August 2019 - keycloak-user - Jboss List Archives

How to configure my client for use ADMIN REST API [DELETE]: https://keycloaksrv.fr/auth/admin/realms/myclient/users/'

by Christophe Lehingue

Hello, how to configure a client so that the user can use the user removal API? [DELETE]: https://keycloaksrv.fr/auth/admin/realms/myclient/users/fdskgjdkdjkgjf-sd... Whenever I try to call this request REST => I get the following error message: "resulted in a 401/403 Unauthorized`" Can you help me ? Thank you

6 years, 6 months

4
4
0 / 0

Keycloak Offline User Sessions and Online User Sessions

by Nagendra Darla

Hello Keycloak experts, We have below challenges in out project where we are building User Access Management using Keycloak. 1. *Offline User Sessions:* When a Offline token is used from two different machines, There is only one Session that will be created and session will have the IP address of the machine from where the User Session is first created. Because of this we cannot suspect any suspicious activity by hackers. Should n't we create different sessions even though same offline token is used from different machines. 2. *Why there is no separate REST end point to get only Online User Sessions: *Below REST end point returns all the User Sessions ie., both Offline and Online User Sessions. GET /{realm}/clients/{id}/user-sessions You help is much appreciated ! Thank you, Nagendra Darla

6 years, 6 months

1
1
0 / 0

resource ids

by Corentin Dupont

Hi guys, I discovered that you can provide your own id when creating resources: curl -X POST " http://localhost:8080/auth/realms/waziup/authz/protection/resource_set" -H "Authorization: Bearer $CLIENTTOKEN" -H "Content-Type: application/json" -d '{*"_id": "123-456"*, "type": "test", "name":"test", "scopes":["sensors:create","sensors:view","sensors:update","sensors:delete"],"owner":"cdupont", "ownerManagedAccess": true}' This is very practical for synchronizing the resources with my own database. After some investigation, I found: - the ID should be unique - the name should be unique Is that correct? The resource type is not used in the unicity. In my application database, resources with different types are stored in different collections, so two resources with different types *can* have the same ID. How do you suggest to solve this in Keycloak? Providing a keycloak ID of the form <type>-<ID> for example? e.g. sensor-123 and project-123 would not collide. Cheers

6 years, 6 months

3
10
0 / 0

multiple reset credentials flows

by Arnault BESNARD

Hi, We're currently developing our own SPI authenticator. In case of authentication failure, we'd like allowing users to reset their credential following a specific scenario. Unfortunately, there is only one reset credentials flow per realm. So 'forgot password' and our SPI reset credential have to share the same scenario, which is not fit in our case. What is the best way to solve our issue? Thanks in advance, Arnault

6 years, 7 months

1
2
0 / 0

Keycloak Gatekeeper configuration with SPA

by Yumna Ghazi

Hello everyone, I'm using Keycloak as an identity manager and since it also provides optional authorization, I decided to use it to suit my access control requirements as well. I have multiple microservices that I want to protect using Keycloak Gatekeeper like the configuration below but with separate Gatekeepers per service. --------- ----------- ----------- ------------ | UI | ---> | Proxy | ---> | GateK | ---> | Service | --------- ------------ ----------- ------------ | || | v -----------------------------------> Keycloak Aside from the CORS related issues this creates (KEYCLOAK-9099 <https://issues.jboss.org/browse/KEYCLOAK-9099>), there's another important issue that I'm struggling with. My UI already has keycloak js integrated with a public client specifically for itself, which I was using for login initially. Now that I want to use the Gatekeeper proxy, I want my login/token refresh to happen on the UI such that it would automatically generate the requisite cookies for Gatekeeper, because I want to disable redirection on Gatekeeper and send 401 directly in case of expired/bad/no token. a) Is my understanding correct and is this the correct approach? b) If so, how can I login via Keycloak directly or via Gatekeeper and get the required cookies (without some proxy-level hacking)? Right now I'm hovering between a couple of options, from using Kong oidc with some custom authorization to using Gatekeeper. Any help would be much appreciated. Thanks. Yumna

6 years, 8 months

2
1
0 / 0

Evaluation of RPT in admin console does not match Rest request result...

by Axel

Hello. Keycloak 6.0.1 and 7 Can anyone help me with understanding of evaluating RPT? Scenario: 2 Realm Roles - RoleA and RoleB 1 user with both realm roles 2 clients: clientA public (or confidential) with Scope=RoleA clientB confidential and Authorization-Enabled with Scope=RoleA,RoleB When I go to clientB Authorization-Evaluate set Client = clientA set User = user choose Any resource with scope(s) Any scope. and see: { "jti": "7692f97f-3907-4e1b-a784-663c52f33bc7", "exp": 1567062109, "nbf": 0, "iat": 1567061809, "aud": "clientB", "sub": "2d6224b8-a4c4-4a4b-b064-18a5ac07a607", "typ": "Bearer", "azp": "clientA", "auth_time": 0, "session_state": "ff2e581c-0663-4b8c-9332-629b02c02729", "acr": "1", "realm_access": { "roles": [ "RoleA" ] }, "authorization": { "permissions": [ { "rsid": "e0dbd6bb-a4de-40bb-b017-4eba9a5a0139", "rsname": "Default Resource" } ] }, "scope": "email profile", "email_verified": false, "preferred_username": "user" } here I see that I have only RoleA (that is correct - I'm going through clientA) But when I make requests: curl -d 'client_id=clientA' -d 'username=user' -d 'password=1' -d 'grant_type=password' ' http://localhost:8280/auth/realms/TestRPT/protocol/openid-connect/token' grab access-token and curl -X POST \ http://localhost:8280/auth/realms/TestRPT/protocol/openid-connect/token \ -H "Authorization: Bearer access-token-from-first-curl" \ --data "grant_type=urn:ietf:params:oauth:grant-type:uma-ticket" \ --data "audience=clientB" I get different jwt: { "jti": "f956218e-abcf-4017-a6b2-d9c3c82692a2", "exp": 1567062641, "nbf": 0, "iat": 1567062341, "iss": "http://localhost:8280/auth/realms/TestRPT", "aud": "clientB", "sub": "2d6224b8-a4c4-4a4b-b064-18a5ac07a607", "typ": "Bearer", "azp": "clientA", "auth_time": 0, "session_state": "4d556dd0-4d27-4028-ac1d-54afd2e1f20e", "acr": "1", "realm_access": { "roles": [ "RoleB", "RoleA" ] }, "authorization": { "permissions": [ { "rsid": "e0dbd6bb-a4de-40bb-b017-4eba9a5a0139", "rsname": "Default Resource" } ] }, "scope": "email profile", "email_verified": false, "preferred_username": "user" } Why "RoleB" is in RPT? Do I understand documentation wrong? Wrong RPT request? Our main target is: when user goes through clientA to clientB, clientB should receive only those roles that the user has in clientA. We have many applications-clients and we want to limit some of them. How can we achieve this? Thanks in advance. Alexey Makarevich.

6 years, 8 months

2
1
0 / 0

Not able to extend User Storage SPI without changing Keycloak configuration files

by David VS

Goal: Setup custom federation which extends ldap provider. Question: What is the proper way to extend the ldap federation while adding one more configuration input? (without changing internal keycloak files) I followed the steps in https://www.keycloak.org/docs/latest/server_development/index.html#_user-... and specify my own provider and providerFactory, In admin console, when trying to create the federation "custom-ldap", most of the input fields do not have a label and some buttons like "Test connection" are missing. The configuration property that I added and customized has label/default value/tooltip. If it is not possible to extend the form, is there an easy way how to inherit the same UI form from the ldap federation page in my extension? (Im new to keycloak, and do not have experience with Freemarker). Thank you so much for your support, David

6 years, 8 months

3
3
0 / 0

Keycloak 7 release

by Stian Thorgersen

https://www.keycloak.org/2019/08/keycloak-700-released.html Note - Keycloak Gatekeeper 7 is not ready yet and will be released next week

6 years, 8 months

2
3
0 / 0

Identity provider mapper - Attribute to role

by Matteo Restelli

Hi all, We're trying to setup an Attribute to role mapper inside our SAML 2.0 identity provider. The problem is that our attribute contains whitespaces. How can we map an attribute with whitespaces to a role? Currently surrounding it with double quotes or single quotes doesn't work. Any thoughts on that? Thank you, Matteo -- Like <https://www.facebook.com/cuebiq/> I Follow <https://twitter.com/Cuebiq>I Connect <https://www.linkedin.com/company/cuebiq> This email is reserved exclusively for sending and receiving messages inherent working activities, and is not intended nor authorized for personal use. Therefore, any outgoing messages or incoming response messages will be treated as company messages and will be subject to the corporate IT policy and may possibly to be read by persons other than by the subscriber of the box. Confidential information may be contained in this message. If you are not the address indicated in this message, please do not copy or deliver this message to anyone. In such case, you should notify the sender immediately and delete the original message.

6 years, 8 months

2
4
0 / 0

Unable to get SAML ForceAuthn to work

by Neil Russell

Hey, I'm trying to get ForceAuthn to work with a third party who is using Shibboleth but have been unable to get it to force re-authentication if I have an existing session. I've inspected the SAML request and ForceAuthn is being passed in the request, one issue is that Shibboleth passes ForceAuthn="1" instead of ForceAuthn="true" and the parser doesn't appear to handle that. I made a fix to the StaxParserUtil class to try and get it working but even though I can now see that parser is returning true when the ForceAuthn attribute is read I'm still not getting the expected behaviour and I'm not sure where to look next. Any suggestions would be appreciated, am I looking in completely the wrong place? Thanks, Neil Russell

6 years, 8 months

3
5
0 / 0

SAML Assertion Expiration v4.8.0

by gambol

Hiya Was wondering if anyone else has come across this error before. After upgrading to v4.8.0 users are complaining about intermittent login failures via the federated IDP 09:14:46,188 INFO [org.keycloak.saml.validators.ConditionsValidator] (default task-434) Assertion _cc9a97f8-2a30-49e8-bca5-8eefcd49d592 expired. 09:14:46,188 ERROR [org.keycloak.broker.saml.SAMLEndpoint] (default task-434) Assertion expired. 09:14:46,188 WARN [org.keycloak.events] (default task-434) type=IDENTITY_PROVIDER_RESPONSE_ERROR, realmId=xxxx, clientId=null, userId=null, ipAddress=xxxxxxxxx, error=invalid_saml_response The federated IDP is backed by ADFS Googling around the issue seems to suggest a diff on clocks; but the time on all the worker nodes (running in kubernetes) is all fine; and the upstream broker (ADFS) said their time is fine. Anyone seen this before? .. even better, anyone know of a solution? :-) Thanks in advance Rohith

6 years, 8 months

2
1
0 / 0

Theme caching

by Barish Yumerov

Hello, I am running keycloack in a docker container using this iamge: jboss/keycloak I created a few themes, and disabled caching by editing ./standalone/configuration/standalone.xml as <theme> <staticMaxAge>-1</staticMaxAge> <cacheThemes>false</cacheThemes> <cacheTemplates>false</cacheTemplates> ... </theme> alghough this, I can see changes only if I restart the docker container. I even clear all type of caches for the ralm in the admin pannel but still I cannot see any changes :( How I can clear cache without restarting docker container or is there any setting that disables caching in dev mode? Thank you in advance! Best Regards, B Yumerov

6 years, 8 months

3
2
0 / 0

Context based User Roles

by Siddhartha Moitra

Hi, Recently started using Keycloak as our IAM. I have a use case where user-roles can change based on some contextual data. The contextual data can be stored as User Attributes but how do I map the user to the derived role. All the roles exist as Realm roles. Any pointers will be much appreciated. Thanks, Sid

6 years, 8 months

1
0
0 / 0

Keycloak Javascript Adapter - How Tied to Keycloak?

by Ben Ashley

Hi, Bit of a strange question from me. How tied to Keycloak server is the Keycloak Javascript adapter when it comes to enabling OIDC and OAuth2 flows? If we have a client application written using it, would it be possible to replace Keycloak with another compliant identity provider (like AzureAD or Auth0)? Cheers, Ben Ashley

6 years, 8 months

1
0
0 / 0

Using Keycloak Gatekeeper for Auth-Code-Flow over multiple microservices

by Seán Kelleher

Hi Stian, > The alternative is to have a backend for your front-end that deals with > obtaining tokens. The front-end uses a httponly cookie to be authenticated > against the backend, but never has access to the token directly. This has > the limitation that front-end and backend has to be hosted on same domain > and if you need to call external services it needs to be proxies through > the backend. It is harder to do though. Would it make sense to use Gatekeeper for this? The backend could require bearer tokens as usual but Gatekeeper could be in charge of using the authorisation code flow to log the user in and proxying the frontend's requests to the backend, mapping the cookies to the corresponding bearer tokens. It's probably more limiting than your solution for handling external services, but it could be a quick way of setting up this type of token handling? Kind regards, Seán.

6 years, 8 months

1
0
0 / 0

Keycloak admin rest api performance

by Mark de Jong

Hi, Keycloak starts to having high latencies when there are 50–100 concurrent users interacting with the Admin REST API. I tested this by using Gatling and run a specific flow which involves calling the Admin REST API. Keycloak uses a H2 database during the performance test. Keycloak is ran in a docker container within docker for Mac. We are using the following endpoints frequently: POST /users - to create a new user GET /roles - to get realm roles POST /users/{userId}/role-mappings/realm - to assign realm roles to a user I tried increasing memory in the JVM flags, but that didn’t help. It shouldn’t be a problem to have that many users right ? How can I diagnose what’s going on? Is there a metric endpoint (Prometheus available)? Are there any other diagnostics I can run? Greets, Mark

6 years, 8 months

1
0
0 / 0

SLO in Identity Brokering

by Karol Buler

Hi Keycloaks! We have a Keycloak as an Identity Broker (KC) and external OIDC Identity Provider (EIDP), which we integrate with Keycloak. Our Android/iOS application is integrated with the Keycloak, but Authentication is handled by EIDP. There is also another Android/iOS application integrated only with EIDP. SSO is working very well in both ways. SLO in the way KC -> EIDP also is working. The problem is when user is logging out from the application integrated only with EIDP. KC doesn't know anything about this logout and Android/iOS application integrated with KC is still logged in. The question is how we should do that in the proper way? BR, Karol [https://www.adbglobal.com/wp-content/uploads/adb.png] adbglobal.com<https://www.adbglobal.com> This message (including any attachments) may contain confidential, proprietary, privileged and/or private information. The information is intended for the use of the individual or entity designated above. If you are not the intended recipient of this message, please notify the sender immediately, and delete the message and any attachments. Any disclosure, reproduction, distribution or other use of this message or any attachments by an individual or entity other than the intended recipient is STRICTLY PROHIBITED. Please note that ADB protects your privacy. Any personal information we collect from you is used in accordance with our Privacy Policy<https://www.adbglobal.com/privacy-policy/> and in compliance with applicable European data protection law (Regulation (EU) 2016/679, General Data Protection Regulation) and other statutory provisions.

6 years, 8 months

1
0
0 / 0

Login and Logout between two application on different subdomains

by Tom Pearson

Hi, We have two applications on different subdomains. One is written with Grails 2 and the other with Laravel. The Grails app is integrated with Keycloak via a modfied Spring Security plugin and the Laravel app with Socialite. Individually both work correctly. However, when a user logs to one, we want them to be automatically logged in the other. Similarly, when the user logs out of one, we want them to be automatically logged out of the other. This is not working. Both applications use the same client and realm. Any help would be appreciated as we have no solution to this apart from maybe using a custom cookie. Regards, Tom Pearson

6 years, 8 months

1
0
0 / 0

Users to group mapping

by Shetty, Shweta

Our login times are not acceptable with keycloak since during the login keycloak is doing the users to the group mapping. Is there any way we can seperate the two concerns of logging in (validating the password vs this group mapping). Is there a way to schedule this users to group mapping in the background after the login is finished ? Any input is appreciated , since we do have large groups which the users belong too and the performance is painfully bad. Shweta

6 years, 8 months

2
1
0 / 0

How to add gidNumber and uidNumber when federated with openLDAP

by Shiva Prasad Thagadur Prakash

Hi Guys, I am trying to find a way to populate the gidNumber and uidNumber when a user is created in LDAP via Keycloak. I don't want to use hardcoded-attribute-mapper as it would put the same value to all the users. Is there is a way to populate these values when a user is created at the Keycloak side? For "posixAccount" in LDAP these are MUST be present attributes and LDAP throws error if these values are not present when a user is created. Eagerly waiting for your reply. Thanks, Shiva

6 years, 8 months

1
0
0 / 0

Re: [keycloak-user] Auth-Code-Flow over multiple microservices

by Hans Zandbelt

on the latter option, see also: https://hanszandbelt.wordpress.com/2017/02/24/openid-connect-for-single-p... Hans. On Thu, Aug 29, 2019 at 10:13 PM <keycloak-user-request(a)lists.jboss.org> wrote: > > You need to decide if you want the front-end to hold tokens or not. If > front-end holds tokens you can do Auth code flow securely with pkce and > public clients. That means your front-end should move secure and you should > really only store tokens temporarily in the window state rather than in > html5 storage. This is perfectly acceptable in most cases. > > The alternative is to have a backend for your front-end that deals with > obtaining tokens. The front-end uses a httponly cookie to be authenticated > against the backend, but never has access to the token directly. This has > the limitation that front-end and backend has to be hosted on same domain > and if you need to call external services it needs to be proxies through > the backend. It is harder to do though. > > An hybrid approach like you mention doesn't make any sense to me. > > On Tue, 27 Aug 2019, 11:18 bob sheknowdas, <bob.skd(a)googlemail.com> wrote: > > > Hi, > > > > I have a setup and a usecase that seems to be quite unique (according to > my > > google search effords). > > > > I use a frontend consisting of pure java script (microservice 1). > > Behind that runs a backend created with java spring boot (microservice > 2). > > > > To authenticate users I want to switch from the implict flow to the > > auth-code-flow for additional security. > > However, this additional security can not be achieved using a pure java > > script client... > > > > So I had the following idea: > > Integrating the backend into the auth-code-flow of the frontend. > > I was planing to let the request to the authorization-endpoint be handled > > by the frontend alone, but than proxy the request to the token endpoint > > through the backend (where the client secret is injected). > > > > Does the keycloak spring-boot-adapter provide any useful functionality > for > > this usecase? > > Is this a good idea in general? > > > > I am thankful for any help or comment provided :) > > > > Best > > Bob > > _______________________________________________ > > keycloak-user mailing list > > keycloak-user(a)lists.jboss.org > > https://lists.jboss.org/mailman/listinfo/keycloak-user > > > > > -- > -- hans.zandbelt(a)zmartzone.eu ZmartZone IAM - www.zmartzone.eu

6 years, 8 months

1
0
0 / 0

Kerberos token for VDI login

by Halling-Brown, Chris HLTH:EX

Hi, newbie to KC I am afraid. Looking to leverage KC for authentication purposes, logging users from multiple domains into a VDI solution hosted by a target domain. The intention is to have the user authenticate with their local IdP creds to create a true SSO solution that logs them into a VDI in the target domain. The platform we are architecting depends on a secure workspace, preferably delivered by VMware Horizon View VDI's to access an application using AD (full Kerberos integration) to manage RBAC. [cid:image001.png@01D5599A.C65088E0] Has anyone out there achieved something similar or am I smoking the good stuff? Cheers Chris

6 years, 8 months

1
1
0 / 0

Keycloak Issuing the same token with jwt/issuer and jwt/jwksUri

by Jayathirth, Pramod Raghavendra

Hi All, I am trying to run an oauth authentication and authorization server like a keycloak along with the istio to enable some form of credentials management. I saw that many people had run into the same. I am following this, https://redhat-developer-demos.github.io/istio-tutorial/istio-tutorial/1..... I am able to successfully block the user without token. I am able to get the token as well. But the curl with token authorization fails from Istio's side. (curl -H "Authorization: Bearer $token" customer-tutorial.$(minishift ip).nip.io). Also I have been using keycloak from a few weeks. I saw that it gives the same token every time. Is this behavior normal? Are you aware of any such issue that you would have faced? Or Did you suggest any other tutorial/Page that explains this better? I am using 1.2.2 istio and keycloak 6.0.1. Please do let me know on how to proceed. Regards, Pramod Raghavendra Jayathirth

6 years, 8 months

1
0
0 / 0

Custom actions on a password, when an user change passwords?

by Rémy Grünblatt

Hello, I'm searching for a way to execute a custom action when an user defines or changes its password. The goal is to save the password in another format (the ultimate goal is being able to do scram/sha1 on the id of the users), while maintaining the normal operation of keycloak (we don't want to change the way keycloak stores its passwords, we just want a sort of copy). Does it ring a bell for someone in there? Do you know of a way to do that? Thanks, Rémy

6 years, 8 months

1
0
0 / 0

Auth-Code-Flow over multiple microservices

by bob sheknowdas

Hi, I have a setup and a usecase that seems to be quite unique (according to my google search effords). I use a frontend consisting of pure java script (microservice 1). Behind that runs a backend created with java spring boot (microservice 2). To authenticate users I want to switch from the implict flow to the auth-code-flow for additional security. However, this additional security can not be achieved using a pure java script client... So I had the following idea: Integrating the backend into the auth-code-flow of the frontend. I was planing to let the request to the authorization-endpoint be handled by the frontend alone, but than proxy the request to the token endpoint through the backend (where the client secret is injected). Does the keycloak spring-boot-adapter provide any useful functionality for this usecase? Is this a good idea in general? I am thankful for any help or comment provided :) Best Bob

6 years, 8 months

2
1
0 / 0

Keycloak Domain TCP Clustering of Sessions in AWS not auto-failing over to node

by JTK

I have two nodes setup in a cluster using TCP port 7600 and I see them join the cluster in the logs. On Master: [Host Controller] 15:07:18,293 INFO [org.jboss.as.domain.controller] (Host Controller Service Threads - 7) WFLYHC0019: Registered remote slave host "dev-slave1", JBoss Keycloak 6.0.1 (WildFly 8.0.0.Final) On Slave: [Host Controller] 15:03:12,603 INFO [org.jboss.as.host.controller] (Host Controller Service Threads - 3) WFLYHC0148: Connected to master host controller at remote://10.10.10.77:9999 In the WildFly admin panel I see the server group: auth-server-group which is ha and then I see both servers in the group and they are both green. I've set the distributed-cache setup to 2 in domain.xml, so it should be sharing session information: <distributed-cache name="sessions" owners="2"/> <distributed-cache name="authenticationSessions" owners="2"/> <distributed-cache name="offlineSessions" owners="2"/> <distributed-cache name="clientSessions" owners="2"/> <distributed-cache name="offlineClientSessions" owners="2"/> <distributed-cache name="loginFailures" owners="2"/> <distributed-cache name="actionTokens" owners="2"> Here is the logs on the master showing there a new cluster has been received: 2019-08-26 15:03:19,776 INFO [org.infinispan.CLUSTER] (MSC service thread 1-1) ISPN000094: Received new cluster view for channel ejb: [dev-master|0] (1) [dev-master] 2019-08-26 15:03:19,779 INFO [org.infinispan.CLUSTER] (MSC service thread 1-3) ISPN000094: Received new cluster view for channel ejb: [dev-master|0] (1) [dev-master] 2019-08-26 15:03:19,780 INFO [org.infinispan.CLUSTER] (MSC service thread 1-2) ISPN000094: Received new cluster view for channel ejb: [dev-master|0] (1) [dev-master] 2019-08-26 15:03:19,780 INFO [org.infinispan.CLUSTER] (MSC service thread 1-4) ISPN000094: Received new cluster view for channel ejb: [dev-master|0] (1) [dev-master] 2019-08-26 15:03:19,875 INFO [org.infinispan.CLUSTER] (MSC service thread 1-1) ISPN000094: Received new cluster view for channel ejb: [dev-master|0] (1) [dev-master] And on the slave: 2019-08-26 15:07:29,567 INFO [org.infinispan.CLUSTER] (MSC service thread 1-2) ISPN000094: Received new cluster view for channel ejb: [dev-slave1|0] (1) [dev-slave1] 2019-08-26 15:07:29,572 INFO [org.infinispan.CLUSTER] (MSC service thread 1-3) ISPN000094: Received new cluster view for channel ejb: [dev-slave1|0] (1) [dev-slave1] 2019-08-26 15:07:29,572 INFO [org.infinispan.CLUSTER] (MSC service thread 1-4) ISPN000094: Received new cluster view for channel ejb: [dev-slave1|0] (1) [dev-slave1] 2019-08-26 15:07:29,574 INFO [org.infinispan.CLUSTER] (MSC service thread 1-1) ISPN000094: Received new cluster view for channel ejb: [dev-slave1|0] (1) [dev-slave1] 2019-08-26 15:07:29,635 INFO [org.infinispan.CLUSTER] (MSC service thread 1-3) ISPN000094: Received new cluster view for channel ejb: [dev-slave1|0] (1) [dev-slave1] I believe I read somewhere that I was supposed to see the master and slave together in the logs an not just master or slave. Maybe this is my issue, but I don't know how to resolve it. I can't use multi-cast as it's disabled in AWS and almost all cloud providers. When I launch the master and let it come up, then launch the slave I can see all the traffic for the session on the master. As soon as I stop the master, the slave is looking for the master, but when I click on the website, it just hangs waiting for a connection and then eventually logs me out, and I end up logging back in, and now I'm on the slave node. The shared sessions are not happening. Is there something else I need to do or set? I have this setup in my domain.xml configuration as well: <server-group name="auth-server-group" profile="ha"> <jvm name="default"> <heap size="64m" max-size="512m"/> </jvm> <socket-binding-group ref="ha-sockets"/> <system-properties> <property name="jboss.cluster.tcp.initial_hosts" value="10.10.10.77[7600],10.10.10.27[7600]"/> </system-properties> </server-group> In my host.xml on the slave I have this setup to reach back to the master as the domain controller <domain-controller> <remote protocol="remote" host="${jboss.domain.master.address}" port="${jboss.domain.master.port:9999}" security-realm="ManagementRealm"/> </domain-controller> Any help would be appreciated

6 years, 8 months

2
6
0 / 0

Is there a LTS version of Keycloak

by Paul Edison

Hi, is there any version as LTS from Keycloak, that is meant to be uses for productive use? Or is there any strategy for long time usage of Keycloak? Kind Regards, Paul

6 years, 8 months

3
2
0 / 0

Log newly synced users form federated LDAP

by Paul Edison

Hi, I’m using a Keycloak with a LDAP federated as user source. The users should be synced manually. What I now would need is to know on a sync what users get newly synced to the Keycloak store and which are simply get updated. Is there a way and get it configured and logged to some logfiles or to the UI? Kind Regards, Paul

6 years, 8 months

3
2
0 / 0

Non-public version of keycloak?

by Paul Luk

In the redhat sso roadmap page, I found the redhat sso 7.3.3 is based on a keycloak of version 4.8.11...And I can't find those versions in keycloak.org and within... Is it means that there are non-public keycloak versions ? I need redhat subscription so as to use those versions? Best regards, Paul

6 years, 8 months

2
1
0 / 0

How to export Keycloak Data with second instance? Or should i use db tools?

by konphite＠mailbox.org

Hello together, iam relative new to keycloak. Iam reading the documentation of keycloak about import/export data. The documentation looks a little bit short to me and, honestly, it confused me why there are only few questions about this in the www. I hope some more experienced user can help me, because i think its a standard problem: I want to backup my keycloak Data. Whats the right way? Backup the data over the standalone.sh, or backup the whole postgredb via db tools? In my feeling, the import/export keycloak function over standalone.sh looks not like a real backup option, more like a "migration-tool" to migrate the data from one database to another. Am i wrong? If i using the standalone.sh, how i can backup my data while my instance is running? I cant stop they keycloak server in production for daily backups. I read in the mailing list, that is possible to run "a second instance" of Jboss on the same server, when i start the standalone.sh with other port binding (i.e : with -Djboss.socket.binding.port-offset=). But iam wondering: How can i stop this instance after the backup is done? Is this really best practice? Iam thanksfull for any help best regards Konphite

6 years, 8 months

2
1
0 / 0

Keycloak - Supported Database Versions - PostgreSQL

by Townsley, Eric L

Hi, What versions of Postgres does Keycloak support? Thanks Eric Please consider the environment before printing this email and any attachments. This e-mail and any attachments are intended only for the individual or company to which it is addressed and may contain information which is privileged, confidential and prohibited from disclosure or unauthorized use under applicable law. If you are not the intended recipient of this e-mail, you are hereby notified that any use, dissemination, or copying of this e-mail or the information contained in this e-mail is strictly prohibited by the sender. If you have received this transmission in error, please return the material received to the sender and delete all copies from your system.

6 years, 8 months

2
1
0 / 0

Unable to change login theme to other than base

by Ana maria Jordan

Dear all. We are testing Keycloak as SAML2 gateway to some both external and internal systems we are to integrate with. We downloaded and configured Keycloak server (standalone) version 6.0.1, created a new realm, and for the initial tests add some clients running on Tomcat. We are able to authenticate to those clients via SAML2 protocol, but the problem is that I would like to configure the login page for them to be the one provided by the corresponding realm theme, and get only the base theme’s login page. Did I misunderstand the documentation (3.6 Theme Selector -> “By default the theme configured for the realm is used […]”)? Could any of you figure out what I am doing wrong? Many thanks in advance for the help. Best regards.

6 years, 8 months

1
0
0 / 0

OIDC ERROR: Failed to exchange code for token. Make sure the client secret is correct. undefined

by Iommi Underwood

Hi, I am currently setting up Cloudflare access with a generic openID provider as an access login method with Keycloak. The configuration is complete from both ends, however when I test from cloudflare, after the authentication is done I see the error "OIDC ERROR: Failed to exchange code for token. Make sure the client secret is correct. undefined". From a trace that I took on the keycloak server, I see that the server is authenticating the user and responding back, but cloudflare is still displaying this error. Below is the TCP stream between client (cloudflare) and server (keycloak): ******************* START STREAM ******************* GET /auth/realms/[**SUPRESSED**]/protocol/openid-connect/auth?client_id=cloudflare-access&redirect_uri=https%3A%2F%2F[**SUPRESSED**].cloudflareaccess.com%2Fcdn-cgi%2Faccess%2Fcallback&response_type=code&state=b59047eb1016be0d59b306a2c35b74d9323864549c7d7ae2c78775e890b4c04c.JTdCJTIyaG9zdG5hbWUlMjIlM0ElMjJ4Y2FsaWJlci5jbG91ZGZsYXJlYWNjZXNzLmNvbSUyMiUyQyUyMnJlZGlyZWN0VVJMJTIyJTNBJTIyJTJGJTIyJTJDJTIyYXVkJTIyJTNBJTIyJTIyJTJDJTIyaWRwSWQlMjIlM0ElMjJiZGY3ZmY5Ni1kNzg4LTRmZGUtYWE1Ny1hNmFmOTZkOWM0ZmUlMjIlMkMlMjJpc0VudFNldHVwJTIyJTNBZmFsc2UlMkMlMjJpc0lEUFRlc3QlMjIlM0F0cnVlJTJDJTIybm9uY2UlMjIlM0ElMjJjNWhPRTZFN3dIMHo0WTdGJTIyJTdE&scope=openid+email+profile HTTP/1.1 Host: keycloak.[**SUPRESSED**].io:8180 Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.100 Safari/537.36 Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3 Sec-Fetch-Site: cross-site Referer: https://dash.cloudflare.com/ Accept-Encoding: gzip, deflate Accept-Language: en-GB,en-US;q=0.9,en;q=0.8 Cookie: AUTH_SESSION_ID=dc1416f0-fc39-457d-80fd-48daa16db16b; KEYCLOAK_IDENTITY=eyJhbGciOiJIUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICI3Yzk0NGUzMi0zZTk2LTRmNjctOGJkMC1jZDUwN2QzNTkxZTcifQ.eyJqdGkiOiI3ZDI4YWQ0ZS0zN2U1LTRkMWEtOWZkNS0zYzQ1YjQ2MzQzNzAiLCJleHAiOjE1NjY5MzI2NDYsIm5iZiI6MCwiaWF0IjoxNTY2ODk2NjQ2LCJpc3MiOiJodHRwOi8va2V5Y2xvYWsueGNhbGliZXIuaW86ODE4MC9hdXRoL3JlYWxtcy9YQ2FsaWJlciIsInN1YiI6ImU5NDA3OWJhLTNhNzUtNDc1ZS1hM2MyLWFiZTIyMjY4MWFiYSIsImF1dGhfdGltZSI6MCwic2Vzc2lvbl9zdGF0ZSI6ImRjMTQxNmYwLWZjMzktNDU3ZC04MGZkLTQ4ZGFhMTZkYjE2YiIsInN0YXRlX2NoZWNrZXIiOiJTeDJOSEZoc1lSUDk2TFF5S3RiZDNINVc3UzhKSXdqX3BLcE1ZSEFiNWhBIn0.zHM0hLg96gEPGTdaBjX0KSaZ4hGoETTKc-efvfqni90; KEYCLOAK_SESSION=[**SUPRESSED**]/e94079ba-3a75-475e-a3c2-abe222681aba/dc1416f0-fc39-457d-80fd-48daa16db16b; _ga=GA1.2.424301711.1560267296; __cfduid=d23d08383e8ff667abef204b0821031e01562311327; __zlcmid=tPiP7fQJt3UNtf; _gid=GA1.2.1095447441.1566802604 HTTP/1.1 200 OK Cache-Control: no-store, must-revalidate, max-age=0 Set-Cookie: AUTH_SESSION_ID=3aae7e12-8755-412f-b565-a65c9b756f9a; Version=1; Path=/auth/realms/[**SUPRESSED**]/; HttpOnly Set-Cookie: KC_RESTART=eyJhbGciOiJIUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICI3Yzk0NGUzMi0zZTk2LTRmNjctOGJkMC1jZDUwN2QzNTkxZTcifQ.eyJjaWQiOiJjbG91ZGZsYXJlLWFjY2VzcyIsInB0eSI6Im9wZW5pZC1jb25uZWN0IiwicnVyaSI6Imh0dHBzOi8veGNhbGliZXIuY2xvdWRmbGFyZWFjY2Vzcy5jb20vY2RuLWNnaS9hY2Nlc3MvY2FsbGJhY2siLCJhY3QiOiJBVVRIRU5USUNBVEUiLCJub3RlcyI6eyJzY29wZSI6Im9wZW5pZCBlbWFpbCBwcm9maWxlIiwiaXNzIjoiaHR0cDovL2tleWNsb2FrLnhjYWxpYmVyLmlvOjgxODAvYXV0aC9yZWFsbXMvWENhbGliZXIiLCJyZXNwb25zZV90eXBlIjoiY29kZSIsImNvZGVfY2hhbGxlbmdlX21ldGhvZCI6InBsYWluIiwicmVkaXJlY3RfdXJpIjoiaHR0cHM6Ly94Y2FsaWJlci5jbG91ZGZsYXJlYWNjZXNzLmNvbS9jZG4tY2dpL2FjY2Vzcy9jYWxsYmFjayIsInN0YXRlIjoiYjU5MDQ3ZWIxMDE2YmUwZDU5YjMwNmEyYzM1Yjc0ZDkzMjM4NjQ1NDljN2Q3YWUyYzc4Nzc1ZTg5MGI0YzA0Yy5KVGRDSlRJeWFHOXpkRzVoYldVbE1qSWxNMEVsTWpKNFkyRnNhV0psY2k1amJHOTFaR1pzWVhKbFlXTmpaWE56TG1OdmJTVXlNaVV5UXlVeU1uSmxaR2x5WldOMFZWSk1KVEl5SlROQkpUSXlKVEpHSlRJeUpUSkRKVEl5WVhWa0pUSXlKVE5CSlRJeUpUSXlKVEpESlRJeWFXUndTV1FsTWpJbE0wRWxNakppWkdZM1ptWTVOaTFrTnpnNExUUm1aR1V0WVdFMU55MWhObUZtT1Raa09XTTBabVVsTWpJbE1rTWxNakpwYzBWdWRGTmxkSFZ3SlRJeUpUTkJabUZzYzJVbE1rTWxNakpwYzBsRVVGUmxjM1FsTWpJbE0wRjBjblZsSlRKREpUSXlibTl1WTJVbE1qSWxNMEVsTWpKak5XaFBSVFpGTjNkSU1IbzBXVGRHSlRJeUpUZEUifX0.nRE_5ul_l3S9FA8-mN23OzZUGGSYN_khFaQ4HSxeuWM; Version=1; Path=/auth/realms/[**SUPRESSED**]/; HttpOnly Set-Cookie: KEYCLOAK_IDENTITY=; Version=1; Comment=Expiring cookie; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Max-Age=0; Path=/auth/realms/[**SUPRESSED**]/; HttpOnly Set-Cookie: KEYCLOAK_SESSION=; Version=1; Comment=Expiring cookie; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Max-Age=0; Path=/auth/realms/[**SUPRESSED**]/ Set-Cookie: KEYCLOAK_IDENTITY=; Version=1; Comment=Expiring cookie; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Max-Age=0; Path=/auth/realms/[**SUPRESSED**]; HttpOnly Set-Cookie: KEYCLOAK_SESSION=; Version=1; Comment=Expiring cookie; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Max-Age=0; Path=/auth/realms/[**SUPRESSED**] Set-Cookie: KEYCLOAK_IDENTITY=; Version=1; Comment=Expiring cookie; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Max-Age=0; Path=/auth/realms/[**SUPRESSED**]; HttpOnly Set-Cookie: KEYCLOAK_SESSION=; Version=1; Comment=Expiring cookie; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Max-Age=0; Path=/auth/realms/[**SUPRESSED**] X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Content-Security-Policy: frame-src 'self'; frame-ancestors 'self'; object-src 'none'; Date: Tue, 27 Aug 2019 09:05:11 GMT Connection: keep-alive X-Robots-Tag: none Strict-Transport-Security: max-age=31536000; includeSubDomains X-Content-Type-Options: nosniff Content-Type: text/html;charset=utf-8 Content-Length: 3013 Content-Language: en <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">; <html xmlns="http://www.w3.org/1999/xhtml"; class="login-pf"> <head> <meta charset="utf-8"> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /> <meta name="robots" content="noindex, nofollow"> <meta name="viewport" content="width=device-width,initial-scale=1"/> <title>Log in to [**SUPRESSED**]</title> <link rel="icon" href="/auth/resources/5.0.0/login/keycloak/img/favicon.ico" /> <link href="/auth/resources/5.0.0/login/keycloak/node_modules/patternfly/dist/css/patternfly.css" rel="stylesheet" /> <link href="/auth/resources/5.0.0/login/keycloak/node_modules/patternfly/dist/css/patternfly-additions.css" rel="stylesheet" /> <link href="/auth/resources/5.0.0/login/keycloak/lib/zocial/zocial.css" rel="stylesheet" /> <link href="/auth/resources/5.0.0/login/keycloak/css/login.css" rel="stylesheet" /> </head> <body class=""> <div class="login-pf-page"> <div id="kc-header" class="login-pf-page-header"> <div id="kc-header-wrapper" class=""><div class="kc-logo-text"><span>[**SUPRESSED**]</span></div></div> </div> <div class="card-pf "> <header class="login-pf-header"> <h1 id="kc-page-title"> Log In </h1> </header> <div id="kc-content"> <div id="kc-content-wrapper"> <div id="kc-form" > <div id="kc-form-wrapper" > <form id="kc-form-login" onsubmit="login.disabled = true; return true;" action="http://keycloak.[**SUPRESSED**].io:8180/auth/realms/[**SUPRESSED**]/login..."; method="post"> <div class="form-group"> <label for="username" class="control-label">Username or email</label> <input tabindex="1" id="username" class="form-control" name="username" value="" type="text" autofocus autocomplete="off" /> </div> <div class="form-group"> <label for="password" class="control-label">Password</label> <input tabindex="2" id="password" class="form-control" name="password" type="password" autocomplete="off" /> </div> <div class="form-group login-pf-settings"> <div id="kc-form-options"> </div> <div class=""> </div> </div> <div id="kc-form-buttons" class="form-group"> <input tabindex="4" class="btn btn-primary btn-block btn-lg" name="login" id="kc-login" type="submit" value="Log In"/> </div> </form> </div> </div> </div> </div> </div> </div> </body> </html> POST /auth/realms/[**SUPRESSED**]/login-actions/authenticate?session_code=f3NG2Rjv0G4ymg2pQqwGMvrxu_rXJXtmZnDCZgsPkb4&execution=07ebd6fc-53e0-4fae-a6dd-5e32b9cf1b73&client_id=cloudflare-access&tab_id=IAnjjExJu-4 HTTP/1.1 Host: keycloak.[**SUPRESSED**].io:8180 Connection: keep-alive Content-Length: 30 Cache-Control: max-age=0 Origin: http://keycloak.[**SUPRESSED**].io:8180 Upgrade-Insecure-Requests: 1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.100 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3 Referer: http://keycloak.[**SUPRESSED**].io:8180/auth/realms/[**SUPRESSED**]/proto... Accept-Encoding: gzip, deflate Accept-Language: en-GB,en-US;q=0.9,en;q=0.8 Cookie: AUTH_SESSION_ID=3aae7e12-8755-412f-b565-a65c9b756f9a; KC_RESTART=eyJhbGciOiJIUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICI3Yzk0NGUzMi0zZTk2LTRmNjctOGJkMC1jZDUwN2QzNTkxZTcifQ.eyJjaWQiOiJjbG91ZGZsYXJlLWFjY2VzcyIsInB0eSI6Im9wZW5pZC1jb25uZWN0IiwicnVyaSI6Imh0dHBzOi8veGNhbGliZXIuY2xvdWRmbGFyZWFjY2Vzcy5jb20vY2RuLWNnaS9hY2Nlc3MvY2FsbGJhY2siLCJhY3QiOiJBVVRIRU5USUNBVEUiLCJub3RlcyI6eyJzY29wZSI6Im9wZW5pZCBlbWFpbCBwcm9maWxlIiwiaXNzIjoiaHR0cDovL2tleWNsb2FrLnhjYWxpYmVyLmlvOjgxODAvYXV0aC9yZWFsbXMvWENhbGliZXIiLCJyZXNwb25zZV90eXBlIjoiY29kZSIsImNvZGVfY2hhbGxlbmdlX21ldGhvZCI6InBsYWluIiwicmVkaXJlY3RfdXJpIjoiaHR0cHM6Ly94Y2FsaWJlci5jbG91ZGZsYXJlYWNjZXNzLmNvbS9jZG4tY2dpL2FjY2Vzcy9jYWxsYmFjayIsInN0YXRlIjoiYjU5MDQ3ZWIxMDE2YmUwZDU5YjMwNmEyYzM1Yjc0ZDkzMjM4NjQ1NDljN2Q3YWUyYzc4Nzc1ZTg5MGI0YzA0Yy5KVGRDSlRJeWFHOXpkRzVoYldVbE1qSWxNMEVsTWpKNFkyRnNhV0psY2k1amJHOTFaR1pzWVhKbFlXTmpaWE56TG1OdmJTVXlNaVV5UXlVeU1uSmxaR2x5WldOMFZWSk1KVEl5SlROQkpUSXlKVEpHSlRJeUpUSkRKVEl5WVhWa0pUSXlKVE5CSlRJeUpUSXlKVEpESlRJeWFXUndTV1FsTWpJbE0wRWxNakppWkdZM1ptWTVOaTFrTnpnNExUUm1aR1V0WVdFMU55MWhObUZtT1Raa09XTTBabVVsTWpJbE1rTWxNakpwYzBWdWRGTmxkSFZ3SlRJeUpUTkJabUZzYzJVbE1rTWxNakpwYzBsRVVGUmxjM1FsTWpJbE0wRjBjblZsSlRKREpUSXlibTl1WTJVbE1qSWxNMEVsTWpKak5XaFBSVFpGTjNkSU1IbzBXVGRHSlRJeUpUZEUifX0.nRE_5ul_l3S9FA8-mN23OzZUGGSYN_khFaQ4HSxeuWM; _ga=GA1.2.424301711.1560267296; __cfduid=d23d08383e8ff667abef204b0821031e01562311327; __zlcmid=tPiP7fQJt3UNtf; _gid=GA1.2.1095447441.1566802604 username=[**SUPRESSED**]&password=[**SUPRESSED**]HTTP/1.1 302 Found Connection: keep-alive Cache-Control: no-store, must-revalidate, max-age=0 Set-Cookie: KC_RESTART=; Version=1; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Max-Age=0; Path=/auth/realms/[**SUPRESSED**]/; HttpOnly Set-Cookie: KEYCLOAK_IDENTITY=eyJhbGciOiJIUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICI3Yzk0NGUzMi0zZTk2LTRmNjctOGJkMC1jZDUwN2QzNTkxZTcifQ.eyJqdGkiOiI5ZDEyY2Y2NS00MzRlLTQ3ZjItODAyYi01MTFiMDFmZjVkMTUiLCJleHAiOjE1NjY5MzI3MTYsIm5iZiI6MCwiaWF0IjoxNTY2ODk2NzE2LCJpc3MiOiJodHRwOi8va2V5Y2xvYWsueGNhbGliZXIuaW86ODE4MC9hdXRoL3JlYWxtcy9YQ2FsaWJlciIsInN1YiI6ImU5NDA3OWJhLTNhNzUtNDc1ZS1hM2MyLWFiZTIyMjY4MWFiYSIsImF1dGhfdGltZSI6MCwic2Vzc2lvbl9zdGF0ZSI6IjNhYWU3ZTEyLTg3NTUtNDEyZi1iNTY1LWE2NWM5Yjc1NmY5YSIsInN0YXRlX2NoZWNrZXIiOiJOQ3M2LVR2T0JPaVg3VWIyUzM3NldvV3piOF91M1pVUXY1ODVOVU5mV2pBIn0.BOFLzvv6qXrMopCHd6uas0g_ywNDHskE3WRvwwS2oWY; Version=1; Path=/auth/realms/[**SUPRESSED**]/; HttpOnly Set-Cookie: KEYCLOAK_SESSION=[**SUPRESSED**]/e94079ba-3a75-475e-a3c2-abe222681aba/3aae7e12-8755-412f-b565-a65c9b756f9a; Version=1; Expires=Tue, 27-Aug-2019 19:05:16 GMT; Max-Age=36000; Path=/auth/realms/[**SUPRESSED**]/ Set-Cookie: KEYCLOAK_REMEMBER_ME=; Version=1; Comment=Expiring cookie; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Max-Age=0; Path=/auth/realms/[**SUPRESSED**]/; HttpOnly P3P: CP="This is not a P3P policy!" Location: https://[**SUPRESSED**].cloudflareaccess.com/cdn-cgi/access/callback?state=b59047eb1016be0d59b306a2c35b74d9323864549c7d7ae2c78775e890b4c04c.JTdCJTIyaG9zdG5hbWUlMjIlM0ElMjJ4Y2FsaWJlci5jbG91ZGZsYXJlYWNjZXNzLmNvbSUyMiUyQyUyMnJlZGlyZWN0VVJMJTIyJTNBJTIyJTJGJTIyJTJDJTIyYXVkJTIyJTNBJTIyJTIyJTJDJTIyaWRwSWQlMjIlM0ElMjJiZGY3ZmY5Ni1kNzg4LTRmZGUtYWE1Ny1hNmFmOTZkOWM0ZmUlMjIlMkMlMjJpc0VudFNldHVwJTIyJTNBZmFsc2UlMkMlMjJpc0lEUFRlc3QlMjIlM0F0cnVlJTJDJTIybm9uY2UlMjIlM0ElMjJjNWhPRTZFN3dIMHo0WTdGJTIyJTdE&session_state=3aae7e12-8755-412f-b565-a65c9b756f9a&code=af698d46-23a0-44e2-9832-71f5434ccf69.3aae7e12-8755-412f-b565-a65c9b756f9a.975d74ab-0c36-465e-bb38-32a0559eca73 Content-Length: 0 Date: Tue, 27 Aug 2019 09:05:16 GMT ******************* END STREAM ******************* Let me know if you have any further queries. Regards, Iommi

6 years, 8 months

1
0
0 / 0

Re: [keycloak-user] check-sso not working as expected with iframe

by Michal Hajas

Sorry, I am not sure I fully understand the question, if my answer is not what you expected, please describe your issue properly with some steps to reproduce and describe what behavior you expect or if you think this is a bug, feel free to file an issue in our Jira. If your webpage is configured as check-sso, it means you do not require authentication (the page is visible also for users which are not authenticated). If an authenticated user is logged out in a separate tab he is redirected to keycloak only in case login is required. But since the webpage is configured as check-sso, keycloak knows it doesn't require authentication and hence doesn't redirect the user to a login page. The iframe is used anyway because keycloak adapter is aware of the fact that user is not logged in (he lost the session), however, it just clears the tokens and set the adapter to authenticated = false state (in case of check-sso option). If I understand correctly, you want to reauthenticate user in case he loses his session. You can do that in two ways. Set the onLoad option to loginRequired or use onAuthLogout callback as I suggested in the last response. It could look something like that (I haven't tested it): keycloak.onAuthLogout = function() { keycloak.login(); } On Mon, Aug 26, 2019 at 9:07 PM Mohsin Ilyas <Mohsin_981(a)hotmail.com> wrote: > But don’t you think if the sso session is valid then the user would > continue to use the website so the iframe shouldn’t be connected again if > the connection was broken? As I’ve seen that the check-sso would use iframe > in a hidden request but if it is not working as expected than what is the > use of that. > > > ------------------------------ > *From:* Michal Hajas <mhajas(a)redhat.com> > *Sent:* Monday, August 26, 2019 1:21:09 PM > *To:* keycloak-user(a)lists.jboss.org <keycloak-user(a)lists.jboss.org> > *Cc:* Mohsin Ilyas <mohsin_981(a)hotmail.com> > *Subject:* Re: [keycloak-user] check-sso not working as expected with > iframe > > Hello Moshin, > > this is actually the way check-sso should work. From docs: > check-sso will only authenticate the client if the user is already > logged-in, if the user is not logged-in the browser will be redirected back > to the application and remain unauthenticated. > > When you logout in the second tab, the tab with check-sso actually detects > you are logged out, however, it does nothing because it is not supposed to. > You can check it by catching onAuthLogout event. See > https://www.keycloak.org/docs/latest/securing_apps/index.html#callback-ev... > . > > Best regards, > Michal > > On Wed, Aug 21, 2019 at 8:34 PM Mohsin Ilyas <mohsin_981(a)hotmail.com> > wrote: > >> Missed the code in original email >> >> >> const keycloak = Keycloak('/keycloak.json'); >> keycloak.init({onLoad: ‘check-sso'}) >> .success(authenticated => { >> if (authenticated) { >> //do something >> } >> }) >> .error(error => { >> console.log(error) >> }); >> >> ________________________________ >> From: Mohsin Ilyas >> Sent: Wednesday, August 21, 2019 11:29 PM >> To: keycloak-user(a)lists.jboss.org <keycloak-user(a)lists.jboss.org> >> Subject: check-sso not working as expected with iframe >> >> >> Hi, >> >> Below is my simple logic in my application to re-establish connection >> with keycloak when a page is reloaded. However, the iframe doesn’t seem to >> work well with ‘check-sso’. Because, I have opened the application in one >> tab and in other tab I have opened keycloak but when I logout of keycloak >> my application doesn’t get logout, however, if I use ‘login-required’ the >> application logs out simultaneously with keycloak. Can someone take a look, >> or help me with this? (P.s: I have tried to set checkIframLogin: true in >> the init options but it doesn’t work for me) >> >> Thanks. >> _______________________________________________ >> keycloak-user mailing list >> keycloak-user(a)lists.jboss.org >> https://lists.jboss.org/mailman/listinfo/keycloak-user >> >

6 years, 8 months

1
0
0 / 0

REST api and the Admin Client Java Wrapper

by Chris Smith

I'm trying to use the REST java api. My maven dependencies <dependencies> <dependency> <groupId>org.keycloak</groupId> <artifactId>keycloak-admin-client</artifactId> <version>7.0.0-SNAPSHOT</version> </dependency> <dependency> <groupId>org.jboss.resteasy</groupId> <artifactId>resteasy-client</artifactId> <version>3.8.1.Final</version> </dependency> <dependency> <groupId>org.jboss.resteasy</groupId> <artifactId>resteasy-jackson2-provider</artifactId> <version>3.8.1.Final</version> </dependency> <dependency> <groupId>org.jboss.resteasy</groupId> <artifactId>resteasy-multipart-provider</artifactId> <version>3.8.1.Final</version> </dependency> </dependencies> I can create a keycloak instance and get a RealmRepresentation. The RealmRepresentation looks like I expect it should, matching what I see in the KC console. When I try to get users or federated users, a null is returned. Here is a code snip Keycloak keycloak = Keycloak.getInstance( serverUrl, realmName, username, password, clientId); RealmResource realmsResource = keycloak.realm("fms-sso"); RealmRepresentation realm = realmsResource.toRepresentation(); List<UserRepresentation> userRepresentations = realm.getFederatedUsers(); userRepresentations.stream().forEach(this::printUser); userRepresentations = realm.getUsers(); userRepresentations.stream().forEach(this::printUser); realm.getFederatedUsers(); and realm.getUsers() both return null, not even an empty list. Is there something required before getting the users from a RealmRepresenetation?

6 years, 8 months

2
2
0 / 0

Incorrect redirect_uri in Authorization Code Flow

by Julián D. Zorzenón

Hi, I'm trying to setup a public client in Keycloak 6.0.1 to make an Authorization Code Flow to work but it fails on the post after the redirect. 1. I've create the following client in the realm "test": client id => keycloak-java-form-example enabled => on client protocol => openid-connect access type => public standard flow enabled => on valid redirect uris => http://localhost:9090/* 2. Manually created a user. 3. Created a simple app. When you go to http://localhost:9090/ it redirects to: https://keycloak.server:8443/auth/realms/test/protocol/openid-connect/aut... 4. I log in in the form and get the response on the endpoint http://localhost:9090/cb with a code (for example: 337f8ec8-dbdd-4965-b538-e5a4fbfff6b4.4cb543a8-1585-4bd0-b174-031288cf3032.cf57276c-98a9-48d3-b460-c678af3f8eb2). 5. I make the following POST request: POST https://keycloak.server:8443/auth/realms/test/protocol/openid-connect/token grant_type=authorization_code client_id=keycloak-java-form-example code=337f8ec8-dbdd-4965-b538-e5a4fbfff6b4.4cb543a8-1585-4bd0-b174-031288cf3032.cf57276c-98a9-48d3-b460-c678af3f8eb2 redirect_uri=http%3A%2F%2Flocalhost%3A9090%2Fcb The response is: 400 {"error":"invalid_grant","error_description":"Incorrect redirect_uri"} I'm not sure what I'm missing. Thanks

6 years, 8 months

2
2
0 / 0

The 'SAML Metadata IDPSSODescriptor' entry does not appear in the format option on the Keycloak SAML Client Installation tab.

by jiojiojijo fjafajfdsojo

Hello, I'm using Keycloak 4.8.3.Final now, and I'm trying to move to the Keycloak 6.0.1. The Keycloak 6.0.1 works fine without any problems, but I have a problem with the SAML client I set up to log in to the AWS web console. The documentation on how to work with Keycloak and AWS tells me to download metadata by selecting the 'SAML Metadata IDPSSODescriptor' item on the Keycloak Installation tab. - https://blog.scandiweb.com/article/sign-in-to-amazon-aws-using-saml-proto... But I couldn't find 'SAML Metadata IDPSSODescriptor' format option in the Keycloak Installation above 4.8.3 version. Only when I installed 4.8.3 I was able to see 'SAML Metadata IDPSSODescriptor' format option. Below is a screenshot showing the 'SAML Metadata IDPSSODescriptor' format option in the Keycloak 4.8.3.Final. This is good without any problem. [image: Screen Shot 2019-08-25 at 11.43.50 PM.png] But please see the screenshot of Keycloak 6.0.1 below. I couldn't find the SAML Metadata IDPSSODescriptor 'format option in that Keycloak 6.0.1. [image: Screen Shot 2019-08-25 at 11.45.58 PM.png] I made both versions of the Keycloak client setup the same but it works like this. I repeated the installation several times and got the same result. How has metadata been changed in the next version of Keycloak 4.8.3.Final? Please let me know if there is anything I can refer to. Thanks.

6 years, 8 months

1
0
0 / 0

Problem: ORA-00001: Unique Constraint Error by Ldap group in group

by Pühringer Stefan

Hallo! We are currently evaluate the keycloak version 6.0.1 , but we ran in an error while sync ldap groups in groups. My teststructure in ldap is: Testgroup (Top Level Group) -> Subgroup (Part of Testgroup) User 1 (Part of Subgroup) At the sync process we get following error: Caused by: java.sql.SQLIntegrityConstraintViolationException: ORA-00001: Unique Constraint (KEYCLOAK.SIBLING_NAMES) verletzt at oracle.jdbc.driver.T4CTTIoer11.processError(T4CTTIoer11.java:494) at oracle.jdbc.driver.T4CTTIoer11.processError(T4CTTIoer11.java:446) at oracle.jdbc.driver.T4C8Oall.processError(T4C8Oall.java:1054) at oracle.jdbc.driver.T4CTTIfun.receive(T4CTTIfun.java:623) at oracle.jdbc.driver.T4CTTIfun.doRPC(T4CTTIfun.java:252) at oracle.jdbc.driver.T4C8Oall.doOALL(T4C8Oall.java:612) at oracle.jdbc.driver.T4CPreparedStatement.doOall8(T4CPreparedStatement.java:226) at oracle.jdbc.driver.T4CPreparedStatement.doOall8(T4CPreparedStatement.java:59) at oracle.jdbc.driver.T4CPreparedStatement.executeForRows(T4CPreparedStatement.java:910) at oracle.jdbc.driver.OracleStatement.doExecuteWithTimeout(OracleStatement.java:1119) at oracle.jdbc.driver.OraclePreparedStatement.executeInternal(OraclePreparedStatement.java:3780) at oracle.jdbc.driver.T4CPreparedStatement.executeInternal(T4CPreparedStatement.java:1343) at oracle.jdbc.driver.OraclePreparedStatement.executeLargeUpdate(OraclePreparedStatement.java:3865) at oracle.jdbc.driver.OraclePreparedStatement.executeUpdate(OraclePreparedStatement.java:3845) at oracle.jdbc.driver.OraclePreparedStatementWrapper.executeUpdate(OraclePreparedStatementWrapper.java:1061) at org.jboss.jca.adapters.jdbc.WrappedPreparedStatement.executeUpdate(WrappedPreparedStatement.java:537) at org.hibernate.engine.jdbc.internal.ResultSetReturnImpl.executeUpdate(ResultSetReturnImpl.java:175) ... 97 more Caused by: Error : 1, Position : 0, Sql = insert into KEYCLOAK_GROUP (NAME, PARENT_GROUP, REALM_ID, ID) values (:1 , :2 , :3 , :4 ), OriginalSql = insert into KEYCLOAK_GROUP (NAME, PARENT_GROUP, REALM_ID, ID) values (?, ?, ?, ?), Error Msg = ORA-00001: Unique Constraint (KEYCLOAK.SIBLING_NAMES) verletzt at oracle.jdbc.driver.T4CTTIoer11.processError(T4CTTIoer11.java:498) ... 113 more Does someone have the same problem or a solution (i found this related and closed issue: https://issues.jboss.org/browse/KEYCLOAK-5405 )? Thanks! Stefan

6 years, 8 months

1
0
0 / 0

Logout after password change

by Himalaya Gupta

Hi, Can you please let me know if there is a setting to make the user logout of the session post password change, so that the user is forced to re-login using the new password? Thanks Scenario: 1. Login to Keycloak 2. Click on Account info. It redirects to " https://localhost:8080/auth/realms/testrealm/account/password <https://localhost:8100/auth/realms/deepikanew/account/password>" 3. On the password tab, change the password and click save 4. "Your password has been updated" message appears 5. The user is still on the same page We would require a logout to happen post successful password change. -- Best regards, Himalaya Gupta

6 years, 8 months

2
2
0 / 0

Query on high availability- HA of Keycloak docker

by vijay

Hi All, For development my setup has two keycloak containers on single VM along with postgres sql. I am following the document mentioned https://github.com/jboss-dockerfiles/keycloak/tree/master/server . I am starting the keycloak and keycloak2 docker containers with docker run -p 8080:8080 --name keycloak --link postgres:postgres -e JGROUPS_DISCOVERY_PROTOCOL=JDBC_PING -e POSTGRES_DATABASE=keycloak -e POSTGRES_USER=keycloak -e POSTGRES_PASSWORD=password -v $HOME/docker/volumes/keycloak:/tmp -d jboss/keycloak docker run -p 8081:8080 --name keycloak2 --link postgres:postgres -e JGROUPS_DISCOVERY_PROTOCOL=JDBC_PING -e POSTGRES_DATABASE=keycloak -e POSTGRES_USER=keycloak -e POSTGRES_PASSWORD=password -v $HOME/docker/volumes/keycloak2:/tmp -d jboss/keycloak In the server logs of both keycloak containers I see below error logs - 19:02:01,596 WARN [org.jboss.as.dependency.private] (MSC service thread 1-1) WFLYSRV0018: Deployment "deployment.keycloak-server.war" is using a private module ("org.kie") which may be changed or removed in future versions without notice. 19:02:02,181 ERROR [org.jboss.msc.service.fail] (ServerService Thread Pool -- 60) MSC000001: Failed to start service org.wildfly.clustering.jgroups.channel.ee: org.jboss.msc.service.StartException in service org.wildfly.clustering.jgroups.channel.ee: java.lang.IllegalStateException: java.lang.IllegalArgumentException: Either the 4 configuration properties starting with 'connection_' or the datasource_jndi_name must be set at org.wildfly.clustering.service.FunctionalService.start(FunctionalService.java:70) at org.wildfly.clustering.service.AsyncServiceConfigurator$AsyncService.lambda$start$0(AsyncServiceConfigurator.java:117) at org.jboss.threads.ContextClassLoaderSavingRunnable.run(ContextClassLoaderSavingRunnable.java:35) at org.jboss.threads.EnhancedQueueExecutor.safeRun(EnhancedQueueExecutor.java:1982) at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.doRunTask(EnhancedQueueExecutor.java:1486) at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1377) at java.lang.Thread.run(Thread.java:748) at org.jboss.threads.JBossThread.run(JBossThread.java:485) Caused by: java.lang.IllegalStateException: java.lang.IllegalArgumentException: Either the 4 configuration properties starting with 'connection_' or the datasource_jndi_name must be set at org.jboss.as.clustering.jgroups.subsystem.ChannelServiceConfigurator.get(ChannelServiceConfigurator.java:116) at org.jboss.as.clustering.jgroups.subsystem.ChannelServiceConfigurator.get(ChannelServiceConfigurator.java:58) at org.wildfly.clustering.service.FunctionalService.start(FunctionalService.java:67) ... 7 more Caused by: java.lang.IllegalArgumentException: Either the 4 configuration properties starting with 'connection_' or the datasource_jndi_name must be set at org.jgroups.protocols.JDBC_PING.verifyConfigurationParameters(JDBC_PING.java:421) at org.jgroups.protocols.JDBC_PING.init(JDBC_PING.java:102) at org.jgroups.stack.ProtocolStack.initProtocolStack(ProtocolStack.java:847) at org.jgroups.stack.ProtocolStack.init(ProtocolStack.java:837) at org.jgroups.JChannel.<init>(JChannel.java:200) at org.jboss.as.clustering.jgroups.JChannelFactory.createChannel(JChannelFactory.java:116) at org.jboss.as.clustering.jgroups.subsystem.ChannelServiceConfigurator.get(ChannelServiceConfigurator.java:96) ... 9 more Any hint will be helpful. Thanks, Vijay

6 years, 8 months

2
1
0 / 0

Getting error while doing HA in docker

by vijay

Hi, I am getting the below error message while setting up two containers in single host. Followed this document to setup - https://www.keycloak.org/2019/04/keycloak-cluster-setup.html 19:37:43,485 ERROR [org.jgroups.protocols.JDBC_PING] (thread-9,ejb,568064445f53) JGRP000138: Error reading JDBC_PING table: org.postgresql.util.PSQLException: ERROR: relation "jgroupsping" does not exist Position: 47 at org.postgresql.core.v3.QueryExecutorImpl.receiveErrorResponse(QueryExecutorImpl.java:2440) at org.postgresql.core.v3.QueryExecutorImpl.processResults(QueryExecutorImpl.java:2183) at org.postgresql.core.v3.QueryExecutorImpl.execute(QueryExecutorImpl.java:308) at org.postgresql.jdbc.PgStatement.executeInternal(PgStatement.java:441) at org.postgresql.jdbc.PgStatement.execute(PgStatement.java:365) at org.postgresql.jdbc.PgPreparedStatement.executeWithFlags(PgPreparedStatement.java:143) at org.postgresql.jdbc.PgPreparedStatement.executeQuery(PgPreparedStatement.java:106) at org.jboss.jca.adapters.jdbc.WrappedPreparedStatement.executeQuery(WrappedPreparedStatement.java:504) at org.jgroups.protocols.JDBC_PING.readAll(JDBC_PING.java:225) at org.jgroups.protocols.JDBC_PING.readAll(JDBC_PING.java:197) at org.jgroups.protocols.FILE_PING.findMembers(FILE_PING.java:124) at org.jgroups.protocols.Discovery.invokeFindMembers(Discovery.java:214) at org.jgroups.protocols.Discovery.findMembers(Discovery.java:239) at org.jgroups.protocols.Discovery.down(Discovery.java:386) at org.jgroups.protocols.FILE_PING.down(FILE_PING.java:119) at org.jgroups.protocols.MERGE3$InfoSender.run(MERGE3.java:408) at org.jgroups.util.TimeScheduler3$Task.run(TimeScheduler3.java:324) at org.jgroups.util.TimeScheduler3$RecurringTask.run(TimeScheduler3.java:358) at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) at org.jboss.as.clustering.jgroups.ClassLoaderThreadFactory.lambda$newThread$0(ClassLoaderThreadFactory.java:52) at java.lang.Thread.run(Thread.java:748) 19:37:43,487 ERROR [org.jgroups.protocols.JDBC_PING] (thread-9,ejb,568064445f53) JGRP000145: Error updating JDBC_PING table: org.postgresql.util.PSQLException: ERROR: relation "jgroupsping" does not exist Position: 13 at org.postgresql.core.v3.QueryExecutorImpl.receiveErrorResponse(QueryExecutorImpl.java:2440) at org.postgresql.core.v3.QueryExecutorImpl.processResults(QueryExecutorImpl.java:2183) at org.postgresql.core.v3.QueryExecutorImpl.execute(QueryExecutorImpl.java:308) at org.postgresql.jdbc.PgStatement.executeInternal(PgStatement.java:441) at org.postgresql.jdbc.PgStatement.execute(PgStatement.java:365) at org.postgresql.jdbc.PgPreparedStatement.executeWithFlags(PgPreparedStatement.java:143) at org.postgresql.jdbc.PgPreparedStatement.executeUpdate(PgPreparedStatement.java:120) at org.jboss.jca.adapters.jdbc.WrappedPreparedStatement.executeUpdate(WrappedPreparedStatement.java:537) at org.jgroups.protocols.JDBC_PING.delete(JDBC_PING.java:339) at org.jgroups.protocols.JDBC_PING.writeToDB(JDBC_PING.java:142) at org.jgroups.protocols.JDBC_PING.write(JDBC_PING.java:125) at org.jgroups.protocols.FILE_PING.findMembers(FILE_PING.java:128) at org.jgroups.protocols.Discovery.invokeFindMembers(Discovery.java:214) at org.jgroups.protocols.Discovery.findMembers(Discovery.java:239) at org.jgroups.protocols.Discovery.down(Discovery.java:386) at org.jgroups.protocols.FILE_PING.down(FILE_PING.java:119) at org.jgroups.protocols.MERGE3$InfoSender.run(MERGE3.java:408) at org.jgroups.util.TimeScheduler3$Task.run(TimeScheduler3.java:324) at org.jgroups.util.TimeScheduler3$RecurringTask.run(TimeScheduler3.java:358) at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) at org.jboss.as.clustering.jgroups.ClassLoaderThreadFactory.lambda$newThread$0(ClassLoaderThreadFactory.java:52) at java.lang.Thread.run(Thread.java:748) 19:38:21,918 ERROR [org.jgroups.protocols.JDBC_PING] (thread-10,ejb,568064445f53) JGRP000138: Error reading JDBC_PING table: org.postgresql.util.PSQLException: ERROR: relation "jgroupsping" does not exist Position: 47 at org.postgresql.core.v3.QueryExecutorImpl.receiveErrorResponse(QueryExecutorImpl.java:2440) at org.postgresql.core.v3.QueryExecutorImpl.processResults(QueryExecutorImpl.java:2183) at org.postgresql.core.v3.QueryExecutorImpl.execute(QueryExecutorImpl.java:308) at org.postgresql.jdbc.PgStatement.executeInternal(PgStatement.java:441) at org.postgresql.jdbc.PgStatement.execute(PgStatement.java:365) at org.postgresql.jdbc.PgPreparedStatement.executeWithFlags(PgPreparedStatement.java:143) at org.postgresql.jdbc.PgPreparedStatement.executeQuery(PgPreparedStatement.java:106) at org.jboss.jca.adapters.jdbc.WrappedPreparedStatement.executeQuery(WrappedPreparedStatement.java:504) at org.jgroups.protocols.JDBC_PING.readAll(JDBC_PING.java:225) at org.jgroups.protocols.JDBC_PING.readAll(JDBC_PING.java:197) at org.jgroups.protocols.FILE_PING.findMembers(FILE_PING.java:124) at org.jgroups.protocols.Discovery.invokeFindMembers(Discovery.java:214) at org.jgroups.protocols.Discovery.findMembers(Discovery.java:239) at org.jgroups.protocols.Discovery.down(Discovery.java:386) at org.jgroups.protocols.FILE_PING.down(FILE_PING.java:119) at org.jgroups.protocols.MERGE3$InfoSender.run(MERGE3.java:408) at org.jgroups.util.TimeScheduler3$Task.run(TimeScheduler3.java:324) at org.jgroups.util.TimeScheduler3$RecurringTask.run(TimeScheduler3.java:358) at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) at org.jboss.as.clustering.jgroups.ClassLoaderThreadFactory.lambda$newThread$0(ClassLoaderThreadFactory.java:52) at java.lang.Thread.run(Thread.java:748) 19:38:21,922 ERROR [org.jgroups.protocols.JDBC_PING] (thread-10,ejb,568064445f53) JGRP000145: Error updating JDBC_PING table: org.postgresql.util.PSQLException: ERROR: relation "jgroupsping" does not exist Position: 13 at org.postgresql.core.v3.QueryExecutorImpl.receiveErrorResponse(QueryExecutorImpl.java:2440) at org.postgresql.core.v3.QueryExecutorImpl.processResults(QueryExecutorImpl.java:2183) at org.postgresql.core.v3.QueryExecutorImpl.execute(QueryExecutorImpl.java:308) at org.postgresql.jdbc.PgStatement.executeInternal(PgStatement.java:441) at org.postgresql.jdbc.PgStatement.execute(PgStatement.java:365) at org.postgresql.jdbc.PgPreparedStatement.executeWithFlags(PgPreparedStatement.java:143) at org.postgresql.jdbc.PgPreparedStatement.executeUpdate(PgPreparedStatement.java:120) at org.jboss.jca.adapters.jdbc.WrappedPreparedStatement.executeUpdate(WrappedPreparedStatement.java:537) at org.jgroups.protocols.JDBC_PING.delete(JDBC_PING.java:339) at org.jgroups.protocols.JDBC_PING.writeToDB(JDBC_PING.java:142) at org.jgroups.protocols.JDBC_PING.write(JDBC_PING.java:125) at org.jgroups.protocols.FILE_PING.findMembers(FILE_PING.java:128) at org.jgroups.protocols.Discovery.invokeFindMembers(Discovery.java:214) at org.jgroups.protocols.Discovery.findMembers(Discovery.java:239) at org.jgroups.protocols.Discovery.down(Discovery.java:386)

6 years, 8 months

2
1
0 / 0

check-sso not working as expected with iframe

by Mohsin Ilyas

Hi, Below is my simple logic in my application to re-establish connection with keycloak when a page is reloaded. However, the iframe doesn’t seem to work well with ‘check-sso’. Because, I have opened the application in one tab and in other tab I have opened keycloak but when I logout of keycloak my application doesn’t get logout, however, if I use ‘login-required’ the application logs out simultaneously with keycloak. Can someone take a look, or help me with this? (P.s: I have tried to set checkIframLogin: true in the init options but it doesn’t work for me) Thanks.

6 years, 8 months

3
2
0 / 0

Hiding the Login elements when we know that the user must Register

by Andrew Braae

Summary ------- We would like to improve the Keycloak experience for our new users by removing all of the the Login elements (Email, Password, Remember me, Forgot password, Login button) on the left hand side of the Keycloak page, when we know that the user does not have an account in Keycloak already. We would also like to pre-populate the Email field on the register page with the user's email. The thing that makes of these appear possible in our scenario is that the user arrives at the Keycloak protected page via an invite link that contains their email address. Are these possible? How can we go about it? More details --------- We'd like to make the Keycloak experience simpler/more obvious for new users. In our scenario: - we know the users email address, e.g. fred(a)gmail.com (it's in our own application database) - we have emailed the user a link to a Keycloak-protected invite page - we allow Google, LinkedIn and email/password signin on the realm Here are the current usability problems that we are seeing when the new users follow their invite link. 1) Keycloak invites the user to enter their email and password to Log in. However since we know their email, we could tell in advance that Login will not work if they are not a Keycloak user already - they will have to register. This is confusing to some subset of them, and they contact us saying e.g. "it looks like I need a password, can you send it to me?". (They don't think to click Register). 2) If they do click Register, then Keycloak allows them to enter any email address. However, only fred(a)gmail.com will do, since that is who the invite is for. Users rightfully feel confused/peeved that they have to type in their email address, when they just clicked through from an email in that same email account. Any assistance gratefully appreciated.

6 years, 8 months

2
1
0 / 0

High Availability, Active Directory LDAPS and Keycloak AD Federation

by Chris Smith

When my LDAPS url = ldaps://ad-dc-01.xxx-apps.com My connection is successful and my bind DN and credential successfully authenticate When my LDAPS url = ldaps://xxx-apps.com My connection is successful but my bind DN and credential do not successfully authenticate. The AD forest has 2 domain controllers, ad-dc-01 and ad-dc-02. What is the proper LDAPS url for high availability AD federation?

6 years, 8 months

1
0
0 / 0

IdentityBroker SAML transient NameID-Format

by keycloak＠phoefer.at

Hi, I'm using Keycloak for IdentityBrokering with an external SAML-Identity-Provider Unfortunately the external SAML Provider only supports transient NameID <Subject> <NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">vyT0gx7o0uo3MtklFqAXRg1Lmy9HuKZBYB6My5jzU7E=</NameID> ... </Subject When I log-in through the external IDP Kecloak generates a local user and links it with this (temporaty) Broker-ID. If I log-in again later, another different temporary user is generated. Is there a possibility to a) use some SAML-Attributes as brokerID (because they include a "unique" ExternalUser-ID) - so only one keycloak account is created for one external user or b) do not create a internal keycloak user at all Or maybe you have another good idea for handling the issue without ending up with thousands of KC-users ;-) Thanks for help

6 years, 8 months

2
1
0 / 0

Group LDAP Storage Mapper

by Travis De Silva

Hi, Isn't there any way to update the USER_GROUP_MEMBERSHIP table when an LDAP group mapper period sync runs? As per a comment from @Marek Posolda <mposolda(a)redhat.com> in this Jira comment https://issues.jboss.org/browse/KEYCLOAK-4918 and also by going over the code in https://github.com/keycloak/keycloak/blob/master/federation/ldap/src/main... line 596, looks like Keycloak will upgrade the LDAP group membership only when the group mapper is created initially when synced. All other subsequent calls are not updating the table. Any idea why this condition is there? Cheers Travis

6 years, 8 months

2
1
0 / 0

Keycloak HTTP 2

by Hammad Haqqani

Hi Folks, Once we enabled http2 on our website it broke our Keycloak authentication. Do we need to upgrade our setup or there any setting we need to enable please let me know. Current version : keycloak-2.5.1.Final Hammad Haqqani Devops Engineer [Xome_Logo_Email]<http://www.xome.com/> This e-mail communication and any attachments may contain confidential, copyrighted, and legally privileged information for use solely by the designated recipients to which this e-mail is addressed. If you are not the intended recipient, you are hereby notified that you have received this communication in error, and that any review, disclosure, dissemination, distribution, or copying of this message or its contents is prohibited and may be subject to governing laws protecting its disclosure. If you have received this communication in error, please notify Xome immediately by e-mail at postmaster(a)xome.com and destroy all copies of this communication and any attachments.

6 years, 8 months

2
3
0 / 0

jboss-cli.sh CLI script setup of subsystem=undertow FAILs at "javax.security.sasl.SaslException: DIGEST-MD5: Server rejected authentication"?

by PGNet Dev

I'm setting up keycloak (8.0.0/head, atm) for ops behind an ssl terminating proxy. In "standalone.xml" I want to change, <server name="default-server"> <http-listener name="default" socket-binding="http" redirect-socket="https" enable-http2="true"/> <https-listener name="https" socket-binding="https" security-realm="ApplicationRealm" enable-http2="true"/> to, <server name="default-server"> <http-listener name="default" socket-binding="http" enable-http2="true" proxy-address-forwarding="true" /> <https-listener name="https" socket-binding="https" enable-http2="true" security-realm="UndertowRealm" /> I'd like to do this with scripting CLI, eventually for orchestrated deployment. checking mgmt access, open/display of gui /opt/keycloak/bin/jboss-cli.sh \ --connect \ --controller=10.0.0.1:9990 \ --properties=/etc/keycloak/jboss.properties \ --user=mgmtuser \ --password=mgmtpass \ --gui works fine -- I can read all my controller's data/props/etc. I've created a script/batch input file cat /tmp/https.cli /subsystem=undertow/server=default-server/http-listener=default/:list-clear /subsystem=undertow/server=default-server/https-listener=https/:list-clear /subsystem=undertow/server=default-server/http-listener=default/:write-attribute(name=socket-binding,value=http):write-attribute(name=enable-http2,value=true):write-attribute(name=proxy-address-forwarding,value=false) /subsystem=undertow/server=default-server/https-listener=https/:write-attribute(name=socket-binding,value=https):write-attribute(name=enable-http2,value=true):write-attribute(name=security-realm,value=UndertowRealm) but exec of cli, with that^ input, fails /opt/keycloak/bin/jboss-cli.sh \ --connect \ --controller=10.0.0.1:9990 \ --properties=/etc/keycloak/jboss.properties \ --user=mgmtuser \ --password=mgmtpass \ --file=/etc/keycloak/https-setup.cli \ Failed to connect to the controller: Unable to authenticate against controller at 10.0.0.1:9990: Authentication failed: all available authentication mechanisms failed: DIGEST-MD5: javax.security.sasl.SaslException: DIGEST-MD5: Server rejected authentication in 'standalone.xml', the auth mech IS defined, ... <sasl> <sasl-authentication-factory name="application-sasl-authentication" sasl-server-factory="configured" s <mechanism-configuration> <mechanism mechanism-name="JBOSS-LOCAL-USER" realm-mapper="local"/> >> <mechanism mechanism-name="DIGEST-MD5"> <mechanism-realm realm-name="ApplicationRealm"/> </mechanism> </mechanism-configuration> </sasl-authentication-factory> <sasl-authentication-factory name="management-sasl-authentication" sasl-server-factory="configured" se <mechanism-configuration> <mechanism mechanism-name="JBOSS-LOCAL-USER" realm-mapper="local"/> >> <mechanism mechanism-name="DIGEST-MD5"> <mechanism-realm realm-name="ManagementRealm"/> </mechanism> </mechanism-configuration> </sasl-authentication-factory> ... WHY is that mech being rejected? Where are the allowed/available auth "mechanism-name" listed/documented? And, ideally, their usage?

6 years, 8 months

1
1
0 / 0

Fwd: how to connect to a mysql database.

by Hugo Cosme (GMAIL)

Hi class, how are you? I have some difficulties getting keycloak to connect to a mysql database, I am not sure which files I must edit in order for the connection to happen. I'm using version 6.0.1, and I'm doing it via Docker ... Has anyone done anything like this? Or do you know which files to edit?

6 years, 8 months

4
3
0 / 0

KeyCloak performance.

by Дима Жданов

Hi. I try to understand Keycloak performance. Where can I find any performance report?

6 years, 8 months

3
2
0 / 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

keycloak-user August 2019