September 2019 - keycloak-user - Jboss List Archives

A newly added Hardcoded Role mapper ignores users that have already logged in before

by EXTERNAL Thiele Frank (TNG, INST-CSS/BSV-OS2)

Hello, In our project, we use the "Hardcoded role" mapper within a configured Identity Provider (also a Keycloak instance, in our case the same but a different realm) to describe that each user logging in via Keycloak shall be given a certain role. This works perfectly if the mapper is configured before the first login of the user. The configured role is granted to the (cloned) user when he logs in the first time via Keycloak. But when another "Hardcoded role" mapper is added to configure another role, then the user is not given the other role when he logs in. Only new users logging in the first time get both roles assigned. Is this on purpose or a bug? Mit freundlichen Grüßen / Best regards Frank Thiele Open Source Services 2 - Product Group Customer Success Services (INST-CSS/BSV-OS2) Bosch Software Innovations GmbH | Ullsteinstr. 128 | 12109 Berlin | GERMANY | www.bosch-si.com<http://www.bosch-si.com> external.Frank.Thiele(a)bosch-si.com<mailto:external.Frank.Thiele@bosch-si.com> Sitz: Berlin, Registergericht: Amtsgericht Charlottenburg; HRB 148411 B Aufsichtsratsvorsitzender: Dr.-Ing. Thorsten Lücke; Geschäftsführung: Dr. Stefan Ferber, Michael Hahn, Dr. Aleksandar Mitrovic

4 years, 8 months

1
0
0 / 0

app-authz-photoz: error 403

by Alex Rozenberg

Hello, I'm new to Keycloak and trying to follow the example in the keycloak-quickstarts: app-authz-photoz I've built and deployed photoz-html5-client and restful-api using the instruction in the Readme file. After I login using the specified credentials (alice or admin) I get error 403: You can not access or perform the requested operation on this resource Profile page does not display the name and I cannot create albums. Any clues or tips are greatly appreciated. Thank you in advance, Alex Rozenberg

4 years, 8 months

1
0
0 / 0

Encoded URL does not work as redirect_uri

by Edgar Vonk - INFO

Hi, I wondered: was there an update on this issue? I think we run into a similar issue when running the OWASP ZAP tool (https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project) on our Keycloak-enabled website. ZAP fires the following HTTP GET request on Keycloak: https://our-website.org/auth/realms/our-realm/protocol/openid-connect/aut...<https://our-website.org/auth/realms/our-realm/protocol/openid-connect/aut... &response_type=code&scope=openid&state=fd5a7f52433549218b76af0671956b8b&code_challenge=sSKuLzTeCeLEMXuaKVbp_ReHqYeTiI1LpTdzI6fdY7g&code_challenge_method=S256> Which results in a 500 HTTP response from Keycloak resulting in a medium-level security vulnerability according to ZAP: "Potential Format String Error. The script closed the connection on a /%s” (https://www.owasp.org/index.php/Format_string_attack)' Any suggestions on how to fix or work around this? In the Keycloak logs: 2019-09-16 10:07:20,286 ERROR [org.keycloak.services.error.KeycloakErrorHandler] (default task-7) Uncaught server error: java.lang.IllegalArgumentException: Invalid URL syntax: Malformed escape pair at index 3: ZAP%n%s%n%s%n%s%n%s%n%s%n%s%n%s%n%s%n%s%n%s%n%s%n%s%n%s%n%s%n%s%n%s%n%s%n%s%n%s%n%s at org.keycloak.protocol.oidc.utils.RedirectUtils.normalizeUrl(RedirectUtils.java:185) at org.keycloak.protocol.oidc.utils.RedirectUtils.verifyRedirectUri(RedirectUtils.java:83) at org.keycloak.protocol.oidc.utils.RedirectUtils.verifyRedirectUri(RedirectUtils.java:52) at org.keycloak.protocol.oidc.endpoints.AuthorizationEndpoint.checkRedirectUri(AuthorizationEndpoint.java:371) at org.keycloak.protocol.oidc.endpoints.AuthorizationEndpoint.process(AuthorizationEndpoint.java:120) at org.keycloak.protocol.oidc.endpoints.AuthorizationEndpoint.buildGet(AuthorizationEndpoint.java:108) at sun.reflect.GeneratedMethodAccessor573.invoke(Unknown Source) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.lang.reflect.Method.invoke(Method.java:498) at org.jboss.resteasy.core.MethodInjectorImpl.invoke(MethodInjectorImpl.java:140) at org.jboss.resteasy.core.ResourceMethodInvoker.internalInvokeOnTarget(ResourceMethodInvoker.java:509) at org.jboss.resteasy.core.ResourceMethodInvoker.invokeOnTargetAfterFilter(ResourceMethodInvoker.java:399) at org.jboss.resteasy.core.ResourceMethodInvoker.lambda$invokeOnTarget$0(ResourceMethodInvoker.java:363) at org.jboss.resteasy.core.interception.PreMatchContainerRequestContext.filter(PreMatchContainerRequestContext.java:358) at org.jboss.resteasy.core.ResourceMethodInvoker.invokeOnTarget(ResourceMethodInvoker.java:365) at org.jboss.resteasy.core.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:337) at org.jboss.resteasy.core.ResourceLocatorInvoker.invokeOnTargetObject(ResourceLocatorInvoker.java:137) at org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorInvoker.java:106) at org.jboss.resteasy.core.ResourceLocatorInvoker.invokeOnTargetObject(ResourceLocatorInvoker.java:132) at org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorInvoker.java:100) at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:443) at org.jboss.resteasy.core.SynchronousDispatcher.lambda$invoke$4(SynchronousDispatcher.java:233) at org.jboss.resteasy.core.SynchronousDispatcher.lambda$preprocess$0(SynchronousDispatcher.java:139) at org.jboss.resteasy.core.interception.PreMatchContainerRequestContext.filter(PreMatchContainerRequestContext.java:358) at org.jboss.resteasy.core.SynchronousDispatcher.preprocess(SynchronousDispatcher.java:142) at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:219) at org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.service(ServletContainerDispatcher.java:227) at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:56) at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:51) at javax.servlet.http.HttpServlet.service(HttpServlet.java:791) at io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:74) at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:129) at org.keycloak.services.filters.KeycloakSessionServletFilter.doFilter(KeycloakSessionServletFilter.java:90) at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61) at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131) at io.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.java:84) at io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:62) at io.undertow.servlet.handlers.ServletChain$1.handleRequest(ServletChain.java:68) at io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36) at org.wildfly.extension.undertow.security.SecurityContextAssociationHandler.handleRequest(SecurityContextAssociationHandler.java:78) at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) at io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:132) at io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:57) at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) at io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:46) at io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64) at io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:60) at io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:77) at io.undertow.security.handlers.NotificationReceiverHandler.handleRequest(NotificationReceiverHandler.java:50) at io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43) at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) at org.wildfly.extension.undertow.security.jacc.JACCContextIdHandler.handleRequest(JACCContextIdHandler.java:61) at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) at org.wildfly.extension.undertow.deployment.GlobalRequestControllerHandler.handleRequest(GlobalRequestControllerHandler.java:68) at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) at io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:292) at io.undertow.servlet.handlers.ServletInitialHandler.access$100(ServletInitialHandler.java:81) at io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:138) at io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:135) at io.undertow.servlet.core.ServletRequestContextThreadSetupAction$1.call(ServletRequestContextThreadSetupAction.java:48) at io.undertow.servlet.core.ContextClassLoaderSetupAction$1.call(ContextClassLoaderSetupAction.java:43) at org.wildfly.extension.undertow.security.SecurityContextThreadSetupAction.lambda$create$0(SecurityContextThreadSetupAction.java:105) at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502) at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502) at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502) at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502) at io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:272) at io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:81) at io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:104) at io.undertow.server.Connectors.executeRootHandler(Connectors.java:360) at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:830) at org.jboss.threads.ContextClassLoaderSavingRunnable.run(ContextClassLoaderSavingRunnable.java:35) at org.jboss.threads.EnhancedQueueExecutor.safeRun(EnhancedQueueExecutor.java:1985) at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.doRunTask(EnhancedQueueExecutor.java:1487) at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1378) at java.lang.Thread.run(Thread.java:748)

4 years, 8 months

1
1
0 / 0

API Gateway association

by Sylvain Malnuit

Hi, I want to associate Keycloak with an open source API Gateway. Have you any feedback? (Easy and level of integration, support of token revocation,...) Thxs, Sylvain

4 years, 8 months

1
0
0 / 0

Fwd: Metadata import error Keycloak V 7.0.0 - the file cannot be imported. Please verify the file

by abhijeet chauhan

Hi, I am trying to import SAML metadata while creating the Identity provider in Keycloak V7.0.0 and getting the error "Error the file cannot be imported. Please verify the file". Its two node standalone cluster deployed on docker . However importing same metadata from url working fine . Also I have local setup of keycloak (standalone) V7.0.0 and I can import the same metadata on that. Attaching the screenshot of error. Thanks, Vj

4 years, 8 months

1
0
0 / 0

keycloak docker image from minikube

by John Norris

Hi, I am trying to run keycloak from within minikube. This is minikube 1.31 running on Windows. Minikube is running a VM via Virtual Box. Here is my yaml file apiVersion: apps/v1 kind: Deployment metadata: name: keycloak labels: app: keycloak spec: replicas: 1 selector: matchLabels: app: keycloak template: metadata: labels: app: keycloak spec: containers: - name: keycloak image: jboss/keycloak env: - name: KEYCLOAK_USER value: "admin" - name: KEYCLOAK_PASSWORD value: "123456" ports: - containerPort: 8080 I have run other images and they work. But keycloak is killing minikube. So ... > kubectl get pods NAME READY STATUS RESTARTS AGE bikes-594d566c6d-65pdp 1/1 Running 0 14m bikes-594d566c6d-klbhw 1/1 Running 0 14m bikes-594d566c6d-qqppz 1/1 Running 0 14m keycloak-66d55fcc58-5ssj9 0/1 ContainerCreating 0 5m50s Several minutes later > kubectl get pods Unable to connect to the server: http2: server sent GOAWAY and closed the connection; LastStreamID=69, ErrCode=NO_ERROR, debug="" > minikube status host: Running kubelet: Running apiserver: Error kubectl: Correctly Configured: pointing to minikube-vm at 192.168.99.101 If I run keubctl logs keycloak-66d55fcc58-5ssj9 then there are no errors though the last entry is [0m [0m17:43:03,402 INFO [org.keycloak.connections.infinispan.DefaultInfinispanConnectionProviderFactory] (ServerService Thread Pool -- 63) Node name: keycloak-66d55fcc58-5ssj9, Site name: null *** JBossAS process (128) received KILL signal *** So I am not sure if the problem is from keycloak or from minikube. can anyone help? Regards, John

4 years, 8 months

2
1
0 / 0

SAML Identity broker audience restriction condition checking

by Georgi Matev

A couple of questions: 1. Is there a way to disable the audience restriction checking in SAML identity brokering? We have a use case where we have a SAML IdP that is able to accept requests from multiple URLs and we are trying to use it to federate access to several SPs backed by different Keycloak instances. Unfortunately the IdP is not able to change the AudienceRestriction attribute dynamically. If there is a way to disable the check in Keycloak that will unblock us. 1. Somewhat related, can a Keycloak SP process an assertion with an audience restriction that has multiple values? The problem at https://access.redhat.com/solutions/4177341 (can’t see the solution) seems to imply that there is an issue. Would test it myself but do not have a convenient way to set this up. Thanks, -Georgi

4 years, 8 months

1
0
0 / 0

Testing realm-mangement fine grain access control

by M Foster

Hello, I am testing Keycloak for deployment and one of the scenarios for adoption is the ability for some users to manage their own group membership. I've read through the Server Admin guide and it says that this functionality only available in a Technical Preview state. I've enabled the tech preview mode and have enabled Permissions for a group and now see the default scope names that appear under Groups > testgroup > Permissions (view, manage, view-membership, view-members, manage-members, manage-membership), which are part of the realm-management Authorization section. This also creates a group resource "group.resource.<goup_UUID>. I've created a User Policy for a single user and then attached that policy to the Keycloak created permission "manage.membership.permission.group.<group_UUID>" as well as the "group.resource.<group_UUID>. I've also assigned this test admin user the query-groups, query-users, and view-users realm-management client role, so in theory if this user logs into the realm admin console, they should see Groups and Users and be able to select a user and join them to the group in the realm on which I enabled permssions and set the policy. This all works, except the last bit: the "join" button is not visible in the group tab of a user that I'd like to add to my test group. Additionally, I can't manage the settings of any of the users. I have all six permissions assigned to that User Policy, but still no go. Any ideas what piece I'm missing? Thanks.

4 years, 8 months

1
1
0 / 0

Metadata import error Keycloak V 7.0.0 - the file cannot be imported. Please verify the file

by vijay

Hi, I am trying to import SAML metadata while creating the Identity provider in Keycloak V7.0.0 and getting the error "Error the file cannot be imported. Please verify the file". Its two node standalone cluster deployed on docker . However importing same metadata from url working fine . Also I have local setup of keycloak (standalone) V7.0.0 and I can import the same metadata on that. Attaching the screenshot of error. Thanks, Vj

4 years, 8 months

1
0
0 / 0

CORS issue - missing "allow origin" headers

by Louis JOHANET

Hi, We are currently facing the following issue : calling a protected client with AJAX fails with the following message : Access to XMLHttpRequest at 'http://localhost:8081/auth/realms/my_realm/protocol/openid-connect/auth?r...' (redirected from 'http://localhost:8080/my_client') from origin 'http://localhost:8080' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. Now this client uses the Java adapter, and does have a proper Web Origin (e.g. http://localhost:8080), which is indeed found in the access token. The keycloak.json also has enable-cors set to true. Indeed Keycloak's response is missing Access-Control-Allow-Origin headers. Adding Web Origins in the client configuration has no effect on the returned headers. I believe we need to add such headers in the Apache configuration, but I am surprised that this case did not come up in the docs since any client without a valid session receiving an AJAX request will cause the problem above, due to the 302 Redirect to Keycloak. Have you ever come across this issue ? Best regards, Louis Johanet

4 years, 8 months

1
0
0 / 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

keycloak-user September 2019