IIRC, if you're using the correct APIs (in Javascript or on the server side), the token will be automatically updated for you when you request it. On 1/7/2015 4:06 AM, Hubert Przybysz wrote: > Hi, > > My jee web application uses its bearer token when issuing AJAX requests > to other REST services within the realm (but at different origins). It > does it by reading the exposed bearer token prior to making an AJAX > request. Is there a mechanism by which the application may find out when > the bearer token is refreshed, to make it possible to read the bearer > token only when needed ? > > Br / Hubert. > > > _______________________________________________ > keycloak-user mailing list > keycloak-user(a)lists.jboss.org > https://lists.jboss.org/mailman/listinfo/keycloak-user > -- Bill Burke JBoss, a division of Red Hat http://bill.burkecentral.com _______________________________________________ keycloak-user mailing list keycloak-user(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/keycloak-user

You probably should not be using the k_query_bearer_token request. I'm thinking of removing it because it is vulnerable to CSRF attacks. Instead use keycloak.js for javascript apps. On 1/7/2015 9:29 AM, Hubert Przybysz wrote: > The token is indeed updated automatically when it is requested. I was > rather wondering if there was a way to not have to request it prior to > each AJAX request. Currently, since the application does not know when > the token expires, it has to either get it prior to each AJAX request, > or try to use a possibly stale token and request it again when it gets a > 401 from the REST service. It would be nice to get information about > token expiry together with the token in response to k_query_bearer_token > request. > > On Wed, Jan 7, 2015 at 3:11 PM, Bill Burke <bburke(a)redhat.com > <mailto:bburke@redhat.com>> wrote: > > IIRC, if you're using the correct APIs (in Javascript or on the server > side), the token will be automatically updated for you when you > request it. > > On 1/7/2015 4:06 AM, Hubert Przybysz wrote: > > Hi, > > > > My jee web application uses its bearer token when issuing AJAX > requests > > to other REST services within the realm (but at different > origins). It > > does it by reading the exposed bearer token prior to making an AJAX > > request. Is there a mechanism by which the application may find > out when > > the bearer token is refreshed, to make it possible to read the > bearer > > token only when needed ? > > > > Br / Hubert. > > > > > > _______________________________________________ > > keycloak-user mailing list > > keycloak-user(a)lists.jboss.org <mailto:keycloak-user@lists. > jboss.org> > > https://lists.jboss.org/mailman/listinfo/keycloak-user > > > > -- > Bill Burke > JBoss, a division of Red Hat > http://bill.burkecentral.com > _______________________________________________ > keycloak-user mailing list > keycloak-user(a)lists.jboss.org <mailto:keycloak-user@lists.jboss.org> > https://lists.jboss.org/mailman/listinfo/keycloak-user > > > -- Bill Burke JBoss, a division of Red Hat http://bill.burkecentral.com

If your server-side components are all REST-based, I suggest using bearer token auth for them and obtaining the token via the keycloak.js adapter. Again, k_query_bearer_token auth is vulnerable to CSRF right now. On 1/7/2015 5:25 PM, Hubert Przybysz wrote: > Thanks for the heads-up. I'll take a closer look at the javascript > adapter. > > FYI, I've found the k_query_bearer_token request quite useful for a web > app that uses a mix of server-side and javascript components. > > On Wed, Jan 7, 2015 at 4:00 PM, Bill Burke <bburke(a)redhat.com > <mailto:bburke@redhat.com>> wrote: > > You probably should not be using the k_query_bearer_token request. > I'm thinking of removing it because it is vulnerable to CSRF > attacks. Instead use keycloak.js for javascript apps. > > On 1/7/2015 9:29 AM, Hubert Przybysz wrote: > > The token is indeed updated automatically when it is requested. > I was > rather wondering if there was a way to not have to request it > prior to > each AJAX request. Currently, since the application does not > know when > the token expires, it has to either get it prior to each AJAX > request, > or try to use a possibly stale token and request it again when > it gets a > 401 from the REST service. It would be nice to get information > about > token expiry together with the token in response to > k_query_bearer_token > request. > > On Wed, Jan 7, 2015 at 3:11 PM, Bill Burke <bburke(a)redhat.com > <mailto:bburke@redhat.com> > <mailto:bburke@redhat.com <mailto:bburke@redhat.com>>> wrote: > > IIRC, if you're using the correct APIs (in Javascript or on > the server > side), the token will be automatically updated for you when > you > request it. > > On 1/7/2015 4:06 AM, Hubert Przybysz wrote: > > Hi, > > > > My jee web application uses its bearer token when > issuing AJAX > requests > > to other REST services within the realm (but at different > origins). It > > does it by reading the exposed bearer token prior to > making an AJAX > > request. Is there a mechanism by which the application > may find > out when > > the bearer token is refreshed, to make it possible to > read the bearer > > token only when needed ? > > > > Br / Hubert. > > > > > > _________________________________________________ > > keycloak-user mailing list > > keycloak-user(a)lists.jboss.org > <mailto:keycloak-user@lists.jboss.org> > <mailto:keycloak-user@lists.__jboss.org > <mailto:keycloak-user@lists.jboss.org>> > > https://lists.jboss.org/__mailman/listinfo/keycloak-user > <https://lists.jboss.org/mailman/listinfo/keycloak-user> > > > > -- > Bill Burke > JBoss, a division of Red Hat > http://bill.burkecentral.com > _________________________________________________ > keycloak-user mailing list > keycloak-user(a)lists.jboss.org > <mailto:keycloak-user@lists.jboss.org> > <mailto:keycloak-user@lists.__jboss.org > <mailto:keycloak-user@lists.jboss.org>> > https://lists.jboss.org/__mailman/listinfo/keycloak-user > <https://lists.jboss.org/mailman/listinfo/keycloak-user> > > > > -- > Bill Burke > JBoss, a division of Red Hat > http://bill.burkecentral.com > > > -- Bill Burke JBoss, a division of Red Hat http://bill.burkecentral.com

I want to use UTF-8 encoding in keycloak theme but I have problem with messages.properties file.

"is assumed to use the ISO 8859-1 character encoding; that is each byte is one Latin1 character. Characters not in Latin1, and certain special characters, are represented in keys and elements using Unicode escapes as defined in section 3.3 of The Java™ Language Specification."

From: "Peter Bardáč" <bardacp(a)gmail.com&gt; To: "Iván Perdomo" <ivan(a)akvo.org&gt; Cc: keycloak-user(a)lists.jboss.org Sent: Thursday, 8 January, 2015 4:08:57 PM Subject: Re: [keycloak-user] Template properties file encoding You are right now it works thanks. Dne 8.1.2015 v 15:15 Iván Perdomo napsal(a): > Hi, > > On Thu, 08 Jan 2015 14:41:13 +0100 > Peter Bardáč <bardacp(a)gmail.com&gt; wrote: > >> I want to use UTF-8 encoding in keycloak theme but I have problem >> with messages.properties file. > Java properties are expected to be encoded using "ISO 8859-1" > >> "is assumed to use the ISO 8859-1 character encoding; that is each >> byte is one Latin1 character. Characters not in Latin1, and certain >> special characters, are represented in keys and elements using Unicode >> escapes as defined in section 3.3 of The Java™ Language >> Specification." > http://docs.oracle.com/javase/7/docs/api/java/util/Properties.html#load%2... > > My five cents, > _______________________________________________ keycloak-user mailing list keycloak-user(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/keycloak-user

"is assumed to use the ISO 8859-1 character encoding; that is each byte is one Latin1 character. Characters not in Latin1, and certain special characters, are represented in keys and elements using Unicode escapes as defined in section 3.3 of The Java™ Language Specification."

I reckon all templates and properties files should be utf-8 so submit a bug and we'll fix ----- Original Message ----- > From: "Peter Bardáč" <bardacp(a)gmail.com&gt; > To: keycloak-user(a)lists.jboss.org > Sent: Thursday, 8 January, 2015 2:41:13 PM > Subject: [keycloak-user] Template properties file encoding > > Hi, > > I want to use UTF-8 encoding in keycloak theme but I have problem with > messages.properties file. > For example I have é symbol in this file but it translates into é (in > login.ftl there is ${rb.usernameOrEmail}). > > But when I type symbol é right into login.ftl file it renders with no > problem. So I assume there is problem with Freemarker <-> > messsages.properties file parsing. > > I have modified template.ftl file to use <meta http-equiv="Content-Type" > content="text/html; charset=utf-8" /> > > I also saved these files with UTF-8 encoding and also added > -Dfile.encoding=UTF-8 to JAVA_OPTS in standalone.conf > > At this moment I have no idea what else should I try please help. > > P.S. I would hardcode strings into login.ftl file but I cannot hardcode > string for invalid uname/passwd message. > > _______________________________________________ > keycloak-user mailing list > keycloak-user(a)lists.jboss.org > https://lists.jboss.org/mailman/listinfo/keycloak-user