2:28 a.m.
I am referring to Keycloak Javascript adapter as mentioned in :
https://www.keycloak.org/docs/4.5/securing_apps/index.html#_javascript_ad...
I have a confidential client and I have downloaded keycloak-oidc.json
containing client secret. Now I am not sure how secure is it to keep this
file containing client-secret at the client side.
Am I being over concerned?
10:32 a.m.
I believe you're missing an important step from the docs. The docs
state that Javascript clients should be configured as public clients.
I don't think it's a good idea to store client secret into web apps,
it's really unsafe.
On Fri, Nov 2, 2018 at 4:28 AM Bruce Wings <testoauth55(a)gmail.com> wrote:
I am referring to Keycloak Javascript adapter as mentioned in :
https://www.keycloak.org/docs/4.5/securing_apps/index.html#_javascript_ad...
I have a confidential client and I have downloaded keycloak-oidc.json
containing client secret. Now I am not sure how secure is it to keep this
file containing client-secret at the client side.
Am I being over concerned?
_______________________________________________
keycloak-user mailing list
keycloak-user(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user
--
- abstractj
11:43 a.m.
Bruno,
Thanks for the reply. However, my project contains Rest Apis that I have
secured with jetty adapter and confidential client ( as keycloak
Authorization works only for confidential client and not public clients).
My angular app is accessing these rest api. Therefore I used the same
confidential client oidc Json in my angular app too.
Am I approaching the keycloak setup in a wrong way?
On Friday, November 2, 2018, Bruno Oliveira <bruno(a)abstractj.org> wrote:
I believe you're missing an important step from the docs. The
docs
state that Javascript clients should be configured as public clients.
I don't think it's a good idea to store client secret into web apps,
it's really unsafe.
On Fri, Nov 2, 2018 at 4:28 AM Bruce Wings <testoauth55(a)gmail.com> wrote:
>
> I am referring to Keycloak Javascript adapter as mentioned in :
> https://www.keycloak.org/docs/4.5/securing_apps/index.html#_
javascript_adapter
>
> I have a confidential client and I have downloaded keycloak-oidc.json
> containing client secret. Now I am not sure how secure is it to keep this
> file containing client-secret at the client side.
>
> Am I being over concerned?
> _______________________________________________
> keycloak-user mailing list
> keycloak-user(a)lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
--
- abstractj
11:51 a.m.
Hi Bruce,
I am fairly new to Keycloak myself, so I am giving my opinion in hopes some else can
double check.
The JS adapter is designed to work with Public clients, siting on the the client side, the
idea is that the a user/person would have to enter his/her credentials to in order to
login.
Confidential clients generate an installation JSON or XML configuration object which is
meant to be installed on the server side/ Application server. The user accessing this
application does not receive this configuration.
Hope this helps.
On Nov 2, 2018, at 1:28 AM, Bruce Wings <testoauth55(a)gmail.com>
wrote:
I am referring to Keycloak Javascript adapter as mentioned in :
https://www.keycloak.org/docs/4.5/securing_apps/index.html#_javascript_ad...
I have a confidential client and I have downloaded keycloak-oidc.json
containing client secret. Now I am not sure how secure is it to keep this
file containing client-secret at the client side.
Am I being over concerned?
_______________________________________________
keycloak-user mailing list
keycloak-user(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user
7:33 p.m.
Thanks Eric for the reply.
But If I use a separate public client for my angular app, I am not able to
access my Rest Api with the generated token, that's why I had to use
confidential client Json that I used to secure my server. Any idea, what is
the right approach in case of server client architecture?
( My project contains Rest Apis that I have secured with jetty adapter and
confidential client ( as keycloak Authorization works only for confidential
client and not public clients). My angular app is accessing these rest api.
Therefore I used the same confidential client oidc Json in my angular app
too. )
On Friday, November 2, 2018, Eric Boyd Ramirez <eric.ramirez.sv(a)gmail.com>
wrote:
Hi Bruce,
I am fairly new to Keycloak myself, so I am giving my opinion in hopes
some else can double check.
The JS adapter is designed to work with Public clients, siting on the the
client side, the idea is that the a user/person would have to enter his/her
credentials to in order to login.
Confidential clients generate an installation JSON or XML configuration
object which is meant to be installed on the server side/ Application
server. The user accessing this application does not receive this
configuration.
Hope this helps.
> On Nov 2, 2018, at 1:28 AM, Bruce Wings <testoauth55(a)gmail.com> wrote:
>
> I am referring to Keycloak Javascript adapter as mentioned in :
> https://www.keycloak.org/docs/4.5/securing_apps/index.html#_
javascript_adapter
>
> I have a confidential client and I have downloaded keycloak-oidc.json
> containing client secret. Now I am not sure how secure is it to keep this
> file containing client-secret at the client side.
>
> Am I being over concerned?
> _______________________________________________
> keycloak-user mailing list
> keycloak-user(a)lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
3:06 a.m.
Bruce, here's how I fixed the issue you're describing. I think it's a
unfortunate omission in the docs (which are generally quite good). You need
to include the backend client ID in the front end clients aud claim.
https://bitbucket.org/snippets/gcleaves/5ebB58/sso-keycloak
On Sat, Nov 3, 2018, 01:45 Bruce Wings <testoauth55(a)gmail.com wrote:
Thanks Eric for the reply.
But If I use a separate public client for my angular app, I am not able to
access my Rest Api with the generated token, that's why I had to use
confidential client Json that I used to secure my server. Any idea, what is
the right approach in case of server client architecture?
( My project contains Rest Apis that I have secured with jetty adapter and
confidential client ( as keycloak Authorization works only for confidential
client and not public clients). My angular app is accessing these rest api.
Therefore I used the same confidential client oidc Json in my angular app
too. )
On Friday, November 2, 2018, Eric Boyd Ramirez <eric.ramirez.sv(a)gmail.com>
wrote:
> Hi Bruce,
> I am fairly new to Keycloak myself, so I am giving my opinion in hopes
> some else can double check.
> The JS adapter is designed to work with Public clients, siting on the the
> client side, the idea is that the a user/person would have to enter
his/her
> credentials to in order to login.
>
> Confidential clients generate an installation JSON or XML configuration
> object which is meant to be installed on the server side/ Application
> server. The user accessing this application does not receive this
> configuration.
>
> Hope this helps.
>
> > On Nov 2, 2018, at 1:28 AM, Bruce Wings <testoauth55(a)gmail.com> wrote:
> >
> > I am referring to Keycloak Javascript adapter as mentioned in :
> > https://www.keycloak.org/docs/4.5/securing_apps/index.html#_
> javascript_adapter
> >
> > I have a confidential client and I have downloaded keycloak-oidc.json
> > containing client secret. Now I am not sure how secure is it to keep
this
> > file containing client-secret at the client side.
> >
> > Am I being over concerned?
> > _______________________________________________
> > keycloak-user mailing list
> > keycloak-user(a)lists.jboss.org
> > https://lists.jboss.org/mailman/listinfo/keycloak-user
>
>
_______________________________________________
keycloak-user mailing list
keycloak-user(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user
8:58 a.m.
Hi Bruce, further to Geoffrey's reply this example should get you started:
https://github.com/keycloak/keycloak-quickstarts/tree/latest/app-authz-re...
On Nov 3, 2018, at 2:06 AM, Geoffrey Cleaves <geoff(a)opticks.io>
wrote:
Bruce, here's how I fixed the issue you're describing. I think it's a
unfortunate omission in the docs (which are generally quite good). You need to include the
backend client ID in the front end clients aud claim.
https://bitbucket.org/snippets/gcleaves/5ebB58/sso-keycloak
<https://bitbucket.org/snippets/gcleaves/5ebB58/sso-keycloak>
On Sat, Nov 3, 2018, 01:45 Bruce Wings <testoauth55(a)gmail.com
<mailto:testoauth55@gmail.com> wrote:
Thanks Eric for the reply.
But If I use a separate public client for my angular app, I am not able to
access my Rest Api with the generated token, that's why I had to use
confidential client Json that I used to secure my server. Any idea, what is
the right approach in case of server client architecture?
( My project contains Rest Apis that I have secured with jetty adapter and
confidential client ( as keycloak Authorization works only for confidential
client and not public clients). My angular app is accessing these rest api.
Therefore I used the same confidential client oidc Json in my angular app
too. )
On Friday, November 2, 2018, Eric Boyd Ramirez <eric.ramirez.sv(a)gmail.com
<mailto:eric.ramirez.sv@gmail.com>>
wrote:
> Hi Bruce,
> I am fairly new to Keycloak myself, so I am giving my opinion in hopes
> some else can double check.
> The JS adapter is designed to work with Public clients, siting on the the
> client side, the idea is that the a user/person would have to enter his/her
> credentials to in order to login.
>
> Confidential clients generate an installation JSON or XML configuration
> object which is meant to be installed on the server side/ Application
> server. The user accessing this application does not receive this
> configuration.
>
> Hope this helps.
>
> > On Nov 2, 2018, at 1:28 AM, Bruce Wings <testoauth55(a)gmail.com
<mailto:testoauth55@gmail.com>> wrote:
> >
> > I am referring to Keycloak Javascript adapter as mentioned in :
> > https://www.keycloak.org/docs/4.5/securing_apps/index.html#_
<https://www.keycloak.org/docs/4.5/securing_apps/index.html#_>
> javascript_adapter
> >
> > I have a confidential client and I have downloaded keycloak-oidc.json
> > containing client secret. Now I am not sure how secure is it to keep this
> > file containing client-secret at the client side.
> >
> > Am I being over concerned?
> > _______________________________________________
> > keycloak-user mailing list
> > keycloak-user(a)lists.jboss.org <mailto:keycloak-user@lists.jboss.org>
> > https://lists.jboss.org/mailman/listinfo/keycloak-user
<https://lists.jboss.org/mailman/listinfo/keycloak-user>
>
>
_______________________________________________
keycloak-user mailing list
keycloak-user(a)lists.jboss.org <mailto:keycloak-user@lists.jboss.org>
https://lists.jboss.org/mailman/listinfo/keycloak-user
<https://lists.jboss.org/mailman/listinfo/keycloak-user>
11:41 a.m.
Thanks Geoffrey,
I believe this will solve my problem. However, I tried creating the mapper,
but maybe I missed something cause I am still getting 401 if I login with
front end.
In the attached image, I have shared my config, can you give it a quick
look and confirm this is how it is supposed to be?
Name of my backend client in keycloak JettyApp:
I have created Token claim name as - clientId and value as JettyApp.
[image: image.png]
On Sat, Nov 3, 2018 at 1:36 PM Geoffrey Cleaves <geoff(a)opticks.io> wrote:
Bruce, here's how I fixed the issue you're describing. I
think it's a
unfortunate omission in the docs (which are generally quite good). You need
to include the backend client ID in the front end clients aud claim.
https://bitbucket.org/snippets/gcleaves/5ebB58/sso-keycloak
On Sat, Nov 3, 2018, 01:45 Bruce Wings <testoauth55(a)gmail.com wrote:
> Thanks Eric for the reply.
>
> But If I use a separate public client for my angular app, I am not able to
> access my Rest Api with the generated token, that's why I had to use
> confidential client Json that I used to secure my server. Any idea, what
> is
> the right approach in case of server client architecture?
>
> ( My project contains Rest Apis that I have secured with jetty adapter
> and
> confidential client ( as keycloak Authorization works only for
> confidential
> client and not public clients). My angular app is accessing these rest
> api.
> Therefore I used the same confidential client oidc Json in my angular app
> too. )
>
>
>
> On Friday, November 2, 2018, Eric Boyd Ramirez <eric.ramirez.sv(a)gmail.com
> >
> wrote:
>
> > Hi Bruce,
> > I am fairly new to Keycloak myself, so I am giving my opinion in hopes
> > some else can double check.
> > The JS adapter is designed to work with Public clients, siting on the
> the
> > client side, the idea is that the a user/person would have to enter
> his/her
> > credentials to in order to login.
> >
> > Confidential clients generate an installation JSON or XML configuration
> > object which is meant to be installed on the server side/ Application
> > server. The user accessing this application does not receive this
> > configuration.
> >
> > Hope this helps.
> >
> > > On Nov 2, 2018, at 1:28 AM, Bruce Wings <testoauth55(a)gmail.com>
> wrote:
> > >
> > > I am referring to Keycloak Javascript adapter as mentioned in :
> > > https://www.keycloak.org/docs/4.5/securing_apps/index.html#_
> > javascript_adapter
> > >
> > > I have a confidential client and I have downloaded keycloak-oidc.json
> > > containing client secret. Now I am not sure how secure is it to keep
> this
> > > file containing client-secret at the client side.
> > >
> > > Am I being over concerned?
> > > _______________________________________________
> > > keycloak-user mailing list
> > > keycloak-user(a)lists.jboss.org
> > > https://lists.jboss.org/mailman/listinfo/keycloak-user
> >
> >
> _______________________________________________
> keycloak-user mailing list
> keycloak-user(a)lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
noon
Geoffrey,
I was able to get the config right. I have received the aud:JettyApp in
generated token also, but I still get 401:Unauthorized for the backend app.
Anything else needs to be done?
Token (Partial):
"jti": "b7b07046-5417-40d6-9338-1851a0f5e1e5",
"exp": 1541292863,
"nbf": 0,
"iat": 1541264063,
"iss": "http://localhost:7200/auth/realms/MyRealm",
*"aud": "JettyApp",*
"sub": "c801fc43-e7d3-4229-869c-cef19d049389",
"typ": "Bearer",
"azp": "Webapps",
"nonce": "3ec36116-c8a3-482c-828e-6458ad179270",
"auth_time": 1541264063,
"session_state": "0b40b785-6956-4234-bcb5-96ff8fdcb822",
"acr": "1",
[image: image.png]
On Sat, Nov 3, 2018 at 10:11 PM Bruce Wings <testoauth55(a)gmail.com> wrote:
Thanks Geoffrey,
I believe this will solve my problem. However, I tried creating the
mapper, but maybe I missed something cause I am still getting 401 if I
login with front end.
In the attached image, I have shared my config, can you give it a quick
look and confirm this is how it is supposed to be?
Name of my backend client in keycloak JettyApp:
I have created Token claim name as - clientId and value as JettyApp.
[image: image.png]
On Sat, Nov 3, 2018 at 1:36 PM Geoffrey Cleaves <geoff(a)opticks.io> wrote:
> Bruce, here's how I fixed the issue you're describing. I think it's a
> unfortunate omission in the docs (which are generally quite good). You need
> to include the backend client ID in the front end clients aud claim.
>
> https://bitbucket.org/snippets/gcleaves/5ebB58/sso-keycloak
>
> On Sat, Nov 3, 2018, 01:45 Bruce Wings <testoauth55(a)gmail.com wrote:
>
>> Thanks Eric for the reply.
>>
>> But If I use a separate public client for my angular app, I am not able
>> to
>> access my Rest Api with the generated token, that's why I had to use
>> confidential client Json that I used to secure my server. Any idea, what
>> is
>> the right approach in case of server client architecture?
>>
>> ( My project contains Rest Apis that I have secured with jetty adapter
>> and
>> confidential client ( as keycloak Authorization works only for
>> confidential
>> client and not public clients). My angular app is accessing these rest
>> api.
>> Therefore I used the same confidential client oidc Json in my angular app
>> too. )
>>
>>
>>
>> On Friday, November 2, 2018, Eric Boyd Ramirez <
>> eric.ramirez.sv(a)gmail.com>
>> wrote:
>>
>> > Hi Bruce,
>> > I am fairly new to Keycloak myself, so I am giving my opinion in hopes
>> > some else can double check.
>> > The JS adapter is designed to work with Public clients, siting on the
>> the
>> > client side, the idea is that the a user/person would have to enter
>> his/her
>> > credentials to in order to login.
>> >
>> > Confidential clients generate an installation JSON or XML configuration
>> > object which is meant to be installed on the server side/ Application
>> > server. The user accessing this application does not receive this
>> > configuration.
>> >
>> > Hope this helps.
>> >
>> > > On Nov 2, 2018, at 1:28 AM, Bruce Wings <testoauth55(a)gmail.com>
>> wrote:
>> > >
>> > > I am referring to Keycloak Javascript adapter as mentioned in :
>> > > https://www.keycloak.org/docs/4.5/securing_apps/index.html#_
>> > javascript_adapter
>> > >
>> > > I have a confidential client and I have downloaded keycloak-oidc.json
>> > > containing client secret. Now I am not sure how secure is it to keep
>> this
>> > > file containing client-secret at the client side.
>> > >
>> > > Am I being over concerned?
>> > > _______________________________________________
>> > > keycloak-user mailing list
>> > > keycloak-user(a)lists.jboss.org
>> > > https://lists.jboss.org/mailman/listinfo/keycloak-user
>> >
>> >
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user(a)lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>
>
11:16 p.m.
The solution that worked for me was suggested by Jim Talbut <
jtalbut(a)spudsoft.co.uk>. He was unable to post on the mailing list, so
posting on his behalf.
You need to create a ScriptMapper because it lets you put multiple values,
so you can use that to overwrite the aud with both the desired values. In
below example, JettyApp is my confidential client and Webapp is public
client.
- Protocol: openid-connect
- Name: aud
- Mapper Type: Script Mapper
- Script: new java.util.ArrayList(["Jettyapp","Webapp"]);
- Multivalued: ON
- Token Claim Name: aud
- Claim JSON Type: String
On Sat, Nov 3, 2018 at 10:30 PM Bruce Wings <testoauth55(a)gmail.com> wrote:
Geoffrey,
I was able to get the config right. I have received the aud:JettyApp in
generated token also, but I still get 401:Unauthorized for the backend app.
Anything else needs to be done?
Token (Partial):
"jti": "b7b07046-5417-40d6-9338-1851a0f5e1e5",
"exp": 1541292863,
"nbf": 0,
"iat": 1541264063,
"iss": "http://localhost:7200/auth/realms/MyRealm",
*"aud": "JettyApp",*
"sub": "c801fc43-e7d3-4229-869c-cef19d049389",
"typ": "Bearer",
"azp": "Webapps",
"nonce": "3ec36116-c8a3-482c-828e-6458ad179270",
"auth_time": 1541264063,
"session_state": "0b40b785-6956-4234-bcb5-96ff8fdcb822",
"acr": "1",
[image: image.png]
On Sat, Nov 3, 2018 at 10:11 PM Bruce Wings <testoauth55(a)gmail.com> wrote:
> Thanks Geoffrey,
>
> I believe this will solve my problem. However, I tried creating the
> mapper, but maybe I missed something cause I am still getting 401 if I
> login with front end.
>
> In the attached image, I have shared my config, can you give it a quick
> look and confirm this is how it is supposed to be?
>
> Name of my backend client in keycloak JettyApp:
>
> I have created Token claim name as - clientId and value as JettyApp.
>
>
> [image: image.png]
>
>
> On Sat, Nov 3, 2018 at 1:36 PM Geoffrey Cleaves <geoff(a)opticks.io> wrote:
>
>> Bruce, here's how I fixed the issue you're describing. I think it's
a
>> unfortunate omission in the docs (which are generally quite good). You need
>> to include the backend client ID in the front end clients aud claim.
>>
>> https://bitbucket.org/snippets/gcleaves/5ebB58/sso-keycloak
>>
>> On Sat, Nov 3, 2018, 01:45 Bruce Wings <testoauth55(a)gmail.com wrote:
>>
>>> Thanks Eric for the reply.
>>>
>>> But If I use a separate public client for my angular app, I am not able
>>> to
>>> access my Rest Api with the generated token, that's why I had to use
>>> confidential client Json that I used to secure my server. Any idea,
>>> what is
>>> the right approach in case of server client architecture?
>>>
>>> ( My project contains Rest Apis that I have secured with jetty adapter
>>> and
>>> confidential client ( as keycloak Authorization works only for
>>> confidential
>>> client and not public clients). My angular app is accessing these rest
>>> api.
>>> Therefore I used the same confidential client oidc Json in my angular
>>> app
>>> too. )
>>>
>>>
>>>
>>> On Friday, November 2, 2018, Eric Boyd Ramirez <
>>> eric.ramirez.sv(a)gmail.com>
>>> wrote:
>>>
>>> > Hi Bruce,
>>> > I am fairly new to Keycloak myself, so I am giving my opinion in hopes
>>> > some else can double check.
>>> > The JS adapter is designed to work with Public clients, siting on the
>>> the
>>> > client side, the idea is that the a user/person would have to enter
>>> his/her
>>> > credentials to in order to login.
>>> >
>>> > Confidential clients generate an installation JSON or XML
>>> configuration
>>> > object which is meant to be installed on the server side/ Application
>>> > server. The user accessing this application does not receive this
>>> > configuration.
>>> >
>>> > Hope this helps.
>>> >
>>> > > On Nov 2, 2018, at 1:28 AM, Bruce Wings
<testoauth55(a)gmail.com>
>>> wrote:
>>> > >
>>> > > I am referring to Keycloak Javascript adapter as mentioned in :
>>> > > https://www.keycloak.org/docs/4.5/securing_apps/index.html#_
>>> > javascript_adapter
>>> > >
>>> > > I have a confidential client and I have downloaded
>>> keycloak-oidc.json
>>> > > containing client secret. Now I am not sure how secure is it to
>>> keep this
>>> > > file containing client-secret at the client side.
>>> > >
>>> > > Am I being over concerned?
>>> > > _______________________________________________
>>> > > keycloak-user mailing list
>>> > > keycloak-user(a)lists.jboss.org
>>> > > https://lists.jboss.org/mailman/listinfo/keycloak-user
>>> >
>>> >
>>> _______________________________________________
>>> keycloak-user mailing list
>>> keycloak-user(a)lists.jboss.org
>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>
>>
2726
days inactive
2736
days old
9 comments
4 participants
participants (4)
-
Bruce Wings -
Bruno Oliveira -
Eric Boyd Ramirez -
Geoffrey Cleaves