July 2019 - keycloak-user - Jboss List Archives

Token store cookie too slow for large tokens?

by Erwin de Wolff

Hi, I've configured wildfly 16 with keycloak 6.0.1 with token-store cookie. Everything works fine, until the number of roles of increased to 30+. It appears that the check if the token exists fails direct after the successful authentication and a new authentication is started etc. Resulting in a too many redirections error in the browser. Is this a known issue? Using wildfly 10.1 and keycloak 4.8.3 results in an out of memory exception NIO. Best Regards

5 years, 5 months

2
1
0 / 0

realm-management client role "view-realm" needed to view/edit a user?

by EXTERNAL Weimer Benjamin (TNG, INST-CSS/BSV-OS2)

Hi all, we are using fine grain permissions in Keycloak to set the rights to edit certain users and have noticed that the roles "manage-users" and "query-realm" of the "realm-management" client are not sufficient to view and edit single users. The "view-realm" role seems to be needed for that. Can you explain me why this role is needed for this action? Best regards and thanks in advance Benjamin Weimer

5 years, 5 months

4
6
0 / 0

Create users in the imported real using helm

by Mathew George

Hello, I am using keycloak helm charts for installing keycloak in our cluster and I am able to import a custom realm as described in the documentation. Now I want to create some users in this custom realm. I tried using the 'prestartScript'. See the contents of my value.yaml extraVolumes: | - name: realm-secret secret: secretName: realm-secret extraVolumeMounts: | - name: realm-secret mountPath: "/realm/" readOnly: true extraArgs: -Dkeycloak.import=/realm/realmData.json preStartScript: | /opt/jboss/keycloak/bin/kcadm.sh create users -r MyCustomRealm -s username=admin -s enabled=true;/opt/jboss/keycloak/bin/kcadm.sh set-password -r MyCustomRealm --username admin --new-password admin; enabled: false But this is not working. I also tried the following command in the 'preStartScript'. ( This is also not working) /opt/jboss/keycloak/bin/add-user-keycloak.sh -r MyCustomRealm -u admin -p admin Kindly provide inputs. Best regards [cid:image001.png@01D54069.121BC050] Mathew George Experiment Software ECTA dSPACE GmbH Rathenaustraße 26 33102 Paderborn Tel.: +49 5251 1638-507 Fax: +49 5251 16198-0 Mail: mgeorge(a)dspace.de<mailto:mgeorge@dspace.de> Web: www.dspace.com<http://www.dspace.com> We comply with our obligation to inform you about data protection according to Art. 13-14 of the GDPR by publishing said information on our website. Read our data protection regulations here<https://www.dspace.com/en/pub/home/privacypolicy.cfm>.

5 years, 5 months

2
2
0 / 0

How to increase logging authenticating against remote IdP

by BOOTH Stephen

I'm trying to get keycloak to use an existing application as an Idp by writing just enough oidc to allow keycloak to authenticate but I'm having difficulty debugging as keycloak is not very informative when its not happy with a response from the IdP Pretty much the only info I'm getting is "Invalid Request" 13:06:51,042 WARN [org.keycloak.events] (default task-2) type=IDENTITY_PROVIDER_LOGIN_ERROR, realmId=openidctest, clientId=null, userId=null, ipAddress=127.0.0.1, error=invalidRequestMessage 13:06:51,042 ERROR [org.keycloak.services.resources.IdentityBrokerService] (default task-2) invalidRequestMessage I can see my authorization token and userinfo endpoints being called (userinfo is not called if I disable this in the keycloak settings) Does anyone have any tips on how to get more debugging info out of keycloak other than attaching a debugger and trying to single step through. Stephen -- ====================================================================== |epcc| Dr Stephen P Booth Principal Architect |epcc| |epcc| s.booth(a)epcc.ed.ac.uk Phone 0131 650 5746 |epcc| ====================================================================== -- The University of Edinburgh is a charitable body, registered in Scotland, with registration number SC005336.

5 years, 5 months

1
0
0 / 0

keycloak-nodejs-connect: ERR_TOO_MANY_REDIRECTS

by Hadidi, Lars

I set up a NodeJS Server to use the keycloak-connect module: // Setup keycloak to use the session memoryStore var memoryStore = new SESSION.MemoryStore(); var keycloak = new KEYCLOAK({ store: memoryStore }); // Set up a server instance and create a session middleware const APP = EXPRESS(); APP.use(SESSION({ secret: CRYPTO.randomBytes(512).toString('hex'), resave: false, saveUninitialized: true, store: memoryStore })); // Default route handler APP.get('/login', keycloak.protect(), function(req, res) { ...some custom logic, involving AXIOS XHR stuff ...getting tokens from REST endpoints res.redirect('/app/html/createCustomer?' + QUERYSTRING.encode({'tokenId': tokenID})); } APP.use(keycloak.middleware( { logout: '/logout'})); // Start servers HTTP.createServer(APP).listen(CONF.serverPort, CONF.serverInterface, () => console.log('Server listening on %s:%d', CONF.serverInterface, CONF.serverPort)); The CONF objects holds CONF.serverPort=9080 and CONF.serverInterface=127.0.0.1 The keycloak.json reads { "realm": "app-realm", "auth-server-url": "https://192.168.32.132/auth", "ssl-required": "external", "resource": "app-client", "public-client": true, "confidential-port": 0 } Both NodeJS and Keycloak Docker Container are binding to 127.0.0.1, living behind an nginx revrse proxy. The nginx reverse proxy uses TLS and terminates all HTTPS, sending all traffic to those upstream servers via plain HTTP. The configuration of nginx reads server { listen 80; listen [::]:80; server_name 192.168.32.132; return 301 https://$server_name$request_uri; } server { listen 443 ssl; listen [::]:443 ssl; server_name 192.168.32.132; ssl_certificate /etc/ssl/private/fullchain.pem; ssl_certificate_key /etc/ssl/private/privkey.pem; ssl_protocols TLSv1 TLSv1.1 TLSv1.2; location /login { proxy_pass http://127.0.0.1:9080; proxy_set_header Host $host; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; } location /auth { proxy_pass http://127.0.0.1:8080; proxy_set_header Host $host; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; } location /app { rewrite ^/app(.*)$ $1 last; proxy_pass http://127.0.0.1:7080; proxy_set_header Host $host; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; } } Additionally, the following lines are added for EVERY location block: proxy_set_header X-Forwarded-Host $host; proxy_set_header X-Forwarded-Server $host; proxy_set_header X-Forwarded-Port $server_port; proxy_buffer_size 128k; proxy_buffers 4 256k; proxy_busy_buffers_size 256k; There is a realm, a client with redirect URIs set to WILDCARD and one user. Accessing route /login always leads to a redirect loop. Following the HTTP stream via WireShark yields these results: GET /login HTTP/1.1 Host: 192.168.32.132 Upgrade-Insecure-Requests: 1 HTTP/1.1 301 Moved Permanently Server: nginx Location: https://192.168.32.132/login Strict-Transport-Security: max-age=31536000; includeSubdomains; GET /login?auth_callback=1&state=eb22b4f5-e262-4deb-8e7d-f483ec1af553&session_state=9759ce64-400e-4e53-8cf5-613b2409a1c1&code=854efde1-71dc-4052-a0ad-7503ea3af7e4.9759ce64-400e-4e53-8cf5-613b2409a1c1.c00e43ce-79c2-48ee-8b92-639a6c9ade44 HTTP/1.1 Host: 192.168.32.132 Cache-Control: max-age=0 Upgrade-Insecure-Requests: 1 Cookie: connect.sid=s%3AhkFnuXd3uHPZym3mvFd2v6v2_bEmOYCm.jAeQvvN%2FZP7%2F9hV77wBI80pi%2B7T9CJo4LENc9kF5eSc HTTP/1.1 301 Moved Permanently Server: nginx Location: https://192.168.32.132/login?auth_callback=1&state=eb22b4f5-e262-4deb-8e7... Strict-Transport-Security: max-age=31536000; includeSubdomains; GET /login?auth_callback=1&state=eb22b4f5-e262-4deb-8e7d-f483ec1af553&session_state=9759ce64-400e-4e53-8cf5-613b2409a1c1&code=854efde1-71dc-4052-a0ad-7503ea3af7e4.9759ce64-400e-4e53-8cf5-613b2409a1c1.c00e43ce-79c2-48ee-8b92-639a6c9ade44&auth_callback=1&state=30d7d290-e967-488d-887c-b6eec1cc5d27&session_state=9759ce64-400e-4e53-8cf5-613b2409a1c1&code=089d3ff9-702f-430c-9e97-f0aa5b9ae0a3.9759ce64-400e-4e53-8cf5-613b2409a1c1.c00e43ce-79c2-48ee-8b92-639a6c9ade44 HTTP/1.1 Host: 192.168.32.132 Cache-Control: max-age=0 Upgrade-Insecure-Requests: 1 Cookie: connect.sid=s%3AhkFnuXd3uHPZym3mvFd2v6v2_bEmOYCm.jAeQvvN%2FZP7%2F9hV77wBI80pi%2B7T9CJo4LENc9kF5eSc HTTP/1.1 301 Moved Permanently Server: nginx Location: https://192.168.32.132/login?auth_callback=1&state=eb22b4f5-e262-4deb-8e7... Strict-Transport-Security: max-age=31536000; includeSubdomains; GET /login?auth_callback=1&state=eb22b4f5-e262-4deb-8e7d-f483ec1af553&session_state=9759ce64-400e-4e53-8cf5-613b2409a1c1&code=854efde1-71dc-4052-a0ad-7503ea3af7e4.9759ce64-400e-4e53-8cf5-613b2409a1c1.c00e43ce-79c2-48ee-8b92-639a6c9ade44&auth_callback=1&state=30d7d290-e967-488d-887c-b6eec1cc5d27&session_state=9759ce64-400e-4e53-8cf5-613b2409a1c1&code=089d3ff9-702f-430c-9e97-f0aa5b9ae0a3.9759ce64-400e-4e53-8cf5-613b2409a1c1.c00e43ce-79c2-48ee-8b92-639a6c9ade44&auth_callback=1&state=d60d22a4-7098-4f6c-8974-0fd98d65d247&session_state=9759ce64-400e-4e53-8cf5-613b2409a1c1&code=27f41194-4dda-412c-b35c-f3e4ad9f987a.9759ce64-400e-4e53-8cf5-613b2409a1c1.c00e43ce-79c2-48ee-8b92-639a6c9ade44 HTTP/1.1 Host: 192.168.32.132 etc. What is the problem with the server setup ?

5 years, 5 months

1
0
0 / 0

Core Services Without UI & Local Unix Users

by Aditya Bhole

Hi, We are building an SSO framework for our company products using Keycloak and want to use our existing UI and flow for login. Is there a way to deploy Keycloak without using any of its UI components (Login Screen and Admin Console) and still use all the core services such as authentication, authorization, managing user storage etc. Also, we want to authenticate the Unix local users via Keycloak. Is there any way to do this? Or is there any workaround that you can suggest for the same? Regards, Aditya Bhole

5 years, 5 months

2
3
0 / 0

Can I get a google offline refresh tokens or not? PLEASE

by Nick Powers

Hello, I am setup with Keycloak & Gatekeeper and my users are able to authenticate with Google and I can retrieve the access token from Google but I cannot receive a refresh token, apparently because Keycloak is not adding ?access_type=offline to the Google authentication URL. Is it even possible to get a refresh token from Google while using Keycloak? It's is very difficult to search for Keycloak related items on Google because the results are littered with 404 pages from previous versions of Keycloak that I guess have since been deleted. But, most of what I have found related to getting refresh tokens from Google end up being frustrated people not getting an answer or people discussing how "someday" it "might" be implemented. These go back years. >From what little I have been able to find, It seems offline access to Google Identify Provider has never worked for Keycloak. I hope that is not true, it seems like a simple thing to add the option of appending ?access_type=offline to the Google authentication URL. I know it may sound like nothing to someone not needing this feature but for me if I cannot get the Google refresh tokens from Google with Keycloak then I cannot use Keycloak. I am not alone in wanting this, the archives of this mailing list and Google search results have LOTS of people looking to do the same thing. PLEASE PLEASE PLEASE can someone PLEASE tell me what I need to do to get a refresh token from Google???? I don't want to have to hard code ?access_type=offline into the URL in the source code if I don't have to. Do any RedHat people monitor this mailing list? Can I purchase a support ticket from RedHat to get support on KeyCloak? I really need to get this working. Thanks, Nick

5 years, 5 months

1
0
0 / 0

Reg: Multiple Login Behaviour.

by Prasad Kris

Greetings, How does KeyCloak oidc sessions behave if we sign in from more than one device on the same account? for example, I am logging in from my Laptop and Desktop using the same account, but I am getting logged out from the old device (it redirects to the login screen) soon after I sign-in from the second device, Is this an expected behaviour? If yes, Is there a way by which we can keep both sessions active so that we don't have to re-login frequently. Cheers, Prasad

5 years, 5 months

1
0
0 / 0

Identity Providers (Google) where are the tokens?

by Nick Powers

Hello, I have configured Keycloak to authenticate users using Google as an identity provider and it works for basic authentication. I have set Default Scopes to https://www.googleapis.com/auth/youtube.force-ssl, a Google scope for accessing the YouTube API. This is obviously getting communicated to Google because when I do authenticate Google prompts me for the YouTube permissions. But, I am not seeing the Google access/refresh tokens in the logs (I have configured logging for org.keycloak.social.user_profile_dump to DEBUG). Logs pasted below. My original plan was to examine the DEBUG logs to learn the structure of the data and then use a Mapper to gain access to that data but now I am at a loss because Google's access/refresh tokens are not in the log. I think I must be missing something. HELP! :) Below is what I am seeing in the logs. I get the user info but not the tokens. :( 23:19:50,259 DEBUG [org.keycloak.social.user_profile_dump] (default task-95) User Profile JSON Data for provider google: {"sub":"116437238580102652286","name":"Nick Powers","given_name":"Nick","family_name":"Powers","picture":" https://lh3.googleusercontent.com/-zeavnWWwmto/AAAAAAAAAAI/AAAAAAAAANE/BO... "} Thanks - Nick

5 years, 5 months

1
0
0 / 0

any vendor to provide a keycloak training?

by Masanobu Hatanaka

Hi, Does anyone knows any vendor to provide a keycloak training class through online/classes? I'm looking for a class training for Keycloak. Kind regards, Masanobu.

5 years, 5 months

1
0
0 / 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

keycloak-user July 2019