (MSC service thread 1-1) WFLYUT0018: Host default-host starting > keycloak | 23:42:05,987 INFO [org.wildfly.extension.undertow] (MSC service thread 1-2) WFLYUT0006: Undertow HTTP listener default listening on 0.0.0.0:8080 > keycloak | 23:42:05,987 INFO [org.wildfly.extension.undertow] (MSC service thread 1-7) WFLYUT0006: Undertow AJP listener ajp listening on 0.0.0.0:8009 > keycloak | 23:42:06,002 INFO [org.jboss.modcluster] (ServerService Thread Pool -- 58) MODCLUSTER000001: Initializing mod_cluster version 1.4.0.Final > keycloak | 23:42:06,018 INFO [org.jboss.modcluster] (ServerService Thread Pool -- 58) MODCLUSTER000032: Listening to proxy advertisements on /224.0.1.105:23364 > keycloak | 23:42:06,078 INFO [org.jboss.as.patching] (MSC service thread 1-5) WFLYPAT0050: Keycloak cumulative patch ID is: base, one-off patches include: none > keycloak | 23:42:06,091 INFO [org.jboss.as.ejb3] (MSC service thread 1-3) WFLYEJB0493: EJB subsystem suspension complete > keycloak | 23:42:06,096 WARN [org.jboss.as.domain.management.security] (MSC service thread 1-8) WFLYDM0111: Keystore /opt/jboss/keycloak/standalone/configuration/application.keystore not found, it will be auto generated on first use with a self signed certificate for host localhost > keycloak | 23:42:06,108 INFO [org.jboss.as.server.deployment.scanner] (MSC service thread 1-4) WFLYDS0013: Started FileSystemDeploymentService for directory /opt/jboss/keycloak/standalone/deployments > keycloak | 23:42:06,119 INFO [org.jboss.as.server.deployment] (MSC service thread 1-7) WFLYSRV0027: Starting deployment of "keycloak-server.war" (runtime-name: "keycloak-server.war") > keycloak | 23:42:06,171 INFO [org.wildfly.extension.undertow] (MSC service thread 1-8) WFLYUT0006: Undertow HTTPS listener https listening on 0.0.0.0:8443 > keycloak | 23:42:06,177 INFO [org.jboss.as.connector.subsystems.datasources] (MSC service thread 1-2) WFLYJCA0001: Bound data source [java:jboss/datasources/ExampleDS] > keycloak | 23:42:06,178 INFO [org.jboss.as.connector.subsystems.datasources] (MSC service thread 1-7) WFLYJCA0001: Bound data source [java:jboss/datasources/KeycloakDS] > keycloak | 23:42:06,344 WARN [org.jboss.as.dependency.private] (MSC service thread 1-1) WFLYSRV0018: Deployment "deployment.keycloak-server.war" is using a private module ("org.kie") which may be changed or removed in future versions without notice. > keycloak | 23:42:06,631 WARN [org.jgroups.protocols.UDP] (ServerService Thread Pool -- 58) JGRP000015: the send buffer of socket ManagedMulticastSocketBinding was set to 1.00MB, but the OS only allocated 212.99KB. This might lead to performance problems. Please set your max send buffer in the OS correctly (e.g. net.core.wmem_max on Linux) > keycloak | 23:42:06,632 WARN [org.jgroups.protocols.UDP] (ServerService Thread Pool -- 58) JGRP000015: the receive buffer of socket ManagedMulticastSocketBinding was set to 20.00MB, but the OS only allocated 212.99KB. This might lead to performance problems. Please set your max receive buffer in the OS correctly (e.g. net.core.rmem_max on Linux) > keycloak | 23:42:06,632 WARN [org.jgroups.protocols.UDP] (ServerService Thread Pool -- 58) JGRP000015: the send buffer of socket ManagedMulticastSocketBinding was set to 1.00MB, but the OS only allocated 212.99KB. This might lead to performance problems. Please set your max send buffer in the OS correctly (e.g. net.core.wmem_max on Linux) > keycloak | 23:42:06,632 WARN [org.jgroups.protocols.UDP] (ServerService Thread Pool -- 58) JGRP000015: the receive buffer of socket ManagedMulticastSocketBinding was set to 25.00MB, but the OS only allocated 212.99KB. This might lead to performance problems. Please set your max receive buffer in the OS correctly (e.g. net.core.rmem_max on Linux) > keycloak | 23:42:09,641 INFO [org.jgroups.protocols.pbcast.GMS] (ServerService Thread Pool -- 58) keycloak: no members discovered after 3003 ms: creating cluster as first member > keycloak | 23:42:09,939 INFO [org.infinispan.factories.GlobalComponentRegistry] (MSC service thread 1-7) ISPN000128: Infinispan version: Infinispan 'Infinity Minus ONE +2' 9.4.8.Final > keycloak | 23:42:10,118 INFO [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service thread 1-4) ISPN000078: Starting JGroups channel ejb > keycloak | 23:42:10,118 INFO [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service thread 1-1) ISPN000078: Starting JGroups channel ejb > keycloak | 23:42:10,118 INFO [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service thread 1-5) ISPN000078: Starting JGroups channel ejb > keycloak | 23:42:10,118 INFO [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service thread 1-6) ISPN000078: Starting JGroups channel ejb > keycloak | 23:42:10,118 INFO [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service thread 1-7) ISPN000078: Starting JGroups channel ejb > keycloak | 23:42:10,124 INFO [org.infinispan.CLUSTER] (MSC service thread 1-4) ISPN000094: Received new cluster view for channel ejb: [keycloak|0] (1) [keycloak] > keycloak | 23:42:10,124 INFO [org.infinispan.CLUSTER] (MSC service thread 1-6) ISPN000094: Received new cluster view for channel ejb: [keycloak|0] (1) [keycloak] > keycloak | 23:42:10,124 INFO [org.infinispan.CLUSTER] (MSC service thread 1-5) ISPN000094: Received new cluster view for channel ejb: [keycloak|0] (1) [keycloak] > keycloak | 23:42:10,124 INFO [org.infinispan.CLUSTER] (MSC service thread 1-7) ISPN000094: Received new cluster view for channel ejb: [keycloak|0] (1) [keycloak] > keycloak | 23:42:10,124 INFO [org.infinispan.CLUSTER] (MSC service thread 1-1) ISPN000094: Received new cluster view for channel ejb: [keycloak|0] (1) [keycloak] > keycloak | 23:42:10,132 INFO [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service thread 1-1) ISPN000079: Channel ejb local address is keycloak, physical addresses are [172.19.0.6:55200] > keycloak | 23:42:10,132 INFO [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service thread 1-6) ISPN000079: Channel ejb local address is keycloak, physical addresses are [172.19.0.6:55200] > keycloak | 23:42:10,133 INFO [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service thread 1-4) ISPN000079: Channel ejb local address is keycloak, physical addresses are [172.19.0.6:55200] > keycloak | 23:42:10,132 INFO [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service thread 1-7) ISPN000079: Channel ejb local address is keycloak, physical addresses are [172.19.0.6:55200] > keycloak | 23:42:10,134 INFO [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service thread 1-5) ISPN000079: Channel ejb local address is keycloak, physical addresses are [172.19.0.6:55200] > keycloak | 23:42:10,311 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 58) WFLYCLINF0002: Started users cache from keycloak container > keycloak | 23:42:10,311 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 61) WFLYCLINF0002: Started realms cache from keycloak container > keycloak | 23:42:10,311 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 65) WFLYCLINF0002: Started authorization cache from keycloak container > keycloak | 23:42:10,311 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 68) WFLYCLINF0002: Started keys cache from keycloak container > keycloak | 23:42:10,666 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 69) WFLYCLINF0002: Started offlineSessions cache from keycloak container > keycloak | 23:42:10,666 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 64) WFLYCLINF0002: Started authenticationSessions cache from keycloak container > keycloak | 23:42:10,668 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 63) WFLYCLINF0002: Started clientSessions cache from keycloak container > keycloak | 23:42:10,668 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 67) WFLYCLINF0002: Started actionTokens cache from keycloak container > keycloak | 23:42:10,668 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 62) WFLYCLINF0002: Started offlineClientSessions cache from keycloak container > keycloak | 23:42:10,668 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 59) WFLYCLINF0002: Started sessions cache from keycloak container > keycloak | 23:42:10,669 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 70) WFLYCLINF0002: Started client-mappings cache from ejb container > keycloak | 23:42:10,669 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 66) WFLYCLINF0002: Started work cache from keycloak container > keycloak | 23:42:10,670 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 60) WFLYCLINF0002: Started loginFailures cache from keycloak container > keycloak | 23:42:10,798 WARN [org.jboss.as.server.deployment] (MSC service thread 1-6) WFLYSRV0273: Excluded subsystem weld via jboss-deployment-structure.xml does not exist. > keycloak | 23:42:10,798 WARN [org.jboss.as.server.deployment] (MSC service thread 1-6) WFLYSRV0273: Excluded subsystem webservices via jboss-deployment-structure.xml does not exist. > keycloak | 23:42:11,300 INFO [org.keycloak.services] (ServerService Thread Pool -- 60) KC-SERVICES0001: Loading config from standalone.xml or domain.xml > keycloak | 23:42:11,612 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 60) WFLYCLINF0002: Started realmRevisions cache from keycloak container > keycloak | 23:42:11,617 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 60) WFLYCLINF0002: Started userRevisions cache from keycloak container > keycloak | 23:42:11,622 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 60) WFLYCLINF0002: Started authorizationRevisions cache from keycloak container > keycloak | 23:42:11,623 INFO [org.keycloak.connections.infinispan.DefaultInfinispanConnectionProviderFactory] (ServerService Thread Pool -- 60) Node name: keycloak, Site name: null > keycloak | 23:42:11,952 WARN [org.jboss.jca.core.connectionmanager.pool.strategy.OnePool] (ServerService Thread Pool -- 60) IJ000604: Throwable while attempting to get a new connection: null: javax.resource.ResourceException: IJ031084: Unable to create connection > keycloak | at org.jboss.jca.adapters.jdbc.local.LocalManagedConnectionFactory.createLocalManagedConnection(LocalManagedConnectionFactory.java:345) > keycloak | at org.jboss.jca.adapters.jdbc.local.LocalManagedConnectionFactory.getLocalManagedConnection(LocalManagedConnectionFactory.java:352) > keycloak | at org.jboss.jca.adapters.jdbc.local.LocalManagedConnectionFactory.createManagedConnection(LocalManagedConnectionFactory.java:287) > keycloak | at org.jboss.jca.core.connectionmanager.pool.mcp.SemaphoreConcurrentLinkedDequeManagedConnectionPool.createConnectionEventListener(SemaphoreConcurrentLinkedDequeManagedConnectionPool.java:1325) > keycloak | at org.jboss.jca.core.connectionmanager.pool.mcp.SemaphoreConcurrentLinkedDequeManagedConnectionPool.getConnection(SemaphoreConcurrentLinkedDequeManagedConnectionPool.java:499) > keycloak | at org.jboss.jca.core.connectionmanager.pool.AbstractPool.getSimpleConnection(AbstractPool.java:632) > keycloak | at org.jboss.jca.core.connectionmanager.pool.AbstractPool.getConnection(AbstractPool.java:604) > keycloak | at org.jboss.jca.core.connectionmanager.AbstractConnectionManager.getManagedConnection(AbstractConnectionManager.java:624) > keycloak | at org.jboss.jca.core.connectionmanager.tx.TxConnectionManagerImpl.getManagedConnection(TxConnectionManagerImpl.java:440) > keycloak | at org.jboss.jca.core.connectionmanager.AbstractConnectionManager.allocateConnection(AbstractConnectionManager.java:789) > keycloak | at org.jboss.jca.adapters.jdbc.WrapperDataSource.getConnection(WrapperDataSource.java:138) > keycloak | at org.jboss.as.connector.subsystems.datasources.WildFlyDataSource.getConnection(WildFlyDataSource.java:64) > keycloak | at org.keycloak.connections.jpa.DefaultJpaConnectionProviderFactory.getConnection(DefaultJpaConnectionProviderFactory.java:376) > keycloak | at org.keycloak.connections.jpa.updater.liquibase.lock.LiquibaseDBLockProvider.lazyInit(LiquibaseDBLockProvider.java:65) > keycloak | at org.keycloak.connections.jpa.updater.liquibase.lock.LiquibaseDBLockProvider.lambda$waitForLock$0(LiquibaseDBLockProvider.java:97) > keycloak | at org.keycloak.models.utils.KeycloakModelUtils.suspendJtaTransaction(KeycloakModelUtils.java:678) > keycloak | at org.keycloak.connections.jpa.updater.liquibase.lock.LiquibaseDBLockProvider.waitForLock(LiquibaseDBLockProvider.java:95) > keycloak | at org.keycloak.services.resources.KeycloakApplication$1.run(KeycloakApplication.java:144) > keycloak | at org.keycloak.models.utils.KeycloakModelUtils.runJobInTransaction(KeycloakModelUtils.java:227) > keycloak | at org.keycloak.services.resources.KeycloakApplication.<init>(KeycloakApplication.java:137) > keycloak | at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method) > keycloak | at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62) > keycloak | at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45) > keycloak | at java.lang.reflect.Constructor.newInstance(Constructor.java:423) > keycloak | at org.jboss.resteasy.core.ConstructorInjectorImpl.construct(ConstructorInjectorImpl.java:152) > keycloak | at org.jboss.resteasy.spi.ResteasyProviderFactory.createProviderInstance(ResteasyProviderFactory.java:2750) > keycloak | at org.jboss.resteasy.spi.ResteasyDeployment.createApplication(ResteasyDeployment.java:364) > keycloak | at org.jboss.resteasy.spi.ResteasyDeployment.startInternal(ResteasyDeployment.java:277) > keycloak | at org.jboss.resteasy.spi.ResteasyDeployment.start(ResteasyDeployment.java:89) > keycloak | at org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.init(ServletContainerDispatcher.java:119) > keycloak | at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.init(HttpServletDispatcher.java:36) > keycloak | at io.undertow.servlet.core.LifecyleInterceptorInvocation.proceed(LifecyleInterceptorInvocation.java:117) > keycloak | at org.wildfly.extension.undertow.security.RunAsLifecycleInterceptor.init(RunAsLifecycleInterceptor.java:78) > keycloak | at io.undertow.servlet.core.LifecyleInterceptorInvocation.proceed(LifecyleInterceptorInvocation.java:103) > keycloak | at io.undertow.servlet.core.ManagedServlet$DefaultInstanceStrategy.start(ManagedServlet.java:303) > keycloak | at io.undertow.servlet.core.ManagedServlet.createServlet(ManagedServlet.java:143) > keycloak | at io.undertow.servlet.core.DeploymentManagerImpl$2.call(DeploymentManagerImpl.java:583) > keycloak | at io.undertow.servlet.core.DeploymentManagerImpl$2.call(DeploymentManagerImpl.java:554) > keycloak | at io.undertow.servlet.core.ServletRequestContextThreadSetupAction$1.call(ServletRequestContextThreadSetupAction.java:42) > keycloak | at io.undertow.servlet.core.ContextClassLoaderSetupAction$1.call(ContextClassLoaderSetupAction.java:43) > keycloak | at org.wildfly.extension.undertow.security.SecurityContextThreadSetupAction.lambda$create$0(SecurityContextThreadSetupAction.java:105) > keycloak | at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502) > keycloak | at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502) > keycloak | at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502) > keycloak | at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502) > keycloak | at io.undertow.servlet.core.DeploymentManagerImpl.start(DeploymentManagerImpl.java:596) > keycloak | at org.wildfly.extension.undertow.deployment.UndertowDeploymentService.startContext(UndertowDeploymentService.java:97) > keycloak | at org.wildfly.extension.undertow.deployment.UndertowDeploymentService$1.run(UndertowDeploymentService.java:78) > keycloak | at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511) > keycloak | at java.util.concurrent.FutureTask.run(FutureTask.java:266) > keycloak | at org.jboss.threads.ContextClassLoaderSavingRunnable.run(ContextClassLoaderSavingRunnable.java:35) > keycloak | at org.jboss.threads.EnhancedQueueExecutor.safeRun(EnhancedQueueExecutor.java:1982) > keycloak | at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.doRunTask(EnhancedQueueExecutor.java:1486) > keycloak | at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1377) > keycloak | at java.lang.Thread.run(Thread.java:748) > keycloak | at org.jboss.threads.JBossThread.run(JBossThread.java:485) > keycloak | Caused by: org.postgresql.util.PSQLException: The connection attempt failed. > keycloak | at org.postgresql.core.v3.ConnectionFactoryImpl.openConnectionImpl(ConnectionFactoryImpl.java:292) > keycloak | at org.postgresql.core.ConnectionFactory.openConnection(ConnectionFactory.java:49) > keycloak | at org.postgresql.jdbc.PgConnection.<init>(PgConnection.java:195) > keycloak | at org.postgresql.Driver.makeConnection(Driver.java:454) > keycloak | at org.postgresql.Driver.connect(Driver.java:256) > keycloak | at org.jboss.jca.adapters.jdbc.local.LocalManagedConnectionFactory.createLocalManagedConnection(LocalManagedConnectionFactory.java:321) > keycloak | ... 55 more > keycloak | Caused by: java.net.UnknownHostException: postgresdb > keycloak | at java.net.AbstractPlainSocketImpl.connect(AbstractPlainSocketImpl.java:184) > keycloak | at java.net.SocksSocketImpl.connect(SocksSocketImpl.java:392) > keycloak | at java.net.Socket.connect(Socket.java:589) > keycloak | at org.postgresql.core.PGStream.<init>(PGStream.java:70) > keycloak | at org.postgresql.core.v3.ConnectionFactoryImpl.tryConnect(ConnectionFactoryImpl.java:91) > keycloak | at org.postgresql.core.v3.ConnectionFactoryImpl.openConnectionImpl(ConnectionFactoryImpl.java:192) > keycloak | ... 60 more > keycloak | > keycloak | 23:42:11,960 INFO [org.jboss.as.server] (Thread-2) WFLYSRV0220: Server shutdown has been requested via an OS signal > keycloak | 23:42:11,971 ERROR [org.jboss.msc.service.fail] (ServerService Thread Pool -- 60) MSC000001: Failed to start service jboss.deployment.unit."keycloak-server.war".undertow-deployment: org.jboss.msc.service.StartException in service jboss.deployment.unit."keycloak-server.war".undertow-deployment: java.lang.RuntimeException: RESTEASY003325: Failed to construct public org.keycloak.services.resources.KeycloakApplication(javax.servlet.ServletContext,org.jboss.resteasy.core.Dispatcher) > keycloak | at org.wildfly.extension.undertow.deployment.UndertowDeploymentService$1.run(UndertowDeploymentService.java:81) > keycloak | at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511) > keycloak | at java.util.concurrent.FutureTask.run(FutureTask.java:266) > keycloak | at org.jboss.threads.ContextClassLoaderSavingRunnable.run(ContextClassLoaderSavingRunnable.java:35) > keycloak | at org.jboss.threads.EnhancedQueueExecutor.safeRun(EnhancedQueueExecutor.java:1982) > keycloak | at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.doRunTask(EnhancedQueueExecutor.java:1486) > keycloak | at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1377) > keycloak | at java.lang.Thread.run(Thread.java:748) > keycloak | at org.jboss.threads.JBossThread.run(JBossThread.java:485) > keycloak | Caused by: java.lang.RuntimeException: RESTEASY003325: Failed to construct public org.keycloak.services.resources.KeycloakApplication(javax.servlet.ServletContext,org.jboss.resteasy.core.Dispatcher) > keycloak | at org.jboss.resteasy.core.ConstructorInjectorImpl.construct(ConstructorInjectorImpl.java:164) > keycloak | at org.jboss.resteasy.spi.ResteasyProviderFactory.createProviderInstance(ResteasyProviderFactory.java:2750) > keycloak | at org.jboss.resteasy.spi.ResteasyDeployment.createApplication(ResteasyDeployment.java:364) > keycloak | at org.jboss.resteasy.spi.ResteasyDeployment.startInternal(ResteasyDeployment.java:277) > keycloak | at org.jboss.resteasy.spi.ResteasyDeployment.start(ResteasyDeployment.java:89) > keycloak | at org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.init(ServletContainerDispatcher.java:119) > keycloak | at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.init(HttpServletDispatcher.java:36) > keycloak | at io.undertow.servlet.core.LifecyleInterceptorInvocation.proceed(LifecyleInterceptorInvocation.java:117) > keycloak | at org.wildfly.extension.undertow.security.RunAsLifecycleInterceptor.init(RunAsLifecycleInterceptor.java:78) > keycloak | at io.undertow.servlet.core.LifecyleInterceptorInvocation.proceed(LifecyleInterceptorInvocation.java:103) > keycloak | at io.undertow.servlet.core.ManagedServlet$DefaultInstanceStrategy.start(ManagedServlet.java:303) > keycloak | at io.undertow.servlet.core.ManagedServlet.createServlet(ManagedServlet.java:143) > keycloak | at io.undertow.servlet.core.DeploymentManagerImpl$2.call(DeploymentManagerImpl.java:583) > keycloak | at io.undertow.servlet.core.DeploymentManagerImpl$2.call(DeploymentManagerImpl.java:554) > keycloak | at io.undertow.servlet.core.ServletRequestContextThreadSetupAction$1.call(ServletRequestContextThreadSetupAction.java:42) > keycloak | at io.undertow.servlet.core.ContextClassLoaderSetupAction$1.call(ContextClassLoaderSetupAction.java:43) > keycloak | at org.wildfly.extension.undertow.security.SecurityContextThreadSetupAction.lambda$create$0(SecurityContextThreadSetupAction.java:105) > keycloak | at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502) > keycloak | at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502) > keycloak | at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502) > keycloak | at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502) > keycloak | at io.undertow.servlet.core.DeploymentManagerImpl.start(DeploymentManagerImpl.java:596) > keycloak | at org.wildfly.extension.undertow.deployment.UndertowDeploymentService.startContext(UndertowDeploymentService.java:97) > keycloak | at org.wildfly.extension.undertow.deployment.UndertowDeploymentService$1.run(UndertowDeploymentService.java:78) > keycloak | ... 8 more > keycloak | Caused by: java.lang.RuntimeException: Failed to connect to database > keycloak | at org.keycloak.connections.jpa.DefaultJpaConnectionProviderFactory.getConnection(DefaultJpaConnectionProviderFactory.java:382) > keycloak | at org.keycloak.connections.jpa.updater.liquibase.lock.LiquibaseDBLockProvider.lazyInit(LiquibaseDBLockProvider.java:65) > keycloak | at org.keycloak.connections.jpa.updater.liquibase.lock.LiquibaseDBLockProvider.lambda$waitForLock$0(LiquibaseDBLockProvider.java:97) > keycloak | at org.keycloak.models.utils.KeycloakModelUtils.suspendJtaTransaction(KeycloakModelUtils.java:678) > keycloak | at org.keycloak.connections.jpa.updater.liquibase.lock.LiquibaseDBLockProvider.waitForLock(LiquibaseDBLockProvider.java:95) > keycloak | at org.keycloak.services.resources.KeycloakApplication$1.run(KeycloakApplication.java:144) > keycloak | at org.keycloak.models.utils.KeycloakModelUtils.runJobInTransaction(KeycloakModelUtils.java:227) > keycloak | at org.keycloak.services.resources.KeycloakApplication.<init>(KeycloakApplication.java:137) > keycloak | at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method) > keycloak | at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62) > keycloak | at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45) > keycloak | at java.lang.reflect.Constructor.newInstance(Constructor.java:423) > keycloak | at org.jboss.resteasy.core.ConstructorInjectorImpl.construct(ConstructorInjectorImpl.java:152) > keycloak | ... 31 more > keycloak | Caused by: java.sql.SQLException: javax.resource.ResourceException: IJ000453: Unable to get managed connection for java:jboss/datasources/KeycloakDS > keycloak | at org.jboss.jca.adapters.jdbc.WrapperDataSource.getConnection(WrapperDataSource.java:146) > keycloak | at org.jboss.as.connector.subsystems.datasources.WildFlyDataSource.getConnection(WildFlyDataSource.java:64) > keycloak | at org.keycloak.connections.jpa.DefaultJpaConnectionProviderFactory.getConnection(DefaultJpaConnectionProviderFactory.java:376) > keycloak | ... 43 more > keycloak | Caused by: javax.resource.ResourceException: IJ000453: Unable to get managed connection for java:jboss/datasources/KeycloakDS > keycloak | at org.jboss.jca.core.connectionmanager.AbstractConnectionManager.getManagedConnection(AbstractConnectionManager.java:690) > keycloak | at org.jboss.jca.core.connectionmanager.tx.TxConnectionManagerImpl.getManagedConnection(TxConnectionManagerImpl.java:440) > keycloak | at org.jboss.jca.core.connectionmanager.AbstractConnectionManager.allocateConnection(AbstractConnectionManager.java:789) > keycloak | at org.jboss.jca.adapters.jdbc.WrapperDataSource.getConnection(WrapperDataSource.java:138) > keycloak | ... 45 more > keycloak | Caused by: javax.resource.ResourceException: IJ031084: Unable to create connection > keycloak | at org.jboss.jca.adapters.jdbc.local.LocalManagedConnectionFactory.createLocalManagedConnection(LocalManagedConnectionFactory.java:345) > keycloak | at org.jboss.jca.adapters.jdbc.local.LocalManagedConnectionFactory.getLocalManagedConnection(LocalManagedConnectionFactory.java:352) > keycloak | at org.jboss.jca.adapters.jdbc.local.LocalManagedConnectionFactory.createManagedConnection(LocalManagedConnectionFactory.java:287) > keycloak | at org.jboss.jca.core.connectionmanager.pool.mcp.SemaphoreConcurrentLinkedDequeManagedConnectionPool.createConnectionEventListener(SemaphoreConcurrentLinkedDequeManagedConnectionPool.java:1325) > keycloak | at org.jboss.jca.core.connectionmanager.pool.mcp.SemaphoreConcurrentLinkedDequeManagedConnectionPool.getConnection(SemaphoreConcurrentLinkedDequeManagedConnectionPool.java:499) > keycloak | at org.jboss.jca.core.connectionmanager.pool.AbstractPool.getSimpleConnection(AbstractPool.java:632) > keycloak | at org.jboss.jca.core.connectionmanager.pool.AbstractPool.getConnection(AbstractPool.java:604) > keycloak | at org.jboss.jca.core.connectionmanager.AbstractConnectionManager.getManagedConnection(AbstractConnectionManager.java:624) > keycloak | ... 48 more > keycloak | Caused by: org.postgresql.util.PSQLException: The connection attempt failed. > keycloak | at org.postgresql.core.v3.ConnectionFactoryImpl.openConnectionImpl(ConnectionFactoryImpl.java:292) > keycloak | at org.postgresql.core.ConnectionFactory.openConnection(ConnectionFactory.java:49) > keycloak | at org.postgresql.jdbc.PgConnection.<init>(PgConnection.java:195) > keycloak | at org.postgresql.Driver.makeConnection(Driver.java:454) > keycloak | at org.postgresql.Driver.connect(Driver.java:256) > keycloak | at org.jboss.jca.adapters.jdbc.local.LocalManagedConnectionFactory.createLocalManagedConnection(LocalManagedConnectionFactory.java:321) > keycloak | ... 55 more > keycloak | Caused by: java.net.UnknownHostException: postgresdb > keycloak | at java.net.AbstractPlainSocketImpl.connect(AbstractPlainSocketImpl.java:184) > keycloak | at java.net.SocksSocketImpl.connect(SocksSocketImpl.java:392) > keycloak | at java.net.Socket.connect(Socket.java:589) > keycloak | at org.postgresql.core.PGStream.<init>(PGStream.java:70) > keycloak | at org.postgresql.core.v3.ConnectionFactoryImpl.tryConnect(ConnectionFactoryImpl.java:91) > keycloak | at org.postgresql.core.v3.ConnectionFactoryImpl.openConnectionImpl(ConnectionFactoryImpl.java:192) > keycloak | ... 60 more > keycloak | > keycloak | 23:42:11,996 INFO [org.jboss.as.connector.subsystems.datasources] (MSC service thread 1-8) WFLYJCA0010: Unbound data source [java:jboss/datasources/KeycloakDS] > keycloak | 23:42:11,998 INFO [org.jboss.as.mail.extension] (MSC service thread 1-7) WFLYMAIL0002: Unbound mail session [java:jboss/mail/Default] > keycloak | 23:42:11,998 INFO [org.wildfly.extension.undertow] (MSC service thread 1-7) WFLYUT0008: Undertow HTTPS listener https suspending > keycloak | 23:42:12,002 INFO [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service thread 1-3) ISPN000080: Disconnecting JGroups channel ejb > keycloak | 23:42:12,003 INFO [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service thread 1-1) ISPN000080: Disconnecting JGroups channel ejb > keycloak | 23:42:12,005 INFO [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service thread 1-4) ISPN000080: Disconnecting JGroups channel ejb > keycloak | 23:42:12,009 INFO [org.jboss.as.connector.subsystems.datasources] (MSC service thread 1-1) WFLYJCA0010: Unbound data source [java:jboss/datasources/ExampleDS] > keycloak | 23:42:12,010 INFO [org.jboss.modcluster] (ServerService Thread Pool -- 70) MODCLUSTER000002: Initiating mod_cluster shutdown > keycloak | 23:42:12,010 INFO [org.wildfly.extension.undertow] (MSC service thread 1-5) WFLYUT0008: Undertow AJP listener ajp suspending > keycloak | 23:42:12,012 INFO [org.jboss.as.connector.deployers.jdbc] (MSC service thread 1-3) WFLYJCA0019: Stopped Driver service with driver-name = postgresql > keycloak | 23:42:12,012 INFO [org.jboss.as.connector.deployers.jdbc] (MSC service thread 1-1) WFLYJCA0019: Stopped Driver service with driver-name = h2 > keycloak | 23:42:12,016 INFO [org.wildfly.extension.undertow] (MSC service thread 1-7) WFLYUT0007: Undertow HTTPS listener https stopped, was bound to 0.0.0.0:8443 > keycloak | 23:42:12,016 INFO [org.wildfly.extension.undertow] (MSC service thread 1-5) WFLYUT0007: Undertow AJP listener ajp stopped, was bound to 0.0.0.0:8009 > keycloak | 23:42:12,022 INFO [org.wildfly.extension.undertow] (MSC service thread 1-5) WFLYUT0008: Undertow HTTP listener default suspending > keycloak | 23:42:12,025 INFO [org.wildfly.extension.undertow] (MSC service thread 1-5) WFLYUT0007: Undertow HTTP listener default stopped, was bound to 0.0.0.0:8080 > keycloak | 23:42:12,029 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 66) WFLYCLINF0003: Stopped client-mappings cache from ejb container > keycloak | 23:42:12,031 INFO [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service thread 1-1) ISPN000080: Disconnecting JGroups channel ejb > keycloak | 23:42:12,034 INFO [org.wildfly.extension.undertow] (MSC service thread 1-4) WFLYUT0019: Host default-host stopping > keycloak | 23:42:12,035 INFO [org.wildfly.extension.undertow] (MSC service thread 1-3) WFLYUT0004: Undertow 2.0.19.Final stopping > keycloak | 23:42:12,040 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 60) WFLYCLINF0003: Stopped keys cache from keycloak container > keycloak | 23:42:12,040 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 64) WFLYCLINF0003: Stopped authorization cache from keycloak container > keycloak | 23:42:12,043 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 64) WFLYCLINF0003: Stopped users cache from keycloak container > keycloak | 23:42:12,046 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 61) WFLYCLINF0003: Stopped realms cache from keycloak container > keycloak | 23:42:12,046 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 59) WFLYCLINF0003: Stopped work cache from keycloak container > keycloak | 23:42:12,049 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 60) WFLYCLINF0003: Stopped offlineSessions cache from keycloak container > keycloak | 23:42:12,051 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 70) WFLYCLINF0003: Stopped authenticationSessions cache from keycloak container > keycloak | 23:42:12,051 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 66) WFLYCLINF0003: Stopped clientSessions cache from keycloak container > keycloak | 23:42:12,053 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 62) WFLYCLINF0003: Stopped offlineClientSessions cache from keycloak container > keycloak | 23:42:12,054 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 63) WFLYCLINF0003: Stopped loginFailures cache from keycloak container > keycloak | 23:42:12,055 INFO [org.jboss.as.server.deployment] (MSC service thread 1-5) WFLYSRV0028: Stopped deployment keycloak-server.war (runtime-name: keycloak-server.war) in 90ms > keycloak | 23:42:12,055 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 69) WFLYCLINF0003: Stopped actionTokens cache from keycloak container > keycloak | 23:42:12,055 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 67) WFLYCLINF0003: Stopped sessions cache from keycloak container > keycloak | 23:42:12,067 INFO [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service thread 1-3) ISPN000080: Disconnecting JGroups channel ejb > keycloak | 23:42:12,078 ERROR [org.jboss.as.controller.management-operation] (Controller Boot Thread) WFLYCTL0013: Operation ("add") failed - address: ([("subsystem" => "microprofile-metrics-smallrye")]): java.lang.NullPointerException > keycloak | at org.wildfly.extension.microprofile.metrics.MicroProfileMetricsSubsystemAdd$2.execute(MicroProfileMetricsSubsystemAdd.java:86) > keycloak | at org.jboss.as.controller.AbstractOperationContext.executeStep(AbstractOperationContext.java:999) > keycloak | at org.jboss.as.controller.AbstractOperationContext.processStages(AbstractOperationContext.java:743) > keycloak | at org.jboss.as.controller.AbstractOperationContext.executeOperation(AbstractOperationContext.java:467) > keycloak | at org.jboss.as.controller.OperationContextImpl.executeOperation(OperationContextImpl.java:1412) > keycloak | at org.jboss.as.controller.ModelControllerImpl.boot(ModelControllerImpl.java:521) > keycloak | at org.jboss.as.controller.AbstractControllerService.boot(AbstractControllerService.java:472) > keycloak | at org.jboss.as.controller.AbstractControllerService.boot(AbstractControllerService.java:434) > keycloak | at org.jboss.as.server.ServerService.boot(ServerService.java:435) > keycloak | at org.jboss.as.server.ServerService.boot(ServerService.java:394) > keycloak | at org.jboss.as.controller.AbstractControllerService$1.run(AbstractControllerService.java:374) > keycloak | at java.lang.Thread.run(Thread.java:748) > keycloak | > keycloak | 23:42:12,080 ERROR [org.jboss.as.controller.management-operation] (Controller Boot Thread) WFLYCTL0190: Step handler org.jboss.as.server.DeployerChainAddHandler$FinalRuntimeStepHandler at 219052d3 for operation add-deployer-chains at address [] failed handling operation rollback -- java.util.concurrent.RejectedExecutionException: java.util.concurrent.RejectedExecutionException > keycloak | at org.jboss.threads.RejectingExecutor.execute(RejectingExecutor.java:37) > keycloak | at org.jboss.threads.EnhancedQueueExecutor.rejectShutdown(EnhancedQueueExecutor.java:2026) > keycloak | at org.jboss.threads.EnhancedQueueExecutor.execute(EnhancedQueueExecutor.java:757) > keycloak | at org.jboss.as.controller.notification.NotificationSupports$NonBlockingNotificationSupport.emit(NotificationSupports.java:95) > keycloak | at org.jboss.as.controller.OperationContextImpl.notifyModificationBegun(OperationContextImpl.java:876) > keycloak | at org.jboss.as.controller.OperationContextImpl.ensureWriteLockForRuntime(OperationContextImpl.java:865) > keycloak | at org.jboss.as.controller.OperationContextImpl.removeService(OperationContextImpl.java:638) > keycloak | at org.jboss.as.server.DeployerChainAddHandler$FinalRuntimeStepHandler$1.handleRollback(DeployerChainAddHandler.java:135) > keycloak | at org.jboss.as.controller.AbstractOperationContext$RollbackDelegatingResultHandler.handleResult(AbstractOperationContext.java:1561) > keycloak | at org.jboss.as.controller.AbstractOperationContext$Step.invokeResultHandler(AbstractOperationContext.java:1533) > keycloak | at org.jboss.as.controller.AbstractOperationContext$Step.handleResult(AbstractOperationContext.java:1515) > keycloak | at org.jboss.as.controller.AbstractOperationContext$Step.finalizeInternal(AbstractOperationContext.java:1472) > keycloak | at org.jboss.as.controller.AbstractOperationContext$Step.finalizeStep(AbstractOperationContext.java:1455) > keycloak | at org.jboss.as.controller.AbstractOperationContext$Step.access$400(AbstractOperationContext.java:1319) > keycloak | at org.jboss.as.controller.AbstractOperationContext.executeResultHandlerPhase(AbstractOperationContext.java:876) > keycloak | at org.jboss.as.controller.AbstractOperationContext.processStages(AbstractOperationContext.java:756) > keycloak | at org.jboss.as.controller.AbstractOperationContext.executeOperation(AbstractOperationContext.java:467) > keycloak | at org.jboss.as.controller.OperationContextImpl.executeOperation(OperationContextImpl.java:1412) > keycloak | at org.jboss.as.controller.ModelControllerImpl.boot(ModelControllerImpl.java:521) > keycloak | at org.jboss.as.controller.AbstractControllerService.boot(AbstractControllerService.java:472) > keycloak | at org.jboss.as.controller.AbstractControllerService.boot(AbstractControllerService.java:434) > keycloak | at org.jboss.as.server.ServerService.boot(ServerService.java:435) > keycloak | at org.jboss.as.server.ServerService.boot(ServerService.java:394) > keycloak | at org.jboss.as.controller.AbstractControllerService$1.run(AbstractControllerService.java:374) > keycloak | at java.lang.Thread.run(Thread.java:748) > keycloak | Suppressed: java.util.concurrent.RejectedExecutionException: Executor is being shut down > keycloak | at org.jboss.threads.EnhancedQueueExecutor.rejectShutdown(EnhancedQueueExecutor.java:2028) > keycloak | ... 23 more > keycloak | > keycloak | 23:42:12,080 ERROR [org.jboss.as.controller.client] (Controller Boot Thread) WFLYCTL0190: Step handler org.jboss.as.server.DeployerChainAddHandler$FinalRuntimeStepHandler at 219052d3 for operation add-deployer-chains at address [] failed handling operation rollback -- java.util.concurrent.RejectedExecutionException > keycloak | keycloak exited with code 1

6 years, 9 months

1
0
0 / 0

SAML Attributes using a general Attribute Importer doesn't work with specific IDP

by Kevin Kaminski

Hello 😊 I am writing the first time to this list so I hope I am doing everything correctly. But here’s what I need help with: Fits of all, we are using Keycloak version 5.0.0. in our company. I am trying a little bit around with the “Attribute Importer” in Keycloak, because I want to receive all SAML Attributes that get delivered via the Identity Providers SAML response, listed in one and the same attribute. And that works actually after I configured the Mapper Type “Attribute Importer”. I can see in Keycloak in my user account > Attributes that all of the Attributes are imported (such as groups, name, first name, mail address) and the will be listed in one grouped attribute (not sure if there is another official name for it) The way I configured the mapper is: * Name: saml_attributes * Mapper Typ: Attribute Importer * Attribute Name: empty * Friendly Name: empty * User Attribute Name: saml_attributes Now I configured a customer IDP (it’s called JOSSO) and I did the exact same configuration of the Attribute Importer. However, Keycloak could not import all SAML attributes. After investigation I could see the structure of the SAML response is different between both IDPs: The one that works (ADFS) looks like this: <AttributeStatement> <Attribute Name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress"> <AttributeValue>kevin.kaminski(a)movingimage.com</AttributeValue<mailto:kevin.kaminski@movingimage.com%3c/AttributeValue>> The one the importer doesn’t work: <saml:Attribute FriendlyName="MA_EMAIL" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" Name="MA_EMAIL"> <saml:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" Is it possible that “saml:” is the reason Keycloak can’t properly import it? Note: In general the “Attribute Importer” works if I configure dedicated mapper for mail, name, etc. I specify these mappers with a Friendly Name. But this “grouped” import, doesn’t work. I hope I could make clear what my problem is and I hope that someone is able to help. Many thanks in advance, Kevin Kevin Kaminski IT- Projektmanager movingimage EVP GmbH Stralauer Allee 7 | 10245 Berlin – Germany Tel: +49 (0)30.330 9660.330 Fax: +49 (0)30.330 9660.99 www.movingimage.com<http://www.movingimage.com/> Berlin | Tokyo | San Francisco | New York Limited liability company based in Berlin District court Berlin-Charlottenburg | HRB 94436 B Managing directors: Dr. Rainer Zugehör, Erdal Ahlatci Board of directors: Daniel Wild, Felix Artmann, Jörg Binnenbrücker, Tim Kindt, Dr. Dirk Schmücking, Russell Zack [http://www.movingimage.com/wp-content/uploads/sites/2/2019/06/mi_email-ba...]<https://www.movingimage.com/lp/advancedsubtitles/>

6 years, 9 months

2
3
0 / 0

Gatekeeper container automatically adds /* uri resource?

by Nick Powers

Bob, Thanks for your quick response. I tried the following but it still doesn't work resources: - uri: /protected/* - uri: /* white-listed: true Now I get the following error message: [error] you've asked for a default denial but whitelisted everything Apparently it doesn't like me marking /* as white-listed. I tried reversing it and marking /protected/* as white-listed and that worked but I am trying to do the reverse of that. I want /* to not require auth, so I can tell people about the site, etc, and provide a link to the authenticated (login) area in /protected/* Thanks - Nick -----Original Message----- From: keycloak-user-bounces at lists.jboss.org <https://lists.jboss.org/mailman/listinfo/keycloak-user> [mailto:keycloak-user-bounces at lists.jboss.org <https://lists.jboss.org/mailman/listinfo/keycloak-user>] On Behalf Of Bob Sheknowdas Sent: Wednesday, Jul 17, 2019 2:08 AM To: keycloak-user at lists.jboss.org <https://lists.jboss.org/mailman/listinfo/keycloak-user> Subject: [keycloak-user] Gatekeeper container automatically adds /* uri resource? > Hi, > > try using White-listed URL's > > resources: > - uri: /some_white_listed_url > white-listed: true > - uri: /* > methods: > - GET > roles: > - <CLIENT_APP_NAME>:<ROLE_NAME> > - <CLIENT_APP_NAME>:<ROLE_NAME> > > My Source: > https://github.com/jangaraj/keycloak-proxy/blob/master/README.md > > Best > Bob -----Original Message----- From: keycloak-user-bounces at lists.jboss.org <https://lists.jboss.org/mailman/listinfo/keycloak-user> [mailto:keycloak-user-bounces at lists.jboss.org <https://lists.jboss.org/mailman/listinfo/keycloak-user>] On Behalf Of Nick Powersia Sent: Tuesday, July 16, 2019 7:55 PM To: keycloak-user at lists.jboss.org <https://lists.jboss.org/mailman/listinfo/keycloak-user> Subject: [keycloak-user] Gatekeeper container automatically adds /* uri resource? >* Hello, *>>* Below is a snip from my Gatekeeper configuration, related to resources. I *>* only have /protected/* listed as a uri resource but loading the index at / *>* still initiates a login. I see from the logs (see below) that both *>* /protected/* and /* are being protected. How do I make it so only *>* /protected/* is a protected resource and the main /* of my site doesn't *>* require authentication? *>>* I was able to HACK (see below) it so that /* was only authenticated for a *>* single method (DELETE) by defining /* as a uri resource with just DELETE *>* listed under methods: but I would rather have a solution that works for all *>* methods. Is anyone aware of a way to tell gatekeeper not to authenticate *>* for /* and only do so for /protected/*? *>>* Thanks in advance! :) - Nick *>>* SNIP from my gatekeeper configuration: *>>* resources: *>* - uri: /protected/* *>>* LOGS showing both /protected: *>>* gatekeeper | {"level":"info","ts":1563319972.1478412,"msg":"protecting *>* resource","resource":"uri: /protected/*, methods: *>* DELETE,GET,HEAD,OPTIONS,PATCH,POST,PUT,TRACE, required: authentication *>* only"} *>* gatekeeper | {"level":"info","ts":1563319972.1482553,"msg":"protecting *>* resource","resource":"uri: /*, methods: *>* DELETE,GET,HEAD,OPTIONS,PATCH,POST,PUT,TRACE, required: authentication *>* only"} *>>* My HACK config: *>>* resources: *>* - uri: /protected/* *>* - uri: /* *>* methods: *>* - DELETE*

6 years, 9 months

1
0
0 / 0

Re: [keycloak-user] Gatekeeper container automatically adds /* uri resource?

by bob sheknowdas

Hi, try using White-listed URL's resources: - uri: /some_white_listed_url white-listed: true - uri: /* methods: - GET roles: - <CLIENT_APP_NAME>:<ROLE_NAME> - <CLIENT_APP_NAME>:<ROLE_NAME> My Source: https://github.com/jangaraj/keycloak-proxy/blob/master/README.md Best Bob -----Original Message----- From: keycloak-user-bounces at lists.jboss.org <https://lists.jboss.org/mailman/listinfo/keycloak-user> [mailto:keycloak-user-bounces at lists.jboss.org <https://lists.jboss.org/mailman/listinfo/keycloak-user>] On Behalf Of Nick Powersia Sent: Tuesday, July 16, 2019 7:55 PM To: keycloak-user at lists.jboss.org <https://lists.jboss.org/mailman/listinfo/keycloak-user> Subject: [keycloak-user] Gatekeeper container automatically adds /* uri resource? > Hello, > > Below is a snip from my Gatekeeper configuration, related to resources. I > only have /protected/* listed as a uri resource but loading the index at / > still initiates a login. I see from the logs (see below) that both > /protected/* and /* are being protected. How do I make it so only > /protected/* is a protected resource and the main /* of my site doesn't > require authentication? > > I was able to HACK (see below) it so that /* was only authenticated for a > single method (DELETE) by defining /* as a uri resource with just DELETE > listed under methods: but I would rather have a solution that works for all > methods. Is anyone aware of a way to tell gatekeeper not to authenticate > for /* and only do so for /protected/*? > > Thanks in advance! :) - Nick > > SNIP from my gatekeeper configuration: > > resources: > - uri: /protected/* > > LOGS showing both /protected: > > gatekeeper | {"level":"info","ts":1563319972.1478412,"msg":"protecting > resource","resource":"uri: /protected/*, methods: > DELETE,GET,HEAD,OPTIONS,PATCH,POST,PUT,TRACE, required: authentication > only"} > gatekeeper | {"level":"info","ts":1563319972.1482553,"msg":"protecting > resource","resource":"uri: /*, methods: > DELETE,GET,HEAD,OPTIONS,PATCH,POST,PUT,TRACE, required: authentication > only"} > > My HACK config: > > resources: > - uri: /protected/* > - uri: /* > methods: > - DELETE

6 years, 9 months

1
0
0 / 0

Gatekeeper container automatically adds /* uri resource?

by Nick Powers

Hello, Below is a snip from my Gatekeeper configuration, related to resources. I only have /protected/* listed as a uri resource but loading the index at / still initiates a login. I see from the logs (see below) that both /protected/* and /* are being protected. How do I make it so only /protected/* is a protected resource and the main /* of my site doesn't require authentication? I was able to HACK (see below) it so that /* was only authenticated for a single method (DELETE) by defining /* as a uri resource with just DELETE listed under methods: but I would rather have a solution that works for all methods. Is anyone aware of a way to tell gatekeeper not to authenticate for /* and only do so for /protected/*? Thanks in advance! :) - Nick SNIP from my gatekeeper configuration: resources: - uri: /protected/* LOGS showing both /protected: gatekeeper | {"level":"info","ts":1563319972.1478412,"msg":"protecting resource","resource":"uri: /protected/*, methods: DELETE,GET,HEAD,OPTIONS,PATCH,POST,PUT,TRACE, required: authentication only"} gatekeeper | {"level":"info","ts":1563319972.1482553,"msg":"protecting resource","resource":"uri: /*, methods: DELETE,GET,HEAD,OPTIONS,PATCH,POST,PUT,TRACE, required: authentication only"} My HACK config: resources: - uri: /protected/* - uri: /* methods: - DELETE

6 years, 9 months

1
0
0 / 0

Can only seem to use docker image 3.4.0.final

by Sinykk Skizm

I'm trying to run keycloak in docker and for whatever reason, it just won't. Except if I use the 3.4.0.Final tag, then keycloak spins up without any issues. This is my docker compose for jboss/keycloak # KeyCloak - Open Source Identity and Access Management keycloak: image: jboss/keycloak container_name: keycloak restart: always hostname: keycloak ports: - "8282:8080" environment: - DB_VENDOR=POSTGRES - DB_ADDR=postgresdb - DB_DATABASE=keycloak - DB_PORT=54320 - DB_USER=myuser - DB_SCHEMA=public - DB_PASSWORD=##mypassword$$ - PROXY_ADDRESS_FORWARDING=true - KEYCLOAK_LOGLEVEL=INFO - KEYCLOAK_USER=admin - KEYCLOAK_PASSWORD=##mypassword## depends_on: - postgresdb command: - "-b 0.0.0.0" - "-Dkeycloak.profile.feature.docker=enabled" This is is what's produced in the docker-compose logs. keycloak | ========================================================================= keycloak | keycloak | JBoss Bootstrap Environment keycloak | keycloak | JBOSS_HOME: /opt/jboss/keycloak keycloak | keycloak | JAVA: /usr/lib/jvm/java/bin/java keycloak | keycloak | JAVA_OPTS: -server -Xms64m -Xmx512m -XX:MetaspaceSize=96M -XX:MaxMetaspaceSize=256m -Djava.net.preferIPv4Stack=true -Djboss.modules.system.pkgs=org.jboss.byteman -Djava.awt.headless=true keycloak | keycloak | ========================================================================= keycloak | keycloak | 23:42:03,387 INFO [org.jboss.modules] (main) JBoss Modules version 1.9.0.Final keycloak | 23:42:03,769 INFO [org.jboss.msc] (main) JBoss MSC version 1.4.5.Final keycloak | 23:42:03,782 INFO [org.jboss.threads] (main) JBoss Threads version 2.3.3.Final keycloak | 23:42:03,918 INFO [org.jboss.as] (MSC service thread 1-1) WFLYSRV0049: Keycloak 6.0.1 (WildFly Core 8.0.0.Final) starting keycloak | 23:42:03,988 INFO [org.jboss.vfs] (MSC service thread 1-7) VFS000002: Failed to clean existing content for temp file provider of type temp. Enable DEBUG level log to find what caused this keycloak | 23:42:04,586 INFO [org.wildfly.security] (ServerService Thread Pool -- 19) ELY00001: WildFly Elytron version 1.8.0.Final keycloak | 23:42:05,261 INFO [org.jboss.as.controller.management-deprecated] (Controller Boot Thread) WFLYCTL0028: Attribute 'security-realm' in the resource at address '/core-service=management/management-interface=http-interface' is deprecated, and may be removed in a future version. See the attribute description in the output of the read-resource-description operation to learn more about the deprecation. keycloak | 23:42:05,293 INFO [org.jboss.as.controller.management-deprecated] (ServerService Thread Pool -- 29) WFLYCTL0028: Attribute 'security-realm' in the resource at address '/subsystem=undertow/server=default-server/https-listener=https' is deprecated, and may be removed in a future version. See the attribute description in the output of the read-resource-description operation to learn more about the deprecation. keycloak | 23:42:05,435 INFO [org.jboss.as.server] (Controller Boot Thread) WFLYSRV0039: Creating http management service using socket-binding (management-http) keycloak | 23:42:05,450 INFO [org.xnio] (MSC service thread 1-4) XNIO version 3.6.5.Final keycloak | 23:42:05,456 INFO [org.xnio.nio] (MSC service thread 1-4) XNIO NIO Implementation Version 3.6.5.Final keycloak | 23:42:05,498 INFO [org.wildfly.extension.io] (ServerService Thread Pool -- 39) WFLYIO001: Worker 'default' has auto-configured to 16 core threads with 128 task threads based on your 8 available processors keycloak | 23:42:05,501 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 38) WFLYCLINF0001: Activating Infinispan subsystem. keycloak | 23:42:05,507 INFO [org.jboss.as.clustering.jgroups] (ServerService Thread Pool -- 42) WFLYCLJG0001: Activating JGroups subsystem. JGroups version 4.0.18 keycloak | 23:42:05,501 INFO [org.jboss.as.connector.subsystems.datasources] (ServerService Thread Pool -- 33) WFLYJCA0004: Deploying JDBC-compliant driver class org.h2.Driver (version 1.4) keycloak | 23:42:05,512 INFO [org.jboss.as.connector] (MSC service thread 1-3) WFLYJCA0009: Starting JCA Subsystem (WildFly/IronJacamar 1.4.12.Final) keycloak | 23:42:05,518 INFO [org.jboss.as.connector.deployers.jdbc] (MSC service thread 1-1) WFLYJCA0018: Started Driver service with driver-name = h2 keycloak | 23:42:05,519 INFO [org.jboss.as.jaxrs] (ServerService Thread Pool -- 40) WFLYRS0016: RESTEasy version 3.6.3.Final keycloak | 23:42:05,536 INFO [org.jboss.as.connector.subsystems.datasources] (ServerService Thread Pool -- 33) WFLYJCA0005: Deploying non-JDBC-compliant driver class org.postgresql.Driver (version 42.2) keycloak | 23:42:05,550 INFO [org.jboss.as.connector.deployers.jdbc] (MSC service thread 1-6) WFLYJCA0018: Started Driver service with driver-name = postgresql keycloak | 23:42:05,565 INFO [org.jboss.remoting] (MSC service thread 1-4) JBoss Remoting version 5.0.8.Final keycloak | 23:42:05,588 INFO [org.wildfly.extension.microprofile.config.smallrye._private] (ServerService Thread Pool -- 47) WFLYCONF0001: Activating WildFly MicroProfile Config Subsystem keycloak | 23:42:05,607 WARN [org.jboss.as.txn] (ServerService Thread Pool -- 56) WFLYTX0013: The node-identifier attribute on the /subsystem=transactions is set to the default value. This is a danger for environments running multiple servers. Please make sure the attribute value is unique. keycloak | 23:42:05,615 INFO [org.wildfly.extension.microprofile.metrics.smallrye] (ServerService Thread Pool -- 49) WFLYMETRICS0001: Activating Eclipse MicroProfile Metrics Subsystem keycloak | 23:42:05,615 INFO [org.jboss.as.mail.extension] (MSC service thread 1-2) WFLYMAIL0002: Unbound mail session [java:jboss/mail/Default] keycloak | 23:42:05,618 INFO [org.wildfly.extension.microprofile.health.smallrye] (ServerService Thread Pool -- 48) WFLYHEALTH0001: Activating Eclipse MicroProfile Health Subsystem keycloak | 23:42:05,619 INFO [org.jboss.as.naming] (ServerService Thread Pool -- 51) WFLYNAM0001: Activating Naming Subsystem keycloak | 23:42:05,747 INFO [org.jboss.as.security] (ServerService Thread Pool -- 54) WFLYSEC0002: Activating Security Subsystem keycloak | 23:42:05,766 INFO [org.wildfly.extension.undertow] (MSC service thread 1-4) WFLYUT0003: Undertow 2.0.19.Final starting keycloak | 23:42:05,767 INFO [org.jboss.as.connector.subsystems.datasources] (MSC service thread 1-5) WFLYJCA0010: Unbound data source [java:jboss/datasources/ExampleDS] keycloak | 23:42:05,774 INFO [org.jboss.as.connector.subsystems.datasources] (MSC service thread 1-2) WFLYJCA0010: Unbound data source [java:jboss/datasources/KeycloakDS] keycloak | 23:42:05,789 INFO [org.jboss.as.security] (MSC service thread 1-4) WFLYSEC0001: Current PicketBox version=5.0.3.Final keycloak | 23:42:05,803 INFO [io.smallrye.metrics] (MSC service thread 1-6) Converted [2] config entries and added [4] replacements keycloak | 23:42:05,810 INFO [io.smallrye.metrics] (MSC service thread 1-6) Converted [3] config entries and added [14] replacements keycloak | 23:42:05,832 INFO [org.jboss.as.naming] (MSC service thread 1-2) WFLYNAM0003: Starting Naming Service keycloak | 23:42:05,841 INFO [org.jboss.as.mail.extension] (MSC service thread 1-4) WFLYMAIL0001: Bound mail session [java:jboss/mail/Default] keycloak | 23:42:05,858 INFO [org.jboss.as.ejb3] (MSC service thread 1-8) WFLYEJB0481: Strict pool slsb-strict-max-pool is using a max instance size of 128 (per class), which is derived from thread worker pool sizing. keycloak | 23:42:05,860 INFO [org.jboss.as.ejb3] (MSC service thread 1-7) WFLYEJB0482: Strict pool mdb-strict-max-pool is using a max instance size of 32 (per class), which is derived from the number of CPUs on this host. keycloak | 23:42:05,924 INFO [org.wildfly.extension.undertow] (ServerService Thread Pool -- 57) WFLYUT0014: Creating file handler for path '/opt/jboss/keycloak/welcome-content' with options [directory-listing: 'false', follow-symlink: 'false', case-sensitive: 'true', safe-symlink-paths: '[]'] keycloak | 23:42:05,934 INFO [org.wildfly.extension.undertow] (MSC service thread 1-6) WFLYUT0012: Started server default-server. keycloak | 23:42:05,953 INFO [org.wildfly.extension.undertow] (MSC service thread 1-1) WFLYUT0018: Host default-host starting keycloak | 23:42:05,987 INFO [org.wildfly.extension.undertow] (MSC service thread 1-2) WFLYUT0006: Undertow HTTP listener default listening on 0.0.0.0:8080 keycloak | 23:42:05,987 INFO [org.wildfly.extension.undertow] (MSC service thread 1-7) WFLYUT0006: Undertow AJP listener ajp listening on 0.0.0.0:8009 keycloak | 23:42:06,002 INFO [org.jboss.modcluster] (ServerService Thread Pool -- 58) MODCLUSTER000001: Initializing mod_cluster version 1.4.0.Final keycloak | 23:42:06,018 INFO [org.jboss.modcluster] (ServerService Thread Pool -- 58) MODCLUSTER000032: Listening to proxy advertisements on /224.0.1.105:23364 keycloak | 23:42:06,078 INFO [org.jboss.as.patching] (MSC service thread 1-5) WFLYPAT0050: Keycloak cumulative patch ID is: base, one-off patches include: none keycloak | 23:42:06,091 INFO [org.jboss.as.ejb3] (MSC service thread 1-3) WFLYEJB0493: EJB subsystem suspension complete keycloak | 23:42:06,096 WARN [org.jboss.as.domain.management.security] (MSC service thread 1-8) WFLYDM0111: Keystore /opt/jboss/keycloak/standalone/configuration/application.keystore not found, it will be auto generated on first use with a self signed certificate for host localhost keycloak | 23:42:06,108 INFO [org.jboss.as.server.deployment.scanner] (MSC service thread 1-4) WFLYDS0013: Started FileSystemDeploymentService for directory /opt/jboss/keycloak/standalone/deployments keycloak | 23:42:06,119 INFO [org.jboss.as.server.deployment] (MSC service thread 1-7) WFLYSRV0027: Starting deployment of "keycloak-server.war" (runtime-name: "keycloak-server.war") keycloak | 23:42:06,171 INFO [org.wildfly.extension.undertow] (MSC service thread 1-8) WFLYUT0006: Undertow HTTPS listener https listening on 0.0.0.0:8443 keycloak | 23:42:06,177 INFO [org.jboss.as.connector.subsystems.datasources] (MSC service thread 1-2) WFLYJCA0001: Bound data source [java:jboss/datasources/ExampleDS] keycloak | 23:42:06,178 INFO [org.jboss.as.connector.subsystems.datasources] (MSC service thread 1-7) WFLYJCA0001: Bound data source [java:jboss/datasources/KeycloakDS] keycloak | 23:42:06,344 WARN [org.jboss.as.dependency.private] (MSC service thread 1-1) WFLYSRV0018: Deployment "deployment.keycloak-server.war" is using a private module ("org.kie") which may be changed or removed in future versions without notice. keycloak | 23:42:06,631 WARN [org.jgroups.protocols.UDP] (ServerService Thread Pool -- 58) JGRP000015: the send buffer of socket ManagedMulticastSocketBinding was set to 1.00MB, but the OS only allocated 212.99KB. This might lead to performance problems. Please set your max send buffer in the OS correctly (e.g. net.core.wmem_max on Linux) keycloak | 23:42:06,632 WARN [org.jgroups.protocols.UDP] (ServerService Thread Pool -- 58) JGRP000015: the receive buffer of socket ManagedMulticastSocketBinding was set to 20.00MB, but the OS only allocated 212.99KB. This might lead to performance problems. Please set your max receive buffer in the OS correctly (e.g. net.core.rmem_max on Linux) keycloak | 23:42:06,632 WARN [org.jgroups.protocols.UDP] (ServerService Thread Pool -- 58) JGRP000015: the send buffer of socket ManagedMulticastSocketBinding was set to 1.00MB, but the OS only allocated 212.99KB. This might lead to performance problems. Please set your max send buffer in the OS correctly (e.g. net.core.wmem_max on Linux) keycloak | 23:42:06,632 WARN [org.jgroups.protocols.UDP] (ServerService Thread Pool -- 58) JGRP000015: the receive buffer of socket ManagedMulticastSocketBinding was set to 25.00MB, but the OS only allocated 212.99KB. This might lead to performance problems. Please set your max receive buffer in the OS correctly (e.g. net.core.rmem_max on Linux) keycloak | 23:42:09,641 INFO [org.jgroups.protocols.pbcast.GMS] (ServerService Thread Pool -- 58) keycloak: no members discovered after 3003 ms: creating cluster as first member keycloak | 23:42:09,939 INFO [org.infinispan.factories.GlobalComponentRegistry] (MSC service thread 1-7) ISPN000128: Infinispan version: Infinispan 'Infinity Minus ONE +2' 9.4.8.Final keycloak | 23:42:10,118 INFO [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service thread 1-4) ISPN000078: Starting JGroups channel ejb keycloak | 23:42:10,118 INFO [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service thread 1-1) ISPN000078: Starting JGroups channel ejb keycloak | 23:42:10,118 INFO [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service thread 1-5) ISPN000078: Starting JGroups channel ejb keycloak | 23:42:10,118 INFO [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service thread 1-6) ISPN000078: Starting JGroups channel ejb keycloak | 23:42:10,118 INFO [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service thread 1-7) ISPN000078: Starting JGroups channel ejb keycloak | 23:42:10,124 INFO [org.infinispan.CLUSTER] (MSC service thread 1-4) ISPN000094: Received new cluster view for channel ejb: [keycloak|0] (1) [keycloak] keycloak | 23:42:10,124 INFO [org.infinispan.CLUSTER] (MSC service thread 1-6) ISPN000094: Received new cluster view for channel ejb: [keycloak|0] (1) [keycloak] keycloak | 23:42:10,124 INFO [org.infinispan.CLUSTER] (MSC service thread 1-5) ISPN000094: Received new cluster view for channel ejb: [keycloak|0] (1) [keycloak] keycloak | 23:42:10,124 INFO [org.infinispan.CLUSTER] (MSC service thread 1-7) ISPN000094: Received new cluster view for channel ejb: [keycloak|0] (1) [keycloak] keycloak | 23:42:10,124 INFO [org.infinispan.CLUSTER] (MSC service thread 1-1) ISPN000094: Received new cluster view for channel ejb: [keycloak|0] (1) [keycloak] keycloak | 23:42:10,132 INFO [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service thread 1-1) ISPN000079: Channel ejb local address is keycloak, physical addresses are [172.19.0.6:55200] keycloak | 23:42:10,132 INFO [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service thread 1-6) ISPN000079: Channel ejb local address is keycloak, physical addresses are [172.19.0.6:55200] keycloak | 23:42:10,133 INFO [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service thread 1-4) ISPN000079: Channel ejb local address is keycloak, physical addresses are [172.19.0.6:55200] keycloak | 23:42:10,132 INFO [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service thread 1-7) ISPN000079: Channel ejb local address is keycloak, physical addresses are [172.19.0.6:55200] keycloak | 23:42:10,134 INFO [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service thread 1-5) ISPN000079: Channel ejb local address is keycloak, physical addresses are [172.19.0.6:55200] keycloak | 23:42:10,311 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 58) WFLYCLINF0002: Started users cache from keycloak container keycloak | 23:42:10,311 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 61) WFLYCLINF0002: Started realms cache from keycloak container keycloak | 23:42:10,311 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 65) WFLYCLINF0002: Started authorization cache from keycloak container keycloak | 23:42:10,311 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 68) WFLYCLINF0002: Started keys cache from keycloak container keycloak | 23:42:10,666 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 69) WFLYCLINF0002: Started offlineSessions cache from keycloak container keycloak | 23:42:10,666 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 64) WFLYCLINF0002: Started authenticationSessions cache from keycloak container keycloak | 23:42:10,668 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 63) WFLYCLINF0002: Started clientSessions cache from keycloak container keycloak | 23:42:10,668 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 67) WFLYCLINF0002: Started actionTokens cache from keycloak container keycloak | 23:42:10,668 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 62) WFLYCLINF0002: Started offlineClientSessions cache from keycloak container keycloak | 23:42:10,668 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 59) WFLYCLINF0002: Started sessions cache from keycloak container keycloak | 23:42:10,669 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 70) WFLYCLINF0002: Started client-mappings cache from ejb container keycloak | 23:42:10,669 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 66) WFLYCLINF0002: Started work cache from keycloak container keycloak | 23:42:10,670 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 60) WFLYCLINF0002: Started loginFailures cache from keycloak container keycloak | 23:42:10,798 WARN [org.jboss.as.server.deployment] (MSC service thread 1-6) WFLYSRV0273: Excluded subsystem weld via jboss-deployment-structure.xml does not exist. keycloak | 23:42:10,798 WARN [org.jboss.as.server.deployment] (MSC service thread 1-6) WFLYSRV0273: Excluded subsystem webservices via jboss-deployment-structure.xml does not exist. keycloak | 23:42:11,300 INFO [org.keycloak.services] (ServerService Thread Pool -- 60) KC-SERVICES0001: Loading config from standalone.xml or domain.xml keycloak | 23:42:11,612 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 60) WFLYCLINF0002: Started realmRevisions cache from keycloak container keycloak | 23:42:11,617 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 60) WFLYCLINF0002: Started userRevisions cache from keycloak container keycloak | 23:42:11,622 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 60) WFLYCLINF0002: Started authorizationRevisions cache from keycloak container keycloak | 23:42:11,623 INFO [org.keycloak.connections.infinispan.DefaultInfinispanConnectionProviderFactory] (ServerService Thread Pool -- 60) Node name: keycloak, Site name: null keycloak | 23:42:11,952 WARN [org.jboss.jca.core.connectionmanager.pool.strategy.OnePool] (ServerService Thread Pool -- 60) IJ000604: Throwable while attempting to get a new connection: null: javax.resource.ResourceException: IJ031084: Unable to create connection keycloak | at org.jboss.jca.adapters.jdbc.local.LocalManagedConnectionFactory.createLocalManagedConnection(LocalManagedConnectionFactory.java:345) keycloak | at org.jboss.jca.adapters.jdbc.local.LocalManagedConnectionFactory.getLocalManagedConnection(LocalManagedConnectionFactory.java:352) keycloak | at org.jboss.jca.adapters.jdbc.local.LocalManagedConnectionFactory.createManagedConnection(LocalManagedConnectionFactory.java:287) keycloak | at org.jboss.jca.core.connectionmanager.pool.mcp.SemaphoreConcurrentLinkedDequeManagedConnectionPool.createConnectionEventListener(SemaphoreConcurrentLinkedDequeManagedConnectionPool.java:1325) keycloak | at org.jboss.jca.core.connectionmanager.pool.mcp.SemaphoreConcurrentLinkedDequeManagedConnectionPool.getConnection(SemaphoreConcurrentLinkedDequeManagedConnectionPool.java:499) keycloak | at org.jboss.jca.core.connectionmanager.pool.AbstractPool.getSimpleConnection(AbstractPool.java:632) keycloak | at org.jboss.jca.core.connectionmanager.pool.AbstractPool.getConnection(AbstractPool.java:604) keycloak | at org.jboss.jca.core.connectionmanager.AbstractConnectionManager.getManagedConnection(AbstractConnectionManager.java:624) keycloak | at org.jboss.jca.core.connectionmanager.tx.TxConnectionManagerImpl.getManagedConnection(TxConnectionManagerImpl.java:440) keycloak | at org.jboss.jca.core.connectionmanager.AbstractConnectionManager.allocateConnection(AbstractConnectionManager.java:789) keycloak | at org.jboss.jca.adapters.jdbc.WrapperDataSource.getConnection(WrapperDataSource.java:138) keycloak | at org.jboss.as.connector.subsystems.datasources.WildFlyDataSource.getConnection(WildFlyDataSource.java:64) keycloak | at org.keycloak.connections.jpa.DefaultJpaConnectionProviderFactory.getConnection(DefaultJpaConnectionProviderFactory.java:376) keycloak | at org.keycloak.connections.jpa.updater.liquibase.lock.LiquibaseDBLockProvider.lazyInit(LiquibaseDBLockProvider.java:65) keycloak | at org.keycloak.connections.jpa.updater.liquibase.lock.LiquibaseDBLockProvider.lambda$waitForLock$0(LiquibaseDBLockProvider.java:97) keycloak | at org.keycloak.models.utils.KeycloakModelUtils.suspendJtaTransaction(KeycloakModelUtils.java:678) keycloak | at org.keycloak.connections.jpa.updater.liquibase.lock.LiquibaseDBLockProvider.waitForLock(LiquibaseDBLockProvider.java:95) keycloak | at org.keycloak.services.resources.KeycloakApplication$1.run(KeycloakApplication.java:144) keycloak | at org.keycloak.models.utils.KeycloakModelUtils.runJobInTransaction(KeycloakModelUtils.java:227) keycloak | at org.keycloak.services.resources.KeycloakApplication.<init>(KeycloakApplication.java:137) keycloak | at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method) keycloak | at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62) keycloak | at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45) keycloak | at java.lang.reflect.Constructor.newInstance(Constructor.java:423) keycloak | at org.jboss.resteasy.core.ConstructorInjectorImpl.construct(ConstructorInjectorImpl.java:152) keycloak | at org.jboss.resteasy.spi.ResteasyProviderFactory.createProviderInstance(ResteasyProviderFactory.java:2750) keycloak | at org.jboss.resteasy.spi.ResteasyDeployment.createApplication(ResteasyDeployment.java:364) keycloak | at org.jboss.resteasy.spi.ResteasyDeployment.startInternal(ResteasyDeployment.java:277) keycloak | at org.jboss.resteasy.spi.ResteasyDeployment.start(ResteasyDeployment.java:89) keycloak | at org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.init(ServletContainerDispatcher.java:119) keycloak | at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.init(HttpServletDispatcher.java:36) keycloak | at io.undertow.servlet.core.LifecyleInterceptorInvocation.proceed(LifecyleInterceptorInvocation.java:117) keycloak | at org.wildfly.extension.undertow.security.RunAsLifecycleInterceptor.init(RunAsLifecycleInterceptor.java:78) keycloak | at io.undertow.servlet.core.LifecyleInterceptorInvocation.proceed(LifecyleInterceptorInvocation.java:103) keycloak | at io.undertow.servlet.core.ManagedServlet$DefaultInstanceStrategy.start(ManagedServlet.java:303) keycloak | at io.undertow.servlet.core.ManagedServlet.createServlet(ManagedServlet.java:143) keycloak | at io.undertow.servlet.core.DeploymentManagerImpl$2.call(DeploymentManagerImpl.java:583) keycloak | at io.undertow.servlet.core.DeploymentManagerImpl$2.call(DeploymentManagerImpl.java:554) keycloak | at io.undertow.servlet.core.ServletRequestContextThreadSetupAction$1.call(ServletRequestContextThreadSetupAction.java:42) keycloak | at io.undertow.servlet.core.ContextClassLoaderSetupAction$1.call(ContextClassLoaderSetupAction.java:43) keycloak | at org.wildfly.extension.undertow.security.SecurityContextThreadSetupAction.lambda$create$0(SecurityContextThreadSetupAction.java:105) keycloak | at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502) keycloak | at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502) keycloak | at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502) keycloak | at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502) keycloak | at io.undertow.servlet.core.DeploymentManagerImpl.start(DeploymentManagerImpl.java:596) keycloak | at org.wildfly.extension.undertow.deployment.UndertowDeploymentService.startContext(UndertowDeploymentService.java:97) keycloak | at org.wildfly.extension.undertow.deployment.UndertowDeploymentService$1.run(UndertowDeploymentService.java:78) keycloak | at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511) keycloak | at java.util.concurrent.FutureTask.run(FutureTask.java:266) keycloak | at org.jboss.threads.ContextClassLoaderSavingRunnable.run(ContextClassLoaderSavingRunnable.java:35) keycloak | at org.jboss.threads.EnhancedQueueExecutor.safeRun(EnhancedQueueExecutor.java:1982) keycloak | at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.doRunTask(EnhancedQueueExecutor.java:1486) keycloak | at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1377) keycloak | at java.lang.Thread.run(Thread.java:748) keycloak | at org.jboss.threads.JBossThread.run(JBossThread.java:485) keycloak | Caused by: org.postgresql.util.PSQLException: The connection attempt failed. keycloak | at org.postgresql.core.v3.ConnectionFactoryImpl.openConnectionImpl(ConnectionFactoryImpl.java:292) keycloak | at org.postgresql.core.ConnectionFactory.openConnection(ConnectionFactory.java:49) keycloak | at org.postgresql.jdbc.PgConnection.<init>(PgConnection.java:195) keycloak | at org.postgresql.Driver.makeConnection(Driver.java:454) keycloak | at org.postgresql.Driver.connect(Driver.java:256) keycloak | at org.jboss.jca.adapters.jdbc.local.LocalManagedConnectionFactory.createLocalManagedConnection(LocalManagedConnectionFactory.java:321) keycloak | ... 55 more keycloak | Caused by: java.net.UnknownHostException: postgresdb keycloak | at java.net.AbstractPlainSocketImpl.connect(AbstractPlainSocketImpl.java:184) keycloak | at java.net.SocksSocketImpl.connect(SocksSocketImpl.java:392) keycloak | at java.net.Socket.connect(Socket.java:589) keycloak | at org.postgresql.core.PGStream.<init>(PGStream.java:70) keycloak | at org.postgresql.core.v3.ConnectionFactoryImpl.tryConnect(ConnectionFactoryImpl.java:91) keycloak | at org.postgresql.core.v3.ConnectionFactoryImpl.openConnectionImpl(ConnectionFactoryImpl.java:192) keycloak | ... 60 more keycloak | keycloak | 23:42:11,960 INFO [org.jboss.as.server] (Thread-2) WFLYSRV0220: Server shutdown has been requested via an OS signal keycloak | 23:42:11,971 ERROR [org.jboss.msc.service.fail] (ServerService Thread Pool -- 60) MSC000001: Failed to start service jboss.deployment.unit."keycloak-server.war".undertow-deployment: org.jboss.msc.service.StartException in service jboss.deployment.unit."keycloak-server.war".undertow-deployment: java.lang.RuntimeException: RESTEASY003325: Failed to construct public org.keycloak.services.resources.KeycloakApplication(javax.servlet.ServletContext,org.jboss.resteasy.core.Dispatcher) keycloak | at org.wildfly.extension.undertow.deployment.UndertowDeploymentService$1.run(UndertowDeploymentService.java:81) keycloak | at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511) keycloak | at java.util.concurrent.FutureTask.run(FutureTask.java:266) keycloak | at org.jboss.threads.ContextClassLoaderSavingRunnable.run(ContextClassLoaderSavingRunnable.java:35) keycloak | at org.jboss.threads.EnhancedQueueExecutor.safeRun(EnhancedQueueExecutor.java:1982) keycloak | at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.doRunTask(EnhancedQueueExecutor.java:1486) keycloak | at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1377) keycloak | at java.lang.Thread.run(Thread.java:748) keycloak | at org.jboss.threads.JBossThread.run(JBossThread.java:485) keycloak | Caused by: java.lang.RuntimeException: RESTEASY003325: Failed to construct public org.keycloak.services.resources.KeycloakApplication(javax.servlet.ServletContext,org.jboss.resteasy.core.Dispatcher) keycloak | at org.jboss.resteasy.core.ConstructorInjectorImpl.construct(ConstructorInjectorImpl.java:164) keycloak | at org.jboss.resteasy.spi.ResteasyProviderFactory.createProviderInstance(ResteasyProviderFactory.java:2750) keycloak | at org.jboss.resteasy.spi.ResteasyDeployment.createApplication(ResteasyDeployment.java:364) keycloak | at org.jboss.resteasy.spi.ResteasyDeployment.startInternal(ResteasyDeployment.java:277) keycloak | at org.jboss.resteasy.spi.ResteasyDeployment.start(ResteasyDeployment.java:89) keycloak | at org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.init(ServletContainerDispatcher.java:119) keycloak | at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.init(HttpServletDispatcher.java:36) keycloak | at io.undertow.servlet.core.LifecyleInterceptorInvocation.proceed(LifecyleInterceptorInvocation.java:117) keycloak | at org.wildfly.extension.undertow.security.RunAsLifecycleInterceptor.init(RunAsLifecycleInterceptor.java:78) keycloak | at io.undertow.servlet.core.LifecyleInterceptorInvocation.proceed(LifecyleInterceptorInvocation.java:103) keycloak | at io.undertow.servlet.core.ManagedServlet$DefaultInstanceStrategy.start(ManagedServlet.java:303) keycloak | at io.undertow.servlet.core.ManagedServlet.createServlet(ManagedServlet.java:143) keycloak | at io.undertow.servlet.core.DeploymentManagerImpl$2.call(DeploymentManagerImpl.java:583) keycloak | at io.undertow.servlet.core.DeploymentManagerImpl$2.call(DeploymentManagerImpl.java:554) keycloak | at io.undertow.servlet.core.ServletRequestContextThreadSetupAction$1.call(ServletRequestContextThreadSetupAction.java:42) keycloak | at io.undertow.servlet.core.ContextClassLoaderSetupAction$1.call(ContextClassLoaderSetupAction.java:43) keycloak | at org.wildfly.extension.undertow.security.SecurityContextThreadSetupAction.lambda$create$0(SecurityContextThreadSetupAction.java:105) keycloak | at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502) keycloak | at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502) keycloak | at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502) keycloak | at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502) keycloak | at io.undertow.servlet.core.DeploymentManagerImpl.start(DeploymentManagerImpl.java:596) keycloak | at org.wildfly.extension.undertow.deployment.UndertowDeploymentService.startContext(UndertowDeploymentService.java:97) keycloak | at org.wildfly.extension.undertow.deployment.UndertowDeploymentService$1.run(UndertowDeploymentService.java:78) keycloak | ... 8 more keycloak | Caused by: java.lang.RuntimeException: Failed to connect to database keycloak | at org.keycloak.connections.jpa.DefaultJpaConnectionProviderFactory.getConnection(DefaultJpaConnectionProviderFactory.java:382) keycloak | at org.keycloak.connections.jpa.updater.liquibase.lock.LiquibaseDBLockProvider.lazyInit(LiquibaseDBLockProvider.java:65) keycloak | at org.keycloak.connections.jpa.updater.liquibase.lock.LiquibaseDBLockProvider.lambda$waitForLock$0(LiquibaseDBLockProvider.java:97) keycloak | at org.keycloak.models.utils.KeycloakModelUtils.suspendJtaTransaction(KeycloakModelUtils.java:678) keycloak | at org.keycloak.connections.jpa.updater.liquibase.lock.LiquibaseDBLockProvider.waitForLock(LiquibaseDBLockProvider.java:95) keycloak | at org.keycloak.services.resources.KeycloakApplication$1.run(KeycloakApplication.java:144) keycloak | at org.keycloak.models.utils.KeycloakModelUtils.runJobInTransaction(KeycloakModelUtils.java:227) keycloak | at org.keycloak.services.resources.KeycloakApplication.<init>(KeycloakApplication.java:137) keycloak | at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method) keycloak | at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62) keycloak | at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45) keycloak | at java.lang.reflect.Constructor.newInstance(Constructor.java:423) keycloak | at org.jboss.resteasy.core.ConstructorInjectorImpl.construct(ConstructorInjectorImpl.java:152) keycloak | ... 31 more keycloak | Caused by: java.sql.SQLException: javax.resource.ResourceException: IJ000453: Unable to get managed connection for java:jboss/datasources/KeycloakDS keycloak | at org.jboss.jca.adapters.jdbc.WrapperDataSource.getConnection(WrapperDataSource.java:146) keycloak | at org.jboss.as.connector.subsystems.datasources.WildFlyDataSource.getConnection(WildFlyDataSource.java:64) keycloak | at org.keycloak.connections.jpa.DefaultJpaConnectionProviderFactory.getConnection(DefaultJpaConnectionProviderFactory.java:376) keycloak | ... 43 more keycloak | Caused by: javax.resource.ResourceException: IJ000453: Unable to get managed connection for java:jboss/datasources/KeycloakDS keycloak | at org.jboss.jca.core.connectionmanager.AbstractConnectionManager.getManagedConnection(AbstractConnectionManager.java:690) keycloak | at org.jboss.jca.core.connectionmanager.tx.TxConnectionManagerImpl.getManagedConnection(TxConnectionManagerImpl.java:440) keycloak | at org.jboss.jca.core.connectionmanager.AbstractConnectionManager.allocateConnection(AbstractConnectionManager.java:789) keycloak | at org.jboss.jca.adapters.jdbc.WrapperDataSource.getConnection(WrapperDataSource.java:138) keycloak | ... 45 more keycloak | Caused by: javax.resource.ResourceException: IJ031084: Unable to create connection keycloak | at org.jboss.jca.adapters.jdbc.local.LocalManagedConnectionFactory.createLocalManagedConnection(LocalManagedConnectionFactory.java:345) keycloak | at org.jboss.jca.adapters.jdbc.local.LocalManagedConnectionFactory.getLocalManagedConnection(LocalManagedConnectionFactory.java:352) keycloak | at org.jboss.jca.adapters.jdbc.local.LocalManagedConnectionFactory.createManagedConnection(LocalManagedConnectionFactory.java:287) keycloak | at org.jboss.jca.core.connectionmanager.pool.mcp.SemaphoreConcurrentLinkedDequeManagedConnectionPool.createConnectionEventListener(SemaphoreConcurrentLinkedDequeManagedConnectionPool.java:1325) keycloak | at org.jboss.jca.core.connectionmanager.pool.mcp.SemaphoreConcurrentLinkedDequeManagedConnectionPool.getConnection(SemaphoreConcurrentLinkedDequeManagedConnectionPool.java:499) keycloak | at org.jboss.jca.core.connectionmanager.pool.AbstractPool.getSimpleConnection(AbstractPool.java:632) keycloak | at org.jboss.jca.core.connectionmanager.pool.AbstractPool.getConnection(AbstractPool.java:604) keycloak | at org.jboss.jca.core.connectionmanager.AbstractConnectionManager.getManagedConnection(AbstractConnectionManager.java:624) keycloak | ... 48 more keycloak | Caused by: org.postgresql.util.PSQLException: The connection attempt failed. keycloak | at org.postgresql.core.v3.ConnectionFactoryImpl.openConnectionImpl(ConnectionFactoryImpl.java:292) keycloak | at org.postgresql.core.ConnectionFactory.openConnection(ConnectionFactory.java:49) keycloak | at org.postgresql.jdbc.PgConnection.<init>(PgConnection.java:195) keycloak | at org.postgresql.Driver.makeConnection(Driver.java:454) keycloak | at org.postgresql.Driver.connect(Driver.java:256) keycloak | at org.jboss.jca.adapters.jdbc.local.LocalManagedConnectionFactory.createLocalManagedConnection(LocalManagedConnectionFactory.java:321) keycloak | ... 55 more keycloak | Caused by: java.net.UnknownHostException: postgresdb keycloak | at java.net.AbstractPlainSocketImpl.connect(AbstractPlainSocketImpl.java:184) keycloak | at java.net.SocksSocketImpl.connect(SocksSocketImpl.java:392) keycloak | at java.net.Socket.connect(Socket.java:589) keycloak | at org.postgresql.core.PGStream.<init>(PGStream.java:70) keycloak | at org.postgresql.core.v3.ConnectionFactoryImpl.tryConnect(ConnectionFactoryImpl.java:91) keycloak | at org.postgresql.core.v3.ConnectionFactoryImpl.openConnectionImpl(ConnectionFactoryImpl.java:192) keycloak | ... 60 more keycloak | keycloak | 23:42:11,996 INFO [org.jboss.as.connector.subsystems.datasources] (MSC service thread 1-8) WFLYJCA0010: Unbound data source [java:jboss/datasources/KeycloakDS] keycloak | 23:42:11,998 INFO [org.jboss.as.mail.extension] (MSC service thread 1-7) WFLYMAIL0002: Unbound mail session [java:jboss/mail/Default] keycloak | 23:42:11,998 INFO [org.wildfly.extension.undertow] (MSC service thread 1-7) WFLYUT0008: Undertow HTTPS listener https suspending keycloak | 23:42:12,002 INFO [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service thread 1-3) ISPN000080: Disconnecting JGroups channel ejb keycloak | 23:42:12,003 INFO [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service thread 1-1) ISPN000080: Disconnecting JGroups channel ejb keycloak | 23:42:12,005 INFO [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service thread 1-4) ISPN000080: Disconnecting JGroups channel ejb keycloak | 23:42:12,009 INFO [org.jboss.as.connector.subsystems.datasources] (MSC service thread 1-1) WFLYJCA0010: Unbound data source [java:jboss/datasources/ExampleDS] keycloak | 23:42:12,010 INFO [org.jboss.modcluster] (ServerService Thread Pool -- 70) MODCLUSTER000002: Initiating mod_cluster shutdown keycloak | 23:42:12,010 INFO [org.wildfly.extension.undertow] (MSC service thread 1-5) WFLYUT0008: Undertow AJP listener ajp suspending keycloak | 23:42:12,012 INFO [org.jboss.as.connector.deployers.jdbc] (MSC service thread 1-3) WFLYJCA0019: Stopped Driver service with driver-name = postgresql keycloak | 23:42:12,012 INFO [org.jboss.as.connector.deployers.jdbc] (MSC service thread 1-1) WFLYJCA0019: Stopped Driver service with driver-name = h2 keycloak | 23:42:12,016 INFO [org.wildfly.extension.undertow] (MSC service thread 1-7) WFLYUT0007: Undertow HTTPS listener https stopped, was bound to 0.0.0.0:8443 keycloak | 23:42:12,016 INFO [org.wildfly.extension.undertow] (MSC service thread 1-5) WFLYUT0007: Undertow AJP listener ajp stopped, was bound to 0.0.0.0:8009 keycloak | 23:42:12,022 INFO [org.wildfly.extension.undertow] (MSC service thread 1-5) WFLYUT0008: Undertow HTTP listener default suspending keycloak | 23:42:12,025 INFO [org.wildfly.extension.undertow] (MSC service thread 1-5) WFLYUT0007: Undertow HTTP listener default stopped, was bound to 0.0.0.0:8080 keycloak | 23:42:12,029 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 66) WFLYCLINF0003: Stopped client-mappings cache from ejb container keycloak | 23:42:12,031 INFO [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service thread 1-1) ISPN000080: Disconnecting JGroups channel ejb keycloak | 23:42:12,034 INFO [org.wildfly.extension.undertow] (MSC service thread 1-4) WFLYUT0019: Host default-host stopping keycloak | 23:42:12,035 INFO [org.wildfly.extension.undertow] (MSC service thread 1-3) WFLYUT0004: Undertow 2.0.19.Final stopping keycloak | 23:42:12,040 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 60) WFLYCLINF0003: Stopped keys cache from keycloak container keycloak | 23:42:12,040 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 64) WFLYCLINF0003: Stopped authorization cache from keycloak container keycloak | 23:42:12,043 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 64) WFLYCLINF0003: Stopped users cache from keycloak container keycloak | 23:42:12,046 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 61) WFLYCLINF0003: Stopped realms cache from keycloak container keycloak | 23:42:12,046 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 59) WFLYCLINF0003: Stopped work cache from keycloak container keycloak | 23:42:12,049 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 60) WFLYCLINF0003: Stopped offlineSessions cache from keycloak container keycloak | 23:42:12,051 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 70) WFLYCLINF0003: Stopped authenticationSessions cache from keycloak container keycloak | 23:42:12,051 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 66) WFLYCLINF0003: Stopped clientSessions cache from keycloak container keycloak | 23:42:12,053 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 62) WFLYCLINF0003: Stopped offlineClientSessions cache from keycloak container keycloak | 23:42:12,054 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 63) WFLYCLINF0003: Stopped loginFailures cache from keycloak container keycloak | 23:42:12,055 INFO [org.jboss.as.server.deployment] (MSC service thread 1-5) WFLYSRV0028: Stopped deployment keycloak-server.war (runtime-name: keycloak-server.war) in 90ms keycloak | 23:42:12,055 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 69) WFLYCLINF0003: Stopped actionTokens cache from keycloak container keycloak | 23:42:12,055 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 67) WFLYCLINF0003: Stopped sessions cache from keycloak container keycloak | 23:42:12,067 INFO [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service thread 1-3) ISPN000080: Disconnecting JGroups channel ejb keycloak | 23:42:12,078 ERROR [org.jboss.as.controller.management-operation] (Controller Boot Thread) WFLYCTL0013: Operation ("add") failed - address: ([("subsystem" => "microprofile-metrics-smallrye")]): java.lang.NullPointerException keycloak | at org.wildfly.extension.microprofile.metrics.MicroProfileMetricsSubsystemAdd$2.execute(MicroProfileMetricsSubsystemAdd.java:86) keycloak | at org.jboss.as.controller.AbstractOperationContext.executeStep(AbstractOperationContext.java:999) keycloak | at org.jboss.as.controller.AbstractOperationContext.processStages(AbstractOperationContext.java:743) keycloak | at org.jboss.as.controller.AbstractOperationContext.executeOperation(AbstractOperationContext.java:467) keycloak | at org.jboss.as.controller.OperationContextImpl.executeOperation(OperationContextImpl.java:1412) keycloak | at org.jboss.as.controller.ModelControllerImpl.boot(ModelControllerImpl.java:521) keycloak | at org.jboss.as.controller.AbstractControllerService.boot(AbstractControllerService.java:472) keycloak | at org.jboss.as.controller.AbstractControllerService.boot(AbstractControllerService.java:434) keycloak | at org.jboss.as.server.ServerService.boot(ServerService.java:435) keycloak | at org.jboss.as.server.ServerService.boot(ServerService.java:394) keycloak | at org.jboss.as.controller.AbstractControllerService$1.run(AbstractControllerService.java:374) keycloak | at java.lang.Thread.run(Thread.java:748) keycloak | keycloak | 23:42:12,080 ERROR [org.jboss.as.controller.management-operation] (Controller Boot Thread) WFLYCTL0190: Step handler org.jboss.as.server.DeployerChainAddHandler$FinalRuntimeStepHandler@219052d3 for operation add-deployer-chains at address [] failed handling operation rollback -- java.util.concurrent.RejectedExecutionException: java.util.concurrent.RejectedExecutionException keycloak | at org.jboss.threads.RejectingExecutor.execute(RejectingExecutor.java:37) keycloak | at org.jboss.threads.EnhancedQueueExecutor.rejectShutdown(EnhancedQueueExecutor.java:2026) keycloak | at org.jboss.threads.EnhancedQueueExecutor.execute(EnhancedQueueExecutor.java:757) keycloak | at org.jboss.as.controller.notification.NotificationSupports$NonBlockingNotificationSupport.emit(NotificationSupports.java:95) keycloak | at org.jboss.as.controller.OperationContextImpl.notifyModificationBegun(OperationContextImpl.java:876) keycloak | at org.jboss.as.controller.OperationContextImpl.ensureWriteLockForRuntime(OperationContextImpl.java:865) keycloak | at org.jboss.as.controller.OperationContextImpl.removeService(OperationContextImpl.java:638) keycloak | at org.jboss.as.server.DeployerChainAddHandler$FinalRuntimeStepHandler$1.handleRollback(DeployerChainAddHandler.java:135) keycloak | at org.jboss.as.controller.AbstractOperationContext$RollbackDelegatingResultHandler.handleResult(AbstractOperationContext.java:1561) keycloak | at org.jboss.as.controller.AbstractOperationContext$Step.invokeResultHandler(AbstractOperationContext.java:1533) keycloak | at org.jboss.as.controller.AbstractOperationContext$Step.handleResult(AbstractOperationContext.java:1515) keycloak | at org.jboss.as.controller.AbstractOperationContext$Step.finalizeInternal(AbstractOperationContext.java:1472) keycloak | at org.jboss.as.controller.AbstractOperationContext$Step.finalizeStep(AbstractOperationContext.java:1455) keycloak | at org.jboss.as.controller.AbstractOperationContext$Step.access$400(AbstractOperationContext.java:1319) keycloak | at org.jboss.as.controller.AbstractOperationContext.executeResultHandlerPhase(AbstractOperationContext.java:876) keycloak | at org.jboss.as.controller.AbstractOperationContext.processStages(AbstractOperationContext.java:756) keycloak | at org.jboss.as.controller.AbstractOperationContext.executeOperation(AbstractOperationContext.java:467) keycloak | at org.jboss.as.controller.OperationContextImpl.executeOperation(OperationContextImpl.java:1412) keycloak | at org.jboss.as.controller.ModelControllerImpl.boot(ModelControllerImpl.java:521) keycloak | at org.jboss.as.controller.AbstractControllerService.boot(AbstractControllerService.java:472) keycloak | at org.jboss.as.controller.AbstractControllerService.boot(AbstractControllerService.java:434) keycloak | at org.jboss.as.server.ServerService.boot(ServerService.java:435) keycloak | at org.jboss.as.server.ServerService.boot(ServerService.java:394) keycloak | at org.jboss.as.controller.AbstractControllerService$1.run(AbstractControllerService.java:374) keycloak | at java.lang.Thread.run(Thread.java:748) keycloak | Suppressed: java.util.concurrent.RejectedExecutionException: Executor is being shut down keycloak | at org.jboss.threads.EnhancedQueueExecutor.rejectShutdown(EnhancedQueueExecutor.java:2028) keycloak | ... 23 more keycloak | keycloak | 23:42:12,080 ERROR [org.jboss.as.controller.client] (Controller Boot Thread) WFLYCTL0190: Step handler org.jboss.as.server.DeployerChainAddHandler$FinalRuntimeStepHandler@219052d3 for operation add-deployer-chains at address [] failed handling operation rollback -- java.util.concurrent.RejectedExecutionException keycloak | keycloak exited with code 1

6 years, 9 months

1
0
0 / 0

Keycloak Gatekeeper (forwarding proxy) does nothing

by bob sheknowdas

Hi, I have a docker-compose setup with service 1 (grafana) sending requests to service 2 (prometheus). I've put a Keycloak Gatekeeper in front of service 2, asking for authentication. That works perfectly fine. Now my idea was to also place a second Keycloak Gatekeeper in front of service 1, injecting said authentication. Unfortunately, that doesnt work. Observing my traffic via wireshark, it seems my second Keycloak Gatekeeper is not even involved in any communication. My docker compose file for service 1 and the forwarding proxy looks roughly like this: keycloak-forwarder: image: quay.io/keycloak/keycloak-gatekeeper command: - --enable-forwarding=true - --forwarding-username=<my_username> - --forwarding-password=<my_password> - --forwarding-domains=${BASE_DOMAIN}/grafana - --listen=:3001 - --client-id=<my_keycloak_client_id> - --client-secret=<my_keycloak_client_secret> - --discovery-url=${DOMAIN_PROTOCOL}://${KEYCLOAK_DOMAIN}/auth/realms/<my_keycloak_realm> networks: - webgateway grafana: image: grafana/grafana networks: - webgateway labels: traefik.enable: true traefik.backend: grafana traefik.frontend.rule: Host:${BASE_DOMAIN};PathPrefix:/grafana;PathPrefixStrip:/grafana traefik.port: 3000 traefik.docker.network: webgateway Do you have any idea how to fix this? Best Bob

6 years, 9 months

1
0
0 / 0

Redirect issue with HTTPS and Proxy

by Yang Yang

Hello, I am trying to make keycloak work behind a Nginx proxy with HTTPS, but got an redirect issue. Could you help to shed some light? 1. keycloak in standalone mode is installed on local_ip_a and public_ip_a, while Nginx is on local_ip_b and public_ip_b. local_ip_a and local_ip_b are in the same subnet. 2. keycloak works fine with https when I reach it with local_ip_a or public_ip_a, following guide here <https://www.keycloak.org/docs/6.0/server_installation/index.html#enabling...> ... <security-realm name="UndertowRealm"> <server-identities> <ssl> <keystore path="keycloak.jks" relative-to="jboss.server.config.dir" keystore-password="secret" /> </ssl> </server-identities> </security-realm> … <server name="default-server"> <http-listener name="default" socket-binding="http" redirect-socket="https" enable-http2="true"/> <https-listener name="https" socket-binding="https" security-realm="UndertowRealm" enable-http2="true"/> <host name="default-host" alias="localhost"> <location name="/" handler="welcome-content"/> <http-invoker security-realm="ApplicationRealm"/> </host> </server> ... 3. my nginx configuration for keycloak is as below: … server { listen 8443 ssl; ... location /auth/ { proxy_pass https://local_ip_a:8443/auth/; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; } … 4. I set the fixed provide following this <https://github.com/keycloak/keycloak-documentation/blob/6.0.1/server_admi...>: <spi name="hostname"> <default-provider>request</default-provider> <provider name="fixed" enabled="true"> <properties> <property name="hostname" value="public_ip_b"/> <property name="httpPort" value="-1"/> <property name="httpsPort" value="-1"/> </properties> </provider> </spi> 5. I was able to get the keycloak welcome page at https://public_ip_b:8443/auth/, but when accessing https://public_ip_b:8443/auth/admin, I was redirected to https://public_ip_b:8443/auth/admin/master/console/ and then to the following address: https://local_ip_a:8443/auth/realms/master/protocol/openid-connect/auth?c... 6. The keycloak message tells: 22:19:44,848 WARN [org.keycloak.events] (default task-16) type=LOGIN_ERROR, realmId=master, clientId=security-admin-console, userId=null, ipAddress= local_ip_b, error=invalid_redirect_uri, redirect_uri=https://public_ip_b:8443/auth/admin/master/console/ 7. I tried to add https://public_ip_b:8443/auth/* to security-admin-console setting, but got no luck…

6 years, 9 months

1
1
0 / 0

Keycloak/Gatekeeper "You don't have authorization to view this page" after login

by Nick Powers

Hello, I have installed Keycloak and Gatekeeper with hopes that i can use it to authenticate for my web application, which is written in PHP. I am getting redirected to Keycloak by Gatekeeper and I am able to register for an account once there. But, as soon as I finish creating the account, or now when I return to my domain I get a 403 error message "You don't have authorization to view this page." The URL that I am landing on is https://commentcontext.com/oauth/callback?state=3e810acf-ff2d-448c-9165-0... Does anyone have any idea why I am getting the 403 error message? I added a new realm and a client in that realm but I didn't add any roles or anything else to it. Also, I have yet to write any code for my webapp yet. I just have an index.php in / that dumps the headers and phpinfo(). Any help would be greatly appreciated! I am happy to provide any additional info that might help you determine the problem. Just let me know what you need. Thanks, Nick

6 years, 9 months

1
0
0 / 0

Offline Token Unique Constraint Violation Errors in 6.0.0

by Harness, Josh

Hello - I'm using keycloak version 6.0.0. Recently, we started seeing unique constraint violations when creating a new offline session for a user. In particular, this constraint is violated: CONSTRAINT_OFFL_CL_SES_PK3 I looked this constraint up and it appears to be the combination of the following columns on the following columns of the "offline_client_session" table: USER_SESSION_ID, CLIENT_ID, CLIENT_STORAGE_PROVIDER, EXTERNAL_CLIENT_ID, OFFLINE_FLAG I enabled trace logging for the UserSession class and can tell that the application believes that it needs to create the row in the offline_client_session table even though the row already exists in the table. As a result, the unique constraint violation occurs and the call fails. This makes me believe it exclusively expects its cache to be a copy of the database and somehow it has gotten out of sync with the database and isn't querying the database when it has a cache "miss". A couple of notes that may be important: * I'm creating the offline token as part of a token exchange * We have configured the offline sessions cache to use passivation (with preloading enabled and purging disabled) Any advice that can be offered as far as how to debug this would be appreciated. I've been unable to make it happen in non-prod but it happens often in prod. Thanks! Josh

6 years, 9 months

1
0
0 / 0

Re: [keycloak-user] Not being prompted for x509 User Certs

by JTK

I wanted to give an update which might help other users. The first issue we had was related to the load balancer and to be specific Amazon ELB. I was under the impression it was set to be pass-thru, but instead it was setup to do SSL termination. After that was fixed, then I was getting prompted for certificates and I was seeing logs, which I was happy with, even error logs, even better. The next issue was related to when our PFX chain was imported into the keystore. The issue was that PFX file had a different password than the keystore in the standalone.xml configuration file. After changing the password and re-importing it back it, that error logs related to padding for the keystore were resolved. Basically error in padding in our case = wrong password in the keystore. The last issue was locating the correct RegEx for our instance. For us, this worked: User Identity Source: Subject Alternative Name A regular expression to extract user identity : RFC822Name=(.*?)(?:,|$) A big shout out to Peter! Thanks for your assistance. On Thu, Jun 27, 2019 at 12:37 PM JTK <jonesy(a)sydow.org> wrote: > Hello, > > I've read through all the documentation I can find online both with the > official documents and everything else I could find and I believe I have > everything setup, with additional logging turned on, but I'm not getting > any type of prompt for a x509 certificate when logging in. > > Here is the excerpt from the standalone.xml file > > <management> > <security-realms> > ...... > <security-realm name="ssl-realm"> > <server-identities> > <ssl> > <keystore path="keycloak.jks" > relative-to="jboss.server.config.dir" keystore-password="mypass"/> > </ssl> > </server-identities> > <authentication> > <truststore path="truststore.jks" > relative-to="jboss.server.config.dir" keystore-password="mypass"/> > </authentication> > </security-realm> > ...... > > <subsystem xmlns="urn:jboss:domain:undertow:7.0" > default-server="default-server" default-virtual-host="default-host" > default-servlet-container="default" default-security-domain="other"> > <buffer-cache name="default"/> > <server name="default-server"> > <http-listener name="default1" socket-binding="http" > redirect-socket="https" enable-http2="true"/> > <https-listener name="default" socket-binding="https" > security-realm="ssl-realm" verify-client="REQUESTED"/> > <host name="default-host" alias="localhost"> > <location name="/" handler="welcome-content"/> > <access-log worker="default" > directory="${jboss.server.log.dir}" prefix="access" suffix=".log"/> > <http-invoker security-realm="ApplicationRealm"/> > </host> > > I've setup the Authentication Flows for the Browser to have x509/Validate > Username Form above the new Browser flow and it's required. > Everything is setup per the KeyCloak documentation to include the binding > settings. > > The only thing I'm not sure about is if the keycloak.jks and > truststore.jks files are the issue. > I have enabled extra logging as best I know, but I'm not seeing anything > in the logs of any relevance when trying to authenticate into the Keycloak > Realm. > > Can anyone assist? We are looking to most likely purchase this as a > product through RedHat SSO if it works well to get the support we need, but > I've been hung up on this for a few weeks and I know it shouldn't be this > hard. > > Thanks, > J > >

6 years, 9 months

1
0
0 / 0

Re: [keycloak-user] transient SSL certificate errors to AD/LDAPS

by Mark Nuttall-Smith

Hi, Thanks for the suggestion, but only server side certificates are required for our AD set up. Mark Nuttall-Smith Software Engineer Flow Traders T: +31 20 799 8753 F: +31 20 799 6780 Jacob Bontiusplaats 9 1018 LL Amsterdam Netherlands www.flowtraders.com -----Original Message----- From: Nick Su [mailto:nicksu@m800.com] Sent: Monday, July 15, 2019 9:40 AM To: Mark Nuttall-Smith Subject: Re: [keycloak-user] transient SSL certificate errors to AD/LDAPS Hi Does your LDAPS server require client verification as well? I came across a similar issue months before, and fixed by providing a trust store and keystore respectively to java > On 15 Jul 2019, at 3:34 PM, Mark Nuttall-Smith <mnuttallsmith(a)flowtraders.com> wrote: > > Hi, > > I've configured Keycloak to talk to an AD server using LDAPS. Everything works perfectly most of the time, but there are rare, transient errors caused by the following exception: > > Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target > at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:397) > at sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:302) > at sun.security.validator.Validator.validate(Validator.java:262) > at sun.security.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:324) > at sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:229) > at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:124) > at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1621) > ... 12 more > Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target > at sun.security.provider.certpath.SunCertPathBuilder.build(SunCertPathBuilder.java:141) > at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:126) > at java.security.cert.CertPathBuilder.build(CertPathBuilder.java:280) > at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:392) > ... 18 more > > Normally retrying the same query allows a user to log in again successfully (browser caches complicate things though). > > We add the certificates to the keystore using the following approach in our kubernetes helm chart: > > -------------------- > extraArgs: "-Djavax.net.ssl.trustStore=/opt/cacerts/cacerts -Djavax.net.ssl.trustStorePassword=changeit -Dkeycloak.import=/opt/import/realm.json" > > # This init container adds the certificates for the AD domain controllers to a keystore using a mounted ad-cacerts volume. > # The same volume with the keystore is then mounted and used by the main keycloak container > extraInitContainers: | > - name: cacerts-init > image: openjdk:8-jre > command: > - bash > args: > - -c > - | > cat $JAVA_HOME/lib/security/cacerts > /opt/cacerts/cacerts; > for host in `getent ahosts mycompany.local | awk '{print $1}' | uniq`; do > echo | openssl s_client -connect ${host}:3269 2>&1 | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > ${host}.cer ; > keytool -keystore /opt/cacerts/cacerts -storepass changeit -noprompt -trustcacerts -importcert -alias ${host} -file ${host}.cer > done > volumeMounts: > - name: ad-cacerts > mountPath: /opt/cacerts > > extraVolumes: | > - name: ad-cacerts > emptyDir: {} > > extraVolumeMounts: | > - name: ad-cacerts > mountPath: /opt/cacerts > ----------------------- > > Does anyone have an idea what could be the cause of these transient errors? > > Thanks, Mark > > Mark Nuttall-Smith > Software Engineer > > [http://www.flowtraders.com/img/FlowTraders.png] > > Flow Traders > > T: +31 20 799 8753 > F: +31 20 799 6780 > > Jacob Bontiusplaats 9 > 1018 LL Amsterdam > Netherlands > www.flowtraders.com<http://www.flowtraders.com> > > Flow Traders has its seat in Amsterdam, Netherlands, its registered office at Jacob Bontiusplaats 9, 1018 LL, Amsterdam, Netherlands and is registered with the Trade Registry of the Chamber of Commerce under number . This message may contain information that is not intended for you. If you are not the addressee or if this message was sent to you by mistake, you are requested to inform the sender and delete the message. This message may not be forwarded or published to any other person than its addressees without Flow Traders's prior consent. Flow Traders accepts no liability for damage of any kind resulting from the risks inherent in the electronic transmission of messages. > _______________________________________________ > keycloak-user mailing list > keycloak-user(a)lists.jboss.org > https://lists.jboss.org/mailman/listinfo/keycloak-user Flow Traders has its seat in Amsterdam, Netherlands, its registered office at Jacob Bontiusplaats 9, 1018 LL, Amsterdam, Netherlands and is registered with the Trade Registry of the Chamber of Commerce under number . This message may contain information that is not intended for you. If you are not the addressee or if this message was sent to you by mistake, you are requested to inform the sender and delete the message. This message may not be forwarded or published to any other person than its addressees without Flow Traders’s prior consent. Flow Traders accepts no liability for damage of any kind resulting from the risks inherent in the electronic transmission of messages.

6 years, 9 months

1
0
0 / 0

transient SSL certificate errors to AD/LDAPS

by Mark Nuttall-Smith

Hi, I've configured Keycloak to talk to an AD server using LDAPS. Everything works perfectly most of the time, but there are rare, transient errors caused by the following exception: Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:397) at sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:302) at sun.security.validator.Validator.validate(Validator.java:262) at sun.security.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:324) at sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:229) at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:124) at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1621) ... 12 more Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target at sun.security.provider.certpath.SunCertPathBuilder.build(SunCertPathBuilder.java:141) at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:126) at java.security.cert.CertPathBuilder.build(CertPathBuilder.java:280) at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:392) ... 18 more Normally retrying the same query allows a user to log in again successfully (browser caches complicate things though). We add the certificates to the keystore using the following approach in our kubernetes helm chart: -------------------- extraArgs: "-Djavax.net.ssl.trustStore=/opt/cacerts/cacerts -Djavax.net.ssl.trustStorePassword=changeit -Dkeycloak.import=/opt/import/realm.json" # This init container adds the certificates for the AD domain controllers to a keystore using a mounted ad-cacerts volume. # The same volume with the keystore is then mounted and used by the main keycloak container extraInitContainers: | - name: cacerts-init image: openjdk:8-jre command: - bash args: - -c - | cat $JAVA_HOME/lib/security/cacerts > /opt/cacerts/cacerts; for host in `getent ahosts mycompany.local | awk '{print $1}' | uniq`; do echo | openssl s_client -connect ${host}:3269 2>&1 | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > ${host}.cer ; keytool -keystore /opt/cacerts/cacerts -storepass changeit -noprompt -trustcacerts -importcert -alias ${host} -file ${host}.cer done volumeMounts: - name: ad-cacerts mountPath: /opt/cacerts extraVolumes: | - name: ad-cacerts emptyDir: {} extraVolumeMounts: | - name: ad-cacerts mountPath: /opt/cacerts ----------------------- Does anyone have an idea what could be the cause of these transient errors? Thanks, Mark Mark Nuttall-Smith Software Engineer [http://www.flowtraders.com/img/FlowTraders.png] Flow Traders T: +31 20 799 8753 F: +31 20 799 6780 Jacob Bontiusplaats 9 1018 LL Amsterdam Netherlands www.flowtraders.com<http://www.flowtraders.com> Flow Traders has its seat in Amsterdam, Netherlands, its registered office at Jacob Bontiusplaats 9, 1018 LL, Amsterdam, Netherlands and is registered with the Trade Registry of the Chamber of Commerce under number . This message may contain information that is not intended for you. If you are not the addressee or if this message was sent to you by mistake, you are requested to inform the sender and delete the message. This message may not be forwarded or published to any other person than its addressees without Flow Traders's prior consent. Flow Traders accepts no liability for damage of any kind resulting from the risks inherent in the electronic transmission of messages.

6 years, 9 months

1
0
0 / 0

Realm based multi-tenancy

by Chamila de Alwis

Hi, I have a KeyCloak deployment where KeyCloak Realms are used as a way to differentiate users among different tenants. The components that currently interact with KeyCloak does so through intermediate router that selects the IdP configuration based on a request path segment (request credentials from the realm using a pre-decided segment in the received path as the realm name). This story works fine with OIDC clients created in each Realm. There is a 3rd party service access that needs to be done through KeyCloak as well. However this 3rd party service doesn't support any kind of realm discovery method (path, header etc). It only works with a single IdP configuration at a time. This doesn't match with the per-realm client configuration model that is there at the moment, because multiple client configurations cannot be dynamically mapped to different host names or path segments. As a workaround, I'm in the process of trying the following approach. I've created a "federator" realm that has the clients in other realms as Identity Providers. The client in the federator realm will act as an identity broker on behalf of the other realms. However, the approach shows all the organizations available at the login screen. This is something sub-optimal for my use case since the list of organizations is made public to any user redirected to the login page. At the moment I'm looking into the customization of the login page, however that also would make upgrades harder. Is there a way to workaround this limitation that the 3rd party service has? Are there any known patterns that you may have employed in similar situations? (The other mail threads that I could find deal in situations where the client code is also changeable, like the use of the KeyCloakConfigResolver extension point [1]. This is not usable in my case, as the 3rd party code is out of my control) Furthermore, is there a way to authenticate users across Realms using only one client configuration? Appreciate your help in this. [1] - https://www.keycloak.org/docs/latest/securing_apps/index.html#_multi_tenancy Thanks! Regards, Chamila Blog: medium.com/@chamilad

6 years, 9 months

1
0
0 / 0

CORS issue with Angular Keycloak and Kong

by Enzo Veltri

Hello, I'm stuck in some CORS problems with a Angular APP. First of all this is my error: "Access to XMLHttpRequest at 'KEYCLOAK_ADDRESS/auth/realms/kong-integration/protocol/openid-connect/auth?response_type=code&client_id=kong&state=51afb0a302eaade545d648ee234ac9c0&redirect_uri=http//KONG_ADDRESS/projects%2F&nonce=5828968bed9a3d5427bed214c482b7a1&scope=openid' (redirected from 'http://KONG_ADDRESS/projects?username=c') from origin 'null' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource." Here is my architecture I have as gateway KONG + OIDC Plugin (https://github.com/nokia/kong-oidc) in a docker-machine located ad KONG_ADDRESS An Identity Management as Keycloak that is located at KEYCLOAK_ADDRESS; An Angular APP that uses the keycloak-angular library ( https://www.npmjs.com/package/keycloak-angular) located at localhost:4200 A Rest API, developed with Restlet, deployed on a tomcat on TOMCAT_ADDRESS/projects I've configured Kong to work with Keycloak using this tutorial ( https://www.jerney.io/secure-apis-kong-keycloak-1/) and everything works fine till I'm interacting with the secured API using the browser or Postman. When I call the secured endpoint KONG/projects, I'm redirected to the login page of Keycloak and then, after submitting the right credentials, I receive the correct response. Problems come when I'm trying to do everything using an Angular APP. It looks like that everything is fine with the /auth and /authenticate calls to KEYCLOAK_ADDRESS made by the initialization of the plugin ( https://www.npmjs.com/package/keycloak-angular#setup), and the /token and the /account calls made by HttpClientInterceptor ( https://www.npmjs.com/package/keycloak-angular#httpclient-interceptor) and the AuthGuard (https://www.npmjs.com/package/keycloak-angular#authguard). Problems come when the APP try to access to the resource at KONG/projects. It looks like there are a lot of jumps in the request: KONG redirects to KEYCLOAK and KEYCLOAK send a 204 No Content. I've added to the Keycloak client the web origins for KONG_ADDRESS and http://localhost:4200 that is my Angular APP. Do you have any idea about the problem? I think is something related to the origin 'null' in the console log, or is something related to my setup. Maybe I'm missing some details about the process. -- Enzo

6 years, 9 months

1
0
0 / 0

Cannot add custom Key2StringMapper for JDBC cache store

by Yifei Sun

Hi Guys, I am trying to add JDBC cache store via standalone-ha.xml in Keycloak 6.0.1, which has WildFly 16 and Infinispan 9.4.x subsystem. I managed to add the configuration to bind tables in Mysql db, but got the "org.infinispan.persistence.keymappers.UnsupportedKeyTypeException: Unsupported key type" when it tried to save the session. I checked out Infinispan and WF documentations, but the solution they gave, e.g. add "<property name="key2StringMapperClass">...</property>" , does not work. Any help would be appreciated. Thanks!!

6 years, 9 months

1
1
0 / 0

Reverse Proxy Keycloak - Kerberos SPNEGO breaks

by Ryan Slominski

Hi all, Any tips setting up Kerberos SPNEGO with Keycloak if Keycloak is reverse proxied? I have everything working if I access the Keycloak host directly, but if I access via a reverse proxy the SPENGO doesn't work. I assume this has to do with Kerberos SPNEGO strict hostname and principal naming. I have even tried setting the password/key (and kvno) the same for both HTTP/proxy.example.com and HTTP/keycloak.example.com principals. I've also updated the /etc/krb5.conf libdefaults ignore_acceptor_hostname = true, but that seems to be ignored by Keycloak. In fact, Keycloak appears to require a hard-coded principal name, which isn't going to match the requested service principal name when requests go through the reverse proxy. Has anyone dealt with this before? Oddly, this isn't a problem for Windows Active Directory principals / SPNs (Micrsoft implementation) - if setspn.exe configures same principal to both hostnames. Just MIT Kerberos KDC and principals seem to have a problem with reverse proxies (Red Hat Identity Manager / FreeIPA wrapper around MIT Kerberos). Ryan

6 years, 9 months

1
0
0 / 0

Kubernetes deployments

by Leandro Nunes

Hi fellow Keycloak users! My team is now looking at deploying a KC cluster to GCP. We wanted to leverage the infrastructure as much as possible but we’re struggling to come up with a good strategy to deploy different SPIs to a KC cluster when it is running in k8s. If we understand it correctly in such environments one does not simply take a single SPI and deploy it to the cluster; instead every time we want to install an SPI we’ll need to build a new (docker?) image that contains KC itself, the new (version of the) SPI and all other pre-existing SPIs. Is this understanding correct? Did you come up with better/leaner approaches to solving this? What is your experience around these issues? As always, any help is much appreciated! Leandro Nunes

6 years, 9 months

1
0
0 / 0

Attaching Role to an Entity

by Arash Rakhshan

Hello team, I am a new fan and after writing my own solution painfully we are hoping to convert to KeyCloak. First, thank you all for your efforts and supporting this project. I have gone through the tutorials and terminology, however, I can not seem to mold a suitable model for my authorization use case through Keycloak concepts. Please consider this use scenario: - You provide a SaaS solution for Car Dealerships. - Every dealership inherits a set of default roles upon creation e.g. admin, manager, sales, accountant,..) - Dealership could add/remove permissions to the default roles. - Dealership can define their own custom roles. - A dealership has multiple vendors and each vendor has a couple of roles (admin, accountant, vendor) - A dealership has numerous departments and each department may have their own roles for that department In my built-in model, I have a table that connects a Role to a Principal (an entity) and the ACLs (or permissions) are assigned to the roles. The Principal could be "DealershipA", "DealershipB", "Vendor1" and "Department0". Now my questions is: What is the best practice to implement this scenario in Keycloak. - How would you connect/assign a role to an entity? - Would you consider a Dealership, Vendor or a Department a Resource or a Client or what? Thank you in advance for all your help,

6 years, 9 months

1
0
0 / 0

Contributions

by Sylvain Malnuit

Hi, I want to share with you my contributions to Keycloak: * https://github.com/malys/rh-sso-email-with-attachment: extension to attach files located in theme repository to email * https://github.com/malys/keycloak-groovy-helpers: high level groovy script using Java Admin API to script configuration and actions. I use it to automate deployment * https://github.com/malys/rh-sso-rest_federation: a generic REST federation supporting role, attributes and many options (I will probably include it in Ansible plugin) * https://github.com/malys/rh-sso-listener-log: Generate detailed logs for audit Feel free to use it, fork it or improve it. Bye Sylvain

6 years, 9 months

2
1
0 / 0

Keycloak 6.0.1 "UUID LDAP attribute" property processed correctly only with "ObjectGUID" value.

by Алина Александровна Громова

Hi, I have User Federation to connect with our Azure AD through LDAP. When I have the default value ‘objectGUID’ for UUID LDAP attribute property it processed correctly and in LDAP_ID user attribute I can see correct UUID formate. Though, if user UUID provided not in ‘objectGUID’ but in ‘msDS-AzureADObjectId’ LDAP-attribute it doesn’t work. In this case, when I set ‘msDS-AzureADObjectId’ value into UUID LDAP attribute property I get incorrect string value in LDAP_ID. It looks like KC can correctly process UUID only if it comes in ‘objectGUID’ attribute. In other cases, we get an incorrect result. So, the problem in org/keycloak/storage/ldap/idm/store/ldap/LDAPOperationManager.java:675 where KC has hardcode action for ‘objectGUID’ value and other fields processed as a plain string. Also, ‘objectGUID’ always gets from LDAP as a binary field but ‘msDS-AzureADObjectId’ doesn't and I need to create user-attribute-ldap-mapper to mark this attribute as binary. The way I fixed it locally: * create user-attribute-ldap-mapper for ‘msDS-AzureADObjectId’ LDAP-attribute + mark this attribute as binary. * set UUID LDAP attribute property to ‘msDS-AzureADObjectId’ * fix condition from org/keycloak/storage/ldap/idm/store/ldap/LDAPOperationManager.java:675 to if (this.config.isActiveDirectory() && entryUUID instanceof byte[]) Is it a bug and can we expect a fix in future versions of KC? ------- Regards Alina Gromova

6 years, 9 months

1
0
0 / 0

User Redis as distributed caching store

by Yifei Sun

Hi guys, I am trying to setup Redis as cache store for Keycloak 6.0.1. It seems Wildfly doesn't support Redis in its Infinispan subsystem, and a workaround might be using a custom caching store. Has anyone done that yet? Any help/information will be greatly appreciated. Thanks!

6 years, 9 months

1
0
0 / 0

SQL Server integrated authorization

by Chris Smith

My keycloak instance is planned to use SQL Server for its database. It will be running on a Windows Server in an Active Directory domain I'd like to not embed the User/Password in the standalone.xml file. To enable this, the driver requires a windows dll to perform the db connection authentication. So, I'm looking for the best way to accomplish this. I'd rather not add -Djava.library.path=<path to folder> as a parameter when invoking standalone.bat Is there a way to configure it in the module created for the JDBC driver jar?

6 years, 9 months

2
2
0 / 0

Keycloak bc-fips compliant

by Srinivas Nangunoori

Hi Experts, Is keycloak bc-fips compliant? If yes, which version? Please help/guide us... Thanks in advance. -Srini

6 years, 9 months

1
0
0 / 0

How to do ?

by Christophe Lehingue

Hello, When registering a user, and that the latter declines the "terms & conditions": I would like to delete his data (when he clicked the button labeled "decline"). Do you have any idea how I could do without modifying JAVA KEYCLOAK? I was thinking of a SQL triger, but is there a simplest way to do that? Regards, Christophe ======= IN FRENCH ====== Bonjour, Lors de l'inscription d'un utilisateur, et que ce dernier décline les "terms & conditions" : je souhaiterais supprimer ses données (quand il a cliqué sur le bouton intitulé "décline"). Avez-vous une idée de comment je pourrais faire sans modifier les souces JAVA KEYCLOAK ? J'avais penser à un triger SQL, mais y a t'il un moyen plus simple pour faire cela ? Cordialement, Christophe

6 years, 9 months

1
0
0 / 0

Question regarding Token lifecycle in Keycloak

by Prasad Kris

Greetings, We are using Keycloak as our OIDC IdP for the internal applications and also for our kubernetes infrastructure, this setup is working great so far. We have the Session Idle Timeout set to 7 days currently and the Session Max Duration is set to 14 days and it works as expected for most of the user's but few users are having issues and have reported that their session is getting expired so fast. when checked in the admin UI, I see that multiple active sessions from those user accounts, but they have been presented with the login screen. I checked the logs and other configurations but couldn't notice any issues, so I believe that this has to do something in the user end as the settings are working fine for the majority of the user accounts.. but would like to know the root cause/more details first before coming to a conclusion. I would appreciate if someone could guide me to grab more details which will help to figure out the root cause of this issue, Cheers

6 years, 9 months

1
0
0 / 0

ldap federation working | test connection / authentication buttons failing

by mj

Hi, Keycloak 6.0.1, LDAP federation is working, users can logon and are updated automatically regularly from ldap: > 2019-07-02 17:39:49,761 INFO [org.keycloak.storage.ldap.LDAPStorageProviderFactory] (Timer-2) Sync changed users from LDAP to local store: realm: our_realm, federation provider: our_realm-ad, last sync time: Mon Jul 01 17:39:43 CEST > 2019-07-02 17:39:50,067 INFO [org.keycloak.storage.ldap.LDAPStorageProviderFactory] (Timer-2) Sync changed users finished: 3 imported users, 22 updated users In keycloak, the configured ldap uri is ldap://localhost:389, where a haproxy instance is listening that talks ldaps to our DCs. The 'problem': in the keycloak GUI, the buttons 'Test authentication' and 'Test connection' do not work: "Error! Error when trying to connect to LDAP. See server.log for details." But nothing logged in server.log, and haproxy does not even log a connection attempt at all. Anyone else seeing this..? MJ

6 years, 9 months

3
6
0 / 0

Keycloak policy enforcer for bearer-only client

by Juan Camilo Vanegas

Hi. I am developing a Node.js web app that uses Keycloak as authentication service. I already have two clients: public client for the web app (app-web) and bearer-only for the API (app-api). On the app-api I use resources, scopes, policies, and permissions to control the access. To check the permissions, I am using the keycloak.enforcer(...) from the keycloak-connectmodule (npm keycloak-connect <https://www.npmjs.com/package/keycloak-connect>). When I try to check permission, the server always returns 403 Access denied response. But if I change app-api from bearer-only to confidential (keeping the same keycloak.json configuration file), the client works fine and is capable to check permissions. This problem seems to be because a bearer-only client cannot obtain tokens from the server (keycloak similar question <http://keycloak-user.88327.x6.nabble.com/keycloak-user-can-we-use-authori...> ). My question is: Is this a normal behavior of Keycloak? Why allow the Authorization tab in bearer-only clients if you cannot use the keycloak.enforcer? Am I missing some configuration? Thanks for your help. Stackoverflow question: https://stackoverflow.com/questions/56906984/keycloak-policy-enforcer-bea...

6 years, 9 months

2
3
0 / 0

How to allow only tokens with a specific claim at identity brokering in KeyCloak?

by Iurii

Hello, I am using KeyCloak with two external identity providers configured for identity brokering. There is a requirement to not allow accessing the application protected with KeyCloak if the token issued by one of the external identity providers doesn't contain a specific claim. In other words - if external IdP "A" issues a token without claim "xxx" equal to "yyy", KeyCloak must not allow logging in. Is it possible to configure this in KeyCloak, or I will have to modify the application protected with KeyCloak to check this condition? Thanks!

6 years, 9 months

1
0
0 / 0

SAML Logout Response 403 Forbidden

by Manuel Waltschek

Hello, I am still trying to logout from my wildfly10 keycloak saml client application. I already described my issues in https://lists.jboss.org/pipermail/keycloak-user/2019-June/018550.html Quick summary: I am trying to logout by calling private void requestGlobalLogout(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException { String contextPath = req.getContextPath(); resp.sendRedirect(contextPath + "?GLO=true"); } from a servlet. I am getting a LogoutResponse from my keycloak IdP with the following status code: <samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/> It seems, that the client cannot handle this response and therefore redirects to a page with content <html><head><title>Error</title></head><body>Forbidden</body></html> with status code 403 Forbidden. I would appreciate any further help, thank you in advance, regards [Logo] Manuel Waltschek BSc. +43 660 86655 47<tel:+436608665547> manuel.waltschek(a)prisma-solutions.at<mailto:manuel.waltschek@prisma-solutions.at> https://www.prisma-solutions.com PRISMA solutions EDV-Dienstleistungen GmbH Klostergasse 18, 2340 Mödling, Austria Firmenbuch: FN 239449 g, Landesgericht Wiener Neustadt

6 years, 9 months

1
0
0 / 0

Persistent sessions

by Leonid Rozenblyum

Hello! I saw these questions in the mailing list 2017 and earlier but would like to double check. We'd like to enable persistent session feature of WildFly in Keycloak (in non-HA environment) By doing this in standalone.xml <persistent-sessions path="sessionsStorage"/> It looks like the feature is not working correctly with keycloak: after keycloak reboot the sessions look lossed. Is it a misconfiguration at my side or a totally not supported feature by keycloak? Thanks in advance for explanation

6 years, 9 months

1
0
0 / 0

Single Logout in Identity brokering mode

by Leonid Rozenblyum

Hello! I'm working on Single Logout in Identity broker mode. App -> Keycloak (OpenIdConnect) Keycloak -> 3'd party (SAML) Documentation to keycloak states that there are 2 ways to execute logout. 1) HttpServletRequest.logout(). 2) redirect the browser to http://auth-server/auth/realms/{realm-name}/protocol/openid-connect/logou... If I execute 2) it indeed causes Keycloak send SAML Logout request to the 3'd party Idp. However if I execute 1) SAML logout request is not sent thus 3'd party session is still valid. (I see that by enabling trace logging in keycloak and by fact that user is still logged in) Is it something by design/misconfiguration at my side or a bug?

6 years, 9 months

1
1
0 / 0

Allowed SAML audiences?

by Craig Setera

If I have a SAML identity provider setup, what would the allowed audience values look like by default? Is there any place in the UI that I can see the allowed audience values? Thanks, Craig ================================= *Craig Setera* *Chief Technology Officer*

6 years, 9 months

1
0
0 / 0

Not being prompted for x509 User Certs on KeyCloak version 4.8.3.Final

by JTK

I've read through all the documentation I can find online both with the official documents and everything else I could find and I believe I have everything setup, with additional logging turned on, but I'm not getting any type of prompt for a x509 certificate when logging in. Here is the excerpts from the standalone.xml file where ssl-realm was added to the management security-realms and under the subsystem. <management> <security-realms> ...... <security-realm name="ssl-realm"> <server-identities> <ssl> <keystore path="keycloak.jks" relative-to="jboss.server.config.dir" keystore-password="mypass"/> </ssl> </server-identities> <authentication> <truststore path="truststore.jks" relative-to="jboss.server.config.dir" keystore-password="mypass"/> </authentication> </security-realm> ...... <subsystem xmlns="urn:jboss:domain:undertow:7.0" default-server="default-server" default-virtual-host="default-host" default-servlet-container="default" default-security-domain="other"> <buffer-cache name="default"/> <server name="default-server"> <http-listener name="default1" socket-binding="http" redirect-socket="https" enable-http2="true"/> <https-listener name="default" socket-binding="https" security-realm="ssl-realm" verify-client="REQUESTED"/> <host name="default-host" alias="localhost"> <location name="/" handler="welcome-content"/> <access-log worker="default" directory="${jboss.server.log.dir}" prefix="access" suffix=".log"/> <http-invoker security-realm="ApplicationRealm"/> </host> I've setup the Authentication Flows for the Browser to have x509/Validate Username Form above the new Browser flow and it's required. Everything is setup per the KeyCloak documentation to include the binding settings. The only thing I'm not sure about is if the keycloak.jks and truststore.jks files are the issue. I have enabled extra logging as best I know, but I'm not seeing anything in the logs of any relevance when trying to authenticate into the Keycloak Realm. Can anyone assist? We are looking to most likely purchase this as a product through RedHat SSO if it works well to get the support we need, but I've been hung up on this for a few weeks and I know it shouldn't be this hard. Thanks, J

6 years, 9 months

2
10
0 / 0

Override "native" Keycloak providers

by Jerry Saravia

Hello, Disclaimer: This might be a keycloak dev mailing list question. We’ve been using version 3.4.3 for a while now and are attempting to upgrade to 4.8 and we’ve run into some issues. Summary: We have created our own providers with the same PROVIDER_ID as some of the built in providers. For example, PasswordCredentialProvider has a provider id of “keycloak-password” and we created our own with the same id that gets loaded after the native one. This worked because in 3.4.3 providers that were using the same id would still have their factories added to the factory map. See this link here for 3.4.3 changes: https://github.com/keycloak/keycloak/blob/3.4.3.Final/services/src/main/j... These are the 4.8 changes https://github.com/keycloak/keycloak/blob/4.8.3.Final/services/src/main/j... In 4.8, the fully qualified class name (FQCN) is not longer used. Instead it uses the provider id and the spi name. I can no longer use the same PROVIDER_ID as the native providers to ‘override’ them, but sometimes there is code that gets the provider specifically by id. For example, in the UpdatePassword required action we have this: PasswordCredentialProvider passwordProvider = (PasswordCredentialProvider)context.getSession().getProvider(CredentialProvider.class, PasswordCredentialProviderFactory.PROVIDER_ID); In 3.4.3 because our provider was loaded we were able to inject into code that normally isn’t overridable. We did the same for the OIDCLoginProtocolFactory to alter some token endpoint behavior even the UpdatePassword required action itself rather than making a brand new required action that is a “second rate” because it isn’t native to Keycloak. Is there a solution for this in 4.8.3? I see this change was made in 4.0.0.Beta1 according to some of the history. J Jerry Saravia Software Engineer T(516) 603-6914 M516-603-6914 virginpulse.com |virginpulse.com/global-challenge 492 Old Connecticut Path, Framingham, MA 01701, USA Australia | Bosnia and Herzegovina | Brazil | Canada | Singapore | Switzerland | United Kingdom | USA Confidentiality Notice: The information contained in this e-mail, including any attachment(s), is intended solely for use by the designated recipient(s). Unauthorized use, dissemination, distribution, or reproduction of this message by anyone other than the intended recipient(s), or a person designated as responsible for delivering such messages to the intended recipient, is strictly prohibited and may be unlawful. This e-mail may contain proprietary, confidential or privileged information. Any views or opinions expressed are solely those of the author and do not necessarily represent those of Virgin Pulse, Inc. If you have received this message in error, or are not the named recipient(s), please immediately notify the sender and delete this e-mail message. v2.48

6 years, 9 months

2
1
0 / 0

KEYCLOAK-3205

by Andrew Martel

Hello, My company is waiting on the functionality to have encrypted client secrets: https://github.com/keycloak/keycloak-community/blob/master/design/secure-.... Would someone be able to provide me with a timeline on when this will be released? Thanks, Andrew Martel CONFIDENTIALITY NOTICE AND DISCLAIMER : This telecommunication, including any and all attachments, contains confidential information intended only for the person(s) to whom it is addressed. Any dissemination, distribution, copying or disclosure is strictly prohibited and is not a waiver of confidentiality. If you have received this telecommunication in error, please notify the sender immediately by return electronic mail and delete the message from your inbox and deleted items folders. This telecommunication does not constitute an express or implied agreement to conduct transactions by electronic means, nor does it constitute a contract offer, a contract amendment or an acceptance of a contract offer. Contract terms contained in this telecommunication are subject to legal review and the completion of formal documentation and are not binding until same is confirmed in writing and has been signed by an authorized signatory.

6 years, 9 months

2
2
0 / 0

Public and Bearer-only role propagation

by Stelios Kyprou

Hello guys, I am trying to work with the following setup, with the goal of eventually propagating Keycloak roles from the public client (front-end) to Spring Security Roles of a bearer-only client (back-end): Client Name Client Type Client Role Full Scope Allowed portals-frontend public TEST_ROLE FALSE portals-backend bearer-only VERSIONS: *Spring Boot:* org.keycloak:keycloak-spring-boot-2-starter:4.0.0.Final org.springframework.boot:spring-boot-starter-security:2.1.4.RELEASE *Angular:* angular: 7 "keycloak-angular": "6.1.0" *Keycloak Server:* 4.0.0.Final My Angular app is using *portals-frontend *client My Spring-Boot-2 app is using *portals-backend *client When running this setup, the back-end verifies the token, but it does not map the *portals-frontend* client Roles into *spring security principal.deatils.roles*. The only way I managed to do this is two ways; 1. Set *Full Scope allowed* to *true. (*I don't like this since we can't restrict the roles in each client token*)* 2. Use the same KC client in the back-end as the one used in the front-end app. (This means that new front-end apps that will need different rights, therefore a new client, will not be able to use the same back-end service) *QUESTION:* Is there a 3rd way, where I keep my configuration as is, and manage to map KC Roles into spring security's *principal.details.roles *list in the back-end and include the front-end client roles? Thanks in advance! P.S: *Additional context:* The Spring-Boot-2 configurations is: keycloak: realm: internal-portals bearer-only: true auth-server-url: <VALID URL> ssl-required: external resource: portals-backend confidential-port: 0 principal-attribute: preferred_username use-resource-role-mappings: true With the following security config: @KeycloakConfiguration class SecurityConfig(private val securityProperties: SecurityProperties) : KeycloakWebSecurityConfigurerAdapter() { @Bean fun keycloakConfigResolver(): KeycloakConfigResolver { return KeycloakSpringBootConfigResolver() } @Autowired @Throws(Exception::class) fun configureGlobal(auth: AuthenticationManagerBuilder) { val keycloakAuthenticationProvider = keycloakAuthenticationProvider() keycloakAuthenticationProvider.setGrantedAuthoritiesMapper(SimpleAuthorityMapper()) auth.authenticationProvider(keycloakAuthenticationProvider) } @Bean override fun sessionAuthenticationStrategy(): SessionAuthenticationStrategy { return NullAuthenticatedSessionStrategy() } ... }

6 years, 9 months

1
0
0 / 0

keycloak 2.5.5-final with bc-fips-1.0.1.jar

by Srinivas Nangunoori

Hi Experts, We want to integrate bc-fips in our application. We have changed our standalone.xml (Wildfly) to use BCKFS keystore and changed java.security to use security.provider.1=org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider and keystore.type=bcfks Copied bc-fips-1.0.1.jar to jre/lib/ext /modules/system/layers/base/org/bouncycastle/fips But when I start my application, I see following error, Caused by: java.lang.NoClassDefFoundError: org/bouncycastle/jce/provider/BouncyCastleProvider at org.keycloak.common.util.PemUtils.<clinit>(PemUtils.java:41) at org.keycloak.adapters.KeycloakDeploymentBuilder.internalBuild(KeycloakDeploymentBuilder.java:63) at org.keycloak.adapters.KeycloakDeploymentBuilder.build(KeycloakDeploymentBuilder.java:137) at org.keycloak.adapters.undertow.KeycloakServletExtension.handleDeployment(KeycloakServletExtension.java:135) at io.undertow.servlet.core.DeploymentManagerImpl.handleExtensions(DeploymentManagerImpl.java:252) at io.undertow.servlet.core.DeploymentManagerImpl.deploy(DeploymentManagerImpl.java:152) at org.wildfly.extension.undertow.deployment.UndertowDeploymentService.startContext(UndertowDeploymentService.java:100) at org.wildfly.extension.undertow.deployment.UndertowDeploymentService$1.run(UndertowDeploymentService.java:82) Not sure what I am missing. Could any one help me here. -Srini

6 years, 9 months

1
0
0 / 0

Serving SPA + API with keycloak-gatekeeper

by Rafael Almeida

Hello, I think I must be missing something. I have a SPA and a backend. Currently, for simplicity, they are being served together from the same hostname (and server). I was able to configure keycloak-gatekeeper in front of it and everything seemed to work well at first. The / (root), which serves my SPA, redirects the user and, after they login, all endpoints become available. However, if the user logs out and still have the SPA loaded, the javascript will attempt to make requests to the API, but it will be unauthorized at this time. The API, however, instead of giving out a helpful 401, will respond with a 307. Understandable. I looked into the gatekeeper's docs and there is a no-redirects option. However, it's a global one, rather than per endpoint. That means that the only option to get the behaviour I want is to have two gatekeepers, one for the API and the other for the SPA, both sharing the same encryption key (so that they use the same session). They also need to be behind the same load balancer so they share hostnames. I think that'd work but it seems rather cumbersome. What am I missing? Am I doing things in a very unusual way? How else could I set this up? Thanks, Rafael

6 years, 9 months

1
0
0 / 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

keycloak-user July 2019