10:16 a.m.
Hi,
We are examining KeyCloak (It looks like it can do what we want), but we have the need
to have an external lookup of accounts who are not in KeyCloak in an external database
which is accessible via a REST call. I know about federation, but would prefer to only
check the external datasource if the user is not in KeyCloak, but from then on have all
the data “live” in KeyCloak and never refer to the external datasource again once the
account is “migrated” into KeyCloak.
Can this be done with some modification of federation?
We do not want to add the user accounts directly into KeyCloak as there are many more
there than will ever be in KeyCloak.
Thank you,
Reed Lewis
11:06 a.m.
Hello Reed,
as you already wrote, you can write a federation provider that queries your
backend service via REST for user data.
Within the federation provider you can then import the user data
returned from the REST call.
This would work as follows - within the method:
org.keycloak.models.UserFederationProvider.getUserByUsername(RealmModel,
String)
you call your backend REST service.
As a next step you create a new user with the given username
UserModel keycloakUser = session.userStorage().addUser(realm, username);
Then you copy all the user data from your backend into Keycloak's UserModel.
After that your backend user has a corresponding representation in Keycloak
with a reference to this federation provider (id) via the
"userModel.federationLink" property.
The federation link will also be shown in the user page in the keycloak
admin console.
As long as the federation link is in place keycloak will ask the federation
provider
for the latest user data. Once you decide to cut the link to the federation
provider you can
simply do userModel.setFederationLink(null). You could basically cut (or
rather omit) the federation
link right after you added the user to Keycloak.
Keycloak has no link information after that anymore and it will only use
the user data stored
in the Keycloak database for that particular user.
You also have the option to do that for all your users via:
org.keycloak.models.UserFederationProviderFactory.syncAllUsers(KeycloakSessionFactory,
String, UserFederationProviderModel)
or just use on demand per User when he / she want's to login for the first
time.
Cheers,
Thomas
2016-01-15 16:16 GMT+01:00 Reed Lewis <RLewis(a)carbonite.com>:
Hi,
We are examining KeyCloak (It looks like it can do what we want), but
we have the need to have an external lookup of accounts who are not in
KeyCloak in an external database which is accessible via a REST call. I
know about federation, but would prefer to only check the external
datasource if the user is not in KeyCloak, but from then on have all the
data “live” in KeyCloak and never refer to the external datasource again
once the account is “migrated” into KeyCloak.
Can this be done with some modification of federation?
We do not want to add the user accounts directly into KeyCloak as there
are many more there than will ever be in KeyCloak.
Thank you,
Reed Lewis
_______________________________________________
keycloak-user mailing list
keycloak-user(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user
1:44 p.m.
Thank you. This is exactly what I was looking for.
Reed
From: Thomas Darimont
<thomas.darimont@googlemail.com<mailto:thomas.darimont@googlemail.com>>
Date: Friday, January 15, 2016 at 11:06 AM
To: Reed Lewis <RLewis@carbonite.com<mailto:RLewis@carbonite.com>>
Cc: "keycloak-user@lists.jboss.org<mailto:keycloak-user@lists.jboss.org>"
<keycloak-user@lists.jboss.org<mailto:keycloak-user@lists.jboss.org>>
Subject: Re: [keycloak-user] External Username, Password, Email... dataset with Keycloak
Hello Reed,
as you already wrote, you can write a federation provider that queries your
backend service via REST for user data.
Within the federation provider you can then import the user data
returned from the REST call.
This would work as follows - within the method:
org.keycloak.models.UserFederationProvider.getUserByUsername(RealmModel, String)
you call your backend REST service.
As a next step you create a new user with the given username
UserModel keycloakUser = session.userStorage().addUser(realm, username);
Then you copy all the user data from your backend into Keycloak's UserModel.
After that your backend user has a corresponding representation in Keycloak
with a reference to this federation provider (id) via the
"userModel.federationLink" property.
The federation link will also be shown in the user page in the keycloak admin console.
As long as the federation link is in place keycloak will ask the federation provider
for the latest user data. Once you decide to cut the link to the federation provider you
can
simply do userModel.setFederationLink(null). You could basically cut (or rather omit) the
federation
link right after you added the user to Keycloak.
Keycloak has no link information after that anymore and it will only use the user data
stored
in the Keycloak database for that particular user.
You also have the option to do that for all your users via:
org.keycloak.models.UserFederationProviderFactory.syncAllUsers(KeycloakSessionFactory,
String, UserFederationProviderModel)
or just use on demand per User when he / she want's to login for the first time.
Cheers,
Thomas
2016-01-15 16:16 GMT+01:00 Reed Lewis
<RLewis@carbonite.com<mailto:RLewis@carbonite.com>>:
Hi,
We are examining KeyCloak (It looks like it can do what we want), but we have the need
to have an external lookup of accounts who are not in KeyCloak in an external database
which is accessible via a REST call. I know about federation, but would prefer to only
check the external datasource if the user is not in KeyCloak, but from then on have all
the data “live” in KeyCloak and never refer to the external datasource again once the
account is “migrated” into KeyCloak.
Can this be done with some modification of federation?
We do not want to add the user accounts directly into KeyCloak as there are many more
there than will ever be in KeyCloak.
Thank you,
Reed Lewis
_______________________________________________
keycloak-user mailing list
keycloak-user@lists.jboss.org<mailto:keycloak-user@lists.jboss.org>
https://lists.jboss.org/mailman/listinfo/keycloak-user
4:42 p.m.
We just put up and blog post[0] and some sample code[1] on how to do this type of
migration.
[0]: http://tech.smartling.com/migrate-to-keycloak-with-zero-downtime/
[1]: https://github.com/Smartling/keycloak-user-migration-provider
Scott Rossillo
Smartling | Senior Software Engineer
srossillo(a)smartling.com
<https://app.sigstr.com/uc/55e5d41c6533390d03580000>
<http://www.sigstr.com/>
On Jan 15, 2016, at 11:06 AM, Thomas Darimont
<thomas.darimont(a)googlemail.com> wrote:
Hello Reed,
as you already wrote, you can write a federation provider that queries your
backend service via REST for user data.
Within the federation provider you can then import the user data
returned from the REST call.
This would work as follows - within the method:
org.keycloak.models.UserFederationProvider.getUserByUsername(RealmModel, String)
you call your backend REST service.
As a next step you create a new user with the given username
UserModel keycloakUser = session.userStorage().addUser(realm, username);
Then you copy all the user data from your backend into Keycloak's UserModel.
After that your backend user has a corresponding representation in Keycloak
with a reference to this federation provider (id) via the
"userModel.federationLink" property.
The federation link will also be shown in the user page in the keycloak admin console.
As long as the federation link is in place keycloak will ask the federation provider
for the latest user data. Once you decide to cut the link to the federation provider you
can
simply do userModel.setFederationLink(null). You could basically cut (or rather omit) the
federation
link right after you added the user to Keycloak.
Keycloak has no link information after that anymore and it will only use the user data
stored
in the Keycloak database for that particular user.
You also have the option to do that for all your users via:
org.keycloak.models.UserFederationProviderFactory.syncAllUsers(KeycloakSessionFactory,
String, UserFederationProviderModel)
or just use on demand per User when he / she want's to login for the first time.
Cheers,
Thomas
2016-01-15 16:16 GMT+01:00 Reed Lewis <RLewis(a)carbonite.com
<mailto:RLewis@carbonite.com>>:
Hi,
We are examining KeyCloak (It looks like it can do what we want), but we have the need
to have an external lookup of accounts who are not in KeyCloak in an external database
which is accessible via a REST call. I know about federation, but would prefer to only
check the external datasource if the user is not in KeyCloak, but from then on have all
the data “live” in KeyCloak and never refer to the external datasource again once the
account is “migrated” into KeyCloak.
Can this be done with some modification of federation?
We do not want to add the user accounts directly into KeyCloak as there are many more
there than will ever be in KeyCloak.
Thank you,
Reed Lewis
_______________________________________________
keycloak-user mailing list
keycloak-user(a)lists.jboss.org <mailto:keycloak-user@lists.jboss.org>
https://lists.jboss.org/mailman/listinfo/keycloak-user
<https://lists.jboss.org/mailman/listinfo/keycloak-user>
_______________________________________________
keycloak-user mailing list
keycloak-user(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user
12:34 p.m.
This is working for me now. I created a service that listens on a port and implements the
GET, HEAD and POST requests that are being made.
The one issue now is that integration with other Identity providers does not work now
since it still calls my server with the username from the external provider. How can I
tell Keycloak that when a user comes from an external Identity provider not to check the
user Federation provider?
Thank you,
Reed Lewis
From: Scott Rossillo
<srossillo@smartling.com<mailto:srossillo@smartling.com>>
Date: Friday, January 15, 2016 at 4:42 PM
To: Thomas Darimont
<thomas.darimont@googlemail.com<mailto:thomas.darimont@googlemail.com>>, Reed
Lewis <RLewis@carbonite.com<mailto:RLewis@carbonite.com>>
Cc: "keycloak-user@lists.jboss.org<mailto:keycloak-user@lists.jboss.org>"
<keycloak-user@lists.jboss.org<mailto:keycloak-user@lists.jboss.org>>
Subject: Re: [keycloak-user] External Username, Password, Email... dataset with Keycloak
We just put up and blog post[0] and some sample code[1] on how to do this type of
migration.
[0]: http://tech.smartling.com/migrate-to-keycloak-with-zero-downtime/
[1]: https://github.com/Smartling/keycloak-user-migration-provider
Scott Rossillo
Smartling | Senior Software Engineer
srossillo@smartling.com<mailto:srossillo@smartling.com>
[Latest News + Events]<https://app.sigstr.com/uc/55e5d41c6533390d03580000>
[Powered by Sigstr]<http://www.sigstr.com/>
On Jan 15, 2016, at 11:06 AM, Thomas Darimont
<thomas.darimont@googlemail.com<mailto:thomas.darimont@googlemail.com>>
wrote:
Hello Reed,
as you already wrote, you can write a federation provider that queries your
backend service via REST for user data.
Within the federation provider you can then import the user data
returned from the REST call.
This would work as follows - within the method:
org.keycloak.models.UserFederationProvider.getUserByUsername(RealmModel, String)
you call your backend REST service.
As a next step you create a new user with the given username
UserModel keycloakUser = session.userStorage().addUser(realm, username);
Then you copy all the user data from your backend into Keycloak's UserModel.
After that your backend user has a corresponding representation in Keycloak
with a reference to this federation provider (id) via the
"userModel.federationLink" property.
The federation link will also be shown in the user page in the keycloak admin console.
As long as the federation link is in place keycloak will ask the federation provider
for the latest user data. Once you decide to cut the link to the federation provider you
can
simply do userModel.setFederationLink(null). You could basically cut (or rather omit) the
federation
link right after you added the user to Keycloak.
Keycloak has no link information after that anymore and it will only use the user data
stored
in the Keycloak database for that particular user.
You also have the option to do that for all your users via:
org.keycloak.models.UserFederationProviderFactory.syncAllUsers(KeycloakSessionFactory,
String, UserFederationProviderModel)
or just use on demand per User when he / she want's to login for the first time.
Cheers,
Thomas
2016-01-15 16:16 GMT+01:00 Reed Lewis
<RLewis@carbonite.com<mailto:RLewis@carbonite.com>>:
Hi,
We are examining KeyCloak (It looks like it can do what we want), but we have the need
to have an external lookup of accounts who are not in KeyCloak in an external database
which is accessible via a REST call. I know about federation, but would prefer to only
check the external datasource if the user is not in KeyCloak, but from then on have all
the data “live” in KeyCloak and never refer to the external datasource again once the
account is “migrated” into KeyCloak.
Can this be done with some modification of federation?
We do not want to add the user accounts directly into KeyCloak as there are many more
there than will ever be in KeyCloak.
Thank you,
Reed Lewis
_______________________________________________
keycloak-user mailing list
keycloak-user@lists.jboss.org<mailto:keycloak-user@lists.jboss.org>
https://lists.jboss.org/mailman/listinfo/keycloak-user
_______________________________________________
keycloak-user mailing list
keycloak-user@lists.jboss.org<mailto:keycloak-user@lists.jboss.org>
https://lists.jboss.org/mailman/listinfo/keycloak-user
1:02 p.m.
I think that’s a more general question about user account merging so maybe one of the core
devs can chime in. However, I just want to clarify, you don’t want to query the federation
provider at all when a user signs in with external IDP, right? In that case, you could
modify the findByUsername() method to not create a user if the login is with a IDP. I’m
not sure if it still exists in 1.7+ but the username used to be created as
idp.email(a)provider.com where the IDP is the username prefix.
Does that make sense / sufficiently address the use case?
~ Scott
On Jan 27, 2016, at 12:34 PM, Reed Lewis <RLewis(a)carbonite.com>
wrote:
This is working for me now. I created a service that listens on a port and implements
the GET, HEAD and POST requests that are being made.
The one issue now is that integration with other Identity providers does not work now
since it still calls my server with the username from the external provider. How can I
tell Keycloak that when a user comes from an external Identity provider not to check the
user Federation provider?
Thank you,
Reed Lewis
From: Scott Rossillo <srossillo(a)smartling.com
<mailto:srossillo@smartling.com>>
Date: Friday, January 15, 2016 at 4:42 PM
To: Thomas Darimont <thomas.darimont(a)googlemail.com
<mailto:thomas.darimont@googlemail.com>>, Reed Lewis <RLewis(a)carbonite.com
<mailto:RLewis@carbonite.com>>
Cc: "keycloak-user(a)lists.jboss.org
<mailto:keycloak-user@lists.jboss.org>" <keycloak-user(a)lists.jboss.org
<mailto:keycloak-user@lists.jboss.org>>
Subject: Re: [keycloak-user] External Username, Password, Email... dataset with Keycloak
We just put up and blog post[0] and some sample code[1] on how to do this type of
migration.
[0]: http://tech.smartling.com/migrate-to-keycloak-with-zero-downtime/
<http://tech.smartling.com/migrate-to-keycloak-with-zero-downtime/>
[1]: https://github.com/Smartling/keycloak-user-migration-provider
<https://github.com/Smartling/keycloak-user-migration-provider>
Scott Rossillo
Smartling | Senior Software Engineer
srossillo(a)smartling.com <mailto:srossillo@smartling.com>
<https://app.sigstr.com/uc/55e5d41c6533390d03580000>
<http://www.sigstr.com/>
> On Jan 15, 2016, at 11:06 AM, Thomas Darimont <thomas.darimont(a)googlemail.com
<mailto:thomas.darimont@googlemail.com>> wrote:
>
> Hello Reed,
>
> as you already wrote, you can write a federation provider that queries your
> backend service via REST for user data.
> Within the federation provider you can then import the user data
> returned from the REST call.
>
> This would work as follows - within the method:
> org.keycloak.models.UserFederationProvider.getUserByUsername(RealmModel, String)
> you call your backend REST service.
>
> As a next step you create a new user with the given username
> UserModel keycloakUser = session.userStorage().addUser(realm, username);
>
> Then you copy all the user data from your backend into Keycloak's UserModel.
>
> After that your backend user has a corresponding representation in Keycloak
> with a reference to this federation provider (id) via the
"userModel.federationLink" property.
>
> The federation link will also be shown in the user page in the keycloak admin
console.
> As long as the federation link is in place keycloak will ask the federation provider
> for the latest user data. Once you decide to cut the link to the federation provider
you can
> simply do userModel.setFederationLink(null). You could basically cut (or rather omit)
the federation
> link right after you added the user to Keycloak.
>
> Keycloak has no link information after that anymore and it will only use the user
data stored
> in the Keycloak database for that particular user.
>
> You also have the option to do that for all your users via:
>
org.keycloak.models.UserFederationProviderFactory.syncAllUsers(KeycloakSessionFactory,
String, UserFederationProviderModel)
> or just use on demand per User when he / she want's to login for the first time.
>
> Cheers,
> Thomas
>
> 2016-01-15 16:16 GMT+01:00 Reed Lewis <RLewis(a)carbonite.com
<mailto:RLewis@carbonite.com>>:
> Hi,
> We are examining KeyCloak (It looks like it can do what we want), but we have the
need to have an external lookup of accounts who are not in KeyCloak in an external
database which is accessible via a REST call. I know about federation, but would prefer
to only check the external datasource if the user is not in KeyCloak, but from then on
have all the data “live” in KeyCloak and never refer to the external datasource again once
the account is “migrated” into KeyCloak.
>
>
> Can this be done with some modification of federation?
>
> We do not want to add the user accounts directly into KeyCloak as there are many more
there than will ever be in KeyCloak.
>
> Thank you,
>
> Reed Lewis
>
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user(a)lists.jboss.org <mailto:keycloak-user@lists.jboss.org>
> https://lists.jboss.org/mailman/listinfo/keycloak-user
<https://lists.jboss.org/mailman/listinfo/keycloak-user>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user(a)lists.jboss.org <mailto:keycloak-user@lists.jboss.org>
> https://lists.jboss.org/mailman/listinfo/keycloak-user
<https://lists.jboss.org/mailman/listinfo/keycloak-user>
1:48 p.m.
Scott,
Yes that is exactly what I wish to have happen. If a user is from an external IDP do
not check the federation provider at all. The reason for this is I might have users in
my federation provider who are going to log in using external IDP going forward. I wish to
have them always use the IDP to login now.
I checked your suggestion, and my federation provider gets the account name as just the
email address, not (idp).email. For example when It is called it comes in as
foo(a)google.com not google.foo(a)google.com so that will not work.
So I think that there must be changes needed to Keycloak to not check the Federation
provider if it comes from an external IDP
Thanks,
Reed
From: Scott Rossillo
<srossillo@smartling.com<mailto:srossillo@smartling.com>>
Date: Wednesday, January 27, 2016 at 1:02 PM
To: Reed Lewis <RLewis@carbonite.com<mailto:RLewis@carbonite.com>>
Cc: Thomas Darimont
<thomas.darimont@googlemail.com<mailto:thomas.darimont@googlemail.com>>,
"keycloak-user@lists.jboss.org<mailto:keycloak-user@lists.jboss.org>"
<keycloak-user@lists.jboss.org<mailto:keycloak-user@lists.jboss.org>>
Subject: Re: [keycloak-user] External Username, Password, Email... dataset with Keycloak
I think that’s a more general question about user account merging so maybe one of the core
devs can chime in. However, I just want to clarify, you don’t want to query the federation
provider at all when a user signs in with external IDP, right? In that case, you could
modify the findByUsername() method to not create a user if the login is with a IDP. I’m
not sure if it still exists in 1.7+ but the username used to be created as
idp.email@provider.com<mailto:idp.email@provider.com> where the IDP is the username
prefix.
Does that make sense / sufficiently address the use case?
~ Scott
On Jan 27, 2016, at 12:34 PM, Reed Lewis
<RLewis@carbonite.com<mailto:RLewis@carbonite.com>> wrote:
This is working for me now. I created a service that listens on a port and implements the
GET, HEAD and POST requests that are being made.
The one issue now is that integration with other Identity providers does not work now
since it still calls my server with the username from the external provider. How can I
tell Keycloak that when a user comes from an external Identity provider not to check the
user Federation provider?
Thank you,
Reed Lewis
From: Scott Rossillo
<srossillo@smartling.com<mailto:srossillo@smartling.com>>
Date: Friday, January 15, 2016 at 4:42 PM
To: Thomas Darimont
<thomas.darimont@googlemail.com<mailto:thomas.darimont@googlemail.com>>, Reed
Lewis <RLewis@carbonite.com<mailto:RLewis@carbonite.com>>
Cc: "keycloak-user@lists.jboss.org<mailto:keycloak-user@lists.jboss.org>"
<keycloak-user@lists.jboss.org<mailto:keycloak-user@lists.jboss.org>>
Subject: Re: [keycloak-user] External Username, Password, Email... dataset with Keycloak
We just put up and blog post[0] and some sample code[1] on how to do this type of
migration.
[0]: http://tech.smartling.com/migrate-to-keycloak-with-zero-downtime/
[1]: https://github.com/Smartling/keycloak-user-migration-provider
Scott Rossillo
Smartling | Senior Software Engineer
srossillo@smartling.com<mailto:srossillo@smartling.com>
[Latest News + Events]<https://app.sigstr.com/uc/55e5d41c6533390d03580000>
[Powered by Sigstr]<http://www.sigstr.com/>
On Jan 15, 2016, at 11:06 AM, Thomas Darimont
<thomas.darimont@googlemail.com<mailto:thomas.darimont@googlemail.com>>
wrote:
Hello Reed,
as you already wrote, you can write a federation provider that queries your
backend service via REST for user data.
Within the federation provider you can then import the user data
returned from the REST call.
This would work as follows - within the method:
org.keycloak.models.UserFederationProvider.getUserByUsername(RealmModel, String)
you call your backend REST service.
As a next step you create a new user with the given username
UserModel keycloakUser = session.userStorage().addUser(realm, username);
Then you copy all the user data from your backend into Keycloak's UserModel.
After that your backend user has a corresponding representation in Keycloak
with a reference to this federation provider (id) via the
"userModel.federationLink" property.
The federation link will also be shown in the user page in the keycloak admin console.
As long as the federation link is in place keycloak will ask the federation provider
for the latest user data. Once you decide to cut the link to the federation provider you
can
simply do userModel.setFederationLink(null). You could basically cut (or rather omit) the
federation
link right after you added the user to Keycloak.
Keycloak has no link information after that anymore and it will only use the user data
stored
in the Keycloak database for that particular user.
You also have the option to do that for all your users via:
org.keycloak.models.UserFederationProviderFactory.syncAllUsers(KeycloakSessionFactory,
String, UserFederationProviderModel)
or just use on demand per User when he / she want's to login for the first time.
Cheers,
Thomas
2016-01-15 16:16 GMT+01:00 Reed Lewis
<RLewis@carbonite.com<mailto:RLewis@carbonite.com>>:
Hi,
We are examining KeyCloak (It looks like it can do what we want), but we have the need
to have an external lookup of accounts who are not in KeyCloak in an external database
which is accessible via a REST call. I know about federation, but would prefer to only
check the external datasource if the user is not in KeyCloak, but from then on have all
the data “live” in KeyCloak and never refer to the external datasource again once the
account is “migrated” into KeyCloak.
Can this be done with some modification of federation?
We do not want to add the user accounts directly into KeyCloak as there are many more
there than will ever be in KeyCloak.
Thank you,
Reed Lewis
_______________________________________________
keycloak-user mailing list
keycloak-user@lists.jboss.org<mailto:keycloak-user@lists.jboss.org>
https://lists.jboss.org/mailman/listinfo/keycloak-user
_______________________________________________
keycloak-user mailing list
keycloak-user@lists.jboss.org<mailto:keycloak-user@lists.jboss.org>
https://lists.jboss.org/mailman/listinfo/keycloak-user
2:06 p.m.
Hello,
I think it would be helpful if keycloak would store a "note" about where a
use came from
in the user model. Cloud Foundry's UAA stores the "origin system name"
(origin) as well as
the "origin user id" (externalId) in the user model.
See:
https://github.com/cloudfoundry/uaa/blob/master/model/src/main/java/org/c...
In the UAA case users created by the UAA have the origin set to "uaa" and
externalId to null. Other users have a different origin.
In my federation provider I set custom user attributes origin.name and
origin.id in order to store
a reference to the original user account. I found this very helpful
especially during migration / transition phases as well as for debugging.
Cheers,
Thomas
2016-01-27 19:48 GMT+01:00 Reed Lewis <RLewis(a)carbonite.com>:
Scott,
Yes that is exactly what I wish to have happen. If a user is from an
external IDP do not check the federation provider at all. The reason for
this is I might have users in my federation provider who are going to log
in using external IDP going forward. I wish to have them always use the IDP
to login now.
I checked your suggestion, and my federation provider gets the account
name as just the email address, not (idp).email. For example when It is
called it comes in as foo(a)google.com not google.foo(a)google.com so that
will not work.
So I think that there must be changes needed to Keycloak to not check the
Federation provider if it comes from an external IDP
Thanks,
Reed
From: Scott Rossillo <srossillo(a)smartling.com>
Date: Wednesday, January 27, 2016 at 1:02 PM
To: Reed Lewis <RLewis(a)carbonite.com>
Cc: Thomas Darimont <thomas.darimont(a)googlemail.com>, "
keycloak-user(a)lists.jboss.org" <keycloak-user(a)lists.jboss.org>
Subject: Re: [keycloak-user] External Username, Password, Email...
dataset with Keycloak
I think that’s a more general question about user account merging so maybe
one of the core devs can chime in. However, I just want to clarify, you
don’t want to query the federation provider at all when a user signs in
with external IDP, right? In that case, you could modify the
findByUsername() method to not create a user if the login is with a IDP.
I’m not sure if it still exists in 1.7+ but the username used to be created
as idp.email(a)provider.com where the IDP is the username prefix.
Does that make sense / sufficiently address the use case?
~ Scott
On Jan 27, 2016, at 12:34 PM, Reed Lewis <RLewis(a)carbonite.com> wrote:
This is working for me now. I created a service that listens on a port
and implements the GET, HEAD and POST requests that are being made.
The one issue now is that integration with other Identity providers does
not work now since it still calls my server with the username from the
external provider. How can I tell Keycloak that when a user comes from
an external Identity provider not to check the user Federation provider?
Thank you,
Reed Lewis
From: Scott Rossillo <srossillo(a)smartling.com>
Date: Friday, January 15, 2016 at 4:42 PM
To: Thomas Darimont <thomas.darimont(a)googlemail.com>, Reed Lewis <
RLewis(a)carbonite.com>
Cc: "keycloak-user(a)lists.jboss.org" <keycloak-user(a)lists.jboss.org>
Subject: Re: [keycloak-user] External Username, Password, Email...
dataset with Keycloak
We just put up and blog post[0] and some sample code[1] on how to do this
type of migration.
[0]: http://tech.smartling.com/migrate-to-keycloak-with-zero-downtime/
[1]: https://github.com/Smartling/keycloak-user-migration-provider
Scott Rossillo
Smartling | Senior Software Engineer
srossillo(a)smartling.com
[image: Latest News + Events]
<https://app.sigstr.com/uc/55e5d41c6533390d03580000>
[image: Powered by Sigstr] <http://www.sigstr.com/>
On Jan 15, 2016, at 11:06 AM, Thomas Darimont <
thomas.darimont(a)googlemail.com> wrote:
Hello Reed,
as you already wrote, you can write a federation provider that queries your
backend service via REST for user data.
Within the federation provider you can then import the user data
returned from the REST call.
This would work as follows - within the method:
org.keycloak.models.UserFederationProvider.getUserByUsername(RealmModel,
String)
you call your backend REST service.
As a next step you create a new user with the given username
UserModel keycloakUser = session.userStorage().addUser(realm, username);
Then you copy all the user data from your backend into Keycloak's
UserModel.
After that your backend user has a corresponding representation in Keycloak
with a reference to this federation provider (id) via the
"userModel.federationLink" property.
The federation link will also be shown in the user page in the keycloak
admin console.
As long as the federation link is in place keycloak will ask the
federation provider
for the latest user data. Once you decide to cut the link to the
federation provider you can
simply do userModel.setFederationLink(null). You could basically cut (or
rather omit) the federation
link right after you added the user to Keycloak.
Keycloak has no link information after that anymore and it will only use
the user data stored
in the Keycloak database for that particular user.
You also have the option to do that for all your users via:
org.keycloak.models.UserFederationProviderFactory.syncAllUsers(KeycloakSessionFactory,
String, UserFederationProviderModel)
or just use on demand per User when he / she want's to login for the first
time.
Cheers,
Thomas
2016-01-15 16:16 GMT+01:00 Reed Lewis <RLewis(a)carbonite.com>:
> Hi,
> We are examining KeyCloak (It looks like it can do what we want), but
> we have the need to have an external lookup of accounts who are not in
> KeyCloak in an external database which is accessible via a REST call. I
> know about federation, but would prefer to only check the external
> datasource if the user is not in KeyCloak, but from then on have all the
> data “live” in KeyCloak and never refer to the external datasource again
> once the account is “migrated” into KeyCloak.
>
>
> Can this be done with some modification of federation?
>
> We do not want to add the user accounts directly into KeyCloak as there
> are many more there than will ever be in KeyCloak.
>
> Thank you,
>
> Reed Lewis
>
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user(a)lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
_______________________________________________
keycloak-user mailing list
keycloak-user(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user
2:13 p.m.
The interesting thing is that the user is not being added to Keycloak at all (or at least
does not look like it gets in at all). When I use an external IDP, and it also calls my
local federation provider I return an account representation, but it never seems to be
added to Keycloak at all.
I am getting an Error in Keycloak execution. I will attach that error to this email.
Reed
From: Thomas Darimont
<thomas.darimont@googlemail.com<mailto:thomas.darimont@googlemail.com>>
Date: Wednesday, January 27, 2016 at 2:06 PM
To: Reed Lewis <RLewis@carbonite.com<mailto:RLewis@carbonite.com>>
Cc: Scott Rossillo <srossillo@smartling.com<mailto:srossillo@smartling.com>>,
"keycloak-user@lists.jboss.org<mailto:keycloak-user@lists.jboss.org>"
<keycloak-user@lists.jboss.org<mailto:keycloak-user@lists.jboss.org>>
Subject: Re: [keycloak-user] External Username, Password, Email... dataset with Keycloak
Hello,
I think it would be helpful if keycloak would store a "note" about where a use
came from
in the user model. Cloud Foundry's UAA stores the "origin system name"
(origin) as well as
the "origin user id" (externalId) in the user model.
See:
https://github.com/cloudfoundry/uaa/blob/master/model/src/main/java/org/c...
In the UAA case users created by the UAA have the origin set to "uaa" and
externalId to null. Other users have a different origin.
In my federation provider I set custom user attributes
origin.name<http://origin.name> and origin.id<http://origin.id> in order to
store
a reference to the original user account. I found this very helpful especially during
migration / transition phases as well as for debugging.
Cheers,
Thomas
2016-01-27 19:48 GMT+01:00 Reed Lewis
<RLewis@carbonite.com<mailto:RLewis@carbonite.com>>:
Scott,
Yes that is exactly what I wish to have happen. If a user is from an external IDP do
not check the federation provider at all. The reason for this is I might have users in
my federation provider who are going to log in using external IDP going forward. I wish to
have them always use the IDP to login now.
I checked your suggestion, and my federation provider gets the account name as just the
email address, not (idp).email. For example when It is called it comes in as
foo@google.com<mailto:foo@google.com> not
google.foo@google.com<mailto:google.foo@google.com> so that will not work.
So I think that there must be changes needed to Keycloak to not check the Federation
provider if it comes from an external IDP
Thanks,
Reed
From: Scott Rossillo
<srossillo@smartling.com<mailto:srossillo@smartling.com>>
Date: Wednesday, January 27, 2016 at 1:02 PM
To: Reed Lewis <RLewis@carbonite.com<mailto:RLewis@carbonite.com>>
Cc: Thomas Darimont
<thomas.darimont@googlemail.com<mailto:thomas.darimont@googlemail.com>>,
"keycloak-user@lists.jboss.org<mailto:keycloak-user@lists.jboss.org>"
<keycloak-user@lists.jboss.org<mailto:keycloak-user@lists.jboss.org>>
Subject: Re: [keycloak-user] External Username, Password, Email... dataset with Keycloak
I think that’s a more general question about user account merging so maybe one of the core
devs can chime in. However, I just want to clarify, you don’t want to query the federation
provider at all when a user signs in with external IDP, right? In that case, you could
modify the findByUsername() method to not create a user if the login is with a IDP. I’m
not sure if it still exists in 1.7+ but the username used to be created as
idp.email@provider.com<mailto:idp.email@provider.com> where the IDP is the username
prefix.
Does that make sense / sufficiently address the use case?
~ Scott
On Jan 27, 2016, at 12:34 PM, Reed Lewis
<RLewis@carbonite.com<mailto:RLewis@carbonite.com>> wrote:
This is working for me now. I created a service that listens on a port and implements the
GET, HEAD and POST requests that are being made.
The one issue now is that integration with other Identity providers does not work now
since it still calls my server with the username from the external provider. How can I
tell Keycloak that when a user comes from an external Identity provider not to check the
user Federation provider?
Thank you,
Reed Lewis
From: Scott Rossillo
<srossillo@smartling.com<mailto:srossillo@smartling.com>>
Date: Friday, January 15, 2016 at 4:42 PM
To: Thomas Darimont
<thomas.darimont@googlemail.com<mailto:thomas.darimont@googlemail.com>>, Reed
Lewis <RLewis@carbonite.com<mailto:RLewis@carbonite.com>>
Cc: "keycloak-user@lists.jboss.org<mailto:keycloak-user@lists.jboss.org>"
<keycloak-user@lists.jboss.org<mailto:keycloak-user@lists.jboss.org>>
Subject: Re: [keycloak-user] External Username, Password, Email... dataset with Keycloak
We just put up and blog post[0] and some sample code[1] on how to do this type of
migration.
[0]: http://tech.smartling.com/migrate-to-keycloak-with-zero-downtime/
[1]: https://github.com/Smartling/keycloak-user-migration-provider
Scott Rossillo
Smartling | Senior Software Engineer
srossillo@smartling.com<mailto:srossillo@smartling.com>
[Latest News + Events]<https://app.sigstr.com/uc/55e5d41c6533390d03580000>
[Powered by Sigstr]<http://www.sigstr.com/>
On Jan 15, 2016, at 11:06 AM, Thomas Darimont
<thomas.darimont@googlemail.com<mailto:thomas.darimont@googlemail.com>>
wrote:
Hello Reed,
as you already wrote, you can write a federation provider that queries your
backend service via REST for user data.
Within the federation provider you can then import the user data
returned from the REST call.
This would work as follows - within the method:
org.keycloak.models.UserFederationProvider.getUserByUsername(RealmModel, String)
you call your backend REST service.
As a next step you create a new user with the given username
UserModel keycloakUser = session.userStorage().addUser(realm, username);
Then you copy all the user data from your backend into Keycloak's UserModel.
After that your backend user has a corresponding representation in Keycloak
with a reference to this federation provider (id) via the
"userModel.federationLink" property.
The federation link will also be shown in the user page in the keycloak admin console.
As long as the federation link is in place keycloak will ask the federation provider
for the latest user data. Once you decide to cut the link to the federation provider you
can
simply do userModel.setFederationLink(null). You could basically cut (or rather omit) the
federation
link right after you added the user to Keycloak.
Keycloak has no link information after that anymore and it will only use the user data
stored
in the Keycloak database for that particular user.
You also have the option to do that for all your users via:
org.keycloak.models.UserFederationProviderFactory.syncAllUsers(KeycloakSessionFactory,
String, UserFederationProviderModel)
or just use on demand per User when he / she want's to login for the first time.
Cheers,
Thomas
2016-01-15 16:16 GMT+01:00 Reed Lewis
<RLewis@carbonite.com<mailto:RLewis@carbonite.com>>:
Hi,
We are examining KeyCloak (It looks like it can do what we want), but we have the need
to have an external lookup of accounts who are not in KeyCloak in an external database
which is accessible via a REST call. I know about federation, but would prefer to only
check the external datasource if the user is not in KeyCloak, but from then on have all
the data “live” in KeyCloak and never refer to the external datasource again once the
account is “migrated” into KeyCloak.
Can this be done with some modification of federation?
We do not want to add the user accounts directly into KeyCloak as there are many more
there than will ever be in KeyCloak.
Thank you,
Reed Lewis
_______________________________________________
keycloak-user mailing list
keycloak-user@lists.jboss.org<mailto:keycloak-user@lists.jboss.org>
https://lists.jboss.org/mailman/listinfo/keycloak-user
_______________________________________________
keycloak-user mailing list
keycloak-user@lists.jboss.org<mailto:keycloak-user@lists.jboss.org>
https://lists.jboss.org/mailman/listinfo/keycloak-user
3:28 p.m.
It looks like no matter which External IDP I use, it always checks the federation provider
also which is not something that I think wants to be done. Is this a bug in the
Keycloak software?
So it looks like one cannot do external IDP and federation at the same time. This should
be fixed.
Reed
From: Scott Rossillo
<srossillo@smartling.com<mailto:srossillo@smartling.com>>
Date: Wednesday, January 27, 2016 at 1:02 PM
To: Reed Lewis <RLewis@carbonite.com<mailto:RLewis@carbonite.com>>
Cc: Thomas Darimont
<thomas.darimont@googlemail.com<mailto:thomas.darimont@googlemail.com>>,
"keycloak-user@lists.jboss.org<mailto:keycloak-user@lists.jboss.org>"
<keycloak-user@lists.jboss.org<mailto:keycloak-user@lists.jboss.org>>
Subject: Re: [keycloak-user] External Username, Password, Email... dataset with Keycloak
I think that’s a more general question about user account merging so maybe one of the core
devs can chime in. However, I just want to clarify, you don’t want to query the federation
provider at all when a user signs in with external IDP, right? In that case, you could
modify the findByUsername() method to not create a user if the login is with a IDP. I’m
not sure if it still exists in 1.7+ but the username used to be created as
idp.email@provider.com<mailto:idp.email@provider.com> where the IDP is the username
prefix.
Does that make sense / sufficiently address the use case?
~ Scott
On Jan 27, 2016, at 12:34 PM, Reed Lewis
<RLewis@carbonite.com<mailto:RLewis@carbonite.com>> wrote:
This is working for me now. I created a service that listens on a port and implements the
GET, HEAD and POST requests that are being made.
The one issue now is that integration with other Identity providers does not work now
since it still calls my server with the username from the external provider. How can I
tell Keycloak that when a user comes from an external Identity provider not to check the
user Federation provider?
Thank you,
Reed Lewis
From: Scott Rossillo
<srossillo@smartling.com<mailto:srossillo@smartling.com>>
Date: Friday, January 15, 2016 at 4:42 PM
To: Thomas Darimont
<thomas.darimont@googlemail.com<mailto:thomas.darimont@googlemail.com>>, Reed
Lewis <RLewis@carbonite.com<mailto:RLewis@carbonite.com>>
Cc: "keycloak-user@lists.jboss.org<mailto:keycloak-user@lists.jboss.org>"
<keycloak-user@lists.jboss.org<mailto:keycloak-user@lists.jboss.org>>
Subject: Re: [keycloak-user] External Username, Password, Email... dataset with Keycloak
We just put up and blog post[0] and some sample code[1] on how to do this type of
migration.
[0]: http://tech.smartling.com/migrate-to-keycloak-with-zero-downtime/
[1]: https://github.com/Smartling/keycloak-user-migration-provider
Scott Rossillo
Smartling | Senior Software Engineer
srossillo@smartling.com<mailto:srossillo@smartling.com>
[Latest News + Events]<https://app.sigstr.com/uc/55e5d41c6533390d03580000>
[Powered by Sigstr]<http://www.sigstr.com/>
On Jan 15, 2016, at 11:06 AM, Thomas Darimont
<thomas.darimont@googlemail.com<mailto:thomas.darimont@googlemail.com>>
wrote:
Hello Reed,
as you already wrote, you can write a federation provider that queries your
backend service via REST for user data.
Within the federation provider you can then import the user data
returned from the REST call.
This would work as follows - within the method:
org.keycloak.models.UserFederationProvider.getUserByUsername(RealmModel, String)
you call your backend REST service.
As a next step you create a new user with the given username
UserModel keycloakUser = session.userStorage().addUser(realm, username);
Then you copy all the user data from your backend into Keycloak's UserModel.
After that your backend user has a corresponding representation in Keycloak
with a reference to this federation provider (id) via the
"userModel.federationLink" property.
The federation link will also be shown in the user page in the keycloak admin console.
As long as the federation link is in place keycloak will ask the federation provider
for the latest user data. Once you decide to cut the link to the federation provider you
can
simply do userModel.setFederationLink(null). You could basically cut (or rather omit) the
federation
link right after you added the user to Keycloak.
Keycloak has no link information after that anymore and it will only use the user data
stored
in the Keycloak database for that particular user.
You also have the option to do that for all your users via:
org.keycloak.models.UserFederationProviderFactory.syncAllUsers(KeycloakSessionFactory,
String, UserFederationProviderModel)
or just use on demand per User when he / she want's to login for the first time.
Cheers,
Thomas
2016-01-15 16:16 GMT+01:00 Reed Lewis
<RLewis@carbonite.com<mailto:RLewis@carbonite.com>>:
Hi,
We are examining KeyCloak (It looks like it can do what we want), but we have the need
to have an external lookup of accounts who are not in KeyCloak in an external database
which is accessible via a REST call. I know about federation, but would prefer to only
check the external datasource if the user is not in KeyCloak, but from then on have all
the data “live” in KeyCloak and never refer to the external datasource again once the
account is “migrated” into KeyCloak.
Can this be done with some modification of federation?
We do not want to add the user accounts directly into KeyCloak as there are many more
there than will ever be in KeyCloak.
Thank you,
Reed Lewis
_______________________________________________
keycloak-user mailing list
keycloak-user@lists.jboss.org<mailto:keycloak-user@lists.jboss.org>
https://lists.jboss.org/mailman/listinfo/keycloak-user
_______________________________________________
keycloak-user mailing list
keycloak-user@lists.jboss.org<mailto:keycloak-user@lists.jboss.org>
https://lists.jboss.org/mailman/listinfo/keycloak-user
6:12 a.m.
Hi,
If you're using Keycloak version 1.7 or later, you can create new
"firstBrokerLogin" flow and replace "Create User If Unique"
authenticator with your own implementation. You can create subclass of
IdpCreateUserIfUniqueAuthenticator and override method
"checkExistingUser" to not look for username at federation provider. It
can be done if you use:
context.getSession().*userStorage()*.getUserByUsername(username,
context.getRealm());
instead of:
context.getSession().*users()*.getUserByUsername(username,
context.getRealm());
Same for email checking.
In that case if you login with user "john" from external identity
provider, the authenticator won't try to find this "john" user in your
external federation provider, but just in Keycloak DB.
Is this what you are trying to achieve?
Btv. As pointed already, the keycloak username for user registered from
external IDP looks like "google.john" by default . You can change this
behaviour to use identity provider mapper for username, which allows you
to change the username template and remove broker prefix from that. So
Keycloak will treat this username as "john". In 1.9 we plan to remove
broker prefix by default and we will always just the username from
broker, because "first login flow" added in Keycloak 1.7 allow us to
easily resolve username conflicts. Corresponding JIRA is:
https://issues.jboss.org/browse/KEYCLOAK-2292
Marek
On 27/01/16 21:28, Reed Lewis wrote:
It looks like no matter which External IDP I use, it always checks
the
federation provider also which is not something that I think wants to
be done. Is this a bug in the Keycloak software?
So it looks like one cannot do external IDP and federation at the same
time. This should be fixed.
Reed
From: Scott Rossillo <srossillo(a)smartling.com
<mailto:srossillo@smartling.com>>
Date: Wednesday, January 27, 2016 at 1:02 PM
To: Reed Lewis <RLewis(a)carbonite.com <mailto:RLewis@carbonite.com>>
Cc: Thomas Darimont <thomas.darimont(a)googlemail.com
<mailto:thomas.darimont@googlemail.com>>,
"keycloak-user(a)lists.jboss.org <mailto:keycloak-user@lists.jboss.org>"
<keycloak-user(a)lists.jboss.org <mailto:keycloak-user@lists.jboss.org>>
Subject: Re: [keycloak-user] External Username, Password, Email...
dataset with Keycloak
I think that’s a more general question about user account merging so
maybe one of the core devs can chime in. However, I just want to
clarify, you don’t want to query the federation provider at all when a
user signs in with external IDP, right? In that case, you could modify
the findByUsername() method to not create a user if the login is with
a IDP. I’m not sure if it still exists in 1.7+ but the username used
to be created as idp.email(a)provider.com
<mailto:idp.email@provider.com> where the IDP is the username prefix.
Does that make sense / sufficiently address the use case?
~ Scott
> On Jan 27, 2016, at 12:34 PM, Reed Lewis <RLewis(a)carbonite.com
> <mailto:RLewis@carbonite.com>> wrote:
>
> This is working for me now. I created a service that listens on a
> port and implements the GET, HEAD and POST requests that are being made.
>
> The one issue now is that integration with other Identity providers
> does not work now since it still calls my server with the username
> from the external provider. How can I tell Keycloak that when a
> user comes from an external Identity provider not to check the user
> Federation provider?
>
> Thank you,
>
> Reed Lewis
>
> From: Scott Rossillo <srossillo(a)smartling.com
> <mailto:srossillo@smartling.com>>
> Date: Friday, January 15, 2016 at 4:42 PM
> To: Thomas Darimont <thomas.darimont(a)googlemail.com
> <mailto:thomas.darimont@googlemail.com>>, Reed Lewis
> <RLewis(a)carbonite.com <mailto:RLewis@carbonite.com>>
> Cc: "keycloak-user(a)lists.jboss.org
> <mailto:keycloak-user@lists.jboss.org>"
> <keycloak-user(a)lists.jboss.org <mailto:keycloak-user@lists.jboss.org>>
> Subject: Re: [keycloak-user] External Username, Password, Email...
> dataset with Keycloak
>
> We just put up and blog post[0] and some sample code[1] on how to do
> this type of migration.
>
> [0]: http://tech.smartling.com/migrate-to-keycloak-with-zero-downtime/
> [1]: https://github.com/Smartling/keycloak-user-migration-provider
>
>
> Scott Rossillo
> Smartling | Senior Software Engineer
> srossillo(a)smartling.com <mailto:srossillo@smartling.com>
>
> Latest News + Events <https://app.sigstr.com/uc/55e5d41c6533390d03580000>
> Powered by Sigstr <http://www.sigstr.com/>
>
>> On Jan 15, 2016, at 11:06 AM, Thomas Darimont
>> <thomas.darimont(a)googlemail.com
>> <mailto:thomas.darimont@googlemail.com>> wrote:
>>
>> Hello Reed,
>>
>> as you already wrote, you can write a federation provider that
>> queries your
>> backend service via REST for user data.
>> Within the federation provider you can then import the user data
>> returned from the REST call.
>>
>> This would work as follows - within the method:
>> org.keycloak.models.UserFederationProvider.getUserByUsername(RealmModel,
>> String)
>> you call your backend REST service.
>>
>> As a next step you create a new user with the given username
>> UserModel keycloakUser = session.userStorage().addUser(realm,
>> username);
>>
>> Then you copy all the user data from your backend into Keycloak's
>> UserModel.
>>
>> After that your backend user has a corresponding representation in
>> Keycloak
>> with a reference to this federation provider (id) via the
>> "userModel.federationLink" property.
>>
>> The federation link will also be shown in the user page in the
>> keycloak admin console.
>> As long as the federation link is in place keycloak will ask the
>> federation provider
>> for the latest user data. Once you decide to cut the link to the
>> federation provider you can
>> simply do userModel.setFederationLink(null). You could basically cut
>> (or rather omit) the federation
>> link right after you added the user to Keycloak.
>>
>> Keycloak has no link information after that anymore and it will only
>> use the user data stored
>> in the Keycloak database for that particular user.
>>
>> You also have the option to do that for all your users via:
>>
org.keycloak.models.UserFederationProviderFactory.syncAllUsers(KeycloakSessionFactory,
>> String, UserFederationProviderModel)
>> or just use on demand per User when he / she want's to login for the
>> first time.
>>
>> Cheers,
>> Thomas
>>
>> 2016-01-15 16:16 GMT+01:00 Reed Lewis <RLewis(a)carbonite.com
>> <mailto:RLewis@carbonite.com>>:
>>
>> Hi,
>> We are examining KeyCloak (It looks like it can do what we
>> want), but we have the need to have an external lookup of
>> accounts who are not in KeyCloak in an external database which
>> is accessible via a REST call. I know about federation, but
>> would prefer to only check the external datasource if the user
>> is not in KeyCloak, but from then on have all the data “live” in
>> KeyCloak and never refer to the external datasource again once
>> the account is “migrated” into KeyCloak.
>>
>>
>> Can this be done with some modification of federation?
>>
>> We do not want to add the user accounts directly into KeyCloak
>> as there are many more there than will ever be in KeyCloak.
>>
>> Thank you,
>>
>> Reed Lewis
>>
>>
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user(a)lists.jboss.org <mailto:keycloak-user@lists.jboss.org>
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>
>>
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user(a)lists.jboss.org <mailto:keycloak-user@lists.jboss.org>
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
_______________________________________________
keycloak-user mailing list
keycloak-user(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user
4:26 p.m.
I modified the Keycloak code directly in the method you mentioned, recompiled the whole
package, and attempted to use it. The issue now is that when I log in using a external
Identity provider, and have a User Federation defined, I still get called in my user
federation with the username that is from the IDP. Plus the login screen shows me a
screen with “ACCOUNT ALREADY EXISTS” and an option to review the profile info or Link
Google with existing account.
The account does not exist before starting the login process.
Thank you for all your help in getting this working. I am attempting to use 1.8RC3 BTW.
Reed
From: Marek Posolda <mposolda@redhat.com<mailto:mposolda@redhat.com>>
Date: Thursday, January 28, 2016 at 6:12 AM
To: Reed Lewis <RLewis@carbonite.com<mailto:RLewis@carbonite.com>>, Scott
Rossillo <srossillo@smartling.com<mailto:srossillo@smartling.com>>
Cc: "keycloak-user@lists.jboss.org<mailto:keycloak-user@lists.jboss.org>"
<keycloak-user@lists.jboss.org<mailto:keycloak-user@lists.jboss.org>>
Subject: Re: [keycloak-user] External Username, Password, Email... dataset with Keycloak
Hi,
If you're using Keycloak version 1.7 or later, you can create new
"firstBrokerLogin" flow and replace "Create User If Unique"
authenticator with your own implementation. You can create subclass of
IdpCreateUserIfUniqueAuthenticator and override method "checkExistingUser" to
not look for username at federation provider. It can be done if you use:
context.getSession().userStorage().getUserByUsername(username, context.getRealm());
instead of:
context.getSession().users().getUserByUsername(username, context.getRealm());
Same for email checking.
In that case if you login with user "john" from external identity provider, the
authenticator won't try to find this "john" user in your external federation
provider, but just in Keycloak DB.
Is this what you are trying to achieve?
Btv. As pointed already, the keycloak username for user registered from external IDP looks
like "google.john" by default . You can change this behaviour to use identity
provider mapper for username, which allows you to change the username template and remove
broker prefix from that. So Keycloak will treat this username as "john". In 1.9
we plan to remove broker prefix by default and we will always just the username from
broker, because "first login flow" added in Keycloak 1.7 allow us to easily
resolve username conflicts. Corresponding JIRA is:
https://issues.jboss.org/browse/KEYCLOAK-2292
Marek
On 27/01/16 21:28, Reed Lewis wrote:
It looks like no matter which External IDP I use, it always checks the federation provider
also which is not something that I think wants to be done. Is this a bug in the
Keycloak software?
So it looks like one cannot do external IDP and federation at the same time. This should
be fixed.
Reed
From: Scott Rossillo
<srossillo@smartling.com<mailto:srossillo@smartling.com>>
Date: Wednesday, January 27, 2016 at 1:02 PM
To: Reed Lewis
<<mailto:RLewis@carbonite.com>RLewis@carbonite.com<mailto:RLewis@carbonite.com>>
Cc: Thomas Darimont
<thomas.darimont@googlemail.com<mailto:thomas.darimont@googlemail.com>>,
"keycloak-user@lists.jboss.org<mailto:keycloak-user@lists.jboss.org>"
<keycloak-user@lists.jboss.org<mailto:keycloak-user@lists.jboss.org>>
Subject: Re: [keycloak-user] External Username, Password, Email... dataset with Keycloak
I think that’s a more general question about user account merging so maybe one of the core
devs can chime in. However, I just want to clarify, you don’t want to query the federation
provider at all when a user signs in with external IDP, right? In that case, you could
modify the findByUsername() method to not create a user if the login is with a IDP. I’m
not sure if it still exists in 1.7+ but the username used to be created as
idp.email@provider.com<mailto:idp.email@provider.com> where the IDP is the username
prefix.
Does that make sense / sufficiently address the use case?
~ Scott
On Jan 27, 2016, at 12:34 PM, Reed Lewis
<RLewis@carbonite.com<mailto:RLewis@carbonite.com>> wrote:
This is working for me now. I created a service that listens on a port and implements the
GET, HEAD and POST requests that are being made.
The one issue now is that integration with other Identity providers does not work now
since it still calls my server with the username from the external provider. How can I
tell Keycloak that when a user comes from an external Identity provider not to check the
user Federation provider?
Thank you,
Reed Lewis
From: Scott Rossillo
<<mailto:srossillo@smartling.com>srossillo@smartling.com<mailto:srossillo@smartling.com>>
Date: Friday, January 15, 2016 at 4:42 PM
To: Thomas Darimont
<thomas.darimont@googlemail.com<mailto:thomas.darimont@googlemail.com>>, Reed
Lewis <RLewis@carbonite.com<mailto:RLewis@carbonite.com>>
Cc:
"<mailto:keycloak-user@lists.jboss.org>keycloak-user@lists.jboss.org<mailto:keycloak-user@lists.jboss.org>"
<keycloak-user@lists.jboss.org<mailto:keycloak-user@lists.jboss.org>>
Subject: Re: [keycloak-user] External Username, Password, Email... dataset with Keycloak
We just put up and blog post[0] and some sample code[1] on how to do this type of
migration.
[0]: http://tech.smartling.com/migrate-to-keycloak-with-zero-downtime/
[1]: https://github.com/Smartling/keycloak-user-migration-provider
Scott Rossillo
Smartling | Senior Software Engineer
srossillo@smartling.com<mailto:srossillo@smartling.com>
[Latest News +
Events]<https://app.sigstr.com/uc/55e5d41c6533390d03580000>
[Powered by Sigstr]<http://www.sigstr.com/>
On Jan 15, 2016, at 11:06 AM, Thomas Darimont
<<mailto:thomas.darimont@googlemail.com>thomas.darimont@googlemail.com<mailto:thomas.darimont@googlemail.com>>
wrote:
Hello Reed,
as you already wrote, you can write a federation provider that queries your
backend service via REST for user data.
Within the federation provider you can then import the user data
returned from the REST call.
This would work as follows - within the method:
org.keycloak.models.UserFederationProvider.getUserByUsername(RealmModel, String)
you call your backend REST service.
As a next step you create a new user with the given username
UserModel keycloakUser = session.userStorage().addUser(realm, username);
Then you copy all the user data from your backend into Keycloak's UserModel.
After that your backend user has a corresponding representation in Keycloak
with a reference to this federation provider (id) via the
"userModel.federationLink" property.
The federation link will also be shown in the user page in the keycloak admin console.
As long as the federation link is in place keycloak will ask the federation provider
for the latest user data. Once you decide to cut the link to the federation provider you
can
simply do userModel.setFederationLink(null). You could basically cut (or rather omit) the
federation
link right after you added the user to Keycloak.
Keycloak has no link information after that anymore and it will only use the user data
stored
in the Keycloak database for that particular user.
You also have the option to do that for all your users via:
org.keycloak.models.UserFederationProviderFactory.syncAllUsers(KeycloakSessionFactory,
String, UserFederationProviderModel)
or just use on demand per User when he / she want's to login for the first time.
Cheers,
Thomas
2016-01-15 16:16 GMT+01:00 Reed Lewis
<RLewis@carbonite.com<mailto:RLewis@carbonite.com>>:
Hi,
We are examining KeyCloak (It looks like it can do what we want), but we have the need
to have an external lookup of accounts who are not in KeyCloak in an external database
which is accessible via a REST call. I know about federation, but would prefer to only
check the external datasource if the user is not in KeyCloak, but from then on have all
the data “live” in KeyCloak and never refer to the external datasource again once the
account is “migrated” into KeyCloak.
Can this be done with some modification of federation?
We do not want to add the user accounts directly into KeyCloak as there are many more
there than will ever be in KeyCloak.
Thank you,
Reed Lewis
_______________________________________________
keycloak-user mailing list
keycloak-user@lists.jboss.org<mailto:keycloak-user@lists.jboss.org>
https://lists.jboss.org/mailman/listinfo/keycloak-user
_______________________________________________
keycloak-user mailing list
keycloak-user@lists.jboss.org<mailto:keycloak-user@lists.jboss.org>
https://lists.jboss.org/mailman/listinfo/keycloak-user
_______________________________________________
keycloak-user mailing list
keycloak-user@lists.jboss.org<mailto:keycloak-user@lists.jboss.org>https://lists.jboss.org/mailman/listinfo/keycloak-user
4:38 p.m.
More information:
I tried all three options for Authentication – First Broker Login – Create User if
Unique
With “Alternative” I get the behavior below
With “Required I get "User with email xxx(a)gmail.com already exists. Please login to
account management to link the account.” and the account is created without a link to
Google
With “Disabled” I get “Invalid username or password” and the account is never created at
all in Keycloak.
Thank you.
Reed
From:
<keycloak-user-bounces@lists.jboss.org<mailto:keycloak-user-bounces@lists.jboss.org>>
on behalf of Reed Lewis <RLewis@carbonite.com<mailto:RLewis@carbonite.com>>
Date: Thursday, January 28, 2016 at 4:26 PM
To: Marek Posolda <mposolda@redhat.com<mailto:mposolda@redhat.com>>, Scott
Rossillo <srossillo@smartling.com<mailto:srossillo@smartling.com>>
Cc: "keycloak-user@lists.jboss.org<mailto:keycloak-user@lists.jboss.org>"
<keycloak-user@lists.jboss.org<mailto:keycloak-user@lists.jboss.org>>
Subject: Re: [keycloak-user] External Username, Password, Email... dataset with Keycloak
I modified the Keycloak code directly in the method you mentioned, recompiled the whole
package, and attempted to use it. The issue now is that when I log in using a external
Identity provider, and have a User Federation defined, I still get called in my user
federation with the username that is from the IDP. Plus the login screen shows me a
screen with “ACCOUNT ALREADY EXISTS” and an option to review the profile info or Link
Google with existing account.
The account does not exist before starting the login process.
Thank you for all your help in getting this working. I am attempting to use 1.8RC3 BTW.
Reed
From: Marek Posolda <mposolda@redhat.com<mailto:mposolda@redhat.com>>
Date: Thursday, January 28, 2016 at 6:12 AM
To: Reed Lewis <RLewis@carbonite.com<mailto:RLewis@carbonite.com>>, Scott
Rossillo <srossillo@smartling.com<mailto:srossillo@smartling.com>>
Cc: "keycloak-user@lists.jboss.org<mailto:keycloak-user@lists.jboss.org>"
<keycloak-user@lists.jboss.org<mailto:keycloak-user@lists.jboss.org>>
Subject: Re: [keycloak-user] External Username, Password, Email... dataset with Keycloak
Hi,
If you're using Keycloak version 1.7 or later, you can create new
"firstBrokerLogin" flow and replace "Create User If Unique"
authenticator with your own implementation. You can create subclass of
IdpCreateUserIfUniqueAuthenticator and override method "checkExistingUser" to
not look for username at federation provider. It can be done if you use:
context.getSession().userStorage().getUserByUsername(username, context.getRealm());
instead of:
context.getSession().users().getUserByUsername(username, context.getRealm());
Same for email checking.
In that case if you login with user "john" from external identity provider, the
authenticator won't try to find this "john" user in your external federation
provider, but just in Keycloak DB.
Is this what you are trying to achieve?
Btv. As pointed already, the keycloak username for user registered from external IDP looks
like "google.john" by default . You can change this behaviour to use identity
provider mapper for username, which allows you to change the username template and remove
broker prefix from that. So Keycloak will treat this username as "john". In 1.9
we plan to remove broker prefix by default and we will always just the username from
broker, because "first login flow" added in Keycloak 1.7 allow us to easily
resolve username conflicts. Corresponding JIRA is:
https://issues.jboss.org/browse/KEYCLOAK-2292
Marek
On 27/01/16 21:28, Reed Lewis wrote:
It looks like no matter which External IDP I use, it always checks the federation provider
also which is not something that I think wants to be done. Is this a bug in the
Keycloak software?
So it looks like one cannot do external IDP and federation at the same time. This should
be fixed.
Reed
From: Scott Rossillo
<srossillo@smartling.com<mailto:srossillo@smartling.com>>
Date: Wednesday, January 27, 2016 at 1:02 PM
To: Reed Lewis
<<mailto:RLewis@carbonite.com>RLewis@carbonite.com<mailto:RLewis@carbonite.com>>
Cc: Thomas Darimont
<thomas.darimont@googlemail.com<mailto:thomas.darimont@googlemail.com>>,
"keycloak-user@lists.jboss.org<mailto:keycloak-user@lists.jboss.org>"
<keycloak-user@lists.jboss.org<mailto:keycloak-user@lists.jboss.org>>
Subject: Re: [keycloak-user] External Username, Password, Email... dataset with Keycloak
I think that’s a more general question about user account merging so maybe one of the core
devs can chime in. However, I just want to clarify, you don’t want to query the federation
provider at all when a user signs in with external IDP, right? In that case, you could
modify the findByUsername() method to not create a user if the login is with a IDP. I’m
not sure if it still exists in 1.7+ but the username used to be created as
idp.email@provider.com<mailto:idp.email@provider.com> where the IDP is the username
prefix.
Does that make sense / sufficiently address the use case?
~ Scott
On Jan 27, 2016, at 12:34 PM, Reed Lewis
<RLewis@carbonite.com<mailto:RLewis@carbonite.com>> wrote:
This is working for me now. I created a service that listens on a port and implements the
GET, HEAD and POST requests that are being made.
The one issue now is that integration with other Identity providers does not work now
since it still calls my server with the username from the external provider. How can I
tell Keycloak that when a user comes from an external Identity provider not to check the
user Federation provider?
Thank you,
Reed Lewis
From: Scott Rossillo
<<mailto:srossillo@smartling.com>srossillo@smartling.com<mailto:srossillo@smartling.com>>
Date: Friday, January 15, 2016 at 4:42 PM
To: Thomas Darimont
<thomas.darimont@googlemail.com<mailto:thomas.darimont@googlemail.com>>, Reed
Lewis <RLewis@carbonite.com<mailto:RLewis@carbonite.com>>
Cc:
"<mailto:keycloak-user@lists.jboss.org>keycloak-user@lists.jboss.org<mailto:keycloak-user@lists.jboss.org>"
<keycloak-user@lists.jboss.org<mailto:keycloak-user@lists.jboss.org>>
Subject: Re: [keycloak-user] External Username, Password, Email... dataset with Keycloak
We just put up and blog post[0] and some sample code[1] on how to do this type of
migration.
[0]: http://tech.smartling.com/migrate-to-keycloak-with-zero-downtime/
[1]: https://github.com/Smartling/keycloak-user-migration-provider
Scott Rossillo
Smartling | Senior Software Engineer
srossillo@smartling.com<mailto:srossillo@smartling.com>
[Latest News +
Events]<https://app.sigstr.com/uc/55e5d41c6533390d03580000>
[Powered by Sigstr]<http://www.sigstr.com/>
On Jan 15, 2016, at 11:06 AM, Thomas Darimont
<<mailto:thomas.darimont@googlemail.com>thomas.darimont@googlemail.com<mailto:thomas.darimont@googlemail.com>>
wrote:
Hello Reed,
as you already wrote, you can write a federation provider that queries your
backend service via REST for user data.
Within the federation provider you can then import the user data
returned from the REST call.
This would work as follows - within the method:
org.keycloak.models.UserFederationProvider.getUserByUsername(RealmModel, String)
you call your backend REST service.
As a next step you create a new user with the given username
UserModel keycloakUser = session.userStorage().addUser(realm, username);
Then you copy all the user data from your backend into Keycloak's UserModel.
After that your backend user has a corresponding representation in Keycloak
with a reference to this federation provider (id) via the
"userModel.federationLink" property.
The federation link will also be shown in the user page in the keycloak admin console.
As long as the federation link is in place keycloak will ask the federation provider
for the latest user data. Once you decide to cut the link to the federation provider you
can
simply do userModel.setFederationLink(null). You could basically cut (or rather omit) the
federation
link right after you added the user to Keycloak.
Keycloak has no link information after that anymore and it will only use the user data
stored
in the Keycloak database for that particular user.
You also have the option to do that for all your users via:
org.keycloak.models.UserFederationProviderFactory.syncAllUsers(KeycloakSessionFactory,
String, UserFederationProviderModel)
or just use on demand per User when he / she want's to login for the first time.
Cheers,
Thomas
2016-01-15 16:16 GMT+01:00 Reed Lewis
<RLewis@carbonite.com<mailto:RLewis@carbonite.com>>:
Hi,
We are examining KeyCloak (It looks like it can do what we want), but we have the need
to have an external lookup of accounts who are not in KeyCloak in an external database
which is accessible via a REST call. I know about federation, but would prefer to only
check the external datasource if the user is not in KeyCloak, but from then on have all
the data “live” in KeyCloak and never refer to the external datasource again once the
account is “migrated” into KeyCloak.
Can this be done with some modification of federation?
We do not want to add the user accounts directly into KeyCloak as there are many more
there than will ever be in KeyCloak.
Thank you,
Reed Lewis
_______________________________________________
keycloak-user mailing list
keycloak-user@lists.jboss.org<mailto:keycloak-user@lists.jboss.org>
https://lists.jboss.org/mailman/listinfo/keycloak-user
_______________________________________________
keycloak-user mailing list
keycloak-user@lists.jboss.org<mailto:keycloak-user@lists.jboss.org>
https://lists.jboss.org/mailman/listinfo/keycloak-user
_______________________________________________
keycloak-user mailing list
keycloak-user@lists.jboss.org<mailto:keycloak-user@lists.jboss.org>https://lists.jboss.org/mailman/listinfo/keycloak-user
11:01 a.m.
Are you using "userStorage()" also for calling getUserByEmail? That
should skip federation call too. Otherwise you can add some additional
logging and check why method "checkExistingUser" returns something.
Btv. you don't need to change Keycloak classes directly, but you can
create your own subclass and register it as SPI (similarly like your
UserFederationSPI provider. See this chapter for details [1]) and then
create modification of "first broker login" authentication flow, which
will use your changed authenticator instead of default
IdpCreateUserIfUniqueAuthenticator. See [2]
[1]
http://keycloak.github.io/docs/userguide/keycloak-server/html/providers.html
[2]
http://keycloak.github.io/docs/userguide/keycloak-server/html/identity-br...
Marek
On 28/01/16 22:26, Reed Lewis wrote:
I modified the Keycloak code directly in the method you mentioned,
recompiled the whole package, and attempted to use it. The issue now
is that when I log in using a external Identity provider, and have a
User Federation defined, I still get called in my user federation with
the username that is from the IDP. Plus the login screen shows me a
screen with “ACCOUNT ALREADY EXISTS” and an option to review the
profile info or Link Google with existing account.
The account does not exist before starting the login process.
Thank you for all your help in getting this working. I am attempting
to use 1.8RC3 BTW.
Reed
From: Marek Posolda <mposolda(a)redhat.com <mailto:mposolda@redhat.com>>
Date: Thursday, January 28, 2016 at 6:12 AM
To: Reed Lewis <RLewis(a)carbonite.com <mailto:RLewis@carbonite.com>>,
Scott Rossillo <srossillo(a)smartling.com <mailto:srossillo@smartling.com>>
Cc: "keycloak-user(a)lists.jboss.org
<mailto:keycloak-user@lists.jboss.org>" <keycloak-user(a)lists.jboss.org
<mailto:keycloak-user@lists.jboss.org>>
Subject: Re: [keycloak-user] External Username, Password, Email...
dataset with Keycloak
Hi,
If you're using Keycloak version 1.7 or later, you can create new
"firstBrokerLogin" flow and replace "Create User If Unique"
authenticator with your own implementation. You can create subclass of
IdpCreateUserIfUniqueAuthenticator and override method
"checkExistingUser" to not look for username at federation provider.
It can be done if you use:
context.getSession().*userStorage()*.getUserByUsername(username,
context.getRealm());
instead of:
context.getSession().*users()*.getUserByUsername(username,
context.getRealm());
Same for email checking.
In that case if you login with user "john" from external identity
provider, the authenticator won't try to find this "john" user in your
external federation provider, but just in Keycloak DB.
Is this what you are trying to achieve?
Btv. As pointed already, the keycloak username for user registered
from external IDP looks like "google.john" by default . You can change
this behaviour to use identity provider mapper for username, which
allows you to change the username template and remove broker prefix
from that. So Keycloak will treat this username as "john". In 1.9 we
plan to remove broker prefix by default and we will always just the
username from broker, because "first login flow" added in Keycloak 1.7
allow us to easily resolve username conflicts. Corresponding JIRA is:
https://issues.jboss.org/browse/KEYCLOAK-2292
Marek
On 27/01/16 21:28, Reed Lewis wrote:
> It looks like no matter which External IDP I use, it always checks
> the federation provider also which is not something that I think
> wants to be done. Is this a bug in the Keycloak software?
>
> So it looks like one cannot do external IDP and federation at the
> same time. This should be fixed.
>
> Reed
>
> From: Scott Rossillo <srossillo(a)smartling.com
> <mailto:srossillo@smartling.com>>
> Date: Wednesday, January 27, 2016 at 1:02 PM
> To: Reed Lewis <RLewis(a)carbonite.com>
> Cc: Thomas Darimont <thomas.darimont(a)googlemail.com
> <mailto:thomas.darimont@googlemail.com>>,
> "keycloak-user(a)lists.jboss.org
> <mailto:keycloak-user@lists.jboss.org>"
> <keycloak-user(a)lists.jboss.org <mailto:keycloak-user@lists.jboss.org>>
> Subject: Re: [keycloak-user] External Username, Password, Email...
> dataset with Keycloak
>
> I think that’s a more general question about user account merging so
> maybe one of the core devs can chime in. However, I just want to
> clarify, you don’t want to query the federation provider at all when
> a user signs in with external IDP, right? In that case, you could
> modify the findByUsername() method to not create a user if the login
> is with a IDP. I’m not sure if it still exists in 1.7+ but the
> username used to be created as idp.email(a)provider.com
> <mailto:idp.email@provider.com> where the IDP is the username prefix.
>
> Does that make sense / sufficiently address the use case?
>
> ~ Scott
>
>> On Jan 27, 2016, at 12:34 PM, Reed Lewis <RLewis(a)carbonite.com
>> <mailto:RLewis@carbonite.com>> wrote:
>>
>> This is working for me now. I created a service that listens on a
>> port and implements the GET, HEAD and POST requests that are being made.
>>
>> The one issue now is that integration with other Identity providers
>> does not work now since it still calls my server with the username
>> from the external provider. How can I tell Keycloak that when a
>> user comes from an external Identity provider not to check the user
>> Federation provider?
>>
>> Thank you,
>>
>> Reed Lewis
>>
>> From: Scott Rossillo <srossillo(a)smartling.com>
>> Date: Friday, January 15, 2016 at 4:42 PM
>> To: Thomas Darimont <thomas.darimont(a)googlemail.com
>> <mailto:thomas.darimont@googlemail.com>>, Reed Lewis
>> <RLewis(a)carbonite.com <mailto:RLewis@carbonite.com>>
>> Cc: "keycloak-user(a)lists.jboss.org" <keycloak-user(a)lists.jboss.org
>> <mailto:keycloak-user@lists.jboss.org>>
>> Subject: Re: [keycloak-user] External Username, Password, Email...
>> dataset with Keycloak
>>
>> We just put up and blog post[0] and some sample code[1] on how to do
>> this type of migration.
>>
>> [0]: http://tech.smartling.com/migrate-to-keycloak-with-zero-downtime/
>> [1]: https://github.com/Smartling/keycloak-user-migration-provider
>>
>>
>> Scott Rossillo
>> Smartling | Senior Software Engineer
>> srossillo(a)smartling.com <mailto:srossillo@smartling.com>
>>
>> Latest News + Events
>> <https://app.sigstr.com/uc/55e5d41c6533390d03580000>
>> Powered by Sigstr <http://www.sigstr.com/>
>>
>>> On Jan 15, 2016, at 11:06 AM, Thomas Darimont
>>> <thomas.darimont(a)googlemail.com> wrote:
>>>
>>> Hello Reed,
>>>
>>> as you already wrote, you can write a federation provider that
>>> queries your
>>> backend service via REST for user data.
>>> Within the federation provider you can then import the user data
>>> returned from the REST call.
>>>
>>> This would work as follows - within the method:
>>> org.keycloak.models.UserFederationProvider.getUserByUsername(RealmModel,
>>> String)
>>> you call your backend REST service.
>>>
>>> As a next step you create a new user with the given username
>>> UserModel keycloakUser = session.userStorage().addUser(realm,
>>> username);
>>>
>>> Then you copy all the user data from your backend into Keycloak's
>>> UserModel.
>>>
>>> After that your backend user has a corresponding representation in
>>> Keycloak
>>> with a reference to this federation provider (id) via the
>>> "userModel.federationLink" property.
>>>
>>> The federation link will also be shown in the user page in the
>>> keycloak admin console.
>>> As long as the federation link is in place keycloak will ask the
>>> federation provider
>>> for the latest user data. Once you decide to cut the link to the
>>> federation provider you can
>>> simply do userModel.setFederationLink(null). You could basically
>>> cut (or rather omit) the federation
>>> link right after you added the user to Keycloak.
>>>
>>> Keycloak has no link information after that anymore and it will
>>> only use the user data stored
>>> in the Keycloak database for that particular user.
>>>
>>> You also have the option to do that for all your users via:
>>>
org.keycloak.models.UserFederationProviderFactory.syncAllUsers(KeycloakSessionFactory,
>>> String, UserFederationProviderModel)
>>> or just use on demand per User when he / she want's to login for
>>> the first time.
>>>
>>> Cheers,
>>> Thomas
>>>
>>> 2016-01-15 16:16 GMT+01:00 Reed Lewis <RLewis(a)carbonite.com
>>> <mailto:RLewis@carbonite.com>>:
>>>
>>> Hi,
>>> We are examining KeyCloak (It looks like it can do what we
>>> want), but we have the need to have an external lookup of
>>> accounts who are not in KeyCloak in an external database which
>>> is accessible via a REST call. I know about federation, but
>>> would prefer to only check the external datasource if the user
>>> is not in KeyCloak, but from then on have all the data “live”
>>> in KeyCloak and never refer to the external datasource again
>>> once the account is “migrated” into KeyCloak.
>>>
>>>
>>> Can this be done with some modification of federation?
>>>
>>> We do not want to add the user accounts directly into KeyCloak
>>> as there are many more there than will ever be in KeyCloak.
>>>
>>> Thank you,
>>>
>>> Reed Lewis
>>>
>>>
>>> _______________________________________________
>>> keycloak-user mailing list
>>> keycloak-user(a)lists.jboss.org
>>> <mailto:keycloak-user@lists.jboss.org>
>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>
>>>
>>> _______________________________________________
>>> keycloak-user mailing list
>>> keycloak-user(a)lists.jboss.org <mailto:keycloak-user@lists.jboss.org>
>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>
>
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user@lists.jboss.orghttps://lists.jboss.org/mailman/listinfo/keycloak-user
12:48 p.m.
Scott,
We are using your keycloak migration provider from here:
https://github.com/Smartling/keycloak-user-migration-provider
But the issue it seems is that version 2.50 and above of Keycloak has removed the AP that
was being used. Is there any way to easily migrate the code to use whatever Keycloak
provides now?
Thank you,
Reed Lewis
From: Scott Rossillo <srossillo(a)smartling.com>
Date: Wednesday, January 27, 2016 at 1:02 PM
To: Reed Lewis <RLewis(a)carbonite.com>
Cc: Thomas Darimont <thomas.darimont(a)googlemail.com>,
"keycloak-user(a)lists.jboss.org" <keycloak-user(a)lists.jboss.org>
Subject: Re: [keycloak-user] External Username, Password, Email... dataset with Keycloak
I think that’s a more general question about user account merging so maybe one of the core
devs can chime in. However, I just want to clarify, you don’t want to query the federation
provider at all when a user signs in with external IDP, right? In that case, you could
modify the findByUsername() method to not create a user if the login is with a IDP. I’m
not sure if it still exists in 1.7+ but the username used to be created as
idp.email@provider.com<mailto:idp.email@provider.com> where the IDP is the username
prefix.
Does that make sense / sufficiently address the use case?
~ Scott
On Jan 27, 2016, at 12:34 PM, Reed Lewis
<RLewis@carbonite.com<mailto:RLewis@carbonite.com>> wrote:
This is working for me now. I created a service that listens on a port and implements the
GET, HEAD and POST requests that are being made.
The one issue now is that integration with other Identity providers does not work now
since it still calls my server with the username from the external provider. How can I
tell Keycloak that when a user comes from an external Identity provider not to check the
user Federation provider?
Thank you,
Reed Lewis
From: Scott Rossillo
<srossillo@smartling.com<mailto:srossillo@smartling.com>>
Date: Friday, January 15, 2016 at 4:42 PM
To: Thomas Darimont
<thomas.darimont@googlemail.com<mailto:thomas.darimont@googlemail.com>>, Reed
Lewis <RLewis@carbonite.com<mailto:RLewis@carbonite.com>>
Cc: "keycloak-user@lists.jboss.org<mailto:keycloak-user@lists.jboss.org>"
<keycloak-user@lists.jboss.org<mailto:keycloak-user@lists.jboss.org>>
Subject: Re: [keycloak-user] External Username, Password, Email... dataset with Keycloak
We just put up and blog post[0] and some sample code[1] on how to do this type of
migration.
[0]: http://tech.smartling.com/migrate-to-keycloak-with-zero-downtime/
[1]: https://github.com/Smartling/keycloak-user-migration-provider
Scott Rossillo
Smartling | Senior Software Engineer
srossillo@smartling.com<mailto:srossillo@smartling.com>
[atest News + Events]<https://app.sigstr.com/uc/55e5d41c6533390d03580000>
[owered by Sigstr]<http://www.sigstr.com/>
On Jan 15, 2016, at 11:06 AM, Thomas Darimont
<thomas.darimont@googlemail.com<mailto:thomas.darimont@googlemail.com>>
wrote:
Hello Reed,
as you already wrote, you can write a federation provider that queries your
backend service via REST for user data.
Within the federation provider you can then import the user data
returned from the REST call.
This would work as follows - within the method:
org.keycloak.models.UserFederationProvider.getUserByUsername(RealmModel, String)
you call your backend REST service.
As a next step you create a new user with the given username
UserModel keycloakUser = session.userStorage().addUser(realm, username);
Then you copy all the user data from your backend into Keycloak's UserModel.
After that your backend user has a corresponding representation in Keycloak
with a reference to this federation provider (id) via the
"userModel.federationLink" property.
The federation link will also be shown in the user page in the keycloak admin console.
As long as the federation link is in place keycloak will ask the federation provider
for the latest user data. Once you decide to cut the link to the federation provider you
can
simply do userModel.setFederationLink(null). You could basically cut (or rather omit) the
federation
link right after you added the user to Keycloak.
Keycloak has no link information after that anymore and it will only use the user data
stored
in the Keycloak database for that particular user.
You also have the option to do that for all your users via:
org.keycloak.models.UserFederationProviderFactory.syncAllUsers(KeycloakSessionFactory,
String, UserFederationProviderModel)
or just use on demand per User when he / she want's to login for the first time.
Cheers,
Thomas
2016-01-15 16:16 GMT+01:00 Reed Lewis
<RLewis@carbonite.com<mailto:RLewis@carbonite.com>>:
Hi,
We are examining KeyCloak (It looks like it can do what we want), but we have the need
to have an external lookup of accounts who are not in KeyCloak in an external database
which is accessible via a REST call. I know about federation, but would prefer to only
check the external datasource if the user is not in KeyCloak, but from then on have all
the data “live” in KeyCloak and never refer to the external datasource again once the
account is “migrated” into KeyCloak.
Can this be done with some modification of federation?
We do not want to add the user accounts directly into KeyCloak as there are many more
there than will ever be in KeyCloak.
Thank you,
Reed Lewis
_______________________________________________
keycloak-user mailing list
keycloak-user@lists.jboss.org<mailto:keycloak-user@lists.jboss.org>
https://lists.jboss.org/mailman/listinfo/keycloak-user
_______________________________________________
keycloak-user mailing list
keycloak-user@lists.jboss.org<mailto:keycloak-user@lists.jboss.org>
https://lists.jboss.org/mailman/listinfo/keycloak-user
10:21 a.m.
Is there anyone who would know what would need to be changed to make the migration
provider work with Keycloak >= 2.5.0?
Thanks,
Reed
On 1/27/17, 12:48 PM, "keycloak-user-bounces(a)lists.jboss.org on behalf of Reed
Lewis" <keycloak-user-bounces(a)lists.jboss.org on behalf of
RLewis(a)carbonite.com> wrote:
[This sender failed our fraud detection checks and may not be who they appear to be.
Learn about spoofing at http://aka.ms/LearnAboutSpoofing]
Scott,
We are using your keycloak migration provider from here:
https://github.com/Smartling/keycloak-user-migration-provider
But the issue it seems is that version 2.50 and above of Keycloak has removed the AP
that was being used. Is there any way to easily migrate the code to use whatever
Keycloak provides now?
Thank you,
Reed Lewis
From: Scott Rossillo <srossillo(a)smartling.com>
Date: Wednesday, January 27, 2016 at 1:02 PM
To: Reed Lewis <RLewis(a)carbonite.com>
Cc: Thomas Darimont <thomas.darimont(a)googlemail.com>,
"keycloak-user(a)lists.jboss.org" <keycloak-user(a)lists.jboss.org>
Subject: Re: [keycloak-user] External Username, Password, Email... dataset with
Keycloak
I think that’s a more general question about user account merging so maybe one of the
core devs can chime in. However, I just want to clarify, you don’t want to query the
federation provider at all when a user signs in with external IDP, right? In that case,
you could modify the findByUsername() method to not create a user if the login is with a
IDP. I’m not sure if it still exists in 1.7+ but the username used to be created as
idp.email@provider.com<mailto:idp.email@provider.com> where the IDP is the username
prefix.
Does that make sense / sufficiently address the use case?
~ Scott
On Jan 27, 2016, at 12:34 PM, Reed Lewis
<RLewis@carbonite.com<mailto:RLewis@carbonite.com>> wrote:
This is working for me now. I created a service that listens on a port and implements
the GET, HEAD and POST requests that are being made.
The one issue now is that integration with other Identity providers does not work now
since it still calls my server with the username from the external provider. How can I
tell Keycloak that when a user comes from an external Identity provider not to check the
user Federation provider?
Thank you,
Reed Lewis
From: Scott Rossillo
<srossillo@smartling.com<mailto:srossillo@smartling.com>>
Date: Friday, January 15, 2016 at 4:42 PM
To: Thomas Darimont
<thomas.darimont@googlemail.com<mailto:thomas.darimont@googlemail.com>>, Reed
Lewis <RLewis@carbonite.com<mailto:RLewis@carbonite.com>>
Cc:
"keycloak-user@lists.jboss.org<mailto:keycloak-user@lists.jboss.org>"
<keycloak-user@lists.jboss.org<mailto:keycloak-user@lists.jboss.org>>
Subject: Re: [keycloak-user] External Username, Password, Email... dataset with
Keycloak
We just put up and blog post[0] and some sample code[1] on how to do this type of
migration.
[0]: http://tech.smartling.com/migrate-to-keycloak-with-zero-downtime/
[1]: https://github.com/Smartling/keycloak-user-migration-provider
Scott Rossillo
Smartling | Senior Software Engineer
srossillo@smartling.com<mailto:srossillo@smartling.com>
[atest News + Events]<https://app.sigstr.com/uc/55e5d41c6533390d03580000>
[owered by Sigstr]<http://www.sigstr.com/>
On Jan 15, 2016, at 11:06 AM, Thomas Darimont
<thomas.darimont@googlemail.com<mailto:thomas.darimont@googlemail.com>>
wrote:
Hello Reed,
as you already wrote, you can write a federation provider that queries your
backend service via REST for user data.
Within the federation provider you can then import the user data
returned from the REST call.
This would work as follows - within the method:
org.keycloak.models.UserFederationProvider.getUserByUsername(RealmModel, String)
you call your backend REST service.
As a next step you create a new user with the given username
UserModel keycloakUser = session.userStorage().addUser(realm, username);
Then you copy all the user data from your backend into Keycloak's UserModel.
After that your backend user has a corresponding representation in Keycloak
with a reference to this federation provider (id) via the
"userModel.federationLink" property.
The federation link will also be shown in the user page in the keycloak admin
console.
As long as the federation link is in place keycloak will ask the federation provider
for the latest user data. Once you decide to cut the link to the federation provider
you can
simply do userModel.setFederationLink(null). You could basically cut (or rather omit)
the federation
link right after you added the user to Keycloak.
Keycloak has no link information after that anymore and it will only use the user data
stored
in the Keycloak database for that particular user.
You also have the option to do that for all your users via:
org.keycloak.models.UserFederationProviderFactory.syncAllUsers(KeycloakSessionFactory,
String, UserFederationProviderModel)
or just use on demand per User when he / she want's to login for the first time.
Cheers,
Thomas
2016-01-15 16:16 GMT+01:00 Reed Lewis
<RLewis@carbonite.com<mailto:RLewis@carbonite.com>>:
Hi,
We are examining KeyCloak (It looks like it can do what we want), but we have the
need to have an external lookup of accounts who are not in KeyCloak in an external
database which is accessible via a REST call. I know about federation, but would prefer
to only check the external datasource if the user is not in KeyCloak, but from then on
have all the data “live” in KeyCloak and never refer to the external datasource again once
the account is “migrated” into KeyCloak.
Can this be done with some modification of federation?
We do not want to add the user accounts directly into KeyCloak as there are many more
there than will ever be in KeyCloak.
Thank you,
Reed Lewis
_______________________________________________
keycloak-user mailing list
keycloak-user@lists.jboss.org<mailto:keycloak-user@lists.jboss.org>
https://lists.jboss.org/mailman/listinfo/keycloak-user
_______________________________________________
keycloak-user mailing list
keycloak-user@lists.jboss.org<mailto:keycloak-user@lists.jboss.org>
https://lists.jboss.org/mailman/listinfo/keycloak-user
_______________________________________________
keycloak-user mailing list
keycloak-user(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user
5:36 p.m.
It looks like when the User Federation is enabled, Keycloak cannot add a user to the
system at all. I always get an error.
So the question is the following:
When a user is presented the login screen there are four flows:
1. The user clicks Google/Facebook/etc. and is sent off to the appropriate site, and
then returns back to Keycloak and an account is created correctly
2. The user Creates an account directly on Keycloak and it is created correctly
3. The user has no account on Keycloak but does have an account on a system that we
control and can directly verify username/password and we wish to create an account in
Keycloak that is wholly owned by Keycloak
4.the user has an account on Keycloak and logs in directly.
Is this possible?
Reed
From: Scott Rossillo
<srossillo@smartling.com<mailto:srossillo@smartling.com>>
Date: Friday, January 15, 2016 at 4:42 PM
To: Thomas Darimont
<thomas.darimont@googlemail.com<mailto:thomas.darimont@googlemail.com>>, Reed
Lewis <RLewis@carbonite.com<mailto:RLewis@carbonite.com>>
Cc: "keycloak-user@lists.jboss.org<mailto:keycloak-user@lists.jboss.org>"
<keycloak-user@lists.jboss.org<mailto:keycloak-user@lists.jboss.org>>
Subject: Re: [keycloak-user] External Username, Password, Email... dataset with Keycloak
We just put up and blog post[0] and some sample code[1] on how to do this type of
migration.
[0]: http://tech.smartling.com/migrate-to-keycloak-with-zero-downtime/
[1]: https://github.com/Smartling/keycloak-user-migration-provider
Scott Rossillo
Smartling | Senior Software Engineer
srossillo@smartling.com<mailto:srossillo@smartling.com>
[Latest News + Events]<https://app.sigstr.com/uc/55e5d41c6533390d03580000>
[Powered by Sigstr]<http://www.sigstr.com/>
On Jan 15, 2016, at 11:06 AM, Thomas Darimont
<thomas.darimont@googlemail.com<mailto:thomas.darimont@googlemail.com>>
wrote:
Hello Reed,
as you already wrote, you can write a federation provider that queries your
backend service via REST for user data.
Within the federation provider you can then import the user data
returned from the REST call.
This would work as follows - within the method:
org.keycloak.models.UserFederationProvider.getUserByUsername(RealmModel, String)
you call your backend REST service.
As a next step you create a new user with the given username
UserModel keycloakUser = session.userStorage().addUser(realm, username);
Then you copy all the user data from your backend into Keycloak's UserModel.
After that your backend user has a corresponding representation in Keycloak
with a reference to this federation provider (id) via the
"userModel.federationLink" property.
The federation link will also be shown in the user page in the keycloak admin console.
As long as the federation link is in place keycloak will ask the federation provider
for the latest user data. Once you decide to cut the link to the federation provider you
can
simply do userModel.setFederationLink(null). You could basically cut (or rather omit) the
federation
link right after you added the user to Keycloak.
Keycloak has no link information after that anymore and it will only use the user data
stored
in the Keycloak database for that particular user.
You also have the option to do that for all your users via:
org.keycloak.models.UserFederationProviderFactory.syncAllUsers(KeycloakSessionFactory,
String, UserFederationProviderModel)
or just use on demand per User when he / she want's to login for the first time.
Cheers,
Thomas
2016-01-15 16:16 GMT+01:00 Reed Lewis
<RLewis@carbonite.com<mailto:RLewis@carbonite.com>>:
Hi,
We are examining KeyCloak (It looks like it can do what we want), but we have the need
to have an external lookup of accounts who are not in KeyCloak in an external database
which is accessible via a REST call. I know about federation, but would prefer to only
check the external datasource if the user is not in KeyCloak, but from then on have all
the data “live” in KeyCloak and never refer to the external datasource again once the
account is “migrated” into KeyCloak.
Can this be done with some modification of federation?
We do not want to add the user accounts directly into KeyCloak as there are many more
there than will ever be in KeyCloak.
Thank you,
Reed Lewis
_______________________________________________
keycloak-user mailing list
keycloak-user@lists.jboss.org<mailto:keycloak-user@lists.jboss.org>
https://lists.jboss.org/mailman/listinfo/keycloak-user
_______________________________________________
keycloak-user mailing list
keycloak-user@lists.jboss.org<mailto:keycloak-user@lists.jboss.org>
https://lists.jboss.org/mailman/listinfo/keycloak-user
2632
days inactive
3021
days old
16 comments
4 participants
participants (4)
-
Marek Posolda -
Reed Lewis -
Scott Rossillo -
Thomas Darimont