7:16 a.m.
After login, i get in my app, and for all my ajax request from page to
backing bean, i receive response 401 even if the session is still alive.
If removed autodetect-bearer-only option, all work fine, but going back to
the old error.
XMLHttpRequest cannot load http://dc09-apps-06:8090/auth/
realms/azovstal/protocol/openid-connect/auth?…ml&state=
60%2F01fc2e79-6fc0-46b8-9f83-39b7421fedf9&login=true&scope=openid. No
'Access-Control-Allow-Origin' header is present on the requested resource.
Origin 'http://localhost:8080' is therefore not allowed access.
---------- Forwarded message ---------
From: Adam Daduev <daduev.ad(a)gmail.com>
Date: вт, 10 янв. 2017 г. в 14:08
Subject: Re: [keycloak-user] Error when session expired and ajax request
execute in Keycloak?
To: <stian(a)redhat.com>
I tried, but does not work.
Firstly, i add autodetect-bearer-only option via adapter subsystem, wildfly
not started, he not know autodetect-bearer-only option, then, i added via
json, wildfly started and app was deployed.
Secondly, on my ajax request to backing bean, i receive response 401 and
does not happend.
This is my keycloak.json
{
"realm": "azovstal",
"auth-server-url": "http://dc09-apps-06:8090/auth",
"ssl-required": "none",
"resource": "web-test",
"public-client": true,
"use-resource-role-mappings": true,
"autodetect-bearer-only": true
}
вт, 10 янв. 2017 г. в 10:19, <daduev.ad(a)gmail.com>:
Ok, I try, thanks.
10 янв. 2017 г., в 07:07, Stian Thorgersen <sthorger(a)redhat.com> написал(а):
In that case take a look at the new autodetect-bearer-only option. You'll
need 2.5.0.Final for that.
On 9 January 2017 at 19:18, <daduev.ad(a)gmail.com> wrote:
No, I have jsf 2 app with richfaces framework, which deploy on wildfly
10.1.
9 янв. 2017 г., в 14:51, Stian Thorgersen <sthorger(a)redhat.com> написал(а):
[Adding list back]
A web app redirects the user to a login page if not authenticated, while a
service should return a 401.
It sounds like what you have is a JS application with a service backend. In
Keycloak you should have two separate types of clients for that. The JS
application should be a public client, while the services a bearer-only
client.
On 9 January 2017 at 13:39, Adam Daduev <daduev.ad(a)gmail.com> wrote:
Thanks for the answer.
Yes i have confidential client, i have web application, that asks
Keycloak server
to authenticate a user for them. As I understand, bearer-only is for web
services clients.
I probably something do not understand?
2017-01-09 11:44 GMT+02:00 Stian Thorgersen <sthorger(a)redhat.com>:
Looks like your services are configured as confidential clients rather than
bearer-only and hence is sending a login request back rather than a 401.
You should either swap your service war to be a bearer-only client or use
the new autodetect-bearer-only option in adapters if you have both web
pages and services in the same war.
On 8 January 2017 at 23:29, Adam Daduev <daduev.ad(a)gmail.com> wrote:
Hi, can you help me!
When session expired and ajax request execute in Keycloak, i have error in
browser console:
XMLHttpRequest cannot load http://dc09-apps-06:8090/auth/
realms/azovstal/protocol/openid-connect/auth?…ml&state=
60%2F01fc2e79-6fc0-46b8-9f83-39b7421fedf9&login=true&scope=openid. No
'Access-Control-Allow-Origin' header is present on the requested resource.
Origin 'http://localhost:8080' is therefore not allowed access.
I add in Keycloak admin console, in the client setting, Web Origins=
http://localhost:8080 (or *), and enabled cors in app, but still has error
in console. I used Keycloak 2.5.0
_______________________________________________
keycloak-user mailing list
keycloak-user(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user
8:34 a.m.
Might be that it's expecting a token in the ajax request rather than
checking for a session, not 100% sure though. RichFaces won't work unless
we can support securing the requests from the session.
Can you create a JIRA bug for this please? If you can attach a simple
example we can build and deploy to reproduce the issue that would be
extremely helpful and we would be able to look at it sooner.
On 12 January 2017 at 07:16, Adam Daduev <daduev.ad(a)gmail.com> wrote:
After login, i get in my app, and for all my ajax request from page
to
backing bean, i receive response 401 even if the session is still alive.
If removed autodetect-bearer-only option, all work fine, but going back to
the old error.
XMLHttpRequest cannot load http://dc09-apps-06:8090/auth/
realms/azovstal/protocol/openid-connect/auth?…ml&state=
60%2F01fc2e79-6fc0-46b8-9f83-39b7421fedf9&login=true&scope=openid. No
'Access-Control-Allow-Origin' header is present on the requested resource.
Origin 'http://localhost:8080' is therefore not allowed access.
---------- Forwarded message ---------
From: Adam Daduev <daduev.ad(a)gmail.com>
Date: вт, 10 янв. 2017 г. в 14:08
Subject: Re: [keycloak-user] Error when session expired and ajax request
execute in Keycloak?
To: <stian(a)redhat.com>
I tried, but does not work.
Firstly, i add autodetect-bearer-only option via adapter subsystem, wildfly
not started, he not know autodetect-bearer-only option, then, i added via
json, wildfly started and app was deployed.
Secondly, on my ajax request to backing bean, i receive response 401 and
does not happend.
This is my keycloak.json
{
"realm": "azovstal",
"auth-server-url": "http://dc09-apps-06:8090/auth",
"ssl-required": "none",
"resource": "web-test",
"public-client": true,
"use-resource-role-mappings": true,
"autodetect-bearer-only": true
}
вт, 10 янв. 2017 г. в 10:19, <daduev.ad(a)gmail.com>:
Ok, I try, thanks.
10 янв. 2017 г., в 07:07, Stian Thorgersen <sthorger(a)redhat.com>
написал(а):
In that case take a look at the new autodetect-bearer-only option. You'll
need 2.5.0.Final for that.
On 9 January 2017 at 19:18, <daduev.ad(a)gmail.com> wrote:
No, I have jsf 2 app with richfaces framework, which deploy on wildfly
10.1.
9 янв. 2017 г., в 14:51, Stian Thorgersen <sthorger(a)redhat.com>
написал(а):
[Adding list back]
A web app redirects the user to a login page if not authenticated, while a
service should return a 401.
It sounds like what you have is a JS application with a service backend. In
Keycloak you should have two separate types of clients for that. The JS
application should be a public client, while the services a bearer-only
client.
On 9 January 2017 at 13:39, Adam Daduev <daduev.ad(a)gmail.com> wrote:
Thanks for the answer.
Yes i have confidential client, i have web application, that asks
Keycloak server
to authenticate a user for them. As I understand, bearer-only is for web
services clients.
I probably something do not understand?
2017-01-09 11:44 GMT+02:00 Stian Thorgersen <sthorger(a)redhat.com>:
Looks like your services are configured as confidential clients rather than
bearer-only and hence is sending a login request back rather than a 401.
You should either swap your service war to be a bearer-only client or use
the new autodetect-bearer-only option in adapters if you have both web
pages and services in the same war.
On 8 January 2017 at 23:29, Adam Daduev <daduev.ad(a)gmail.com> wrote:
Hi, can you help me!
When session expired and ajax request execute in Keycloak, i have error in
browser console:
XMLHttpRequest cannot load http://dc09-apps-06:8090/auth/
realms/azovstal/protocol/openid-connect/auth?…ml&state=
60%2F01fc2e79-6fc0-46b8-9f83-39b7421fedf9&login=true&scope=openid. No
'Access-Control-Allow-Origin' header is present on the requested resource.
Origin 'http://localhost:8080' is therefore not allowed access.
I add in Keycloak admin console, in the client setting, Web Origins=
http://localhost:8080 (or *), and enabled cors in app, but still has error
in console. I used Keycloak 2.5.0
_______________________________________________
keycloak-user mailing list
keycloak-user(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user
_______________________________________________
keycloak-user mailing list
keycloak-user(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user
9:53 a.m.
I created JIRA bug, and add simple example.
https://issues.jboss.org/browse/KEYCLOAK-4214
пт, 13 янв. 2017 г. в 9:34, Stian Thorgersen <sthorger(a)redhat.com>:
Might be that it's expecting a token in the ajax request rather
than
checking for a session, not 100% sure though. RichFaces won't work unless
we can support securing the requests from the session.
Can you create a JIRA bug for this please? If you can attach a simple
example we can build and deploy to reproduce the issue that would be
extremely helpful and we would be able to look at it sooner.
On 12 January 2017 at 07:16, Adam Daduev <daduev.ad(a)gmail.com> wrote:
After login, i get in my app, and for all my ajax request from page to
backing bean, i receive response 401 even if the session is still alive.
If removed autodetect-bearer-only option, all work fine, but going back to
the old error.
XMLHttpRequest cannot load http://dc09-apps-06:8090/auth/
realms/azovstal/protocol/openid-connect/auth?…ml&state=
60%2F01fc2e79-6fc0-46b8-9f83-39b7421fedf9&login=true&scope=openid. No
'Access-Control-Allow-Origin' header is present on the requested resource.
Origin 'http://localhost:8080' is therefore not allowed access.
---------- Forwarded message ---------
From: Adam Daduev <daduev.ad(a)gmail.com>
Date: вт, 10 янв. 2017 г. в 14:08
Subject: Re: [keycloak-user] Error when session expired and ajax request
execute in Keycloak?
To: <stian(a)redhat.com>
I tried, but does not work.
Firstly, i add autodetect-bearer-only option via adapter subsystem, wildfly
not started, he not know autodetect-bearer-only option, then, i added via
json, wildfly started and app was deployed.
Secondly, on my ajax request to backing bean, i receive response 401 and
does not happend.
This is my keycloak.json
{
"realm": "azovstal",
"auth-server-url": "http://dc09-apps-06:8090/auth",
"ssl-required": "none",
"resource": "web-test",
"public-client": true,
"use-resource-role-mappings": true,
"autodetect-bearer-only": true
}
вт, 10 янв. 2017 г. в 10:19, <daduev.ad(a)gmail.com>:
Ok, I try, thanks.
10 янв. 2017 г., в 07:07, Stian Thorgersen <sthorger(a)redhat.com>
написал(а):
In that case take a look at the new autodetect-bearer-only option. You'll
need 2.5.0.Final for that.
On 9 January 2017 at 19:18, <daduev.ad(a)gmail.com> wrote:
No, I have jsf 2 app with richfaces framework, which deploy on wildfly
10.1.
9 янв. 2017 г., в 14:51, Stian Thorgersen <sthorger(a)redhat.com>
написал(а):
[Adding list back]
A web app redirects the user to a login page if not authenticated, while a
service should return a 401.
It sounds like what you have is a JS application with a service backend. In
Keycloak you should have two separate types of clients for that. The JS
application should be a public client, while the services a bearer-only
client.
On 9 January 2017 at 13:39, Adam Daduev <daduev.ad(a)gmail.com> wrote:
Thanks for the answer.
Yes i have confidential client, i have web application, that asks
Keycloak server
to authenticate a user for them. As I understand, bearer-only is for web
services clients.
I probably something do not understand?
2017-01-09 11:44 GMT+02:00 Stian Thorgersen <sthorger(a)redhat.com>:
Looks like your services are configured as confidential clients rather than
bearer-only and hence is sending a login request back rather than a 401.
You should either swap your service war to be a bearer-only client or use
the new autodetect-bearer-only option in adapters if you have both web
pages and services in the same war.
On 8 January 2017 at 23:29, Adam Daduev <daduev.ad(a)gmail.com> wrote:
Hi, can you help me!
When session expired and ajax request execute in Keycloak, i have error in
browser console:
XMLHttpRequest cannot load http://dc09-apps-06:8090/auth/
realms/azovstal/protocol/openid-connect/auth?…ml&state=
60%2F01fc2e79-6fc0-46b8-9f83-39b7421fedf9&login=true&scope=openid. No
'Access-Control-Allow-Origin' header is present on the requested resource.
Origin 'http://localhost:8080' is therefore not allowed access.
I add in Keycloak admin console, in the client setting, Web Origins=
http://localhost:8080 (or *), and enabled cors in app, but still has error
in console. I used Keycloak 2.5.0
_______________________________________________
keycloak-user mailing list
keycloak-user(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user
_______________________________________________
keycloak-user mailing list
keycloak-user(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user
2:47 p.m.
Hi Adam,
I started today to look at your ticket. First of all, thank you for the
provided example, it makes it really easier to reproduce.
So Stian is right, it's expecting a token which isn't present and therefore
returning a 401.
Stian suggested that we should maybe support ajax request secured with the
session (to support Richfaces ajax requests).
I would like to have the opinion of everyone here, is that something we
want ? Doesn't we break any specs here (I have no idea just asking) ?
Anyway I will start looking how this change could be implemented.
Seb
On Fri, Jan 13, 2017 at 9:53 AM, Adam Daduev <daduev.ad(a)gmail.com> wrote:
I created JIRA bug, and add simple example.
https://issues.jboss.org/browse/KEYCLOAK-4214
пт, 13 янв. 2017 г. в 9:34, Stian Thorgersen <sthorger(a)redhat.com>:
> Might be that it's expecting a token in the ajax request rather than
> checking for a session, not 100% sure though. RichFaces won't work unless
> we can support securing the requests from the session.
>
> Can you create a JIRA bug for this please? If you can attach a simple
> example we can build and deploy to reproduce the issue that would be
> extremely helpful and we would be able to look at it sooner.
>
> On 12 January 2017 at 07:16, Adam Daduev <daduev.ad(a)gmail.com> wrote:
>
> After login, i get in my app, and for all my ajax request from page to
> backing bean, i receive response 401 even if the session is still alive.
> If removed autodetect-bearer-only option, all work fine, but going back
to
> the old error.
>
> XMLHttpRequest cannot load http://dc09-apps-06:8090/auth/
> realms/azovstal/protocol/openid-connect/auth?…ml&state=
> 60%2F01fc2e79-6fc0-46b8-9f83-39b7421fedf9&login=true&scope=openid. No
> 'Access-Control-Allow-Origin' header is present on the requested
resource.
> Origin 'http://localhost:8080' is therefore not allowed access.
>
> ---------- Forwarded message ---------
> From: Adam Daduev <daduev.ad(a)gmail.com>
> Date: вт, 10 янв. 2017 г. в 14:08
> Subject: Re: [keycloak-user] Error when session expired and ajax request
> execute in Keycloak?
> To: <stian(a)redhat.com>
>
>
> I tried, but does not work.
> Firstly, i add autodetect-bearer-only option via adapter subsystem,
wildfly
> not started, he not know autodetect-bearer-only option, then, i added via
> json, wildfly started and app was deployed.
> Secondly, on my ajax request to backing bean, i receive response 401 and
> does not happend.
> This is my keycloak.json
> {
> "realm": "azovstal",
> "auth-server-url": "http://dc09-apps-06:8090/auth",
> "ssl-required": "none",
> "resource": "web-test",
> "public-client": true,
> "use-resource-role-mappings": true,
> "autodetect-bearer-only": true
> }
>
> вт, 10 янв. 2017 г. в 10:19, <daduev.ad(a)gmail.com>:
>
> Ok, I try, thanks.
>
> 10 янв. 2017 г., в 07:07, Stian Thorgersen <sthorger(a)redhat.com>
> написал(а):
>
> In that case take a look at the new autodetect-bearer-only option. You'll
> need 2.5.0.Final for that.
>
> On 9 January 2017 at 19:18, <daduev.ad(a)gmail.com> wrote:
>
> No, I have jsf 2 app with richfaces framework, which deploy on wildfly
> 10.1.
>
> 9 янв. 2017 г., в 14:51, Stian Thorgersen <sthorger(a)redhat.com>
> написал(а):
>
> [Adding list back]
>
> A web app redirects the user to a login page if not authenticated, while
a
> service should return a 401.
>
> It sounds like what you have is a JS application with a service backend.
In
> Keycloak you should have two separate types of clients for that. The JS
> application should be a public client, while the services a bearer-only
> client.
>
> On 9 January 2017 at 13:39, Adam Daduev <daduev.ad(a)gmail.com> wrote:
>
> Thanks for the answer.
> Yes i have confidential client, i have web application, that asks
> Keycloak server
> to authenticate a user for them. As I understand, bearer-only is for web
> services clients.
> I probably something do not understand?
>
> 2017-01-09 11:44 GMT+02:00 Stian Thorgersen <sthorger(a)redhat.com>:
>
> Looks like your services are configured as confidential clients rather
than
> bearer-only and hence is sending a login request back rather than a 401.
> You should either swap your service war to be a bearer-only client or use
> the new autodetect-bearer-only option in adapters if you have both web
> pages and services in the same war.
>
> On 8 January 2017 at 23:29, Adam Daduev <daduev.ad(a)gmail.com> wrote:
>
> Hi, can you help me!
> When session expired and ajax request execute in Keycloak, i have error
in
> browser console:
>
> XMLHttpRequest cannot load http://dc09-apps-06:8090/auth/
> realms/azovstal/protocol/openid-connect/auth?…ml&state=
> 60%2F01fc2e79-6fc0-46b8-9f83-39b7421fedf9&login=true&scope=openid. No
> 'Access-Control-Allow-Origin' header is present on the requested
resource.
> Origin 'http://localhost:8080' is therefore not allowed access.
>
> I add in Keycloak admin console, in the client setting, Web Origins=
> http://localhost:8080 (or *), and enabled cors in app, but still has
error
> in console. I used Keycloak 2.5.0
> _______________________________________________
> keycloak-user mailing list
> keycloak-user(a)lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
> _______________________________________________
> keycloak-user mailing list
> keycloak-user(a)lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
>
>
_______________________________________________
keycloak-user mailing list
keycloak-user(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user
6:43 p.m.
Hi Seb,
For all i do not say, but i would wanted. About specs, i do not know. I use
Keycloak in my application, and i can not to report user when session is
expired. I do not know whether i said, but when occur redirect request, not
ajax request, i catched error with jsf exception handler (there is in my
example CommonExceptionHandler), and to report users, i want that same
occurred with my ajax request. It is occur not only in Richfaces, but in
Primefaces, i think it it happens with all jsf ajax request.
And one more, i observed that keycloak session expire early than i setup in
the keycloak admin console, and in keycloak log i have warning, error
refresh token. Maybe these problems are bind, i do not know.
I have one little question, can i disable refresh token, use Implicit Flow,
when i disabled Authorization Code Flow, nothing works?
Thank you.
ср, 12 апр. 2017 г. в 15:47, Sebastien Blanc <sblanc(a)redhat.com>:
Hi Adam,
I started today to look at your ticket. First of all, thank you for the
provided example, it makes it really easier to reproduce.
So Stian is right, it's expecting a token which isn't present and
therefore returning a 401.
Stian suggested that we should maybe support ajax request secured with the
session (to support Richfaces ajax requests).
I would like to have the opinion of everyone here, is that something we
want ? Doesn't we break any specs here (I have no idea just asking) ?
Anyway I will start looking how this change could be implemented.
Seb
On Fri, Jan 13, 2017 at 9:53 AM, Adam Daduev <daduev.ad(a)gmail.com> wrote:
> I created JIRA bug, and add simple example.
> https://issues.jboss.org/browse/KEYCLOAK-4214
>
>
> пт, 13 янв. 2017 г. в 9:34, Stian Thorgersen <sthorger(a)redhat.com>:
>
> > Might be that it's expecting a token in the ajax request rather than
> > checking for a session, not 100% sure though. RichFaces won't work
> unless
> > we can support securing the requests from the session.
> >
> > Can you create a JIRA bug for this please? If you can attach a simple
> > example we can build and deploy to reproduce the issue that would be
> > extremely helpful and we would be able to look at it sooner.
> >
> > On 12 January 2017 at 07:16, Adam Daduev <daduev.ad(a)gmail.com> wrote:
> >
> > After login, i get in my app, and for all my ajax request from page to
> > backing bean, i receive response 401 even if the session is still alive.
> > If removed autodetect-bearer-only option, all work fine, but going back
> to
> > the old error.
> >
> > XMLHttpRequest cannot load http://dc09-apps-06:8090/auth/
> > realms/azovstal/protocol/openid-connect/auth?…ml&state=
> > 60%2F01fc2e79-6fc0-46b8-9f83-39b7421fedf9&login=true&scope=openid. No
> > 'Access-Control-Allow-Origin' header is present on the requested
> resource.
> > Origin 'http://localhost:8080' is therefore not allowed access.
> >
> > ---------- Forwarded message ---------
> > From: Adam Daduev <daduev.ad(a)gmail.com>
> > Date: вт, 10 янв. 2017 г. в 14:08
> > Subject: Re: [keycloak-user] Error when session expired and ajax request
> > execute in Keycloak?
> > To: <stian(a)redhat.com>
> >
> >
> > I tried, but does not work.
> > Firstly, i add autodetect-bearer-only option via adapter subsystem,
> wildfly
> > not started, he not know autodetect-bearer-only option, then, i added
> via
> > json, wildfly started and app was deployed.
> > Secondly, on my ajax request to backing bean, i receive response 401 and
> > does not happend.
> > This is my keycloak.json
> > {
> > "realm": "azovstal",
> > "auth-server-url": "http://dc09-apps-06:8090/auth",
> > "ssl-required": "none",
> > "resource": "web-test",
> > "public-client": true,
> > "use-resource-role-mappings": true,
> > "autodetect-bearer-only": true
> > }
> >
> > вт, 10 янв. 2017 г. в 10:19, <daduev.ad(a)gmail.com>:
> >
> > Ok, I try, thanks.
> >
> > 10 янв. 2017 г., в 07:07, Stian Thorgersen <sthorger(a)redhat.com>
> > написал(а):
> >
> > In that case take a look at the new autodetect-bearer-only option.
> You'll
> > need 2.5.0.Final for that.
> >
> > On 9 January 2017 at 19:18, <daduev.ad(a)gmail.com> wrote:
> >
> > No, I have jsf 2 app with richfaces framework, which deploy on wildfly
> > 10.1.
> >
> > 9 янв. 2017 г., в 14:51, Stian Thorgersen <sthorger(a)redhat.com>
> > написал(а):
> >
> > [Adding list back]
> >
> > A web app redirects the user to a login page if not authenticated,
> while a
> > service should return a 401.
> >
> > It sounds like what you have is a JS application with a service
> backend. In
> > Keycloak you should have two separate types of clients for that. The JS
> > application should be a public client, while the services a bearer-only
> > client.
> >
> > On 9 January 2017 at 13:39, Adam Daduev <daduev.ad(a)gmail.com> wrote:
> >
> > Thanks for the answer.
> > Yes i have confidential client, i have web application, that asks
> > Keycloak server
> > to authenticate a user for them. As I understand, bearer-only is for web
> > services clients.
> > I probably something do not understand?
> >
> > 2017-01-09 11:44 GMT+02:00 Stian Thorgersen <sthorger(a)redhat.com>:
> >
> > Looks like your services are configured as confidential clients rather
> than
> > bearer-only and hence is sending a login request back rather than a 401.
> > You should either swap your service war to be a bearer-only client or
> use
> > the new autodetect-bearer-only option in adapters if you have both web
> > pages and services in the same war.
> >
> > On 8 January 2017 at 23:29, Adam Daduev <daduev.ad(a)gmail.com> wrote:
> >
> > Hi, can you help me!
> > When session expired and ajax request execute in Keycloak, i have error
> in
> > browser console:
> >
> > XMLHttpRequest cannot load http://dc09-apps-06:8090/auth/
> > realms/azovstal/protocol/openid-connect/auth?…ml&state=
> > 60%2F01fc2e79-6fc0-46b8-9f83-39b7421fedf9&login=true&scope=openid. No
> > 'Access-Control-Allow-Origin' header is present on the requested
> resource.
> > Origin 'http://localhost:8080' is therefore not allowed access.
> >
> > I add in Keycloak admin console, in the client setting, Web Origins=
> > http://localhost:8080 (or *), and enabled cors in app, but still has
> error
> > in console. I used Keycloak 2.5.0
> > _______________________________________________
> > keycloak-user mailing list
> > keycloak-user(a)lists.jboss.org
> > https://lists.jboss.org/mailman/listinfo/keycloak-user
> > _______________________________________________
> > keycloak-user mailing list
> > keycloak-user(a)lists.jboss.org
> > https://lists.jboss.org/mailman/listinfo/keycloak-user
> >
> >
> >
> _______________________________________________
> keycloak-user mailing list
> keycloak-user(a)lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
8:04 a.m.
Hi Seb,
Is there progress in this issue, in which release will be fixed this bug?
Thanks.
чт, 13 апр. 2017 г. в 19:43, Adam Daduev <daduev.ad(a)gmail.com>:
Hi Seb,
For all i do not say, but i would wanted. About specs, i do not know. I
use Keycloak in my application, and i can not to report user when session
is expired. I do not know whether i said, but when occur redirect request,
not ajax request, i catched error with jsf exception handler (there is in
my example CommonExceptionHandler), and to report users, i want that same
occurred with my ajax request. It is occur not only in Richfaces, but in
Primefaces, i think it it happens with all jsf ajax request.
And one more, i observed that keycloak session expire early than i setup
in the keycloak admin console, and in keycloak log i have warning, error
refresh token. Maybe these problems are bind, i do not know.
I have one little question, can i disable refresh token, use Implicit
Flow, when i disabled Authorization Code Flow, nothing works?
Thank you.
ср, 12 апр. 2017 г. в 15:47, Sebastien Blanc <sblanc(a)redhat.com>:
> Hi Adam,
>
> I started today to look at your ticket. First of all, thank you for the
> provided example, it makes it really easier to reproduce.
>
> So Stian is right, it's expecting a token which isn't present and
> therefore returning a 401.
> Stian suggested that we should maybe support ajax request secured with
> the session (to support Richfaces ajax requests).
>
> I would like to have the opinion of everyone here, is that something we
> want ? Doesn't we break any specs here (I have no idea just asking) ?
>
> Anyway I will start looking how this change could be implemented.
>
> Seb
>
>
> On Fri, Jan 13, 2017 at 9:53 AM, Adam Daduev <daduev.ad(a)gmail.com> wrote:
>
>> I created JIRA bug, and add simple example.
>> https://issues.jboss.org/browse/KEYCLOAK-4214
>>
>>
>> пт, 13 янв. 2017 г. в 9:34, Stian Thorgersen <sthorger(a)redhat.com>:
>>
>> > Might be that it's expecting a token in the ajax request rather than
>> > checking for a session, not 100% sure though. RichFaces won't work
>> unless
>> > we can support securing the requests from the session.
>> >
>> > Can you create a JIRA bug for this please? If you can attach a simple
>> > example we can build and deploy to reproduce the issue that would be
>> > extremely helpful and we would be able to look at it sooner.
>> >
>> > On 12 January 2017 at 07:16, Adam Daduev <daduev.ad(a)gmail.com> wrote:
>> >
>> > After login, i get in my app, and for all my ajax request from page to
>> > backing bean, i receive response 401 even if the session is still
>> alive.
>> > If removed autodetect-bearer-only option, all work fine, but going
>> back to
>> > the old error.
>> >
>> > XMLHttpRequest cannot load http://dc09-apps-06:8090/auth/
>> > realms/azovstal/protocol/openid-connect/auth?…ml&state=
>> > 60%2F01fc2e79-6fc0-46b8-9f83-39b7421fedf9&login=true&scope=openid.
No
>> > 'Access-Control-Allow-Origin' header is present on the requested
>> resource.
>> > Origin 'http://localhost:8080' is therefore not allowed access.
>> >
>> > ---------- Forwarded message ---------
>> > From: Adam Daduev <daduev.ad(a)gmail.com>
>> > Date: вт, 10 янв. 2017 г. в 14:08
>> > Subject: Re: [keycloak-user] Error when session expired and ajax
>> request
>> > execute in Keycloak?
>> > To: <stian(a)redhat.com>
>> >
>> >
>> > I tried, but does not work.
>> > Firstly, i add autodetect-bearer-only option via adapter subsystem,
>> wildfly
>> > not started, he not know autodetect-bearer-only option, then, i added
>> via
>> > json, wildfly started and app was deployed.
>> > Secondly, on my ajax request to backing bean, i receive response 401
>> and
>> > does not happend.
>> > This is my keycloak.json
>> > {
>> > "realm": "azovstal",
>> > "auth-server-url": "http://dc09-apps-06:8090/auth",
>> > "ssl-required": "none",
>> > "resource": "web-test",
>> > "public-client": true,
>> > "use-resource-role-mappings": true,
>> > "autodetect-bearer-only": true
>> > }
>> >
>> > вт, 10 янв. 2017 г. в 10:19, <daduev.ad(a)gmail.com>:
>> >
>> > Ok, I try, thanks.
>> >
>> > 10 янв. 2017 г., в 07:07, Stian Thorgersen <sthorger(a)redhat.com>
>> > написал(а):
>> >
>> > In that case take a look at the new autodetect-bearer-only option.
>> You'll
>> > need 2.5.0.Final for that.
>> >
>> > On 9 January 2017 at 19:18, <daduev.ad(a)gmail.com> wrote:
>> >
>> > No, I have jsf 2 app with richfaces framework, which deploy on wildfly
>> > 10.1.
>> >
>> > 9 янв. 2017 г., в 14:51, Stian Thorgersen <sthorger(a)redhat.com>
>> > написал(а):
>> >
>> > [Adding list back]
>> >
>> > A web app redirects the user to a login page if not authenticated,
>> while a
>> > service should return a 401.
>> >
>> > It sounds like what you have is a JS application with a service
>> backend. In
>> > Keycloak you should have two separate types of clients for that. The JS
>> > application should be a public client, while the services a bearer-only
>> > client.
>> >
>> > On 9 January 2017 at 13:39, Adam Daduev <daduev.ad(a)gmail.com> wrote:
>> >
>> > Thanks for the answer.
>> > Yes i have confidential client, i have web application, that asks
>> > Keycloak server
>> > to authenticate a user for them. As I understand, bearer-only is for
>> web
>> > services clients.
>> > I probably something do not understand?
>> >
>> > 2017-01-09 11:44 GMT+02:00 Stian Thorgersen <sthorger(a)redhat.com>:
>> >
>> > Looks like your services are configured as confidential clients rather
>> than
>> > bearer-only and hence is sending a login request back rather than a
>> 401.
>> > You should either swap your service war to be a bearer-only client or
>> use
>> > the new autodetect-bearer-only option in adapters if you have both web
>> > pages and services in the same war.
>> >
>> > On 8 January 2017 at 23:29, Adam Daduev <daduev.ad(a)gmail.com> wrote:
>> >
>> > Hi, can you help me!
>> > When session expired and ajax request execute in Keycloak, i have
>> error in
>> > browser console:
>> >
>> > XMLHttpRequest cannot load http://dc09-apps-06:8090/auth/
>> > realms/azovstal/protocol/openid-connect/auth?…ml&state=
>> > 60%2F01fc2e79-6fc0-46b8-9f83-39b7421fedf9&login=true&scope=openid.
No
>> > 'Access-Control-Allow-Origin' header is present on the requested
>> resource.
>> > Origin 'http://localhost:8080' is therefore not allowed access.
>> >
>> > I add in Keycloak admin console, in the client setting, Web Origins=
>> > http://localhost:8080 (or *), and enabled cors in app, but still has
>> error
>> > in console. I used Keycloak 2.5.0
>> > _______________________________________________
>> > keycloak-user mailing list
>> > keycloak-user(a)lists.jboss.org
>> > https://lists.jboss.org/mailman/listinfo/keycloak-user
>> > _______________________________________________
>> > keycloak-user mailing list
>> > keycloak-user(a)lists.jboss.org
>> > https://lists.jboss.org/mailman/listinfo/keycloak-user
>> >
>> >
>> >
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user(a)lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>
>
>
2499
days inactive
2660
days old
5 comments
3 participants
participants (3)
-
Adam Daduev -
Sebastien Blanc -
Stian Thorgersen