August 2019 - keycloak-user - Jboss List Archives

by A. Ilchinger

Hello, in our setup we secure a service via keycloak and access its web frontend through a gatekeeper proxy. Access is done from two locations: 1) Inside the same network. 2) From an offsite location While the first works fine, the latter has problems. Authenticating and the access itself work fine, but retrieving large files from the web application (we encountered this with a 16MB javascript file) fails. The file is downloaded incomplete. We checked the network. Connections speed is fine, there are no other proxies or firewalls in between. So from all our investigation it looks like gatekeeper is the pint of failure (logs look unsuspicious though). Do you have any hints or ideas what else we could try? Are there maybe some config options to try out?

6 years, 10 months

2
1
0 / 0

SPI For CAS Ticket Proxy

by ext.jose.luis.anton＠altia.es

Good morning, I am working with keycloak 5.0.0 and I'd need to make Keycloak act as Proxy ticket service and proxy ticket validation as parto f the implementation of CAS 2.0 Is there any SPI that I can consume or do I need to implement it? Thanks in advance. Best regards

6 years, 10 months

2
1
0 / 0

Using urn:ietf:wg:oauth:2.0:oob

by Frans van Niekerk

I am investigating the possibility to obtain the authorisation code from another channel to hopefully remove the need to have the user log into keycloak from a redirect the client initiated. It does seem like section 2.4.5 Redirect URLs (specifically the use of urn:ietf:wg:oauth:2.0:oob) allows for this. Where in Keycloak can the the authorisation token be obtained in this case? Can it be requested via API from another trusted application? Is it possible for a user to setup consent beforehand, then when the client asks for authorisation it is returned immediately instead of waiting for user interaction?

6 years, 10 months

2
1
0 / 0

Disabling HTTPS Requirement

by Carrington Ellis

Reference: https://issues.jboss.org/browse/KEYCLOAK-9889 The reverse proxy in use has HTTPS enabled, “X-Forward-Proto along” with all it’s variants are set. Additionally I have enabled “PROXY_ADDRESS_FORWARDING” by setting this to true and “KEYCLOAK_ALWAYS_HTTPS” to false, yet attempting to access the Administration Console, I’m met with “We’re sorry: HTTPS required”. Despite having a HTTPS Proxy, the necessary headers set, Address Forwarding enabled, and Always HTTPS disabled, I’m still unable to access my Administration Console. I’ve linked a reference to the bug which is eerie similar to the same thing I’m experiencing currently, except that report was filled back on Version 5.0, and we are currently on 6.0, with 8.0 right on the horizon. Is there something missing here to disable this HTTPS check that appears to not function properly? If reverse proxying IS unsupported (which it shouldn’t be by any means), then this should be explicitly written in the documentation to prevent anyone from further attempting applying TLS in this manner.

6 years, 10 months

2
1
0 / 0

mvn build of keycloak/6.0.1, with tests DISabled -- fails at tests ... missing flag? or bug?

by PGNet Dev

building keycloak release6, git checkout 6.0.1 git log | head commit 217e2ee4721c069bb977e40fd9a03dc08e2d42a9 Author: keycloak-bot <keycloak.bot(a)gmail.com> Date: Wed Apr 24 06:22:09 2019 +0000 Set version to 6.0.1 commit 65326ce16af0901824ebd5635b1f6e9acbea1e66 Author: Hynek Mlnarik <hmlnarik(a)redhat.com> Date: Mon Mar 11 09:48:10 2019 +0100 with java -version openjdk version "1.8.0_222" OpenJDK Runtime Environment (IcedTea 3.13.0) (build 1.8.0_222-b10 suse-lp151.333.1-x86_64) OpenJDK 64-Bit Server VM (build 25.222-b10, mixed mode) mvn -version Maven home: /usr/share/java/maven Java version: 1.8.0_222, vendor: IcedTea, runtime: /usr/lib64/jvm/java-1.8.0-openjdk-1.8.0/jre Default locale: en_US, platform encoding: UTF-8 OS name: "linux", version: "5.2.9-25.g71d4424-default", arch: "amd64", family: "unix" git --version git version 2.23.0 build exec with tests intended to be DISabled, mvn \ --errors \ --activate-profiles distribution \ -Dmaven.test.skip=true \ clean \ install FAILs -- at tests: "Failure to find org.keycloak.testsuite:integration-arquillian-tests-base", in more detail, ... [INFO] Tests .............................................. SUCCESS [ 0.208 s] [INFO] Base TestSuite ..................................... SUCCESS [ 24.875 s] [INFO] Other Tests Modules ................................ SUCCESS [ 0.036 s] [INFO] Adapter Tests ...................................... SUCCESS [ 0.035 s] [INFO] Adapter Tests - JBoss .............................. SUCCESS [ 0.034 s] [INFO] Adapter Tests - Karaf .............................. SUCCESS [ 0.034 s] [INFO] Adapter Tests - WAS ................................ SUCCESS [ 0.034 s] [INFO] Adapter Tests - WLS ................................ SUCCESS [ 0.034 s] [INFO] SSSD tests ......................................... FAILURE [ 0.305 s] [INFO] integration-arquillian-tests-springboot ............ SKIPPED [INFO] Keycloak AS7 / JBoss EAP 6 Adapter Distros ......... SKIPPED [INFO] Distribution Parent ................................ SKIPPED [INFO] Keycloak Distribution Licenses Common .............. SKIPPED [INFO] Keycloak Distribution Maven Plugins Parent ......... SKIPPED [INFO] Keycloak Licenses Processor Maven Plugin ........... SKIPPED [INFO] Keycloak AS7 / JBoss EAP 6 Modules ................. SKIPPED [INFO] Keycloak JBoss EAP 6 Adapter Distro ................ SKIPPED [INFO] Keycloak AS7 Adapter Distro ........................ SKIPPED [INFO] Keycloak OSGI Features ............................. SKIPPED [INFO] Keycloak OSGI JAAS Realm Configuration ............. SKIPPED [INFO] Keycloak Fuse Adapter Distro ....................... SKIPPED [INFO] Keycloak JS Adapter Distribution ................... SKIPPED [INFO] Keycloak OSGI Integration .......................... SKIPPED [INFO] Feature Pack Builds ................................ SKIPPED [INFO] Keycloak Feature Pack: Adapter ..................... SKIPPED [INFO] Adapters Distribution Parent ....................... SKIPPED [INFO] Keycloak Adapter Overlay Distribution .............. SKIPPED [INFO] Keycloak Tomcat 6 Adapter Distro ................... SKIPPED [INFO] Keycloak Tomcat 7 Adapter Distro ................... SKIPPED [INFO] Keycloak Tomcat 8 Adapter Distro ................... SKIPPED [INFO] Keycloak Jetty 9.2.x Adapter Distro ................ SKIPPED [INFO] Keycloak Jetty 9.3.x Adapter Distro ................ SKIPPED [INFO] Keycloak Jetty 9.4.x Adapter Distro ................ SKIPPED [INFO] Keycloak Wildfly 8 Modules ......................... SKIPPED [INFO] Keycloak Wildfly 8 Adapter Distro .................. SKIPPED [INFO] Keycloak Wildfly 8 Adapter ......................... SKIPPED [INFO] Keycloak JS Adapter NPM Distribution ............... SKIPPED [INFO] Keycloak SAML Wildfly Modules ...................... SKIPPED [INFO] Keycloak SAML Wildfly Adapter Distro ............... SKIPPED [INFO] Keycloak Wildfly SAML Adapter ...................... SKIPPED [INFO] Keycloak SAML AS7 / JBoss EAP 6 Adapter Distros .... SKIPPED [INFO] Keycloak SAML AS7 / JBoss EAP 6 Modules ............ SKIPPED [INFO] Keycloak SAML JBoss EAP 6 Adapter Distro ........... SKIPPED [INFO] Keycloak SAML AS7 Adapter Distro ................... SKIPPED [INFO] Keycloak SAML Jetty 9.2.x Adapter Distro ........... SKIPPED [INFO] Keycloak SAML Jetty 9.3.x Adapter Distro ........... SKIPPED [INFO] Keycloak SAML Jetty 9.4.x Adapter Distro ........... SKIPPED [INFO] Keycloak SAML Tomcat 6 Adapter Distro .............. SKIPPED [INFO] Keycloak SAML Tomcat 7 Adapter Distro .............. SKIPPED [INFO] Keycloak SAML Tomcat 8 Adapter Distro .............. SKIPPED [INFO] SAML Adapters Distribution Parent .................. SKIPPED [INFO] Keycloak Feature Pack: Server ...................... SKIPPED [INFO] Keycloak Server Distribution ....................... SKIPPED [INFO] Keycloak Server Overlay Distribution ............... SKIPPED [INFO] ------------------------------------------------------------------------ [INFO] BUILD FAILURE [INFO] ------------------------------------------------------------------------ [INFO] Total time: 03:19 min [INFO] Finished at: 2019-08-21T14:09:52-07:00 [INFO] ------------------------------------------------------------------------ [ERROR] Failed to execute goal on project integration-arquillian-tests-sssd: Could not resolve dependencies for project org.keycloak.testsuite:integration-arquillian-tests-sssd:jar:6.0.1: Failure to find org.keycloak.testsuite:integration-arquillian-tests-base:jar:tests:6.0.1 in https://repository.jboss.org/nexus/content/groups/public/ was cached in the local repository, resolution will not be reattempted until the update interval of jboss has elapsed or updates are forced -> [Help 1] org.apache.maven.lifecycle.LifecycleExecutionException: Failed to execute goal on project integration-arquillian-tests-sssd: Could not resolve dependencies for project org.keycloak.testsuite:integration-arquillian-tests-sssd:jar:6.0.1: Failure to find org.keycloak.testsuite:integration-arquillian-tests-base:jar:tests:6.0.1 in https://repository.jboss.org/nexus/content/groups/public/ was cached in the local repository, resolution will not be reattempted until the update interval of jboss has elapsed or updates are forced at org.apache.maven.lifecycle.internal.LifecycleDependencyResolver.getDependencies (LifecycleDependencyResolver.java:269) at org.apache.maven.lifecycle.internal.LifecycleDependencyResolver.resolveProjectDependencies (LifecycleDependencyResolver.java:147) at org.apache.maven.lifecycle.internal.MojoExecutor.ensureDependenciesAreResolved (MojoExecutor.java:248) at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:202) at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:156) at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:148) at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:117) at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:81) at org.apache.maven.lifecycle.internal.builder.singlethreaded.SingleThreadedBuilder.build (SingleThreadedBuilder.java:56) at org.apache.maven.lifecycle.internal.LifecycleStarter.execute (LifecycleStarter.java:128) at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:305) at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:192) at org.apache.maven.DefaultMaven.execute (DefaultMaven.java:105) at org.apache.maven.cli.MavenCli.execute (MavenCli.java:956) at org.apache.maven.cli.MavenCli.doMain (MavenCli.java:288) at org.apache.maven.cli.MavenCli.main (MavenCli.java:192) at sun.reflect.NativeMethodAccessorImpl.invoke0 (Native Method) at sun.reflect.NativeMethodAccessorImpl.invoke (NativeMethodAccessorImpl.java:62) at sun.reflect.DelegatingMethodAccessorImpl.invoke (DelegatingMethodAccessorImpl.java:43) at java.lang.reflect.Method.invoke (Method.java:498) at org.codehaus.plexus.classworlds.launcher.Launcher.launchEnhanced (Launcher.java:282) at org.codehaus.plexus.classworlds.launcher.Launcher.launch (Launcher.java:225) at org.codehaus.plexus.classworlds.launcher.Launcher.mainWithExitCode (Launcher.java:406) at org.codehaus.plexus.classworlds.launcher.Launcher.main (Launcher.java:347) Caused by: org.apache.maven.project.DependencyResolutionException: Could not resolve dependencies for project org.keycloak.testsuite:integration-arquillian-tests-sssd:jar:6.0.1: Failure to find org.keycloak.testsuite:integration-arquillian-tests-base:jar:tests:6.0.1 in https://repository.jboss.org/nexus/content/groups/public/ was cached in the local repository, resolution will not be reattempted until the update interval of jboss has elapsed or updates are forced at org.apache.maven.project.DefaultProjectDependenciesResolver.resolve (DefaultProjectDependenciesResolver.java:209) at org.apache.maven.lifecycle.internal.LifecycleDependencyResolver.getDependencies (LifecycleDependencyResolver.java:243) at org.apache.maven.lifecycle.internal.LifecycleDependencyResolver.resolveProjectDependencies (LifecycleDependencyResolver.java:147) at org.apache.maven.lifecycle.internal.MojoExecutor.ensureDependenciesAreResolved (MojoExecutor.java:248) at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:202) at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:156) at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:148) at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:117) at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:81) at org.apache.maven.lifecycle.internal.builder.singlethreaded.SingleThreadedBuilder.build (SingleThreadedBuilder.java:56) at org.apache.maven.lifecycle.internal.LifecycleStarter.execute (LifecycleStarter.java:128) at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:305) at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:192) at org.apache.maven.DefaultMaven.execute (DefaultMaven.java:105) at org.apache.maven.cli.MavenCli.execute (MavenCli.java:956) at org.apache.maven.cli.MavenCli.doMain (MavenCli.java:288) at org.apache.maven.cli.MavenCli.main (MavenCli.java:192) at sun.reflect.NativeMethodAccessorImpl.invoke0 (Native Method) at sun.reflect.NativeMethodAccessorImpl.invoke (NativeMethodAccessorImpl.java:62) at sun.reflect.DelegatingMethodAccessorImpl.invoke (DelegatingMethodAccessorImpl.java:43) at java.lang.reflect.Method.invoke (Method.java:498) at org.codehaus.plexus.classworlds.launcher.Launcher.launchEnhanced (Launcher.java:282) at org.codehaus.plexus.classworlds.launcher.Launcher.launch (Launcher.java:225) at org.codehaus.plexus.classworlds.launcher.Launcher.mainWithExitCode (Launcher.java:406) at org.codehaus.plexus.classworlds.launcher.Launcher.main (Launcher.java:347) Caused by: org.eclipse.aether.resolution.DependencyResolutionException: Failure to find org.keycloak.testsuite:integration-arquillian-tests-base:jar:tests:6.0.1 in https://repository.jboss.org/nexus/content/groups/public/ was cached in the local repository, resolution will not be reattempted until the update interval of jboss has elapsed or updates are forced at org.eclipse.aether.internal.impl.DefaultRepositorySystem.resolveDependencies (DefaultRepositorySystem.java:352) at org.apache.maven.project.DefaultProjectDependenciesResolver.resolve (DefaultProjectDependenciesResolver.java:202) at org.apache.maven.lifecycle.internal.LifecycleDependencyResolver.getDependencies (LifecycleDependencyResolver.java:243) at org.apache.maven.lifecycle.internal.LifecycleDependencyResolver.resolveProjectDependencies (LifecycleDependencyResolver.java:147) at org.apache.maven.lifecycle.internal.MojoExecutor.ensureDependenciesAreResolved (MojoExecutor.java:248) at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:202) at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:156) at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:148) at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:117) at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:81) at org.apache.maven.lifecycle.internal.builder.singlethreaded.SingleThreadedBuilder.build (SingleThreadedBuilder.java:56) at org.apache.maven.lifecycle.internal.LifecycleStarter.execute (LifecycleStarter.java:128) at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:305) at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:192) at org.apache.maven.DefaultMaven.execute (DefaultMaven.java:105) at org.apache.maven.cli.MavenCli.execute (MavenCli.java:956) at org.apache.maven.cli.MavenCli.doMain (MavenCli.java:288) at org.apache.maven.cli.MavenCli.main (MavenCli.java:192) at sun.reflect.NativeMethodAccessorImpl.invoke0 (Native Method) at sun.reflect.NativeMethodAccessorImpl.invoke (NativeMethodAccessorImpl.java:62) at sun.reflect.DelegatingMethodAccessorImpl.invoke (DelegatingMethodAccessorImpl.java:43) at java.lang.reflect.Method.invoke (Method.java:498) at org.codehaus.plexus.classworlds.launcher.Launcher.launchEnhanced (Launcher.java:282) at org.codehaus.plexus.classworlds.launcher.Launcher.launch (Launcher.java:225) at org.codehaus.plexus.classworlds.launcher.Launcher.mainWithExitCode (Launcher.java:406) at org.codehaus.plexus.classworlds.launcher.Launcher.main (Launcher.java:347) Caused by: org.eclipse.aether.resolution.ArtifactResolutionException: Failure to find org.keycloak.testsuite:integration-arquillian-tests-base:jar:tests:6.0.1 in https://repository.jboss.org/nexus/content/groups/public/ was cached in the local repository, resolution will not be reattempted until the update interval of jboss has elapsed or updates are forced at org.eclipse.aether.internal.impl.DefaultArtifactResolver.resolve (DefaultArtifactResolver.java:423) at org.eclipse.aether.internal.impl.DefaultArtifactResolver.resolveArtifacts (DefaultArtifactResolver.java:225) at org.eclipse.aether.internal.impl.DefaultRepositorySystem.resolveDependencies (DefaultRepositorySystem.java:335) at org.apache.maven.project.DefaultProjectDependenciesResolver.resolve (DefaultProjectDependenciesResolver.java:202) at org.apache.maven.lifecycle.internal.LifecycleDependencyResolver.getDependencies (LifecycleDependencyResolver.java:243) at org.apache.maven.lifecycle.internal.LifecycleDependencyResolver.resolveProjectDependencies (LifecycleDependencyResolver.java:147) at org.apache.maven.lifecycle.internal.MojoExecutor.ensureDependenciesAreResolved (MojoExecutor.java:248) at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:202) at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:156) at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:148) at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:117) at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:81) at org.apache.maven.lifecycle.internal.builder.singlethreaded.SingleThreadedBuilder.build (SingleThreadedBuilder.java:56) at org.apache.maven.lifecycle.internal.LifecycleStarter.execute (LifecycleStarter.java:128) at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:305) at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:192) at org.apache.maven.DefaultMaven.execute (DefaultMaven.java:105) at org.apache.maven.cli.MavenCli.execute (MavenCli.java:956) at org.apache.maven.cli.MavenCli.doMain (MavenCli.java:288) at org.apache.maven.cli.MavenCli.main (MavenCli.java:192) at sun.reflect.NativeMethodAccessorImpl.invoke0 (Native Method) at sun.reflect.NativeMethodAccessorImpl.invoke (NativeMethodAccessorImpl.java:62) at sun.reflect.DelegatingMethodAccessorImpl.invoke (DelegatingMethodAccessorImpl.java:43) at java.lang.reflect.Method.invoke (Method.java:498) at org.codehaus.plexus.classworlds.launcher.Launcher.launchEnhanced (Launcher.java:282) at org.codehaus.plexus.classworlds.launcher.Launcher.launch (Launcher.java:225) at org.codehaus.plexus.classworlds.launcher.Launcher.mainWithExitCode (Launcher.java:406) at org.codehaus.plexus.classworlds.launcher.Launcher.main (Launcher.java:347) Caused by: org.eclipse.aether.transfer.ArtifactNotFoundException: Failure to find org.keycloak.testsuite:integration-arquillian-tests-base:jar:tests:6.0.1 in https://repository.jboss.org/nexus/content/groups/public/ was cached in the local repository, resolution will not be reattempted until the update interval of jboss has elapsed or updates are forced at org.eclipse.aether.internal.impl.DefaultUpdateCheckManager.newException (DefaultUpdateCheckManager.java:219) at org.eclipse.aether.internal.impl.DefaultUpdateCheckManager.checkArtifact (DefaultUpdateCheckManager.java:192) at org.eclipse.aether.internal.impl.DefaultArtifactResolver.gatherDownloads (DefaultArtifactResolver.java:564) at org.eclipse.aether.internal.impl.DefaultArtifactResolver.performDownloads (DefaultArtifactResolver.java:482) at org.eclipse.aether.internal.impl.DefaultArtifactResolver.resolve (DefaultArtifactResolver.java:400) at org.eclipse.aether.internal.impl.DefaultArtifactResolver.resolveArtifacts (DefaultArtifactResolver.java:225) at org.eclipse.aether.internal.impl.DefaultRepositorySystem.resolveDependencies (DefaultRepositorySystem.java:335) at org.apache.maven.project.DefaultProjectDependenciesResolver.resolve (DefaultProjectDependenciesResolver.java:202) at org.apache.maven.lifecycle.internal.LifecycleDependencyResolver.getDependencies (LifecycleDependencyResolver.java:243) at org.apache.maven.lifecycle.internal.LifecycleDependencyResolver.resolveProjectDependencies (LifecycleDependencyResolver.java:147) at org.apache.maven.lifecycle.internal.MojoExecutor.ensureDependenciesAreResolved (MojoExecutor.java:248) at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:202) at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:156) at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:148) at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:117) at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:81) at org.apache.maven.lifecycle.internal.builder.singlethreaded.SingleThreadedBuilder.build (SingleThreadedBuilder.java:56) at org.apache.maven.lifecycle.internal.LifecycleStarter.execute (LifecycleStarter.java:128) at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:305) at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:192) at org.apache.maven.DefaultMaven.execute (DefaultMaven.java:105) at org.apache.maven.cli.MavenCli.execute (MavenCli.java:956) at org.apache.maven.cli.MavenCli.doMain (MavenCli.java:288) at org.apache.maven.cli.MavenCli.main (MavenCli.java:192) at sun.reflect.NativeMethodAccessorImpl.invoke0 (Native Method) at sun.reflect.NativeMethodAccessorImpl.invoke (NativeMethodAccessorImpl.java:62) at sun.reflect.DelegatingMethodAccessorImpl.invoke (DelegatingMethodAccessorImpl.java:43) at java.lang.reflect.Method.invoke (Method.java:498) at org.codehaus.plexus.classworlds.launcher.Launcher.launchEnhanced (Launcher.java:282) at org.codehaus.plexus.classworlds.launcher.Launcher.launch (Launcher.java:225) at org.codehaus.plexus.classworlds.launcher.Launcher.mainWithExitCode (Launcher.java:406) at org.codehaus.plexus.classworlds.launcher.Launcher.main (Launcher.java:347) [ERROR] [ERROR] Re-run Maven using the -X switch to enable full debug logging. [ERROR] [ERROR] For more information about the errors and possible solutions, please read the following articles: [ERROR] [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/DependencyResolutionExce... [ERROR] [ERROR] After correcting the problems, you can resume the build with the command [ERROR] mvn <goals> -rf :integration-arquillian-tests-sssd At this stage, my goal is just a successful full dist, release build -- without tests. What 'mvn' flags fully DISable _all_ tests -- &/or specifically, the "arquillian" test suite?

6 years, 10 months

2
2
0 / 0

Pure OAuth2.0 provider

by bob sheknowdas

Can keycloak handle a pure OAuth2.0 identity provider? I know that an OIDC-IDP can be used as an external identity provider. But what about providers, that dont support identity tokens but only access tokens? Does anyone have any experience with that? Best regards Bob

6 years, 10 months

2
1
0 / 0

Java Adapter - Claim body removes content

by Felipe Roca

Hi Guys, I was creating a small PEP for a third party service API using the keycloak authorization service. My idea was to check whether an user is allowed to perform certain operation based on some body parameters, but it turns out that the body claim left the body content unsusable for the proxy application. What do you think? Is this a bug or an expected behavior? For a better understanding, here you can find my configuration file and controller class. I am using keycloak-spring-boot-starter and keycloak-authz-client version 6.0.0 maven modules but I tried also with 6.0.1 and same results. keycloak.realm=spring-boot-quickstart keycloak.auth-server-url=http://example.local/keycloak/auth keycloak.ssl-required=external keycloak.resource=app keycloak.bearer-only=true keycloak.credentials.secret=c23a55c0-0c96-4e28-8922-c47f918c2102 keycloak.securityConstraints[0].authRoles[0]=user keycloak.securityConstraints[0].securityCollections[0].name=protected keycloak.securityConstraints[0].securityCollections[0].patterns[0]=/version keycloak.securityConstraints[0].securityCollections[0].patterns[1]=/admin/* keycloak.securityConstraints[0].securityCollections[0].patterns[2]=/v1/* keycloak.securityConstraints[0].securityCollections[0].patterns[3]=/v2/* keycloak.policy-enforcer-config.enforcement-mode=ENFORCING keycloak.policy-enforcer-config.claimInformationPointConfig.claims[http.uri]={request.relativePath} keycloak.policy-enforcer-config.claimInformationPointConfig.claims[http.fiware-service]={request.header['service']} keycloak.policy-enforcer-config.claimInformationPointConfig.claims[http.fiware-servicepath]={request.header['servicepath']} keycloak.policy-enforcer-config.claimInformationPointConfig.claims[http.id]={request.body['/id']} @RestController public class ProxyController { @Value("${proxy.schema}") private Stringschema; @Value("${proxy.host}") private Stringhost; @Value("${proxy.port}") private int port; private RestTemplaterestTemplate; @Autowired public ProxyController() { restTemplate =new RestTemplate(); restTemplate.setRequestFactory(new HttpComponentsClientHttpRequestFactory()); restTemplate.setErrorHandler(new BlankResponseErrorHandler()); } @RequestMapping(value ="/login", produces ="application/json", method =POST) public ResponseEntity<Login> login(@RequestBody Login login) { return ResponseEntity.ok().body(login); } @RequestMapping(value ="/**", produces ="application/json", method = {GET,DELETE,HEAD,OPTIONS}) public ResponseEntity<String> proxyRequestWithoutBody(HttpMethod method, HttpServletRequest request)throws URISyntaxException { return restTemplate.exchange(buildUri(request), method,new HttpEntity<String>(copyHeaders(request)), String.class); } @RequestMapping(value ="/**", produces ="application/json", method = {POST,PUT,PATCH}) public ResponseEntity<String> proxyRequest(@RequestBody String body, HttpMethod method, HttpServletRequest request)throws URISyntaxException { return restTemplate.exchange(buildUri(request), method,new HttpEntity<>(body, copyHeaders(request)), String.class); } private URI buildUri(HttpServletRequest request)throws URISyntaxException { return new URI(schema,null,host,port, request.getRequestURI(), request.getQueryString(),null); } private HttpHeaders copyHeaders(HttpServletRequest request) { HttpHeaders httpHeaders =new HttpHeaders(); for (String headerName : Collections.list(request.getHeaderNames())) { if (!headerName.equals("host")) httpHeaders.add(headerName, request.getHeader(headerName)); } return httpHeaders; } } Thank you in advance, Best regards, Felipe -- Felipe Roca Blaya Software Engineer - HOP Ubiquitous S.L. www.hopu.eu <http://www.hopu.eu> C/Luis Buñuel 6 30562, Ceutí, Murcia. Spain - logo_hop <http://www.hopu.eu/> - face <https://www.facebook.com/hopubiquitous/> Twitter <https://twitter.com/HOPUbiquitous> google <https://plus.google.com/+HOPUbiquitousCeut%C3%AD?hl=es> vimeo <https://vimeo.com/hopu> linkedin <https://www.linkedin.com/company-beta/3810080/>

6 years, 10 months

2
1
0 / 0

UMA and large resource sets

by Asbjørn Dyhrberg Thegler

Hello there, I am implementing a Node.js resource server and I currently struggle with figuring out how to let a user list all their resources from a specifict resource set. For example, a user can GET /activities and get all their own activities, but not other users. I am not certain of how to create a UMA permission ticket for that request, since don't already know the IDs of the users activities. Further, the user could have access to other users activities through resource sharing. This list is potentially very large, (as in thousands of IDs), and I don't imagine putting that large a JWT in a header is a good idea either. What is the recommended way to handle this? I am wondering if I should let the resource server itself query KeyCloak for a list of IDs for all its own activities and activities shared with the user - but I can't seem to figure out what API endpoint that lets me do this in KeyCloak 6.0.1, since the Entitlement API has been deprecated. Thanks for your help, I really enjoy working with KeyCloak so far. :) Regards, Asbjørn

6 years, 10 months

2
2
0 / 0

Is there clear x509 configuration in a domain clustered environment using external DB

by JTK

I've stood up a stand-alone version to use x509 and with the help off this list I was able to get it working, but the configuration documentation is not clear for setting it up in a domain clustered environment. For example ssl-realm is added to standalone.xml to get it to work in conjunction with the https-listener and browser flow, but in the clustered domain setup, you don't configure domain.xml with the additional ssl-realm information. i.e. <security-realm name="ssl-realm"> <server-identities> <ssl> <keystore path="keystore.jks" relative-to="jboss.server.config.dir" keystore-password="mypass"/> </ssl> </server-identities> <authentication> <truststore path="truststore.jks" relative-to="jboss.server.config.dir" keystore-password="mypass"/> </authentication> & <https-listener name="https" socket-binding="https" security-realm="ssl-realm" enabled-protocols="TLSv1.2" verify-client="REQUESTED" enable-http2="true"/> I did add that information to the host.xml and even the host-master.xml file, but I'm not getting prompted for my cert. This is what I'm running to launch KeyCloak with the debug setup for SSL,handshake /opt/keycloak/bin/domain.sh --host-config=host-master.xml -Djboss.bind.address=0.0.0.0 -Djboss.bind.address.management=10.10.10.7 -Djboss.bind.address=10.10.10.7 -Djboss.bind.address.private=10.10.10.7 -Djboss.https.port=443 -Djboss.tx.node.id=dev-master -Djboss.node.name=dev-master -Djava.security.egd=file:/dev/./urandom -Djavax.net.debug=ssl,handshake I also have this enabled in domain.xml <logger category="org.keycloak.authentication.authenticators.x509"> <level name="TRACE"/> </logger> <logger category="org.keycloak.services.x509"> <level name="TRACE"/> </logger> Do I need to enable debug for console below in domain.xml to get more detailed info? Right now it's set to INFO <console-handler name="CONSOLE"> <level name="DEBUG"/> I have the Root CA and the intermediate loaded for the x509 cert which I am presenting. I've double checked the Browser Flow, which is setup just like the working standalone. I just want to make sure there isn't something else I'm missing because there seems to be a lack of clarity from the standalone setup vs the domain clustered setup. For now, I'm using just the master node, to ensure I'm not hitting the slave node when testing. Thanks

6 years, 10 months

1
0
0 / 0

Per-client authorization

by Chris Boot

Hi all, I'm trying to restrict which OIDC clients users can login to based on roles or group membership. I can't believe this isn't something built-into Keycloak yet, but it seems that way. I had previously experimented with per-client Authorization settings, applying policies to Resources. I could have sworn this worked at some point, but it doesn't now. AIUI it seems to require the use of the Keycloak Gatekeeper or other Keycloak-specific code, so it's not going to work for most of my applications. As far as I can tell, the only way to make this work is using a custom authentication flow: https://stackoverflow.com/a/54384513/9531301 Is this indeed the only way to make this work? Is there a way of stopping such clients from being shown on the Account Management => Applications screen without globally removing the offline_access role for all users? Thanks, Chris -- Chris Boot bootc(a)boo.tc

6 years, 10 months

1
1
0 / 0

IS there is Keycloak REST API for users

by Shiva Prasad Thagadur Prakash

Hi Guys, Does keycloak have user REST API like it has keycloak admin REST API? If so, is there a documentation for user REST API? For example, can a user himself change or reset his password via REST API instead of doing it through the UI? Eagerly waiting to hear from you. Thanks, Shiva

6 years, 10 months

3
3
0 / 0

IdP Initiated SSO

by Chris Stephens

Hello, Thanks for the great product. We have set up several instances of keycloak as the SP utilizing SP-Initiated SSO to external IdPs. Everything in that process is going smoothly. We have an external IdP that wants us to use IdP-initiated SSO to connect to their IdP. The current client protocol is openid-connect. We are using keycloak 5.0. 1. Is it possible for a keycloak service provider client using the openid-connect protocol to perform IdP-initiated SSO. I believe we have to set the client up using the saml protocol. Is this correct? 1a. If it is not possible, are there any workarounds that I can use? My app is using an openid-connect public client. How can I use IdP-initiated SSO in this scenario 2. We need to provide the IdP the public key used to sign the assertions. Are the keys used to sign the assertions located in the keycloak admin console > realm settings > keys > Providers tab? Thanks, Christopher Stephens Software Engineer | EdLogics chris.stephens(a)edlogics.com

6 years, 10 months

2
1
0 / 0

Keycloak "SSSD" user federation option doesn't shows up on the drop down menu

by Miroslav Beranič

Hi all, I have same problems as described in an existing JIRA: https://issues.jboss.org/browse/KEYCLOAK-8095 I have followed suggested documentation located at: https://www.keycloak.org/docs/latest/server_admin/index.html#_sssd With differences: - I do not use docker - using standalone computer node - I use DNS, so I did not update /etc/hosts file - I run as root user ( I've tried both - with dedicated user also, same result ) ( in file /etc/sssd/sssd.conf I have : [ifp] allowed_uids = root ) [root@sso keycloak-8.0.0-SNAPSHOT]# sssctl user-checks admin -s keycloak user: admin action: acct service: keycloak SSSD nss user lookup result: - user name: admin - user id: 804200000 - group id: 804200000 - gecos: Administrator - home directory: /home/admin - shell: /bin/bash SSSD InfoPipe user lookup result: - name: admin - uidNumber: 804200000 - gidNumber: 804200000 - gecos: Administrator - homeDirectory: /home/admin - loginShell: /bin/bash - sn: Administrator testing pam_acct_mgmt pam_acct_mgmt: Success PAM Environment: - no env - Is there any additional validation test I can run, to validate server setup? Kind Regards, Miroslav -- Miroslav Beranič MIBESIS miroslav.beranic(a)mibesis.si https://www.mibesis.si

6 years, 10 months

1
1
0 / 0

Help getting External token to Internal Token Exchange right

by Leandro Del Sole

Hello, I've been struggling to get the https://www.keycloak.org/docs/latest/securing_apps/index.html#external-to... working. First, I tried on version 3.4, the first version to have this feature. In my company, we're slowly updating our version of Keycloak, it is a bit old. After some tries, I changed Keycloak version to 6.0.1 because I think it will be easier for me get support from you. I got same error in both versions. Below is described the scenario in 6.0.1: Well, I want to get an external token, minted by another realm of my own keycloak "connect", and exchange it to an internal token, of another realm of my keycloak "emm". To enable this feature and others as test, I included in standalone.conf: JAVA_OPTS="$JAVA_OPTS -Dkeycloak.profile.feature.token_exchange=enabled -Dkeycloak.profile.feature.admin_fine_grained_authz=enabled -Dkeycloak.profile=preview -Dkeycloak.profile.feature.scripts=enabled" This enabled the Permission tab as expected. However, after opening it, when I click in "Permissions Enabled" to change the switch from off to on, the message pops up "*Error!* An unexpected server error has occurred" This happens in both Permissions tab, in client edit and IDP edit. In the server log: > 17:07:48,338 ERROR [org.keycloak.services.error.KeycloakErrorHandler] > (default task-5) Uncaught server error: java.lang.NullPointerException > at > org.keycloak.services.resources.admin.permissions.MgmtPermissions.initializeRealmResourceServer(MgmtPermissions.java:263) > at > org.keycloak.services.resources.admin.permissions.MgmtPermissions.findOrCreateResourceServer(MgmtPermissions.java:242) > at > org.keycloak.services.resources.admin.permissions.ClientPermissions.initialize(ClientPermissions.java:95) > at > org.keycloak.services.resources.admin.permissions.ClientPermissions.setPermissionsEnabled(ClientPermissions.java:198) > at > org.keycloak.services.resources.admin.ClientResource.setManagementPermissionsEnabled(ClientResource.java:658) > at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) > at > sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) > at > sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) > at java.lang.reflect.Method.invoke(Method.java:498) > at > org.jboss.resteasy.core.MethodInjectorImpl.invoke(MethodInjectorImpl.java:139) > at > org.jboss.resteasy.core.ResourceMethodInvoker.internalInvokeOnTarget(ResourceMethodInvoker.java:510) .... it continues, but has no other cause or information on the stack. In version 3.4.2, the stack is: > 16:43:34,740 ERROR [org.keycloak.services.error.KeycloakErrorHandler] > (default task-28) Uncaught server error: java.lang.NullPointerException > at > org.keycloak.services.resources.admin.permissions.MgmtPermissions.initializeRealmResourceServer(MgmtPermissions.java:262) ... I tried to run a curl to make the exchange and the error is the same as above. Additionally, I tried is to make the exchange with a Google IDP as in https://www.mathieupassenaud.fr/token-exchange-keycloak/, using the Google OAuth Playground. Same error again. I hope someone can help me or point a resource, like a tutorial that covers all steps and they work properly. Best Regards and thank you in advance, Leandro Del Sole

6 years, 10 months

1
1
0 / 0

Keycloak ERROR: ailed to add user 'xxx' to realm 'xxx': user with username exists

by Hossein Doutaghy

Hi, We are seeing the following errors in the server.log of those keycloak servers that use a database that had been already initialized before and already has all the tables. As far as I know, these errors are expected as the realm and user already exist in the database. We do not want to forward these errors to our logging server, so is there a way to remove/disable these logs? 06:19:46,301 WARN [org.hibernate.engine.jdbc.spi.SqlExceptionHelper] (ServerService Thread Pool -- 59) SQL Error: 1062, SQLState: 23000 06:19:46,302 ERROR [org.hibernate.engine.jdbc.spi.SqlExceptionHelper] (ServerService Thread Pool -- 59) (conn=58) Duplicate entry 'master-admin' for key 'UK_RU8TT6T700S9V50BU18WS5HA6' 06:19:46,353 ERROR [org.keycloak.services] (ServerService Thread Pool -- 59) KC-SERVICES0010: Failed to add user 'admin' to realm 'master': user with username exists Thanks, Moe Doutaghy

6 years, 10 months

1
0
0 / 0

Keycloak adapter in Wildfly domain mode

by No Reply (Conta de Teste)

Hello, I am using wildfly 10.1.0.Final as Domain Controller with 2 slaves. I have found documentation about installing keycloak adapter just in standalone mode. Anyone has documentation with steps to install it at domain mode? When I try to deploy an application, I receive this message: UT010039: Unknown authentication mechanism KEYCLOAK"}, Thanks for your response.

6 years, 10 months

1
0
0 / 0

Alternative authentication systems: SPI, token exchange. or IDP?

by Aaron Harnly

Hi all, I'd like your thoughts on the best way to integrate, in an adequately decoupled way, "alternative" login systems with Keycloak. Background: We are building or have built support for alternative authentication mechanisms, including the LTI standard for education technology single-sign-on, QR code-based login for young students, simple "autologin" buttons for demo accounts, and other alternative login methods for very young students. We see three obvious options for implementing these: 1. Authentication SPI (ie build a custom authenticator flow and package it into Keycloak) 2. Token exchange (ie the upstream system performs its authentication, then does token exchange to obtain a token for the target user, placing it into a Keycloak cookie) 3. IDP, ie the upstream system performs its authentication, then acts as an IDP to Keycloak via SAML or Oauth Currently we've done pathway #2, which is relatively decoupled, requiring a single POST from the authenticator to Keycloak. But we don't love that we have to (as we understand it) place the token into a Keycloak cookie, which feels like we're diving into Keycloak internals. #1 (Authentication SPI) seems reasonable, but couples very tightly to Keycloak, and requires that it be built in Java, which not all of our teams prefer, and couples development and deployment with Keycloak. I'd love to hear about experiences from people who have built Authentication SPIs, though. #3, building a wholly separate authenticator which uses SAML or Oauth to establish Keycloak sessions, is very decoupled, but requires incorporating Oauth or SAML libraries and keeping them all up to date, which is sort of why we've invested in Keycloak to begin with :) Any thoughts? -Aaron

6 years, 10 months

1
0
0 / 0

Access tokens in Queue based systems

by Pavel Micka

Hello everyone, We are using Keycloak (OIDC) in our system and it has proven to be a great solution for http based communication. But we have slight issue with figuring out how to correctly pass the access tokens through queues. The point is that we have a partially a streaming system and we want to make sure that if an attacker manages to send the messages to Rabbit, the messages will not be authorized by clients. That is the theory. We can send the access tokens through the queue... but the messages may rot in the queue for quite some time (our SLA is in hours), so that would mean long validity of the token (and that may cause issues in case the token is somehow leaked). Better option would be to have a long validity token, but scope it to the content of the message. But you know...streaming application... there can be thousands of messages a second. And that may cause big scalability issues when bombarding keycloak for each and every message in the system. Is there some better approach with OIDC? Or should I look on some additional non-KC solution? Thanks! Pavel

6 years, 10 months

2
3
0 / 0

Using nginx as a reverse proxy for Keycloak 6.0.1 on a port other than 443

by Jannis Warnat

Hi all, I cannot get Keycloak 6.0.1 to work behind nginx as a reverse proxy for TLS termination with nginx listening on a port other than 443 (I try to configure it to use 8443). Here is what I did: - Set up nginx and Keycloak 6.0.1 in a user-defined Docker network (using docker-compose, see below for details) with self-signed certificates for localhost. - Environment variable PROXY_ADDRESS_FORWARDING is set to true for the Keycloak container. - Nginx listens for SSL connections on port 8443 and forwards to keycloak:8080 while adding x-forwarded headers. - According to the documentation (https://www.keycloak.org/docs/latest/server_installation/index.html#_sett...), I added the following to standalone-ha.xml: [...] <http-listener name="default" socket-binding="http" *redirect-socket="proxy-https"*proxy-address-forwarding="${env.PROXY_ADDRESS_FORWARDING:false}" enable-http2="true"/> [...] *<socket-binding name="proxy-https" port="8443"/>* [...] Yet when I check URL https://localhost:8443/auth/realms/master/.well-known/openid-configuration the URLs listed assume https standard port instead of 8443 for the listed endpoints, e.g. authorization_endpoint "https://localhost/auth/realms/master/protocol/openid-connect/auth" etc. I would expect authorization_endpoint "https://localhost:8443/auth/realms/master/protocol/openid-connect/auth" I put a minimal example on GitHub, the issue is reproducible like this: git clone https://github.com/janniswarnat/keycloak-minimal-example.git cd keycloak-minimal-example docker-compose up -d curl --insecure https://localhost:8443/auth/realms/master/.well-known/openid-configuration | jq Do I miss anything obvious? Thanks in advance and best regards Jannis -- Jannis Warnat ------------------------------ Research Associate User-Centered Ubiquitous Computing Fraunhofer Institute for Applied Information Technology FIT Schloss Birlinghoven, 53754 Sankt Augustin, GERMANY Phone:(+49) 2241 / 14 3673 Email: jannis.warnat(a)fit.fraunhofer.de ------------------------------ http://www.fit.fraunhofer.de/en http://www.fit.fraunhofer.de/en/fb/ucc/ubiquitous.html ------------------------------

6 years, 10 months

1
0
0 / 0

Permission request with no resources

by Corentin Dupont

Hi all, I find strange a little thing in the permissions API. If I request permissions with some resources in my client, it works well: $ curl -X POST http://localhost:8080/auth/realms/waziup/protocol/openid-connect/token -H "Authorization: Bearer $USERTOKEN" -d "grant_type=urn:ietf:params:oauth:grant-type:uma-ticket&audience=api-server&permission=#gateways:view&response_mode=permissions" The response is: [{"scopes":["gateways:update","gateways:view","gateways:delete"],"rsid":"gateway-GW1","rsname":"GW1"}] However, If I request permissions when there is no resources at all in my client: [{"scopes":["gateways:view"]}] Why not the empty list? Thanks a lot and good vacations! Corentin

6 years, 10 months

2
1
0 / 0

Violation in Password Change Form results in System Error using a user defined jpa storage provider

by Andreas Sättler

Hello, we are using a user defined storage provider for our application postgres db defined as ejb similar to https://github.com/keycloak/keycloak-quickstarts/tree/latest/user-storage.... <https://github.com/keycloak/keycloak-quickstarts/tree/latest/user-storage...> On the other hand we want to use keycloaks's password update forms including password policy configured in keycloak. The policies are checked in the upgradeCredential method and in case of violation a ModelException is thrown. But unfortunately the exception is caught as javax.ejb.EJBTransactionRolledbackException in org.keycloak.services.resources.account.AccountFormService#processPasswordUpdate: 2019-08-14 17:16:54,973 ERROR [org.keycloak.services] (default task-2) KC-SERVICES0065: Failed to update Password: javax.ejb.EJBTransactionRolledbackException: invalidPasswordMinLengthMessage at org.jboss.as.ejb3@16.0.0.Final//org.jboss.as.ejb3.tx.CMTTxInterceptor.invokeInCallerTx(CMTTxInterceptor.java:203) at org.jboss.as.ejb3@16.0.0.Final//org.jboss.as.ejb3.tx.CMTTxInterceptor.required(CMTTxInterceptor.java:364) at org.jboss.as.ejb3@16.0.0.Final//org.jboss.as.ejb3.tx.CMTTxInterceptor.processInvocation(CMTTxInterceptor.java:144) at org.jboss.invocation@1.5.2.Final//org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:422) at org.jboss.as.ejb3@16.0.0.Final//org.jboss.as.ejb3.component.interceptors.CurrentInvocationContextInterceptor.processInvocation(CurrentInvocationContextInterceptor.java:41) at org.jboss.invocation@1.5.2.Final//org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:422) at org.jboss.as.ejb3@16.0.0.Final//org.jboss.as.ejb3.component.invocationmetrics.WaitTimeInterceptor.processInvocation(WaitTimeInterceptor.java:47) at org.jboss.invocation@1.5.2.Final//org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:422) at org.jboss.as.ejb3@16.0.0.Final//org.jboss.as.ejb3.security.SecurityContextInterceptor.processInvocation(SecurityContextInterceptor.java:100) at org.jboss.invocation@1.5.2.Final//org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:422) at org.jboss.as.ejb3@16.0.0.Final//org.jboss.as.ejb3.deployment.processors.StartupAwaitInterceptor.processInvocation(StartupAwaitInterceptor.java:22) at org.jboss.invocation@1.5.2.Final//org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:422) at org.jboss.as.ejb3@16.0.0.Final//org.jboss.as.ejb3.component.interceptors.ShutDownInterceptorFactory$1.processInvocation(ShutDownInterceptorFactory.java:64) at org.jboss.invocation@1.5.2.Final//org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:422) at org.jboss.as.ejb3@16.0.0.Final//org.jboss.as.ejb3.component.interceptors.LoggingInterceptor.processInvocation(LoggingInterceptor.java:67) at org.jboss.invocation@1.5.2.Final//org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:422) at org.jboss.as.ee@16.0.0.Final//org.jboss.as.ee.component.NamespaceContextInterceptor.processInvocation(NamespaceContextInterceptor.java:50) at org.jboss.invocation@1.5.2.Final//org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:422) at org.jboss.invocation@1.5.2.Final//org.jboss.invocation.ContextClassLoaderInterceptor.processInvocation(ContextClassLoaderInterceptor.java:60) at org.jboss.invocation@1.5.2.Final//org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:422) at org.jboss.invocation@1.5.2.Final//org.jboss.invocation.InterceptorContext.run(InterceptorContext.java:438) at org.wildfly.security.elytron-private@1.8.0.Final//org.wildfly.security.manager.WildFlySecurityManager.doChecked(WildFlySecurityManager.java:618) at org.jboss.invocation@1.5.2.Final//org.jboss.invocation.AccessCheckingInterceptor.processInvocation(AccessCheckingInterceptor.java:57) at org.jboss.invocation@1.5.2.Final//org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:422) at org.jboss.invocation@1.5.2.Final//org.jboss.invocation.ChainedInterceptor.processInvocation(ChainedInterceptor.java:53) at org.jboss.as.ee@16.0.0.Final//org.jboss.as.ee.component.ViewService$View.invoke(ViewService.java:198) at org.jboss.as.ee@16.0.0.Final//org.jboss.as.ee.component.ViewDescription$1.processInvocation(ViewDescription.java:185) at org.jboss.as.ee@16.0.0.Final//org.jboss.as.ee.component.ProxyInvocationHandler.invoke(ProxyInvocationHandler.java:81) at deployment.keycloak-ofbiz-provider-ear.ear.keycloak-ofbiz-provider.jar//com.zyres.keycloak.storage.OFBizUserStorageProvider$$$view2.updateCredential(Unknown Source) at org.keycloak.keycloak-services@6.0.1//org.keycloak.credential.UserCredentialStoreManager.updateCredential(UserCredentialStoreManager.java:168) at org.keycloak.keycloak-services@6.0.1//org.keycloak.services.resources.account.AccountFormService.processPasswordUpdate(AccountFormService.java:577) ... Caused by: org.keycloak.models.ModelException: invalidPasswordMinLengthMessage at deployment.keycloak-ofbiz-provider-ear.ear.keycloak-ofbiz-provider.jar//com.zyres.keycloak.storage.OFBizUserStorageProvider.updateCredential(OFBizUserStorageProvider.java:256) at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) ... Therefore the account password change form results in a system error instead of a model validation. Do you have any suggestions how to avoid this or is i a bug ? (we are using keycloak server 6.0.1) Kind regards Andreas

6 years, 10 months

1
0
0 / 0

External users federation

by Doh A. Ouattara

Hello We are dealing with a dozen of external third-party applications developed by different software vendors. We do not have access to their authentication scheme or application servers. Is there a way to use Keycloak so that a user will use only one account/password to authenticate with Keycloak, then Keycloak will make a second authentication on behalf the user to the third-party application using the user credentials (mapped) and redirect the user into the target application? To be short, can keycloak behave like a password manager or password vault for external applications? Is there a way to solve our problem with keycloak? Kind regards --- Doh Ouattara

6 years, 10 months

1
0
0 / 0

Keycloak configuration on AWS for a large scale

by Ferdous Shibly

Hi, I am trying to configure Keycloak 6.0.1 on AWS. I need to configure multi AZ Keycloak cluster for almost seven million active users (growing everyday). Currently I am using standalone HA with PostgreSQL (RDS). When I am trying to import all the users from LDAP, the cluster stopped working. Here are the errors I am getting, 2019-08-08 11:35:21,645 ERROR [org.infinispan.interceptors.impl.InvocationContextInterceptor] (timeout-thread--p11-t1) ISPN000136: Error executing command PutKeyValueCommand, writing keys [task::ClearExpiredEvents]: org.infinispan.util.concurrent.TimeoutException: ISPN000476: Timed out waiting for responses for request 76 from keycloak1 at org.infinispan.remoting.transport.impl.MultiTargetRequest.onTimeout(MultiTargetRequest.java:167) at org.infinispan.remoting.transport.AbstractRequest.call(AbstractRequest.java:87) at org.infinispan.remoting.transport.AbstractRequest.call(AbstractRequest.java:22) at java.util.concurrent.FutureTask.run(FutureTask.java:266) at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$201(ScheduledThreadPoolExecutor.java:180) at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:293) at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) at java.lang.Thread.run(Thread.java:748) 2019-08-08 11:35:32,684 ERROR [org.infinispan.interceptors.impl.InvocationContextInterceptor] (timeout-thread--p11-t1) ISPN000136: Error executing command RemoveCommand, writing keys [task::ClearExpiredClientInitialAccessTokens]: org.infinispan.util.concurrent.TimeoutException: ISPN000476: Timed out waiting for responses for request 81 from keycloak1 at org.infinispan.remoting.transport.impl.MultiTargetRequest.onTimeout(MultiTargetRequest.java:167) at org.infinispan.remoting.transport.AbstractRequest.call(AbstractRequest.java:87) at org.infinispan.remoting.transport.AbstractRequest.call(AbstractRequest.java:22) at java.util.concurrent.FutureTask.run(FutureTask.java:266) at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$201(ScheduledThreadPoolExecutor.java:180) at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:293) at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) at java.lang.Thread.run(Thread.java:748) 2019-08-08 11:36:14,107 ERROR [org.infinispan.interceptors.impl.InvocationContextInterceptor] (timeout-thread--p11-t1) ISPN000136: Error executing command RemoveExpiredCommand, writing keys [5d57dd8d-79e0-4ab9-9d8b-60fc570ec8b2]: org.infinispan.util.concurrent.TimeoutException: ISPN000476: Timed out waiting for responses for request 85 from keycloak1 at org.infinispan.remoting.transport.impl.SingleTargetRequest.onTimeout(SingleTargetRequest.java:65) at org.infinispan.remoting.transport.AbstractRequest.call(AbstractRequest.java:87) at org.infinispan.remoting.transport.AbstractRequest.call(AbstractRequest.java:22) at java.util.concurrent.FutureTask.run(FutureTask.java:266) at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$201(ScheduledThreadPoolExecutor.java:180) at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:293) at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) 2019-08-08 11:56:34,720 FATAL [org.infinispan.CLUSTER] (transport-thread--p13-t2) [Context=sessions] ISPN000313: Lost data because of abrupt leavers [keycloak1] 2019-08-08 11:56:34,721 INFO [org.infinispan.CLUSTER] (transport-thread--p13-t2) [Context=sessions] ISPN100008: Updating cache members list [keycloak2], topology id 6 2019-08-08 11:56:34,739 FATAL [org.infinispan.CLUSTER] (transport-thread--p13-t2) [Context=clientSessions] ISPN000313: Lost data because of abrupt leavers [keycloak1] 2019-08-08 11:56:34,740 INFO [org.infinispan.CLUSTER] (transport-thread--p13-t2) [Context=clientSessions] ISPN100008: Updating cache members list [keycloak2], topology id 6 2019-08-08 11:56:34,744 WARN [org.infinispan.CLUSTER] (transport-thread--p13-t2) [Context=work] ISPN000314: Lost at least half of the stable members, possible split brain causing data inconsistency. Current members are [keycloak1], lost members are [keycloak1], stable members are [keycloak2, keycloak2] at java.lang.Thread.run(Thread.java:748) Here is the jgroup configuration <subsystem xmlns="urn:jboss:domain:jgroups:6.0"> <channels default="ee"> <channel name="ee" stack="tcp" cluster="ejb"/> </channels> <stacks> <stack name="tcp"> <transport type="TCP" socket-binding="jgroups-tcp"/> <protocol type="JDBC_PING"/> <jdbc-protocol type="JDBC_PING" data-source="KeycloakDS"> <property name="initialize_sql"> CREATE TABLE IF NOT EXISTS jgroupsping ( own_addr VARCHAR(200) NOT NULL, cluster_name VARCHAR(200) NOT NULL, ping_data BYTEA DEFAULT NULL, PRIMARY KEY (own_addr, cluster_name) ) </property> </jdbc-protocol> <protocol type="MERGE3"/> <protocol type="FD_SOCK"/> <protocol type="FD_ALL"/> <protocol type="VERIFY_SUSPECT"/> <protocol type="pbcast.NAKACK2"/> <protocol type="UNICAST3"/> <protocol type="pbcast.STABLE"/> <protocol type="pbcast.GMS"> <property name="join_timeout"> 60000 </property> <property name="print_local_addr"> true </property> <property name="print_physical_addrs"> true </property> </protocol> <protocol type="MFC"/> <protocol type="FRAG2"/> </stack> </stacks> > </subsystem> Any help would be appreciated. Cheers Ferdous Shibly

6 years, 10 months

1
0
0 / 0

DBusException: "Failed to connect to bus ""Failed to auth""

by Miroslav Beranič

Hi, I am trying to integrate FreeIPA with Keycloak ( same issue with 6.0.0 and 8.0.0-SNAPSHOT, following line numbers are from master/8.0.0-SNAPSHOT ). I have issue with User Federation - SSSD Provider being DISABLED. I run on OpenJDK 8 and Fedora 31. I run WildFly in Standalone mode, with logging set to DEBUG. In log server.log error message is written: "org.freedesktop.dbus.exceptions.DBusException: "Failed to connect to bus ""Failed to auth"". This is from: org/freedesktop/dbus/Transport.java:811 throw new IOException(getString("errorAuth")); and org/freedesktop/dbus/DBusConnection.java:306 throw new DBusException(getString("connectionFailure") + IOe.getMessage()); I guess this error message is not the most correct one ( or meaningful ). Origin of the error is from: org/freedesktop/dbus/Transport.java:488 ==> org.freedesktop.dbus.Transport.SASL#auth, where username "root" is encoded with stupidlyEncode(username); ( as I am on JVM8, com.sun.security.auth.module.UnixSystem is not found ). I get back "COMMAND_REJECTED" and as a result "state = FAILED" ( org/freedesktop/dbus/Transport.java:548 ). I am able to execute dbus commands: [root@sso ~]# dbus-send --print-reply --system --dest=org.freedesktop.sssd.infopipe /org/freedesktop/sssd/infopipe org.freedesktop.sssd.infopipe.Ping string:PING Creating home directory for keycloak. method return time=1565779939.956922 sender=:1.259 -> destination=:1.3491 serial=22 reply_serial=2 string "PONG" [root@sso ~]# echo $? 0 [root@sso ~]# dbus-send --print-reply --system --dest=org.freedesktop.sssd.infopipe /org/freedesktop/sssd/infopipe org.freedesktop.sssd.infopipe.GetUserGroups string:admin method return time=1565537226.470653 sender=:1.87 -> destination=:1.104 serial=12 reply_serial=2 array [ string "trust admins" string "admins" ] [root@sso ~]# echo $? 0 This terminal commands were pointed out as " self test of well configured system ", but all of this commands work, WildFly/Keycloak on the other hand rejects SSSD discovery. Is it possible I am missing some SELinux setting? Is there a way to test and get to this failure without WildFly -- by using terminal commands, that I could pinpoint what is the problem. I was working after steps presented by "Christian Heimes - Identity management, single sign-on and certificates with FreeIPA" and "scott poore's blog / How to setup Keycloak". What am I missing? Is there some test I can run from Keycloak source, to check beforehand, what is wrong? Thanks a lot. Kind Regards, Miroslav

6 years, 10 months

1
0
0 / 0

Keycloak json logs

by Vucomir Ianculov

Hi, i'm using keyclock server running docker and i want to enable json log format to stdout if i execute following commands when keycloak is started it will work /subsystem=logging/json-formatter=json:add(exception-output-type=formatted, pretty-print=false, meta-data={label=value}) /subsystem=logging/console-handler=CONSOLE:write-attribute(name=named-formatter, value=json) but i want this to be done autmatacly on docker image start, i tryed adding a custom scipt .cli but it dose not work. dose enyone know who can i do this automaticly ? Thanks. Kind Regards, Vucomir Ianculov E-Mail: [ mailto:vukomir@ianculov.ro | vukomir(a)ianculov.ro ] Phone: (+40) 722 - 690 - 514 [ http://ro.linkedin.com/in/vukomir | ] [ http://www.xing.com/profile/Vucomir_Ianculov ]

6 years, 10 months

1
0
0 / 0

Could not modify attribute for DN

by Benjamin Sher

Help! I am using AWS Simple AD. I have my users federated no problem. I can change the password of a user inside the realm no problem. If I impersonate a user or do a password reset and attempt to change the password as the user I receive the "Could not modify attribute for DN [CN=........] Any thoughts?

6 years, 10 months

1
0
0 / 0

Error fromIndex < 0 making no sense

by Sébastien Minne

Hi Guys, I'm getting this wired error message from keycloak. I'm running two keycloak instance on the same host, one is fien and the second one is getting me this : Caused by: java.lang.IndexOutOfBoundsException: fromIndex < 0: -1 Aug 14 17:23:58 keycloak.srv2 sh[2512]: [Server:server-one] at java.util.BitSet.nextClearBit(BitSet.java:744) Aug 14 17:23:58 keycloak.srv2 sh[2512]: [Server:server-one] at org.keycloak.models.sessions.infinispan.initializer.InitializerState.getNextUnfinishedSegmentFromIndex(InitializerState.java:102) Aug 14 17:23:58 keycloak.srv2 sh[2512]: [Server:server-one] at org.keycloak.models.sessions.infinispan.initializer.InitializerState.updateLowestUnfinishedSegment(InitializerState.java:98) Aug 14 17:23:58 keycloak.srv2 sh[2512]: [Server:server-one] at org.keycloak.models.sessions.infinispan.initializer.InitializerState.markSegmentFinished(InitializerState.java:94) Aug 14 17:23:58 keycloak.srv2 sh[2512]: [Server:server-one] at org.keycloak.models.sessions.infinispan.initializer.InfinispanCacheInitializer.startLoadingImpl(InfinispanCacheInitializer.java:187) Aug 14 17:23:58 keycloak.srv2 sh[2512]: [Server:server-one] at org.keycloak.models.sessions.infinispan.initializer.InfinispanCacheInitializer.startLoading(InfinispanCacheInitializer.java:108) Aug 14 17:23:58 keycloak.srv2 sh[2512]: [Server:server-one] at org.keycloak.models.sessions.infinispan.initializer.CacheInitializer.loadSessions(CacheInitializer.java:41) Aug 14 17:23:58 keycloak.srv2 sh[2512]: [Server:server-one] at org.keycloak.models.sessions.infinispan.InfinispanUserSessionProviderFactory$7.run(InfinispanUserSessionProviderFactory.java:317) Aug 14 17:23:58 keycloak.srv2 sh[2512]: [Server:server-one] at org.keycloak.models.utils.KeycloakModelUtils.runJobInTransaction(KeycloakModelUtils.java:227) Aug 14 17:23:58 keycloak.srv2 sh[2512]: [Server:server-one] at org.keycloak.models.sessions.infinispan.InfinispanUserSessionProviderFactory.loadSessionsFromRemoteCache(InfinispanUserSessionProviderFactory.java:306) Aug 14 17:23:58 keycloak.srv2 sh[2512]: [Server:server-one] at org.keycloak.models.sessions.infinispan.InfinispanUserSessionProviderFactory.loadSessionsFromRemoteCaches(InfinispanUserSessionProviderFactory.java:298) Aug 14 17:23:58 keycloak.srv2 sh[2512]: [Server:server-one] at org.keycloak.models.sessions.infinispan.InfinispanUserSessionProviderFactory.access$500(InfinispanUserSessionProviderFactory.java:68) Aug 14 17:23:58 keycloak.srv2 sh[2512]: [Server:server-one] at org.keycloak.models.sessions.infinispan.InfinispanUserSessionProviderFactory$1.lambda$onEvent$0(InfinispanUserSessionProviderFactory.java:127) Aug 14 17:23:58 keycloak.srv2 sh[2512]: [Server:server-one] at org.keycloak.models.utils.KeycloakModelUtils.runJobInTransaction(KeycloakModelUtils.java:227) Aug 14 17:23:58 keycloak.srv2 sh[2512]: [Server:server-one] at org.keycloak.models.utils.KeycloakModelUtils.runJobInTransactionWithTimeout(KeycloakModelUtils.java:267) Aug 14 17:23:58 keycloak.srv2 sh[2512]: [Server:server-one] at org.keycloak.models.sessions.infinispan.InfinispanUserSessionProviderFactory$1.onEvent(InfinispanUserSessionProviderFactory.java:121) Aug 14 17:23:58 keycloak.srv2 sh[2512]: [Server:server-one] at org.keycloak.services.DefaultKeycloakSessionFactory.publish(DefaultKeycloakSessionFactory.java:69) Aug 14 17:23:58 keycloak.srv2 sh[2512]: [Server:server-one] at org.keycloak.services.resources.KeycloakApplication.<init>(KeycloakApplication.java:170) Aug 14 17:23:58 keycloak.srv2 sh[2512]: [Server:server-one] at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method) Aug 14 17:23:58 keycloak.srv2 sh[2512]: [Server:server-one] at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62) Aug 14 17:23:58 keycloak.srv2 sh[2512]: [Server:server-one] at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45) Aug 14 17:23:58 keycloak.srv2 sh[2512]: [Server:server-one] at java.lang.reflect.Constructor.newInstance(Constructor.java:423) Aug 14 17:23:58 keycloak.srv2 sh[2512]: [Server:server-one] at org.jboss.resteasy.core.ConstructorInjectorImpl.construct(ConstructorInjectorImpl.java:152) Aug 14 17:23:58 keycloak.srv2 sh[2512]: [Server:server-one] ... 31 more Aug 14 17:23:58 keycloak.srv2 sh[2512]: [Server:server-one] I've already lost a bunch of hours trying things around but can't figure out what's wrong Any piece of advice would be more than welcome Sébastien

6 years, 10 months

1
0
0 / 0

Prevent users from changing email address when email is used as username

by Ales Fuchs

Hello, We are using Keycloak version 4.8.3 and in our setting we have the option "Email as username" switched on and "Edit username" switched off. At the same time we need to let users to log in and change their name in the account console. Once the name and surname is editable, email can be changed too, which changes also the username. The input with email can be hidden, but whoever knows how Keycloak works can simply add this input and update the username. Does anyone have any idea how updating of username can be prevented? Best regards, Ales Fuchs

6 years, 10 months

3
7
0 / 0

Custom password hashing in user federation

by Simon Levermann

Hello, in our custom user database, we have passwords hashed by bcrypt (or argon2). As far as I can see we have 2 ways of verifying these passwords: 1) Create a PasswordHashProvider via SPI, and teach it how to use the hashing algorithms. 2) Include the hashing algorithms as a dependency of our UserProvider, and do it internally via implementing CredentialInputValidator. Which of these options is the recommended way to do this? Cheers, Simon

6 years, 10 months

1
0
0 / 0

Federation of Roles, Groups and Realms

by Simon Levermann

Hello, we have a user database in form of a license server, which we would like to use as a source of data for a Keycloak server. I've been able to find plenty of resources on how to map the *users* into Keycloak via SPI, but I haven't been able to find much on Roles, Groups and Realms. Are any (or all) of the three possible to achieve, or do we have to manage these manually? The problem is that we would like to have some logical separation of users into a realm (or a group) per customer, as well as mapping roles onto licenses for different products. Our current stab at a solution is an external synchronization service which periodically performs updates via the Keycloak Admin API, but if possible, we would like to get rid of this service and perform all the mappings inside Keycloak. Best regards, Simon Levermann

6 years, 10 months

2
3
0 / 0

Keycloak Plugin: How to retrieve list of synced users form Federated LDAP in EventListener

by Paul Edison

Hi, I’m trying to write a plugin for Keycloak that should work (“export”) with the data of users that get created. Currently writing it as a EventListerner Plugin that acts on adminEvents. If a user is created in Keycloak itself in the local store this works fine. With the event I get the "resourcePath=users/0958198e-7a5d-4fb3-9b1b-2481841bff3f" and with that I can access the user: > UserModel user = session.users().getUserById(<ID>, session.getContext().getRealm()); Thats fine – but with federation I got problems. In the event of synchronisation I don’t get this information. I only get the "resourcePath=user-storage/381a8a65-c425-487e-b14a-a1186fda5940/sync" How would I get the users form that info? Is there a way to get form the session the list of synced users form that ID? And in best case a list of new users and only updated users? Kind regards, Paul

6 years, 10 months

1
0
0 / 0

Audience claim in Keycloak access tokens

by Peemöller, Björn

Hi everyone, I have some questions about the audience claim in JWT and how they are handled in Keycloak, maybe someone can help me? During an upgrade of our Keycloak instances from 4.1.0 to 6.0.1, we discovered that the handling of the audience claim changed for at least the following scenario: - A technical (service) user obtains a token for the client clientA using the endpoint /realms/{realm-name}/protocol/openid-connect/token - In the scope mappings of client A, the client roles of client clientB are added Using Keycloak 4.1.0, the returned JWT contains ... "aud": "clientA", "azp": "clientA", ... while using Keycloak 6.0.1, the JWT contains ... "aud": "clientB", "azp": "clientA", ... While I understand that the second variant better allows to securely use the token also for client clientB, the token can no longer be used for the clientA if the client validates the token's audience, although the client was explicitly requested for clientA. The Keycloak documentation [1] says that the client for which the token is issued will not be contained in the audience of the access token but can be added using the hardcoded audience mapper, which indeed leads to the claims ... "aud": [ "clientA", "clientB", ], "azp": "clientA", ... Now my questions: What is the rationale behind this behavioral change from Keycloak 4.1.0 to Keycloak 6.0.1? Why is the client for which the token is issued not included in the access token's audience? I mean, finally, it is the client the token is requested for. Many thanks in advance, Björn [1]: https://www.keycloak.org/docs/latest/server_admin/#_audience Bei Berenberg hat der Schutz Ihrer Daten seit jeher höchste Priorität. Informationen zum Umgang mit personenbezogenen Daten finden Sie hier: https://www.berenberg.de/files/Rechtliche%20Hinweise/DSGVO/DSGVO-Kundenin... Diese Nachricht einschliesslich etwa beigefuegter Anhaenge ist vertraulich und kann dem Bank- und Datengeheimnis unterliegen oder sonst rechtlich geschuetzte Daten und Informationen enthalten. Wenn Sie nicht der richtige Adressat sind oder diese Nachricht irrtuemlich erhalten haben, informieren Sie bitte sofort den Absender über die Antwortfunktion. Anschliessend moechten Sie bitte diese Nachricht einschliesslich etwa beigefuegter Anhaenge unverzueglich vollstaendig loeschen. Das unerlaubte Kopieren oder Speichern dieser Nachricht und/oder der ihr etwa beigefuegten Anhaenge sowie die unbefugte Weitergabe der darin enthaltenen Daten und Informationen sind nicht gestattet. Wir weisen darauf hin, dass rechtsverbindliche Erklaerungen namens unseres Hauses grundsaetzlich der Unterschriften zweier ausreichend bevollmaechtigter Vertreter unseres Hauses beduerfen. Wir verschicken daher keine rechtsverbindlichen Erklaerungen per E-Mail an Dritte. Demgemaess nehmen wir per E-Mail auch keine rechtsverbindlichen Erklaerungen oder Auftraege von Dritten entgegen. Sollten Sie Schwierigkeiten beim Oeffnen dieser E-Mail haben, wenden Sie sich bitte an den Absender oder an info(a)berenberg.de. Unsere Hinweise zum Schutz personenbezogener Daten finden Sie unter https://www.berenberg.de/files/Rechtliche+Hinweise/DSGVO/DSGVO-Kundeninfo....

6 years, 10 months

2
2
0 / 0

difference between openid connect 1.0 and keycloak open id connect identity providers

by Madhu

Whats the benefit and advantage of using keycloak openid connect identity provider over the standard open id connect 1.0 provider, i dont seem much literature around this in the latest keycloak documents? The identity provider page /configurations too looks very same.. When should i use keycloak openid connect and when open id connect? RegardsMadhu

6 years, 10 months

1
0
0 / 0

Redirect secured by Keycloak client side apps to login page after idle timeout. Apps are behind app gateway

by Roman Ok

6 years, 10 months

1
0
0 / 0

extending SAML session with Azure ID via Keycloak

by Nijo Johny

Hi, Our Application setup details --------------------- Keycloak version: 3.3.0 Final Keycloak acts as Broker. Azure AD configured as identity provider over SAML. Problem statement: Not able to renew and extract new SAML assertion from Azure AD. Our app is secured using Keycloak over Open ID Connect with JWT token. We are leveraging Keycloak Identity Brokering to use Customer's Azure AD as the Identity Provider. Once user login, we need invoke customer API by sending SAML assertion issued by Azure AD. We can extract SAML issued by IDP from keycloak via GET /auth/realms/{realm}/broker/{provider_alias}/token HTTP/1.1. Keycloak is always returning same SAML assertion, one issued on login even if expired. Keycloak issues new JWT token to our app via refresh token exchange our side. But we need valid SAML assertion to call customer API. Is there a way to renew session with AD via keycloak? Passive SAML2 Auth request is what I found as a solution for this. Is this supported from Keycloak when it acts as a broker? Any help is appreciated. This e-Mail may contain proprietary and confidential information and is sent for the intended recipient(s) only. If by an addressing or transmission error this mail has been misdirected to you, you are requested to delete this mail immediately. You are also hereby notified that any use, any form of reproduction, dissemination, copying, disclosure, modification, distribution and/or publication of this e-mail message, contents or its attachment other than by its intended recipient/s is strictly prohibited. Visit us at https://www.intellectdesign.com

6 years, 10 months

1
0
0 / 0

Regarding finding the source code link for few keycloak dependencies

by Shiva Prasad Thagadur Prakash

Hi Guys, I am unable to find the source code link for few of the keycloak dependencies. For example, PicketLink 2.5.5SP12. Is there a way we could find the source code link to the dependencies of keycloak? Thanks, Shiva

6 years, 10 months

1
0
0 / 0

Implementing Multi-tenancy through Keycloak

by Dhara Basida

Hi Team, We are currently planning to integrate our application with keycloak in order to achieve multi-tenancy. We have hierarchy like : 1) Super Admin : Who have access to eveything and will create tenant. 2) Tenant Admin : This admin can create their Members and one tenant admin cannot see the data of another tenant admin or Tenant. Also he could not able to see any details of Super Admin. 3) Members : Member are specific to Tenant. Member have rights to create their employees and roles which are applicable for their employees. But Member cannot see details of other Members or their Tenant Admin. 4) Employees : Employees are users who can only have view permissions for role applicable to them and manage their profile. He could not able to see any details of Member or Tenant. QUestions : I have created admin and tenant. I have link admin with Super Admin and Tenant Admin with Realm admin. For Member I linked it with Client but somehow I don't find the way to manage it. As I am not able to create Employees from member (Not able to get Add options for users and If I enable manage users or view users role from tenant admin than I can also see data of tenant which is wrong). Kindly provide the way to achieve these hierarchy. Thank you, Dhara Basida --- This email has been checked for viruses by Avast antivirus software. https://www.avast.com/antivirus

6 years, 10 months

2
1
0 / 0

Running keycloak with azure web app for containers

by Neba Medard

Hello i have been trying to run keycloak in azure now with some problems Am running keycloak as a container in azure using web app for containers Am getting the keycloak image from docker hub and when i run the container and serve the page and then try to navigate to the administration console, it shows the page "we are sorry, invalid parameter:redirect_uri" Am not even able to reach the administration console Is there any configuration needed? Just to let you know i am a junior developer and am starting with keycloak Any help will be much appreciated

6 years, 10 months

2
1
0 / 0

Keycloak, Samba, and ldap password modify extended operation (RFC3062)

by Gary Kennedy

Someone has installed the smbk5pwd module into our ldap system used by our Keycloak instance. They wish to share the ldap service with another system that needs the samba password hash attributes. Unfortunately this means I now need keycloak to perform the ldap v3 password modify extended operation. I've hacked this into our current user federation provider (which apparently extends the in-built ldap one), by having the provider implement `CredentialInputUpdater`, and everything is working within the realms of our tests. What I am interested in, is if there is already usable work out there in having Keycloak use the password modify extended operation? and/or how other people have integrated similar requirements (ldap password modify extended operation, or samba/extra password hashes in ldap) - without extending too much of Keycloak (I was sooo close to removing our custom user federation provider) :p Cheers, Gary

6 years, 10 months

1
0
0 / 0

Alternative to Kerberos & Custom Use Case

by Aditya Bhole

Hi, Are there any other mechanisms in Keycloak apart from Kerberos which can establish something similar to a cross realm trust? Also, consider this use case: We have App A and App B. App A and App B may have different Keycloak instances or maybe in different realms of the same Keycloak instance. User logs into App A. He clicks on a button in App A which is supposed to take him to App B. The user now has a JWT when he logged into App A. Now App B knows that all the redirects are going to be from App A. So can App B verify the token through App A? Regards, Aditya

6 years, 10 months

2
3
0 / 0

Admin User Impersonation Restriction

by Prado, Renann

Hello. I'm currently doing a research to see if keycloak fits our use cases and the impersonation feature is important for the case when we want to do support and see what the users sees for some reason. Of course Impersonation is nice, yet it can be very risky if impersonation permission is given to wrong people. I was doing some tests (locally) and I found out that by having only the client roles of view view-users and impersonation, I was able to impersonate the admin user. I'm using docker to runs my tests, so basically I was able to impersonate the user that is created via the KEYCLOAK_USER and KEYCLOAK_PASSWORD environment variables. My question is: is it possible to restrict impersonation to certain users based on attributes, roles, or something else? Or is the impersonation always possible to be done on all the users within the realm as long as the user has permission to do impersonation? As I understand the master realm shouldn't be used for anything other than administration, correct? Then what would be the best way to "slice" your realms, per product (e.g. web app)? We also want to use keycloak to provide SSO for us, which I suppose only works in the realm level. So if we create one realm per application, then we cannot really do SSO. Thanks -- Best regards, *Renann Prado*

6 years, 10 months

1
0
0 / 0

Docker X509 Apache Cert Lookup Client Certificate Passthrough

by Johnson, Freddie [USA]

Team -- I'm currently having issues getting Keycloak to read the client certificate forwarded from proxy in HTTP header from Apache using Apache SPI Cert lookup. Instead, it reads the wildcard of the cert provided below in the virtual host of *.xxx.ninja from SSLProxyMachineCertificateFile. However, if i use that common name of the wildcard and assign it to any user, Keycloak will log that user in even though that is not the user originally making the initial request to the proxy. In short, how do I force Keycloak running in a container to use the apache spi to retrieve cert credentials in header? I tried developer documentation by adding spi per https://www.keycloak.org/docs/latest/server_admin/index.html#client-certi... to both standalone.xml and deployment folder but it's as if Keycloak is not recognizing the configuration change in container after build. If I remove SSLProxyMachineCertificateFile from Apache, Keycloak sends a message to the proxy saying "downstream server expected client cert but none configured" so that option didn't work either. Details below: My apache reverse proxy is: <VirtualHost *:443> SSLEngine on SSLProxyEngine on SSLVerifyClient optional SSLVerifyDepth 4 SSLOptions +ExportCertData SSLProxyCheckPeerName off ProxyPreserveHost On SSLProxyCACertificateFile "/usr/local/apache2/conf/ca-xxx-ninja.crt" SSLCACertificateFile "/usr/local/apache2/conf/xxx_authorities.pem" SSLProxyMachineCertificateFile "/usr/local/apache2/conf/proxy-wildcard-xxx-ninja.pem" RequestHeader set SSL_CLIENT_CERT "" RequestHeader set SSL_CLIENT_CERT_CHAIN_4 "" ServerName sso.xxx.ninja ProxyPass / https://keycloak:8443/ ProxyPassReverse / https://keycloak:8443/ ProxyRequests Off RequestHeader set X-Forwarded-Port "443" RequestHeader set X-Forwarded-Proto "https" RequestHeader set SSL_CLIENT_CERT "%{SSL_CLIENT_CERT}i" RequestHeader set CERT_CHAIN "%{SSL_CLIENT_CERT_CHAIN_4}i" </VirtualHost> My Keycloak Dockerfile (abbreviated - sanitized): ENV "X509_CA_BUNDLE"="/opt/xxx/xxx_authorities.pem" USER root RUN mkdir -p /etc/x509/https RUN mkdir -p /opt/xxx COPY "./certs/tls.crt" "/etc/x509/https" COPY "./certs/tls.key" "/etc/x509/https" COPY "./standalone.xml" "/opt/jboss/keycloak/standalone/configuration/standalone.xml" <---- originally edited this file to hold apache spi COPY "./apache.xml" "/opt/jboss/keycloak/standalone/deployments/apache.xml" < ------- moved apache spi for x509 here per online instructions COPY "./certs/ca-xxx-ninja.crt" "/opt" COPY "./certs/xxx/xxx_authorities.pem" "/opt/xxx/" RUN keytool -noprompt -import -trustcacerts -alias root -file /opt/ca-xxx-ninja.crt -keystore $JAVA_HOME/jre/lib/security/cacerts -storepass changeit RUN keytool -noprompt -import -trustcacerts -alias xxx -file /opt/xxx/xxx_authorities.pem -keystore $JAVA_HOME/jre/lib/security/cacerts -storepass changeit USER 1000 EXPOSE 8080 8443 Any guidance/ideas you can provide would much appreciated as I've been working it for a few days now and can't seem to get over this last hurdle. Respectfully, Freddie Lee Johnson, Jr.

6 years, 10 months

2
3
0 / 0

Docker X509 Apache Cert Lookup Client Certificate Passthrough

by Johnson, Freddie [USA]

Sebastian – Thanks for the awesome feedback. I’ll implement your suggestion. How would you recommend I activate the Apache SPI in the docker image? Should I add it to the standalone.xml and comment out the default provider or add it to the deployment URL as annotated in docker documentation: “To add a custom provider extend the Keycloak image and add the provider to the /opt/jboss/keycloak/standalone/deployments/ directory.” Does that count as a custom provider? Freddie From: Sebastian Laskawiec <slaskawi(a)redhat.com> Date: Thursday, August 8, 2019 at 12:18 AM To: "Johnson, Freddie [USA]" <Johnson_Freddie(a)bah.com> Cc: "keycloak-user(a)lists.jboss.org" <keycloak-user(a)lists.jboss.org> Subject: [External] Re: [keycloak-user] Docker X509 Apache Cert Lookup Client Certificate Passthrough The only thing I found a bit weird is that you create `/etc/x509/https` directory. Keycloak image has a small script that tries to grab a key and a certificate in that directory and import them [1]. But I see you're already doing that in `RUN keytool ...` commands. Perhaps you should either put tls.crt and tls.key there and rely on our script or do everything by yourself (but in that case, please remember about modifying configuration similarly to [2]). The last advice I can give to you is to append `-Djavax.net.debug=all` argument to ./standalone.sh. This way you can see, what certificates are being picked up and if the TLS handshake looks correct (although, the debugging is really time-consuming). [1] https://github.com/jboss-dockerfiles/keycloak/blob/master/server/tools/x5...<https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_jboss-2Dd...> [2] https://github.com/jboss-dockerfiles/keycloak/blob/master/server/tools/x5...<https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_jboss-2Dd...> On Thu, Aug 8, 2019 at 1:05 AM Johnson, Freddie [USA] <Johnson_Freddie(a)bah.com<mailto:Johnson_Freddie@bah.com>> wrote: Team -- I'm currently having issues getting Keycloak to read the client certificate forwarded from proxy in HTTP header from Apache using Apache SPI Cert lookup. Instead, it reads the wildcard of the cert provided below in the virtual host of *.xxx.ninja from SSLProxyMachineCertificateFile. However, if i use that common name of the wildcard and assign it to any user, Keycloak will log that user in even though that is not the user originally making the initial request to the proxy. In short, how do I force Keycloak running in a container to use the apache spi to retrieve cert credentials in header? I tried developer documentation by adding spi per https://www.keycloak.org/docs/latest/server_admin/index.html#client-certi...<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.keycloak.org_doc...> to both standalone.xml and deployment folder but it's as if Keycloak is not recognizing the configuration change in container after build. If I remove SSLProxyMachineCertificateFile from Apache, Keycloak sends a message to the proxy saying "downstream ser! ver expected client cert but none configured" so that option didn't work either. Details below: My apache reverse proxy is: <VirtualHost *:443> SSLEngine on SSLProxyEngine on SSLVerifyClient optional SSLVerifyDepth 4 SSLOptions +ExportCertData SSLProxyCheckPeerName off ProxyPreserveHost On SSLProxyCACertificateFile "/usr/local/apache2/conf/ca-xxx-ninja.crt" SSLCACertificateFile "/usr/local/apache2/conf/xxx_authorities.pem" SSLProxyMachineCertificateFile "/usr/local/apache2/conf/proxy-wildcard-xxx-ninja.pem" RequestHeader set SSL_CLIENT_CERT "" RequestHeader set SSL_CLIENT_CERT_CHAIN_4 "" ServerName sso.xxx.ninja ProxyPass / https://keycloak:8443/<https://urldefense.proofpoint.com/v2/url?u=https-3A__keycloak-3A8443_&d=D...> ProxyPassReverse / https://keycloak:8443/<https://urldefense.proofpoint.com/v2/url?u=https-3A__keycloak-3A8443_&d=D...> ProxyRequests Off RequestHeader set X-Forwarded-Port "443" RequestHeader set X-Forwarded-Proto "https" RequestHeader set SSL_CLIENT_CERT "%{SSL_CLIENT_CERT}i" RequestHeader set CERT_CHAIN "%{SSL_CLIENT_CERT_CHAIN_4}i" </VirtualHost> My Keycloak Dockerfile (abbreviated - sanitized): ENV "X509_CA_BUNDLE"="/opt/xxx/xxx_authorities.pem" USER root RUN mkdir -p /etc/x509/https RUN mkdir -p /opt/xxx COPY "./certs/tls.crt" "/etc/x509/https" COPY "./certs/tls.key" "/etc/x509/https" COPY "./standalone.xml" "/opt/jboss/keycloak/standalone/configuration/standalone.xml" <---- originally edited this file to hold apache spi COPY "./apache.xml" "/opt/jboss/keycloak/standalone/deployments/apache.xml" < ------- moved apache spi for x509 here per online instructions COPY "./certs/ca-xxx-ninja.crt" "/opt" COPY "./certs/xxx/xxx_authorities.pem" "/opt/xxx/" RUN keytool -noprompt -import -trustcacerts -alias root -file /opt/ca-xxx-ninja.crt -keystore $JAVA_HOME/jre/lib/security/cacerts -storepass changeit RUN keytool -noprompt -import -trustcacerts -alias xxx -file /opt/xxx/xxx_authorities.pem -keystore $JAVA_HOME/jre/lib/security/cacerts -storepass changeit USER 1000 EXPOSE 8080 8443 Any guidance/ideas you can provide would much appreciated as I've been working it for a few days now and can't seem to get over this last hurdle. Respectfully, Freddie Lee Johnson, Jr. _______________________________________________ keycloak-user mailing list keycloak-user(a)lists.jboss.org<mailto:keycloak-user@lists.jboss.org> https://lists.jboss.org/mailman/listinfo/keycloak-user<https://urldefense.proofpoint.com/v2/url?u=https-3A__lists.jboss.org_mail...>

6 years, 10 months

1
0
0 / 0

Disable sending the email about invalid login

by Katarzyna Sycz

Hello, I would like to ask if there is a possibility to disable sending the specific email via Keycloak. In this case, I would like to prevent sending the email informing about the invalid login (when users use the incorrect username or password). I didn't find any setting for that in the console and I didn't find the info about it in the docs. I would appreciate any help. Kind regards, Katarzyna Sycz

6 years, 10 months

1
0
0 / 0

Is quorum needed in Keycloak Standalone Clustered Configuration?

by Roman Ok

Sorry, i'm sending this again as my last post was posted without text for some unknown reason: Should an Keycloak deployments configured in Standalone Clustered Configuration have odd number of nodes to ensure quorum? It's stated that Keycloak is built on top of the WildFly application server and its sub-projects like Infinispan (for caching) and Hibernate (for persistence). Keycloak recommends to look in WildFly Documentation and High Availability Guide. If understood correctly Standalone Clustered Configuration allows session replication or transmission of SSO contexts around the cluster. I don't understand though if odd number of Keycloak nodes is required so that there will be quorum. Singleton subsystem states 10.1.3. Quorum Network partitions are particularly problematic for singleton services, since they can trigger multiple singleton providers for the same service to run at the same time. To defend against this scenario, a singleton policy may define a quorum that requires a minimum number of nodes to be present before a singleton provider election can take place. A typical deployment scenario uses a quorum of N/2 + 1, where N is the anticipated cluster size. This value can be updated at runtime, and will immediately affect any active singleton services. e.g. Is it somehow related to Keycloak and its Standalone Clustered Configuration?

6 years, 10 months

2
1
0 / 0

Latest version download link?

by Uumas

Is there a direct link to downlaod the latest version of keycloak? I'm trying to write a script for updating.

6 years, 10 months

1
0
0 / 0

UserStorageProvider.updateCredential to receive current password

by Steve Thomas

Hi there, I have a custom UserStorageProvider with updateCredential method being implemented. Everything works fine but for security reason, I need the current password to be passed to that method as well. What is the suggested way if I want to change the behavior of the processPasswordUpdate method of the AccountFormService? Or is there a SPI I can use? Is there an example somewhere online? Thank you in advance [http://images.logibec.com/Logibec121x57.png] Steve Thomas Analyste-programmeur Infrastructure de d?veloppement Programmer Analyst T +1-800-361-9659 | T +1 800 361-9659 Steve.Thomas(a)logibec.com www.logibec.com AVIS DE CONFIDENTIALIT? Le pr?sent courriel et les informations qu'il contient sont confidentiels et demeurent la propri?t? exclusive de Logibec. Ils ne peuvent ?tre diffus?s ? quiconque hormis les membres du personnel devant en prendre connaissance, et ce, sous condition de leur avoir inform? qu'ils sont la propri?t? de Logibec, sont confidentiels et ne peuvent ?tre partag?s ? un tiers sans une autorisation pr?alable ?crite de Logibec. Si vous n'?tes pas le destinataire vis?, veuillez en aviser imm?diatement l'?metteur et d?truire le contenu du courriel sans le communiquer ou le reproduire. CONFIDENTIALITY NOTICE This email and the information it contains contained herein are confidential and remain the exclusive property of Logibec. They may not be disseminated to anyone except the staff members who must be aware of it, provided that they have been informed that the documents are the property of Logibec, are confidential and can not be shared with a third party without the prior written authorization of Logibec. If you are not the intended recipient, please indicate it immediately and destroy the contents of the email without disclosing or reproducing it.

6 years, 10 months

2
1
0 / 0

Logout from identity provider is not propagated to Keycload clients

by SauliK

Hi, I have set up Keycloak with a SAML2 Identity Provider and I have a client application configured to authenticate against Keycloak using SAML2. If I logout from the application, the logout happens correctly using browser redirects and the user is logged out from the application, from Keycloak, and from the identity provider. But if I logout from the Identity provider, the provider sends a logout request to Keycloak but Keycloak does not send the logouts to the clients. I have checked the source code regarding this and in the second scenario Keycloak uses only the backchannel logout and does not even attempt to do the browser / frontchannel logout. In my case backchannel logout is not supported. In the source code I can see that in SamlService class (which is being invoked when I do the logout from the application) it uses either browser logout or backchannel logout https://github.com/keycloak/keycloak/blob/1ac51611d3c1dd7c9b6537430587fa4... But in the SamlEndpoint class (which is used when the identity provider sends the logout request to Keycloak) it only attempts the backchannel logout: https://github.com/keycloak/keycloak/blob/ca4e14fbfa76e5c909503bde9b0f4e2... Is this the way it's supposed to work or is Keycloak just missing this feature? Br, Sauli -- Sent from: http://keycloak-user.88327.x6.nabble.com/

6 years, 10 months

1
0
0 / 0

Logout from identity provider is not propagated to Keycload clients

by SauliK

Hi, I have set up Keycloak with a SAML2 Identity Provider and I have a client application configured to authenticate against Keycloak using SAML2. If I logout from the application, the logout happens correctly using browser redirects and the user is logged out from the application, from Keycloak, and from the identity provider. But if I logout from the Identity provider, the provider sends a logout request to Keycloak but Keycloak does not send the logouts to the clients. I have checked the source code regarding this and in the second scenario Keycloak uses only the backchannel logout and does not even attempt to do the browser / frontchannel logout. In my case backchannel logout is not supported. In the source code I can see that in SamlService class (which is being invoked when I do the logout from the application) it uses either browser logout or backchannel logout https://github.com/keycloak/keycloak/blob/1ac51611d3c1dd7c9b6537430587fa4... But in the SamlEndpoint class (which is used when the identity provider sends the logout request to Keycloak) it only attempts the backchannel logout: https://github.com/keycloak/keycloak/blob/ca4e14fbfa76e5c909503bde9b0f4e2... Is this the way it's supposed to work or is Keycloak just missing this feature? Br, Sauli -- Sent from: http://keycloak-user.88327.x6.nabble.com/

6 years, 10 months

1
0
0 / 0

Is quorum needed in Keycloak Standalone Clustered Configuration?

by Roman Ok

6 years, 10 months

1
0
0 / 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

keycloak-user August 2019