August 2019 - keycloak-user - Jboss List Archives

Re: [keycloak-user] Auth-Code-Flow over multiple microservices

by Hans Zandbelt

on the latter option, see also: https://hanszandbelt.wordpress.com/2017/02/24/openid-connect-for-single-p... Hans. On Thu, Aug 29, 2019 at 10:13 PM <keycloak-user-request(a)lists.jboss.org> wrote: > > You need to decide if you want the front-end to hold tokens or not. If > front-end holds tokens you can do Auth code flow securely with pkce and > public clients. That means your front-end should move secure and you should > really only store tokens temporarily in the window state rather than in > html5 storage. This is perfectly acceptable in most cases. > > The alternative is to have a backend for your front-end that deals with > obtaining tokens. The front-end uses a httponly cookie to be authenticated > against the backend, but never has access to the token directly. This has > the limitation that front-end and backend has to be hosted on same domain > and if you need to call external services it needs to be proxies through > the backend. It is harder to do though. > > An hybrid approach like you mention doesn't make any sense to me. > > On Tue, 27 Aug 2019, 11:18 bob sheknowdas, <bob.skd(a)googlemail.com> wrote: > > > Hi, > > > > I have a setup and a usecase that seems to be quite unique (according to > my > > google search effords). > > > > I use a frontend consisting of pure java script (microservice 1). > > Behind that runs a backend created with java spring boot (microservice > 2). > > > > To authenticate users I want to switch from the implict flow to the > > auth-code-flow for additional security. > > However, this additional security can not be achieved using a pure java > > script client... > > > > So I had the following idea: > > Integrating the backend into the auth-code-flow of the frontend. > > I was planing to let the request to the authorization-endpoint be handled > > by the frontend alone, but than proxy the request to the token endpoint > > through the backend (where the client secret is injected). > > > > Does the keycloak spring-boot-adapter provide any useful functionality > for > > this usecase? > > Is this a good idea in general? > > > > I am thankful for any help or comment provided :) > > > > Best > > Bob > > _______________________________________________ > > keycloak-user mailing list > > keycloak-user(a)lists.jboss.org > > https://lists.jboss.org/mailman/listinfo/keycloak-user > > > > > -- > -- hans.zandbelt(a)zmartzone.eu ZmartZone IAM - www.zmartzone.eu

5 years, 4 months

1
0
0 / 0

Kerberos token for VDI login

by Halling-Brown, Chris HLTH:EX

Hi, newbie to KC I am afraid. Looking to leverage KC for authentication purposes, logging users from multiple domains into a VDI solution hosted by a target domain. The intention is to have the user authenticate with their local IdP creds to create a true SSO solution that logs them into a VDI in the target domain. The platform we are architecting depends on a secure workspace, preferably delivered by VMware Horizon View VDI's to access an application using AD (full Kerberos integration) to manage RBAC. [cid:image001.png@01D5599A.C65088E0] Has anyone out there achieved something similar or am I smoking the good stuff? Cheers Chris

5 years, 4 months

1
1
0 / 0

Keycloak Issuing the same token with jwt/issuer and jwt/jwksUri

by Jayathirth, Pramod Raghavendra

Hi All, I am trying to run an oauth authentication and authorization server like a keycloak along with the istio to enable some form of credentials management. I saw that many people had run into the same. I am following this, https://redhat-developer-demos.github.io/istio-tutorial/istio-tutorial/1..... I am able to successfully block the user without token. I am able to get the token as well. But the curl with token authorization fails from Istio's side. (curl -H "Authorization: Bearer $token" customer-tutorial.$(minishift ip).nip.io). Also I have been using keycloak from a few weeks. I saw that it gives the same token every time. Is this behavior normal? Are you aware of any such issue that you would have faced? Or Did you suggest any other tutorial/Page that explains this better? I am using 1.2.2 istio and keycloak 6.0.1. Please do let me know on how to proceed. Regards, Pramod Raghavendra Jayathirth

5 years, 4 months

1
0
0 / 0

Custom actions on a password, when an user change passwords?

by Rémy Grünblatt

Hello, I'm searching for a way to execute a custom action when an user defines or changes its password. The goal is to save the password in another format (the ultimate goal is being able to do scram/sha1 on the id of the users), while maintaining the normal operation of keycloak (we don't want to change the way keycloak stores its passwords, we just want a sort of copy). Does it ring a bell for someone in there? Do you know of a way to do that? Thanks, Rémy

5 years, 4 months

1
0
0 / 0

Auth-Code-Flow over multiple microservices

by bob sheknowdas

Hi, I have a setup and a usecase that seems to be quite unique (according to my google search effords). I use a frontend consisting of pure java script (microservice 1). Behind that runs a backend created with java spring boot (microservice 2). To authenticate users I want to switch from the implict flow to the auth-code-flow for additional security. However, this additional security can not be achieved using a pure java script client... So I had the following idea: Integrating the backend into the auth-code-flow of the frontend. I was planing to let the request to the authorization-endpoint be handled by the frontend alone, but than proxy the request to the token endpoint through the backend (where the client secret is injected). Does the keycloak spring-boot-adapter provide any useful functionality for this usecase? Is this a good idea in general? I am thankful for any help or comment provided :) Best Bob

5 years, 4 months

2
1
0 / 0

Keycloak Domain TCP Clustering of Sessions in AWS not auto-failing over to node

by JTK

I have two nodes setup in a cluster using TCP port 7600 and I see them join the cluster in the logs. On Master: [Host Controller] 15:07:18,293 INFO [org.jboss.as.domain.controller] (Host Controller Service Threads - 7) WFLYHC0019: Registered remote slave host "dev-slave1", JBoss Keycloak 6.0.1 (WildFly 8.0.0.Final) On Slave: [Host Controller] 15:03:12,603 INFO [org.jboss.as.host.controller] (Host Controller Service Threads - 3) WFLYHC0148: Connected to master host controller at remote://10.10.10.77:9999 In the WildFly admin panel I see the server group: auth-server-group which is ha and then I see both servers in the group and they are both green. I've set the distributed-cache setup to 2 in domain.xml, so it should be sharing session information: <distributed-cache name="sessions" owners="2"/> <distributed-cache name="authenticationSessions" owners="2"/> <distributed-cache name="offlineSessions" owners="2"/> <distributed-cache name="clientSessions" owners="2"/> <distributed-cache name="offlineClientSessions" owners="2"/> <distributed-cache name="loginFailures" owners="2"/> <distributed-cache name="actionTokens" owners="2"> Here is the logs on the master showing there a new cluster has been received: 2019-08-26 15:03:19,776 INFO [org.infinispan.CLUSTER] (MSC service thread 1-1) ISPN000094: Received new cluster view for channel ejb: [dev-master|0] (1) [dev-master] 2019-08-26 15:03:19,779 INFO [org.infinispan.CLUSTER] (MSC service thread 1-3) ISPN000094: Received new cluster view for channel ejb: [dev-master|0] (1) [dev-master] 2019-08-26 15:03:19,780 INFO [org.infinispan.CLUSTER] (MSC service thread 1-2) ISPN000094: Received new cluster view for channel ejb: [dev-master|0] (1) [dev-master] 2019-08-26 15:03:19,780 INFO [org.infinispan.CLUSTER] (MSC service thread 1-4) ISPN000094: Received new cluster view for channel ejb: [dev-master|0] (1) [dev-master] 2019-08-26 15:03:19,875 INFO [org.infinispan.CLUSTER] (MSC service thread 1-1) ISPN000094: Received new cluster view for channel ejb: [dev-master|0] (1) [dev-master] And on the slave: 2019-08-26 15:07:29,567 INFO [org.infinispan.CLUSTER] (MSC service thread 1-2) ISPN000094: Received new cluster view for channel ejb: [dev-slave1|0] (1) [dev-slave1] 2019-08-26 15:07:29,572 INFO [org.infinispan.CLUSTER] (MSC service thread 1-3) ISPN000094: Received new cluster view for channel ejb: [dev-slave1|0] (1) [dev-slave1] 2019-08-26 15:07:29,572 INFO [org.infinispan.CLUSTER] (MSC service thread 1-4) ISPN000094: Received new cluster view for channel ejb: [dev-slave1|0] (1) [dev-slave1] 2019-08-26 15:07:29,574 INFO [org.infinispan.CLUSTER] (MSC service thread 1-1) ISPN000094: Received new cluster view for channel ejb: [dev-slave1|0] (1) [dev-slave1] 2019-08-26 15:07:29,635 INFO [org.infinispan.CLUSTER] (MSC service thread 1-3) ISPN000094: Received new cluster view for channel ejb: [dev-slave1|0] (1) [dev-slave1] I believe I read somewhere that I was supposed to see the master and slave together in the logs an not just master or slave. Maybe this is my issue, but I don't know how to resolve it. I can't use multi-cast as it's disabled in AWS and almost all cloud providers. When I launch the master and let it come up, then launch the slave I can see all the traffic for the session on the master. As soon as I stop the master, the slave is looking for the master, but when I click on the website, it just hangs waiting for a connection and then eventually logs me out, and I end up logging back in, and now I'm on the slave node. The shared sessions are not happening. Is there something else I need to do or set? I have this setup in my domain.xml configuration as well: <server-group name="auth-server-group" profile="ha"> <jvm name="default"> <heap size="64m" max-size="512m"/> </jvm> <socket-binding-group ref="ha-sockets"/> <system-properties> <property name="jboss.cluster.tcp.initial_hosts" value="10.10.10.77[7600],10.10.10.27[7600]"/> </system-properties> </server-group> In my host.xml on the slave I have this setup to reach back to the master as the domain controller <domain-controller> <remote protocol="remote" host="${jboss.domain.master.address}" port="${jboss.domain.master.port:9999}" security-realm="ManagementRealm"/> </domain-controller> Any help would be appreciated

5 years, 4 months

2
6
0 / 0

Is there a LTS version of Keycloak

by Paul Edison

Hi, is there any version as LTS from Keycloak, that is meant to be uses for productive use? Or is there any strategy for long time usage of Keycloak? Kind Regards, Paul

5 years, 4 months

3
2
0 / 0

Log newly synced users form federated LDAP

by Paul Edison

Hi, I’m using a Keycloak with a LDAP federated as user source. The users should be synced manually. What I now would need is to know on a sync what users get newly synced to the Keycloak store and which are simply get updated. Is there a way and get it configured and logged to some logfiles or to the UI? Kind Regards, Paul

5 years, 4 months

3
2
0 / 0

Non-public version of keycloak?

by Paul Luk

In the redhat sso roadmap page, I found the redhat sso 7.3.3 is based on a keycloak of version 4.8.11...And I can't find those versions in keycloak.org and within... Is it means that there are non-public keycloak versions ? I need redhat subscription so as to use those versions? Best regards, Paul

5 years, 4 months

2
1
0 / 0

How to export Keycloak Data with second instance? Or should i use db tools?

by konphite＠mailbox.org

Hello together, iam relative new to keycloak. Iam reading the documentation of keycloak about import/export data. The documentation looks a little bit short to me and, honestly, it confused me why there are only few questions about this in the www. I hope some more experienced user can help me, because i think its a standard problem: I want to backup my keycloak Data. Whats the right way? Backup the data over the standalone.sh, or backup the whole postgredb via db tools? In my feeling, the import/export keycloak function over standalone.sh looks not like a real backup option, more like a "migration-tool" to migrate the data from one database to another. Am i wrong? If i using the standalone.sh, how i can backup my data while my instance is running? I cant stop they keycloak server in production for daily backups. I read in the mailing list, that is possible to run "a second instance" of Jboss on the same server, when i start the standalone.sh with other port binding (i.e : with -Djboss.socket.binding.port-offset=). But iam wondering: How can i stop this instance after the backup is done? Is this really best practice? Iam thanksfull for any help best regards Konphite

5 years, 4 months

2
1
0 / 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

keycloak-user August 2019