5:50 a.m.
Stian,
I have an application deployed on Tomcat 7 using the Tomcat Adapter.
When i'm logged in and I go to a non-secured URL, KeycloakSecurityContext returns
null.
I deployed the same application to the Keycloak Standalone Server, there I don't have
this problem.
At Tomcat the code below returns null when called from /movies/, and works when called
from /article/
At Keycloak Standalone Server /movies/ and /article/ works fine.
(KeycloakSecurityContext) request.getAttribute(KeycloakSecurityContext.class.getName());
Why is this happening?
In my web.xml I have only one security-constraint securing /article/*
WEB.XML:
<security-constraint>
<web-resource-collection>
<web-resource-name>Articles</web-resource-name>
<url-pattern>/article/*</url-pattern>
</web-resource-collection>
<auth-constraint>
<role-name>user</role-name>
</auth-constraint>
</security-constraint>
--
Leonardo Nunes
________________________________
Esta mensagem pode conter informa??o confidencial e/ou privilegiada. Se voc? n?o for o
destinat?rio ou a pessoa autorizada a receber esta mensagem, n?o poder? usar, copiar ou
divulgar as informa??es nela contidas ou tomar qualquer a??o baseada nessas informa??es.
Se voc? recebeu esta mensagem por engano, por favor avise imediatamente o remetente,
respondendo o e-mail e em seguida apague-o. Agradecemos sua coopera??o.
This message may contain confidential and/or privileged information. If you are not the
addressee or authorized to receive this for the addressee, you must not use, copy,
disclose or take any action based on this message or any information herein. If you have
received this message in error, please advise the sender immediately by reply e-mail and
delete this message. Thank you for your cooperation
7:12 a.m.
This is down to the fact that there are differences between different
containers. In reality you can only guarantee that KeycloakSecurityContext
as long as the request requires authentication. Add a security-constraint
for movies and you're fine.
On 18 February 2016 at 12:50, LEONARDO NUNES <leo.nunes(a)gjccorp.com.br>
wrote:
Stian,
I have an application deployed on Tomcat 7 using the Tomcat Adapter.
When i'm logged in and I go to a non-secured URL, KeycloakSecurityContext
returns null.
I deployed the same application to the Keycloak Standalone Server, there I
don't have this problem.
At Tomcat the code below returns null when called from /movies/, and works
when called from /article/
At Keycloak Standalone Server /movies/ and /article/ works fine.
(KeycloakSecurityContext)
request.getAttribute(KeycloakSecurityContext.class.getName());
Why is this happening?
In my web.xml I have only one security-constraint securing /article/*
WEB.XML:
<security-constraint>
<web-resource-collection>
<web-resource-name>Articles</web-resource-name>
<url-pattern>/article/*</url-pattern>
</web-resource-collection>
<auth-constraint>
<role-name>user</role-name>
</auth-constraint>
</security-constraint>
--
Leonardo Nunes
------------------------------
*Esta mensagem pode conter informação confidencial e/ou privilegiada. Se
você não for o destinatário ou a pessoa autorizada a receber esta mensagem,
não poderá usar, copiar ou divulgar as informações nela contidas ou tomar
qualquer ação baseada nessas informações. Se você recebeu esta mensagem por
engano, por favor avise imediatamente o remetente, respondendo o e-mail e
em seguida apague-o. Agradecemos sua cooperação. This message may contain
confidential and/or privileged information. If you are not the addressee or
authorized to receive this for the addressee, you must not use, copy,
disclose or take any action based on this message or any information
herein. If you have received this message in error, please advise the
sender immediately by reply e-mail and delete this message. Thank you for
your cooperation*
7:22 a.m.
Hi Stian, thanks for your replay.
The problem is that /movies is a page that doesn't require the user to be logged in.
But when he is logged in and goes to /movies, I need retrieve user information.
If I add a security-constraint for movies the user will be redirected to the login page,
and this can't happen.
Is there another way I can do this?
From: Stian Thorgersen <sthorger@redhat.com<mailto:sthorger@redhat.com>>
Reply-To: "stian@redhat.com<mailto:stian@redhat.com>"
<stian@redhat.com<mailto:stian@redhat.com>>
Date: quinta-feira, 18 de fevereiro de 2016 11:12
To: Leonardo Nunes
<leo.nunes@gjccorp.com.br<mailto:leo.nunes@gjccorp.com.br>>
Cc: "keycloak-user@lists.jboss.org<mailto:keycloak-user@lists.jboss.org>"
<keycloak-user@lists.jboss.org<mailto:keycloak-user@lists.jboss.org>>
Subject: Re: KeycloakSecurityContext returns NULL using Tomcat Adapter
This is down to the fact that there are differences between different containers. In
reality you can only guarantee that KeycloakSecurityContext as long as the request
requires authentication. Add a security-constraint for movies and you're fine.
On 18 February 2016 at 12:50, LEONARDO NUNES
<leo.nunes@gjccorp.com.br<mailto:leo.nunes@gjccorp.com.br>> wrote:
Stian,
I have an application deployed on Tomcat 7 using the Tomcat Adapter.
When i'm logged in and I go to a non-secured URL, KeycloakSecurityContext returns
null.
I deployed the same application to the Keycloak Standalone Server, there I don't have
this problem.
At Tomcat the code below returns null when called from /movies/, and works when called
from /article/
At Keycloak Standalone Server /movies/ and /article/ works fine.
(KeycloakSecurityContext) request.getAttribute(KeycloakSecurityContext.class.getName());
Why is this happening?
In my web.xml I have only one security-constraint securing /article/*
WEB.XML:
<security-constraint>
<web-resource-collection>
<web-resource-name>Articles</web-resource-name>
<url-pattern>/article/*</url-pattern>
</web-resource-collection>
<auth-constraint>
<role-name>user</role-name>
</auth-constraint>
</security-constraint>
--
Leonardo Nunes
________________________________
Esta mensagem pode conter informação confidencial e/ou privilegiada. Se você não for o
destinatário ou a pessoa autorizada a receber esta mensagem, não poderá usar, copiar ou
divulgar as informações nela contidas ou tomar qualquer ação baseada nessas informações.
Se você recebeu esta mensagem por engano, por favor avise imediatamente o remetente,
respondendo o e-mail e em seguida apague-o. Agradecemos sua cooperação.
This message may contain confidential and/or privileged information. If you are not the
addressee or authorized to receive this for the addressee, you must not use, copy,
disclose or take any action based on this message or any information herein. If you have
received this message in error, please advise the sender immediately by reply e-mail and
delete this message. Thank you for your cooperation
8:08 a.m.
Log a jira. I'll look into fixing it in the next few weeks.
On 2/18/2016 8:22 AM, LEONARDO NUNES wrote:
Hi Stian, thanks for your replay.
The problem is that /movies is a page that doesn't require the user to
be logged in.
But when he is logged in and goes to /movies, I need retrieve user
information.
If I add a security-constraint for movies the user will be redirected
to the login page, and this can't happen.
Is there another way I can do this?
From: Stian Thorgersen <sthorger(a)redhat.com <mailto:sthorger@redhat.com>>
Reply-To: "stian(a)redhat.com <mailto:stian@redhat.com>"
<stian(a)redhat.com <mailto:stian@redhat.com>>
Date: quinta-feira, 18 de fevereiro de 2016 11:12
To: Leonardo Nunes <leo.nunes(a)gjccorp.com.br
<mailto:leo.nunes@gjccorp.com.br>>
Cc: "keycloak-user(a)lists.jboss.org
<mailto:keycloak-user@lists.jboss.org>" <keycloak-user(a)lists.jboss.org
<mailto:keycloak-user@lists.jboss.org>>
Subject: Re: KeycloakSecurityContext returns NULL using Tomcat Adapter
This is down to the fact that there are differences between different
containers. In reality you can only guarantee
that KeycloakSecurityContext as long as the request requires
authentication. Add a security-constraint for movies and you're fine.
On 18 February 2016 at 12:50, LEONARDO NUNES <leo.nunes(a)gjccorp.com.br
<mailto:leo.nunes@gjccorp.com.br>> wrote:
Stian,
I have an application deployed on Tomcat 7 using the Tomcat Adapter.
When i'm logged in and I go to a non-secured URL,
KeycloakSecurityContext returns null.
I deployed the same application to the Keycloak Standalone Server,
there I don't have this problem.
At Tomcat the code below returns null when called from /movies/,
and works when called from /article/
At Keycloak Standalone Server /movies/ and /article/ works fine.
(KeycloakSecurityContext)
request.getAttribute(KeycloakSecurityContext.class.getName());
Why is this happening?
In my web.xml I have only one security-constraint securing /article/*
WEB.XML:
<security-constraint>
<web-resource-collection>
<web-resource-name>Articles</web-resource-name>
<url-pattern>/article/*</url-pattern>
</web-resource-collection>
<auth-constraint>
<role-name>user</role-name>
</auth-constraint>
</security-constraint>
--
Leonardo Nunes
------------------------------------------------------------------------
/Esta mensagem pode conter informação confidencial e/ou
privilegiada. Se você não for o destinatário ou a pessoa
autorizada a receber esta mensagem, não poderá usar, copiar ou
divulgar as informações nela contidas ou tomar qualquer ação
baseada nessas informações. Se você recebeu esta mensagem por
engano, por favor avise imediatamente o remetente, respondendo o
e-mail e em seguida apague-o. Agradecemos sua cooperação.
This message may contain confidential and/or privileged
information. If you are not the addressee or authorized to receive
this for the addressee, you must not use, copy, disclose or take
any action based on this message or any information herein. If you
have received this message in error, please advise the sender
immediately by reply e-mail and delete this message. Thank you for
your cooperation/
_______________________________________________
keycloak-user mailing list
keycloak-user(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user
--
Bill Burke
JBoss, a division of Red Hat
http://bill.burkecentral.com
7:44 a.m.
Hi everyone,
This problem might stop me from using Keycloak, it's been a week since i'm trying
to find a way to make it work but I couldn't find any.
If it's a container issue, is there another way to make it work?
What can I do to access information from the current logged in user at a page that is not
secured at the security-contraints at web.xml?
The code below returns null at pages that is not secured, even when the user is logged
in.
If the application is deployed to Wildfly it works, but it doesn't work at Jboss EAP
and Apache Tomcat.
(KeycloakPrincipal) req.getUserPrincipal()
Or
(KeycloakSecurityContext) req.getAttribute(KeycloakSecurityContext.class.getName())
All of our applications is deployed to Jboss EAP and Apache Tomcat.
--
Leonardo
From: Stian Thorgersen <sthorger@redhat.com<mailto:sthorger@redhat.com>>
Reply-To: "stian@redhat.com<mailto:stian@redhat.com>"
<stian@redhat.com<mailto:stian@redhat.com>>
Date: quinta-feira, 18 de fevereiro de 2016 11:12
To: Leonardo Nunes
<leo.nunes@gjccorp.com.br<mailto:leo.nunes@gjccorp.com.br>>
Cc: "keycloak-user@lists.jboss.org<mailto:keycloak-user@lists.jboss.org>"
<keycloak-user@lists.jboss.org<mailto:keycloak-user@lists.jboss.org>>
Subject: Re: KeycloakSecurityContext returns NULL using Tomcat Adapter
This is down to the fact that there are differences between different containers. In
reality you can only guarantee that KeycloakSecurityContext as long as the request
requires authentication. Add a security-constraint for movies and you're fine.
On 18 February 2016 at 12:50, LEONARDO NUNES
<leo.nunes@gjccorp.com.br<mailto:leo.nunes@gjccorp.com.br>> wrote:
Stian,
I have an application deployed on Tomcat 7 using the Tomcat Adapter.
When i'm logged in and I go to a non-secured URL, KeycloakSecurityContext returns
null.
I deployed the same application to the Keycloak Standalone Server, there I don't have
this problem.
At Tomcat the code below returns null when called from /movies/, and works when called
from /article/
At Keycloak Standalone Server /movies/ and /article/ works fine.
(KeycloakSecurityContext) request.getAttribute(KeycloakSecurityContext.class.getName());
Why is this happening?
In my web.xml I have only one security-constraint securing /article/*
WEB.XML:
<security-constraint>
<web-resource-collection>
<web-resource-name>Articles</web-resource-name>
<url-pattern>/article/*</url-pattern>
</web-resource-collection>
<auth-constraint>
<role-name>user</role-name>
</auth-constraint>
</security-constraint>
--
Leonardo Nunes
________________________________
Esta mensagem pode conter informação confidencial e/ou privilegiada. Se você não for o
destinatário ou a pessoa autorizada a receber esta mensagem, não poderá usar, copiar ou
divulgar as informações nela contidas ou tomar qualquer ação baseada nessas informações.
Se você recebeu esta mensagem por engano, por favor avise imediatamente o remetente,
respondendo o e-mail e em seguida apague-o. Agradecemos sua cooperação.
This message may contain confidential and/or privileged information. If you are not the
addressee or authorized to receive this for the addressee, you must not use, copy,
disclose or take any action based on this message or any information herein. If you have
received this message in error, please advise the sender immediately by reply e-mail and
delete this message. Thank you for your cooperation
8:16 a.m.
Hi I just saw your response asking me to open a Jira.
I have just opened now.
https://issues.jboss.org/browse/KEYCLOAK-2518
This is very important for us to continue the project to put Keycloak into production at
our company.
Thank you.
--
Att,
Leonardo Nunes
Analista de Sistemas
leo.nunes@gjccorp.com.br<mailto:leo.nunes@gjccorp.com.br>
Skype: leonardo.puc
+55 (62) 3250-1462
Grupo Jaime Câmara
www.gjccorp.com.br<applewebdata://B0E38BB5-8499-4F51-929B-00F21C9F6683...
From: Leonardo Nunes
<leo.nunes@gjccorp.com.br<mailto:leo.nunes@gjccorp.com.br>>
Date: segunda-feira, 22 de fevereiro de 2016 10:44
To: "keycloak-user@lists.jboss.org<mailto:keycloak-user@lists.jboss.org>"
<keycloak-user@lists.jboss.org<mailto:keycloak-user@lists.jboss.org>>
Subject: Re: KeycloakSecurityContext returns NULL using Tomcat Adapter
Hi everyone,
This problem might stop me from using Keycloak, it's been a week since i'm trying
to find a way to make it work but I couldn't find any.
If it's a container issue, is there another way to make it work?
What can I do to access information from the current logged in user at a page that is not
secured at the security-contraints at web.xml?
The code below returns null at pages that is not secured, even when the user is logged
in.
If the application is deployed to Wildfly it works, but it doesn't work at Jboss EAP
and Apache Tomcat.
(KeycloakPrincipal) req.getUserPrincipal()
Or
(KeycloakSecurityContext) req.getAttribute(KeycloakSecurityContext.class.getName())
All of our applications is deployed to Jboss EAP and Apache Tomcat.
--
Leonardo
From: Stian Thorgersen <sthorger@redhat.com<mailto:sthorger@redhat.com>>
Reply-To: "stian@redhat.com<mailto:stian@redhat.com>"
<stian@redhat.com<mailto:stian@redhat.com>>
Date: quinta-feira, 18 de fevereiro de 2016 11:12
To: Leonardo Nunes
<leo.nunes@gjccorp.com.br<mailto:leo.nunes@gjccorp.com.br>>
Cc: "keycloak-user@lists.jboss.org<mailto:keycloak-user@lists.jboss.org>"
<keycloak-user@lists.jboss.org<mailto:keycloak-user@lists.jboss.org>>
Subject: Re: KeycloakSecurityContext returns NULL using Tomcat Adapter
This is down to the fact that there are differences between different containers. In
reality you can only guarantee that KeycloakSecurityContext as long as the request
requires authentication. Add a security-constraint for movies and you're fine.
On 18 February 2016 at 12:50, LEONARDO NUNES
<leo.nunes@gjccorp.com.br<mailto:leo.nunes@gjccorp.com.br>> wrote:
Stian,
I have an application deployed on Tomcat 7 using the Tomcat Adapter.
When i'm logged in and I go to a non-secured URL, KeycloakSecurityContext returns
null.
I deployed the same application to the Keycloak Standalone Server, there I don't have
this problem.
At Tomcat the code below returns null when called from /movies/, and works when called
from /article/
At Keycloak Standalone Server /movies/ and /article/ works fine.
(KeycloakSecurityContext) request.getAttribute(KeycloakSecurityContext.class.getName());
Why is this happening?
In my web.xml I have only one security-constraint securing /article/*
WEB.XML:
<security-constraint>
<web-resource-collection>
<web-resource-name>Articles</web-resource-name>
<url-pattern>/article/*</url-pattern>
</web-resource-collection>
<auth-constraint>
<role-name>user</role-name>
</auth-constraint>
</security-constraint>
--
Leonardo Nunes
________________________________
Esta mensagem pode conter informação confidencial e/ou privilegiada. Se você não for o
destinatário ou a pessoa autorizada a receber esta mensagem, não poderá usar, copiar ou
divulgar as informações nela contidas ou tomar qualquer ação baseada nessas informações.
Se você recebeu esta mensagem por engano, por favor avise imediatamente o remetente,
respondendo o e-mail e em seguida apague-o. Agradecemos sua cooperação.
This message may contain confidential and/or privileged information. If you are not the
addressee or authorized to receive this for the addressee, you must not use, copy,
disclose or take any action based on this message or any information herein. If you have
received this message in error, please advise the sender immediately by reply e-mail and
delete this message. Thank you for your cooperation
3216
days inactive
3220
days old
5 comments
3 participants
participants (3)
-
Bill Burke -
LEONARDO NUNES -
Stian Thorgersen