6:36 a.m.
I have an app secured by keycloak. Going to a secured page brings up a keycloak login page
and the correct user/password gives the expected results.
Within the client, I have switched on user registation. So now the login page shows a
register link, which displays another keycloak page allowing the user to register with
name, username, email.
This "works" in that the user is added to the keycloak user database. But the
application displays the error page because a role is not mapped to that user in
keycloak.
What I would like to happen is to be able to add the new user to the apps own user
database, associate a role with the user, perhaps do some verification of the user.
So I don't really know what keycloak is sending back to the app except that it
eventually leads to /error. Is there a way to tell keycloak after a new registration
contact this url where things can happen within the app?
I realise that I could set a default role. But I really want a way of telling keycloak to
go to a specific URL after a new user registration is completed.
Regards,
7:28 a.m.
Not sure I understand the use-case 100% correctly, bu I think you can:
- Implement EventListener, which will allow you to do some callback when
registration of new user happens in Keycloak. For example add some role
or other data specific to your application to the DB used by your
application
- Use the single redirect URL as an "entry point" of your application.
Or eventually use something like servlet filter (if your application is
servlet based) or something similar. That may allow you to doublecheck
the content of the IDToken and check if the user is "known" to your DB
(then it's not new user) or it is unknown user (hence new registered
user). You can also check the "createdDate" of user in the token and
compare with current time .
Hopefully some of those options (or some slight variant of it) will work
for your use-case.
Marek
On 22. 09. 19 13:36, John Norris wrote:
I have an app secured by keycloak. Going to a secured page brings up
a keycloak login page and the correct user/password gives the expected results.
Within the client, I have switched on user registation. So now the login page shows a
register link, which displays another keycloak page allowing the user to register with
name, username, email.
This "works" in that the user is added to the keycloak user database. But the
application displays the error page because a role is not mapped to that user in
keycloak.
What I would like to happen is to be able to add the new user to the apps own user
database, associate a role with the user, perhaps do some verification of the user.
So I don't really know what keycloak is sending back to the app except that it
eventually leads to /error. Is there a way to tell keycloak after a new registration
contact this url where things can happen within the app?
I realise that I could set a default role. But I really want a way of telling keycloak to
go to a specific URL after a new user registration is completed.
Regards,
_______________________________________________
keycloak-user mailing list
keycloak-user(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user
8:27 a.m.
Thanks for this Marek.
"Use the single redirect URL as an "entry point" of your
application." How would the application know that it had come from new user
registration? I already have a root URL set for the client?
What would be useful is if return from new user mapped to a particular endpoint. Could I
raise that as an enhancement? So within keycloak client admin, with the allow registration
switch, add an endpoint as well.
Regards
John
Get Outlook for Android<https://aka.ms/ghei36>
________________________________
From: Marek Posolda <mposolda(a)redhat.com>
Sent: Tuesday, September 24, 2019 1:28:17 PM
To: John Norris <johnnorris-10(a)outlook.com>; keycloak-user(a)lists.jboss.org
<keycloak-user(a)lists.jboss.org>
Subject: Re: [keycloak-user] register new user; redirect to specific client url
Not sure I understand the use-case 100% correctly, bu I think you can:
- Implement EventListener, which will allow you to do some callback when
registration of new user happens in Keycloak. For example add some role
or other data specific to your application to the DB used by your
application
- Use the single redirect URL as an "entry point" of your application.
Or eventually use something like servlet filter (if your application is
servlet based) or something similar. That may allow you to doublecheck
the content of the IDToken and check if the user is "known" to your DB
(then it's not new user) or it is unknown user (hence new registered
user). You can also check the "createdDate" of user in the token and
compare with current time .
Hopefully some of those options (or some slight variant of it) will work
for your use-case.
Marek
On 22. 09. 19 13:36, John Norris wrote:
I have an app secured by keycloak. Going to a secured page brings up
a keycloak login page and the correct user/password gives the expected results.
Within the client, I have switched on user registation. So now the login page shows a
register link, which displays another keycloak page allowing the user to register with
name, username, email.
This "works" in that the user is added to the keycloak user database. But the
application displays the error page because a role is not mapped to that user in
keycloak.
What I would like to happen is to be able to add the new user to the apps own user
database, associate a role with the user, perhaps do some verification of the user.
So I don't really know what keycloak is sending back to the app except that it
eventually leads to /error. Is there a way to tell keycloak after a new registration
contact this url where things can happen within the app?
I realise that I could set a default role. But I really want a way of telling keycloak to
go to a specific URL after a new user registration is completed.
Regards,
_______________________________________________
keycloak-user mailing list
keycloak-user(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user
8:52 a.m.
On 24. 09. 19 15:27, John Norris wrote:
Thanks for this Marek.
"Use the single redirect URL as an "entry point" of your
application." How would the application know that it had come from new
user registration? I already have a root URL set for the client?
What would be useful is if return from new user mapped to a particular
endpoint. Could I raise that as an enhancement? So within keycloak
client admin, with the allow registration switch, add an endpoint as well.
Assume you have always single redirect-uri and process both "new user"
and "old user" requests. Your application may need to:
- Take a look at the ID Token and parse it's content
- Based on if you have some DB if user data, you can then check your DB
if user is known. If not, you know that it's maybe registration of new user
- If you don't have any DB with user data, you can possibly check the
token and look if some claim like "createdDate" exists in the token and
corresponds with the latest time (or is close to it). This can help to
decide if it's new user or not. The "createdDate" is not added to token
by default AFAIK, but you can possibly add protocolMapper to your
client. In tab "Client Scope" of the client in Keycloak admin console,
you can test how the token will look like and if it contains
"createdDate" claim with expected value.
I would personally try to do something along those lines.
Marek
Regards
John
Get Outlook for Android <https://aka.ms/ghei36>
------------------------------------------------------------------------
*From:* Marek Posolda <mposolda(a)redhat.com>
*Sent:* Tuesday, September 24, 2019 1:28:17 PM
*To:* John Norris <johnnorris-10(a)outlook.com>;
keycloak-user(a)lists.jboss.org <keycloak-user(a)lists.jboss.org>
*Subject:* Re: [keycloak-user] register new user; redirect to specific
client url
Not sure I understand the use-case 100% correctly, bu I think you can:
- Implement EventListener, which will allow you to do some callback when
registration of new user happens in Keycloak. For example add some role
or other data specific to your application to the DB used by your
application
- Use the single redirect URL as an "entry point" of your application.
Or eventually use something like servlet filter (if your application is
servlet based) or something similar. That may allow you to doublecheck
the content of the IDToken and check if the user is "known" to your DB
(then it's not new user) or it is unknown user (hence new registered
user). You can also check the "createdDate" of user in the token and
compare with current time .
Hopefully some of those options (or some slight variant of it) will work
for your use-case.
Marek
On 22. 09. 19 13:36, John Norris wrote:
> I have an app secured by keycloak. Going to a secured page brings up
a keycloak login page and the correct user/password gives the expected
results.
> Within the client, I have switched on user registation. So now the
login page shows a register link, which displays another keycloak page
allowing the user to register with name, username, email.
> This "works" in that the user is added to the keycloak user
database. But the application displays the error page because a role
is not mapped to that user in keycloak.
> What I would like to happen is to be able to add the new user to the
apps own user database, associate a role with the user, perhaps do
some verification of the user.
> So I don't really know what keycloak is sending back to the app
except that it eventually leads to /error. Is there a way to tell
keycloak after a new registration contact this url where things can
happen within the app?
>
> I realise that I could set a default role. But I really want a way
of telling keycloak to go to a specific URL after a new user
registration is completed.
>
> Regards,
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user(a)lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
10:57 a.m.
Hi Marek,
am I asking for something unusual here?
It seems that if Keycloak is going to give "register new user" functionality
then there should be an easy straightforward way for the application of knowing that is
what has happened and taking any necessary action.
My application is built on Spring Boot 2. You mentioned previously about java filters.
Looking at
https://www.keycloak.org/docs/latest/securing_apps/index.html#_servlet_fi..., and
that has a code example of
<filter-mapping>
<filter-name>Keycloak Filter</filter-name>
<url-pattern>/keycloak/*</url-pattern>
<url-pattern>/protected/*</url-pattern>
</filter-mapping>
Spring Boot 2 has a Keycloak adapter so would adding a
@GetMapping("/keycloak/**") mean that keycloak would return from registration to
here? This is where an extra field for user registration would be useful to have a url it
could return to.
Regards,
John
2:30 a.m.
Hi John,
On 25. 09. 19 17:57, John Norris wrote:
Hi Marek,
am I asking for something unusual here?
Yes, to be honest :) Or at least I can't recall any other similar
request in the past. I think most applications don't care if user is
brand new user, who was just registered or if it is the old keycloak
user. In OIDC protocol, there is "redirect_uri" sent in the initial
request and that is always where the Keycloak will redirect regardless
of whether there was user registered or just existing user
authenticated. I understand your use-case, however I don't think it's
very common.
To your particular problem, there should be solution as I mentioned
already. Either the event listener or parse the token in your
application and then decide if it's new user or existing user based on
"createdDate" claim. For more hints, I suggest to take a look at Spring
Boot 2 applications and our adapter quickstarts. There should be
something to show how to obtain token in your app and parse it. Adding
"createdDate" claim or something like this should be also possible.
Marek
It seems that if Keycloak is going to give "register new
user"
functionality then there should be an easy straightforward way for the
application of knowing that is what has happened and taking any
necessary action.
My application is built on Spring Boot 2. You mentioned previously
about java filters. Looking at
https://www.keycloak.org/docs/latest/securing_apps/index.html#_servlet_fi...,
and that has a code example of
|<filter-mapping> <filter-name>Keycloak Filter</filter-name>
<url-pattern>/keycloak/*</url-pattern>
<url-pattern>/protected/*</url-pattern> </filter-mapping>|
Spring Boot 2 has a Keycloak adapter so would adding a
@GetMapping("/keycloak/**") mean that keycloak would return from
registration to here? This is where an extra field for user
registration would be useful to have a url it could return to.
Regards,
John
4:05 a.m.
Hi Marek,
it is not unusual for me to be the only one to think something is obvious. Unfortunately
not a very useful character trait.
You mentioned event listeners. Just so we are talking about the same thing, you mean the
events in the admin console?
So, I could write my own event listener for keycloak and it would show up here (currently
the two built in event listeners are jboss-logging and email). Then save events to
"on" and remove all events except for register? And that event listener would be
able to call my application "post-register" endpoint?
And my java code is a separate project and then the jar is registered as a module in
keycloak? (section 6.2.2 of the Server Developer docs)
Looking at the docs
https://access.redhat.com/documentation/en-us/red_hat_single_sign-on/7.0/...,
that mentions keycloak-server.json. I have keycloak 6.0.1 and that does not have this
file. Has it been replaced with application.keystore? Which is a binary file and so
uneditable.
Could you point me in the direction of some documentation for producing a custom event
listener with lots of examples?
Regards,
John
4:36 a.m.
Hello John,
I happen to have written a MQTT event listener for keycloak:
https://github.com/mhuin/keycloak-event-listener-mqtt - it's mostly based
on the text event listener you can find in the keycloak-examples repository
on github.
It's kind of "alpha" status because there aren't tests and it
doesn't
support config parameters, and also mostly because my Java skills are
extremely limited; but I managed to make it work with Keycloak 6 a while
ago and in my specific MQTT setup, following KC's documentation about SPIs.
Hopefully it'll give you some pointers to achieve what you want. Also, feel
free to contribute to it if you can!
Best regards,
MHU
On Thu, Sep 26, 2019 at 11:09 AM John Norris <johnnorris-10(a)outlook.com>
wrote:
Hi Marek,
it is not unusual for me to be the only one to think something is obvious.
Unfortunately not a very useful character trait.
You mentioned event listeners. Just so we are talking about the same
thing, you mean the events in the admin console?
So, I could write my own event listener for keycloak and it would show up
here (currently the two built in event listeners are jboss-logging and
email). Then save events to "on" and remove all events except for register?
And that event listener would be able to call my application
"post-register" endpoint?
And my java code is a separate project and then the jar is registered as a
module in keycloak? (section 6.2.2 of the Server Developer docs)
Looking at the docs
https://access.redhat.com/documentation/en-us/red_hat_single_sign-on/7.0/...,
that mentions keycloak-server.json. I have keycloak 6.0.1 and that does not
have this file. Has it been replaced with application.keystore? Which is a
binary file and so uneditable.
Could you point me in the direction of some documentation for producing a
custom event listener with lots of examples?
Regards,
John
_______________________________________________
keycloak-user mailing list
keycloak-user(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user
--
Matthieu Huin
Senior Software Developper
Red Hat <https://www.redhat.com>
<https://red.ht/sig>
1932
days inactive
1936
days old
7 comments
3 participants
participants (3)
-
John Norris -
Marek Posolda -
Matthieu Huin