1:44 a.m.
Isn't it possible to create a cookie or add an url parameter after the logout, so the
user is not logged in automatically?
It's crucial for us to be able to log in as a different user, otherwise we can not use
kerberos at all :(
Michael
Am 22. Juli 2015 um 23:06 schrieb Marek Posolda <mposolda(a)redhat.com>:
I don't think it's doable. Kerberos is kind of desktop login and logout from the
web application won't destroy the kerberos ticket - similarly like it can't logout
your laptop/desktop session. So when you visit the secured application next time, you are
automatically logged into Keycloak through SPNEGO due to the Kerberos ticket.
Hence you need to remove kerberos ticket manually (For example "kdestroy" works
on Linux, but I guess you're using Windows + ActiveDirectory? ) and then you will be
able to see keycloak login screen and login as different user.
Marek
On 22.7.2015 15:38, Michael Gerber wrote:
Hi all,
I use LDAP with Kerberos and would like to logout and login again with a different user
(no kerberos login, just keycloak username and password dialog).
Is that possible?
cheers
Michael
_______________________________________________
keycloak-user mailing list
keycloak-user(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user
2:26 a.m.
New subject: LDAP with Kerberos, login with different user
Do you want that for normal users or just for admin users? Just trying
to understand the usecase. Because AFAIK the point of kerberos is, that
you login into the desktop and then you're automatically logged into
integrated web applications without need to deal with any login screens
and username/password. When user has just one keycloak account
corresponding to his kerberos ticket, then why he need to login as
different user?
I can understand the usecase for admin, when you want to login as
different user for testing purpose etc. For this, isn't it possible in
windows to do something like "kdestroy" to be able to login without
kerberos?
Marek
On 23.7.2015 07:44, Michael Gerber wrote:
Isn't it possible to create a cookie or add an url parameter
after the
logout, so the user is not logged in automatically?
It's crucial for us to be able to log in as a different user,
otherwise we can not use kerberos at all :(
Michael
Am 22. Juli 2015 um 23:06 schrieb Marek Posolda <mposolda(a)redhat.com>:
> I don't think it's doable. Kerberos is kind of desktop login and
> logout from the web application won't destroy the kerberos ticket -
> similarly like it can't logout your laptop/desktop session. So when
> you visit the secured application next time, you are automatically
> logged into Keycloak through SPNEGO due to the Kerberos ticket.
>
> Hence you need to remove kerberos ticket manually (For example
> "kdestroy" works on Linux, but I guess you're using Windows +
> ActiveDirectory? ) and then you will be able to see keycloak login
> screen and login as different user.
>
> Marek
>
> On 22.7.2015 15:38, Michael Gerber wrote:
>> Hi all,
>>
>> I use LDAP with Kerberos and would like to logout and login again
>> with a different user (no kerberos login, just keycloak username and
>> password dialog).
>> Is that possible?
>>
>> cheers
>> Michael
>>
>>
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user(a)lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
2:35 a.m.
New subject: LDAP with Kerberos, login with different user
Maybe we can have special request parameter, which will be send from
application to login screen. The parameter will contain list of
authentication mechanisms, which you want to skip for this login.
Something like "skipAuthType=cookie,kerberos" . The list of skipped
alternative mechanisms will be saved in ClientSession, so authentication
SPI can deal with it.
Not sure if it makes sense to add support into adapter, but maybe
something basic (like we have for parameters "login_hint" or
"kc_idp_hint" in keycloak.js) can be added as well?
Marek
On 23.7.2015 08:26, Marek Posolda wrote:
Do you want that for normal users or just for admin users? Just
trying
to understand the usecase. Because AFAIK the point of kerberos is,
that you login into the desktop and then you're automatically logged
into integrated web applications without need to deal with any login
screens and username/password. When user has just one keycloak account
corresponding to his kerberos ticket, then why he need to login as
different user?
I can understand the usecase for admin, when you want to login as
different user for testing purpose etc. For this, isn't it possible in
windows to do something like "kdestroy" to be able to login without
kerberos?
Marek
On 23.7.2015 07:44, Michael Gerber wrote:
> Isn't it possible to create a cookie or add an url parameter after
> the logout, so the user is not logged in automatically?
>
> It's crucial for us to be able to log in as a different user,
> otherwise we can not use kerberos at all :(
>
> Michael
>
> Am 22. Juli 2015 um 23:06 schrieb Marek Posolda <mposolda(a)redhat.com>:
>
>> I don't think it's doable. Kerberos is kind of desktop login and
>> logout from the web application won't destroy the kerberos ticket -
>> similarly like it can't logout your laptop/desktop session. So when
>> you visit the secured application next time, you are automatically
>> logged into Keycloak through SPNEGO due to the Kerberos ticket.
>>
>> Hence you need to remove kerberos ticket manually (For example
>> "kdestroy" works on Linux, but I guess you're using Windows +
>> ActiveDirectory? ) and then you will be able to see keycloak login
>> screen and login as different user.
>>
>> Marek
>>
>> On 22.7.2015 15:38, Michael Gerber wrote:
>>> Hi all,
>>>
>>> I use LDAP with Kerberos and would like to logout and login again
>>> with a different user (no kerberos login, just keycloak username
>>> and password dialog).
>>> Is that possible?
>>>
>>> cheers
>>> Michael
>>>
>>>
>>> _______________________________________________
>>> keycloak-user mailing list
>>> keycloak-user(a)lists.jboss.org
>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>
3:51 a.m.
New subject: LDAP with Kerberos, login with different user
How about when a user logs out from Keycloak we add a session cookie to not use Kerberos
again automatically? Even better if there's a concept of a session-id with Kerberos we
can add the session-id to the cookie and automatically login if the users Kerberos session
is changed, but otherwise display username/password form.
----- Original Message -----
From: "Marek Posolda" <mposolda(a)redhat.com>
To: "Michael Gerber" <gerbermichi(a)me.com>
Cc: keycloak-user(a)lists.jboss.org
Sent: Thursday, 23 July, 2015 8:35:30 AM
Subject: Re: [keycloak-user] LDAP with Kerberos, login with different user
Maybe we can have special request parameter, which will be send from
application to login screen. The parameter will contain list of
authentication mechanisms, which you want to skip for this login. Something
like "skipAuthType=cookie,kerberos" . The list of skipped alternative
mechanisms will be saved in ClientSession, so authentication SPI can deal
with it.
Not sure if it makes sense to add support into adapter, but maybe something
basic (like we have for parameters "login_hint" or "kc_idp_hint" in
keycloak.js) can be added as well?
Marek
On 23.7.2015 08:26, Marek Posolda wrote:
Do you want that for normal users or just for admin users? Just trying to
understand the usecase. Because AFAIK the point of kerberos is, that you
login into the desktop and then you're automatically logged into integrated
web applications without need to deal with any login screens and
username/password. When user has just one keycloak account corresponding to
his kerberos ticket, then why he need to login as different user?
I can understand the usecase for admin, when you want to login as different
user for testing purpose etc. For this, isn't it possible in windows to do
something like "kdestroy" to be able to login without kerberos?
Marek
On 23.7.2015 07:44, Michael Gerber wrote:
Isn't it possible to create a cookie or add an url parameter after the
logout, so the user is not logged in automatically?
It's crucial for us to be able to log in as a different user, otherwise we
can not use kerberos at all :(
Michael
Am 22. Juli 2015 um 23:06 schrieb Marek Posolda <mposolda(a)redhat.com> :
I don't think it's doable. Kerberos is kind of desktop login and logout from
the web application won't destroy the kerberos ticket - similarly like it
can't logout your laptop/desktop session. So when you visit the secured
application next time, you are automatically logged into Keycloak through
SPNEGO due to the Kerberos ticket.
Hence you need to remove kerberos ticket manually (For example "kdestroy"
works on Linux, but I guess you're using Windows + ActiveDirectory? ) and
then you will be able to see keycloak login screen and login as different
user.
Marek
On 22.7.2015 15:38, Michael Gerber wrote:
Hi all,
I use LDAP with Kerberos and would like to logout and login again with a
different user (no kerberos login, just keycloak username and password
dialog).
Is that possible?
cheers
Michael
_______________________________________________
keycloak-user mailing list keycloak-user(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user
_______________________________________________
keycloak-user mailing list
keycloak-user(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user
7:35 a.m.
New subject: LDAP with Kerberos, login with different user
TBH I am not very confident about adding cookie during logout. Usually
in production, I want to always login with Kerberos and don't deal with
any login screen. Like when I go to https://mojo.redhat.com it always
login with kerberos ticket and when I logout or login again (either same
or next day) it works fine without need to deal with any cookie.
The only usecase, which come to my mind, why someone may want to skip
login with his kerberos account, is the admin during
testing/preproduction setup phase when he want to try login with
different users etc. But now we have impersonation, so maybe this won't
be needed at all? Awaiting feedback from Michael in other mail..
Marek
On 23.7.2015 09:51, Stian Thorgersen wrote:
How about when a user logs out from Keycloak we add a session cookie
to not use Kerberos again automatically? Even better if there's a concept of a
session-id with Kerberos we can add the session-id to the cookie and automatically login
if the users Kerberos session is changed, but otherwise display username/password form.
----- Original Message -----
> From: "Marek Posolda" <mposolda(a)redhat.com>
> To: "Michael Gerber" <gerbermichi(a)me.com>
> Cc: keycloak-user(a)lists.jboss.org
> Sent: Thursday, 23 July, 2015 8:35:30 AM
> Subject: Re: [keycloak-user] LDAP with Kerberos, login with different user
>
> Maybe we can have special request parameter, which will be send from
> application to login screen. The parameter will contain list of
> authentication mechanisms, which you want to skip for this login. Something
> like "skipAuthType=cookie,kerberos" . The list of skipped alternative
> mechanisms will be saved in ClientSession, so authentication SPI can deal
> with it.
>
> Not sure if it makes sense to add support into adapter, but maybe something
> basic (like we have for parameters "login_hint" or "kc_idp_hint"
in
> keycloak.js) can be added as well?
>
> Marek
>
> On 23.7.2015 08:26, Marek Posolda wrote:
>
>
>
> Do you want that for normal users or just for admin users? Just trying to
> understand the usecase. Because AFAIK the point of kerberos is, that you
> login into the desktop and then you're automatically logged into integrated
> web applications without need to deal with any login screens and
> username/password. When user has just one keycloak account corresponding to
> his kerberos ticket, then why he need to login as different user?
>
> I can understand the usecase for admin, when you want to login as different
> user for testing purpose etc. For this, isn't it possible in windows to do
> something like "kdestroy" to be able to login without kerberos?
>
> Marek
>
> On 23.7.2015 07:44, Michael Gerber wrote:
>
>
>
> Isn't it possible to create a cookie or add an url parameter after the
> logout, so the user is not logged in automatically?
>
> It's crucial for us to be able to log in as a different user, otherwise we
> can not use kerberos at all :(
>
> Michael
>
> Am 22. Juli 2015 um 23:06 schrieb Marek Posolda <mposolda(a)redhat.com> :
>
>
>
>
> I don't think it's doable. Kerberos is kind of desktop login and logout from
> the web application won't destroy the kerberos ticket - similarly like it
> can't logout your laptop/desktop session. So when you visit the secured
> application next time, you are automatically logged into Keycloak through
> SPNEGO due to the Kerberos ticket.
>
> Hence you need to remove kerberos ticket manually (For example "kdestroy"
> works on Linux, but I guess you're using Windows + ActiveDirectory? ) and
> then you will be able to see keycloak login screen and login as different
> user.
>
> Marek
>
> On 22.7.2015 15:38, Michael Gerber wrote:
>
>
>
> Hi all,
>
> I use LDAP with Kerberos and would like to logout and login again with a
> different user (no kerberos login, just keycloak username and password
> dialog).
> Is that possible?
>
> cheers
> Michael
>
>
> _______________________________________________
> keycloak-user mailing list keycloak-user(a)lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
>
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user(a)lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
10:02 a.m.
New subject: LDAP with Kerberos, login with different user
With the new flows, we could detect a kerberos login then ask if they
want to login as that user or another.
On 7/23/2015 2:26 AM, Marek Posolda wrote:
Do you want that for normal users or just for admin users? Just
trying
to understand the usecase. Because AFAIK the point of kerberos is, that
you login into the desktop and then you're automatically logged into
integrated web applications without need to deal with any login screens
and username/password. When user has just one keycloak account
corresponding to his kerberos ticket, then why he need to login as
different user?
I can understand the usecase for admin, when you want to login as
different user for testing purpose etc. For this, isn't it possible in
windows to do something like "kdestroy" to be able to login without
kerberos?
Marek
On 23.7.2015 07:44, Michael Gerber wrote:
> Isn't it possible to create a cookie or add an url parameter after the
> logout, so the user is not logged in automatically?
>
> It's crucial for us to be able to log in as a different user,
> otherwise we can not use kerberos at all :(
>
> Michael
>
> Am 22. Juli 2015 um 23:06 schrieb Marek Posolda <mposolda(a)redhat.com>:
>
>> I don't think it's doable. Kerberos is kind of desktop login and
>> logout from the web application won't destroy the kerberos ticket -
>> similarly like it can't logout your laptop/desktop session. So when
>> you visit the secured application next time, you are automatically
>> logged into Keycloak through SPNEGO due to the Kerberos ticket.
>>
>> Hence you need to remove kerberos ticket manually (For example
>> "kdestroy" works on Linux, but I guess you're using Windows +
>> ActiveDirectory? ) and then you will be able to see keycloak login
>> screen and login as different user.
>>
>> Marek
>>
>> On 22.7.2015 15:38, Michael Gerber wrote:
>>> Hi all,
>>>
>>> I use LDAP with Kerberos and would like to logout and login again
>>> with a different user (no kerberos login, just keycloak username and
>>> password dialog).
>>> Is that possible?
>>>
>>> cheers
>>> Michael
>>>
>>>
>>> _______________________________________________
>>> keycloak-user mailing list
>>> keycloak-user(a)lists.jboss.org
>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>
_______________________________________________
keycloak-user mailing list
keycloak-user(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user
--
Bill Burke
JBoss, a division of Red Hat
http://bill.burkecentral.com
10:36 a.m.
New subject: LDAP with Kerberos, login with different user
"Is this you?"
----- Original Message -----
From: "Bill Burke" <bburke(a)redhat.com>
To: keycloak-user(a)lists.jboss.org
Sent: Thursday, 23 July, 2015 4:02:53 PM
Subject: Re: [keycloak-user] LDAP with Kerberos, login with different user
With the new flows, we could detect a kerberos login then ask if they
want to login as that user or another.
On 7/23/2015 2:26 AM, Marek Posolda wrote:
> Do you want that for normal users or just for admin users? Just trying
> to understand the usecase. Because AFAIK the point of kerberos is, that
> you login into the desktop and then you're automatically logged into
> integrated web applications without need to deal with any login screens
> and username/password. When user has just one keycloak account
> corresponding to his kerberos ticket, then why he need to login as
> different user?
>
> I can understand the usecase for admin, when you want to login as
> different user for testing purpose etc. For this, isn't it possible in
> windows to do something like "kdestroy" to be able to login without
> kerberos?
>
> Marek
>
> On 23.7.2015 07:44, Michael Gerber wrote:
>> Isn't it possible to create a cookie or add an url parameter after the
>> logout, so the user is not logged in automatically?
>>
>> It's crucial for us to be able to log in as a different user,
>> otherwise we can not use kerberos at all :(
>>
>> Michael
>>
>> Am 22. Juli 2015 um 23:06 schrieb Marek Posolda <mposolda(a)redhat.com>:
>>
>>> I don't think it's doable. Kerberos is kind of desktop login and
>>> logout from the web application won't destroy the kerberos ticket -
>>> similarly like it can't logout your laptop/desktop session. So when
>>> you visit the secured application next time, you are automatically
>>> logged into Keycloak through SPNEGO due to the Kerberos ticket.
>>>
>>> Hence you need to remove kerberos ticket manually (For example
>>> "kdestroy" works on Linux, but I guess you're using Windows +
>>> ActiveDirectory? ) and then you will be able to see keycloak login
>>> screen and login as different user.
>>>
>>> Marek
>>>
>>> On 22.7.2015 15:38, Michael Gerber wrote:
>>>> Hi all,
>>>>
>>>> I use LDAP with Kerberos and would like to logout and login again
>>>> with a different user (no kerberos login, just keycloak username and
>>>> password dialog).
>>>> Is that possible?
>>>>
>>>> cheers
>>>> Michael
>>>>
>>>>
>>>> _______________________________________________
>>>> keycloak-user mailing list
>>>> keycloak-user(a)lists.jboss.org
>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>
>
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user(a)lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
--
Bill Burke
JBoss, a division of Red Hat
http://bill.burkecentral.com
_______________________________________________
keycloak-user mailing list
keycloak-user(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user
10:50 a.m.
New subject: LDAP with Kerberos, login with different user
Maybe it can be configurable for the kerberos mechanism? Just the flag
"login automatically" . If it's off, another confirmation screen for the
user will be displayed?
Marek
On 23.7.2015 16:36, Stian Thorgersen wrote:
"Is this you?"
----- Original Message -----
> From: "Bill Burke" <bburke(a)redhat.com>
> To: keycloak-user(a)lists.jboss.org
> Sent: Thursday, 23 July, 2015 4:02:53 PM
> Subject: Re: [keycloak-user] LDAP with Kerberos, login with different user
>
> With the new flows, we could detect a kerberos login then ask if they
> want to login as that user or another.
>
> On 7/23/2015 2:26 AM, Marek Posolda wrote:
>> Do you want that for normal users or just for admin users? Just trying
>> to understand the usecase. Because AFAIK the point of kerberos is, that
>> you login into the desktop and then you're automatically logged into
>> integrated web applications without need to deal with any login screens
>> and username/password. When user has just one keycloak account
>> corresponding to his kerberos ticket, then why he need to login as
>> different user?
>>
>> I can understand the usecase for admin, when you want to login as
>> different user for testing purpose etc. For this, isn't it possible in
>> windows to do something like "kdestroy" to be able to login without
>> kerberos?
>>
>> Marek
>>
>> On 23.7.2015 07:44, Michael Gerber wrote:
>>> Isn't it possible to create a cookie or add an url parameter after the
>>> logout, so the user is not logged in automatically?
>>>
>>> It's crucial for us to be able to log in as a different user,
>>> otherwise we can not use kerberos at all :(
>>>
>>> Michael
>>>
>>> Am 22. Juli 2015 um 23:06 schrieb Marek Posolda <mposolda(a)redhat.com>:
>>>
>>>> I don't think it's doable. Kerberos is kind of desktop login and
>>>> logout from the web application won't destroy the kerberos ticket -
>>>> similarly like it can't logout your laptop/desktop session. So when
>>>> you visit the secured application next time, you are automatically
>>>> logged into Keycloak through SPNEGO due to the Kerberos ticket.
>>>>
>>>> Hence you need to remove kerberos ticket manually (For example
>>>> "kdestroy" works on Linux, but I guess you're using Windows
+
>>>> ActiveDirectory? ) and then you will be able to see keycloak login
>>>> screen and login as different user.
>>>>
>>>> Marek
>>>>
>>>> On 22.7.2015 15:38, Michael Gerber wrote:
>>>>> Hi all,
>>>>>
>>>>> I use LDAP with Kerberos and would like to logout and login again
>>>>> with a different user (no kerberos login, just keycloak username and
>>>>> password dialog).
>>>>> Is that possible?
>>>>>
>>>>> cheers
>>>>> Michael
>>>>>
>>>>>
>>>>> _______________________________________________
>>>>> keycloak-user mailing list
>>>>> keycloak-user(a)lists.jboss.org
>>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>
>>
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user(a)lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>
> --
> Bill Burke
> JBoss, a division of Red Hat
> http://bill.burkecentral.com
> _______________________________________________
> keycloak-user mailing list
> keycloak-user(a)lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
_______________________________________________
keycloak-user mailing list
keycloak-user(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user
11:14 a.m.
New subject: LDAP with Kerberos, login with different user
Why can't we have two separate authentication mechanisms - one IWA, in which case the
user is logged in automatically and on logout he is taken to a login page where a diff
userid can be entered and two, a login page that allows userid/password? That would
address our use case.
Sent from my iPhone
On Jul 23, 2015, at 10:50 AM, Marek Posolda
<mposolda(a)redhat.com> wrote:
Maybe it can be configurable for the kerberos mechanism? Just the flag
"login automatically" . If it's off, another confirmation screen for the
user will be displayed?
Marek
> On 23.7.2015 16:36, Stian Thorgersen wrote:
> "Is this you?"
>
> ----- Original Message -----
>> From: "Bill Burke" <bburke(a)redhat.com>
>> To: keycloak-user(a)lists.jboss.org
>> Sent: Thursday, 23 July, 2015 4:02:53 PM
>> Subject: Re: [keycloak-user] LDAP with Kerberos, login with different user
>>
>> With the new flows, we could detect a kerberos login then ask if they
>> want to login as that user or another.
>>
>>> On 7/23/2015 2:26 AM, Marek Posolda wrote:
>>> Do you want that for normal users or just for admin users? Just trying
>>> to understand the usecase. Because AFAIK the point of kerberos is, that
>>> you login into the desktop and then you're automatically logged into
>>> integrated web applications without need to deal with any login screens
>>> and username/password. When user has just one keycloak account
>>> corresponding to his kerberos ticket, then why he need to login as
>>> different user?
>>>
>>> I can understand the usecase for admin, when you want to login as
>>> different user for testing purpose etc. For this, isn't it possible in
>>> windows to do something like "kdestroy" to be able to login
without
>>> kerberos?
>>>
>>> Marek
>>>
>>>> On 23.7.2015 07:44, Michael Gerber wrote:
>>>> Isn't it possible to create a cookie or add an url parameter after
the
>>>> logout, so the user is not logged in automatically?
>>>>
>>>> It's crucial for us to be able to log in as a different user,
>>>> otherwise we can not use kerberos at all :(
>>>>
>>>> Michael
>>>>
>>>>> Am 22. Juli 2015 um 23:06 schrieb Marek Posolda
<mposolda(a)redhat.com>:
>>>>>
>>>>> I don't think it's doable. Kerberos is kind of desktop login
and
>>>>> logout from the web application won't destroy the kerberos ticket
-
>>>>> similarly like it can't logout your laptop/desktop session. So
when
>>>>> you visit the secured application next time, you are automatically
>>>>> logged into Keycloak through SPNEGO due to the Kerberos ticket.
>>>>>
>>>>> Hence you need to remove kerberos ticket manually (For example
>>>>> "kdestroy" works on Linux, but I guess you're using
Windows +
>>>>> ActiveDirectory? ) and then you will be able to see keycloak login
>>>>> screen and login as different user.
>>>>>
>>>>> Marek
>>>>>
>>>>>> On 22.7.2015 15:38, Michael Gerber wrote:
>>>>>> Hi all,
>>>>>>
>>>>>> I use LDAP with Kerberos and would like to logout and login
again
>>>>>> with a different user (no kerberos login, just keycloak username
and
>>>>>> password dialog).
>>>>>> Is that possible?
>>>>>>
>>>>>> cheers
>>>>>> Michael
>>>>>>
>>>>>>
>>>>>> _______________________________________________
>>>>>> keycloak-user mailing list
>>>>>> keycloak-user(a)lists.jboss.org
>>>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>
>>>
>>> _______________________________________________
>>> keycloak-user mailing list
>>> keycloak-user(a)lists.jboss.org
>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>
>> --
>> Bill Burke
>> JBoss, a division of Red Hat
>> http://bill.burkecentral.com
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user(a)lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user(a)lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
_______________________________________________
keycloak-user mailing list
keycloak-user(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user
11:28 a.m.
New subject: LDAP with Kerberos, login with different user
All this interaction is defined by the SAML and OIDC specifications.
Logout redirects you back to the application and its up to the
application what to do next. We could add a query param that if it is
set, to not do kerberos. This could be in addition to the "login
automatically" flag.
On 7/23/2015 11:14 AM, Raghu Prabhala wrote:
Why can't we have two separate authentication mechanisms - one
IWA, in which case the user is logged in automatically and on logout he is taken to a
login page where a diff userid can be entered and two, a login page that allows
userid/password? That would address our use case.
Sent from my iPhone
> On Jul 23, 2015, at 10:50 AM, Marek Posolda <mposolda(a)redhat.com> wrote:
>
> Maybe it can be configurable for the kerberos mechanism? Just the flag
> "login automatically" . If it's off, another confirmation screen for
the
> user will be displayed?
>
> Marek
>
>> On 23.7.2015 16:36, Stian Thorgersen wrote:
>> "Is this you?"
>>
>> ----- Original Message -----
>>> From: "Bill Burke" <bburke(a)redhat.com>
>>> To: keycloak-user(a)lists.jboss.org
>>> Sent: Thursday, 23 July, 2015 4:02:53 PM
>>> Subject: Re: [keycloak-user] LDAP with Kerberos, login with different user
>>>
>>> With the new flows, we could detect a kerberos login then ask if they
>>> want to login as that user or another.
>>>
>>>> On 7/23/2015 2:26 AM, Marek Posolda wrote:
>>>> Do you want that for normal users or just for admin users? Just trying
>>>> to understand the usecase. Because AFAIK the point of kerberos is, that
>>>> you login into the desktop and then you're automatically logged into
>>>> integrated web applications without need to deal with any login screens
>>>> and username/password. When user has just one keycloak account
>>>> corresponding to his kerberos ticket, then why he need to login as
>>>> different user?
>>>>
>>>> I can understand the usecase for admin, when you want to login as
>>>> different user for testing purpose etc. For this, isn't it possible
in
>>>> windows to do something like "kdestroy" to be able to login
without
>>>> kerberos?
>>>>
>>>> Marek
>>>>
>>>>> On 23.7.2015 07:44, Michael Gerber wrote:
>>>>> Isn't it possible to create a cookie or add an url parameter
after the
>>>>> logout, so the user is not logged in automatically?
>>>>>
>>>>> It's crucial for us to be able to log in as a different user,
>>>>> otherwise we can not use kerberos at all :(
>>>>>
>>>>> Michael
>>>>>
>>>>>> Am 22. Juli 2015 um 23:06 schrieb Marek Posolda
<mposolda(a)redhat.com>:
>>>>>>
>>>>>> I don't think it's doable. Kerberos is kind of desktop
login and
>>>>>> logout from the web application won't destroy the kerberos
ticket -
>>>>>> similarly like it can't logout your laptop/desktop session.
So when
>>>>>> you visit the secured application next time, you are
automatically
>>>>>> logged into Keycloak through SPNEGO due to the Kerberos ticket.
>>>>>>
>>>>>> Hence you need to remove kerberos ticket manually (For example
>>>>>> "kdestroy" works on Linux, but I guess you're using
Windows +
>>>>>> ActiveDirectory? ) and then you will be able to see keycloak
login
>>>>>> screen and login as different user.
>>>>>>
>>>>>> Marek
>>>>>>
>>>>>>> On 22.7.2015 15:38, Michael Gerber wrote:
>>>>>>> Hi all,
>>>>>>>
>>>>>>> I use LDAP with Kerberos and would like to logout and login
again
>>>>>>> with a different user (no kerberos login, just keycloak
username and
>>>>>>> password dialog).
>>>>>>> Is that possible?
>>>>>>>
>>>>>>> cheers
>>>>>>> Michael
>>>>>>>
>>>>>>>
>>>>>>> _______________________________________________
>>>>>>> keycloak-user mailing list
>>>>>>> keycloak-user(a)lists.jboss.org
>>>>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>>
>>>>
>>>> _______________________________________________
>>>> keycloak-user mailing list
>>>> keycloak-user(a)lists.jboss.org
>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>>
>>> --
>>> Bill Burke
>>> JBoss, a division of Red Hat
>>> http://bill.burkecentral.com
>>> _______________________________________________
>>> keycloak-user mailing list
>>> keycloak-user(a)lists.jboss.org
>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user(a)lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user(a)lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
--
Bill Burke
JBoss, a division of Red Hat
http://bill.burkecentral.com
11:31 a.m.
New subject: LDAP with Kerberos, login with different user
OpenID Connect has prompt=select_account query param. If this is sent,
we could automatically display the "Is this you?" page for kerberos.
On 7/23/2015 11:28 AM, Bill Burke wrote:
All this interaction is defined by the SAML and OIDC specifications.
Logout redirects you back to the application and its up to the
application what to do next. We could add a query param that if it is
set, to not do kerberos. This could be in addition to the "login
automatically" flag.
On 7/23/2015 11:14 AM, Raghu Prabhala wrote:
> Why can't we have two separate authentication mechanisms - one IWA, in which case
the user is logged in automatically and on logout he is taken to a login page where a diff
userid can be entered and two, a login page that allows userid/password? That would
address our use case.
>
>
>
> Sent from my iPhone
>
>> On Jul 23, 2015, at 10:50 AM, Marek Posolda <mposolda(a)redhat.com> wrote:
>>
>> Maybe it can be configurable for the kerberos mechanism? Just the flag
>> "login automatically" . If it's off, another confirmation screen
for the
>> user will be displayed?
>>
>> Marek
>>
>>> On 23.7.2015 16:36, Stian Thorgersen wrote:
>>> "Is this you?"
>>>
>>> ----- Original Message -----
>>>> From: "Bill Burke" <bburke(a)redhat.com>
>>>> To: keycloak-user(a)lists.jboss.org
>>>> Sent: Thursday, 23 July, 2015 4:02:53 PM
>>>> Subject: Re: [keycloak-user] LDAP with Kerberos, login with different
user
>>>>
>>>> With the new flows, we could detect a kerberos login then ask if they
>>>> want to login as that user or another.
>>>>
>>>>> On 7/23/2015 2:26 AM, Marek Posolda wrote:
>>>>> Do you want that for normal users or just for admin users? Just
trying
>>>>> to understand the usecase. Because AFAIK the point of kerberos is,
that
>>>>> you login into the desktop and then you're automatically logged
into
>>>>> integrated web applications without need to deal with any login
screens
>>>>> and username/password. When user has just one keycloak account
>>>>> corresponding to his kerberos ticket, then why he need to login as
>>>>> different user?
>>>>>
>>>>> I can understand the usecase for admin, when you want to login as
>>>>> different user for testing purpose etc. For this, isn't it
possible in
>>>>> windows to do something like "kdestroy" to be able to login
without
>>>>> kerberos?
>>>>>
>>>>> Marek
>>>>>
>>>>>> On 23.7.2015 07:44, Michael Gerber wrote:
>>>>>> Isn't it possible to create a cookie or add an url parameter
after the
>>>>>> logout, so the user is not logged in automatically?
>>>>>>
>>>>>> It's crucial for us to be able to log in as a different
user,
>>>>>> otherwise we can not use kerberos at all :(
>>>>>>
>>>>>> Michael
>>>>>>
>>>>>>> Am 22. Juli 2015 um 23:06 schrieb Marek Posolda
<mposolda(a)redhat.com>:
>>>>>>>
>>>>>>> I don't think it's doable. Kerberos is kind of
desktop login and
>>>>>>> logout from the web application won't destroy the
kerberos ticket -
>>>>>>> similarly like it can't logout your laptop/desktop
session. So when
>>>>>>> you visit the secured application next time, you are
automatically
>>>>>>> logged into Keycloak through SPNEGO due to the Kerberos
ticket.
>>>>>>>
>>>>>>> Hence you need to remove kerberos ticket manually (For
example
>>>>>>> "kdestroy" works on Linux, but I guess you're
using Windows +
>>>>>>> ActiveDirectory? ) and then you will be able to see keycloak
login
>>>>>>> screen and login as different user.
>>>>>>>
>>>>>>> Marek
>>>>>>>
>>>>>>>> On 22.7.2015 15:38, Michael Gerber wrote:
>>>>>>>> Hi all,
>>>>>>>>
>>>>>>>> I use LDAP with Kerberos and would like to logout and
login again
>>>>>>>> with a different user (no kerberos login, just keycloak
username and
>>>>>>>> password dialog).
>>>>>>>> Is that possible?
>>>>>>>>
>>>>>>>> cheers
>>>>>>>> Michael
>>>>>>>>
>>>>>>>>
>>>>>>>> _______________________________________________
>>>>>>>> keycloak-user mailing list
>>>>>>>> keycloak-user(a)lists.jboss.org
>>>>>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>>>
>>>>>
>>>>> _______________________________________________
>>>>> keycloak-user mailing list
>>>>> keycloak-user(a)lists.jboss.org
>>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>>>
>>>> --
>>>> Bill Burke
>>>> JBoss, a division of Red Hat
>>>> http://bill.burkecentral.com
>>>> _______________________________________________
>>>> keycloak-user mailing list
>>>> keycloak-user(a)lists.jboss.org
>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>>
>>> _______________________________________________
>>> keycloak-user mailing list
>>> keycloak-user(a)lists.jboss.org
>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user(a)lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
--
Bill Burke
JBoss, a division of Red Hat
http://bill.burkecentral.com
11:43 a.m.
New subject: LDAP with Kerberos, login with different user
The select account prompt wouldn't work for us as some of our applications require
that the user login only by entering userid/pw but your other suggestion might work as
long as we do the Kerberos authentication using Id/ow
Sent from my iPhone
On Jul 23, 2015, at 11:28 AM, Bill Burke <bburke(a)redhat.com>
wrote:
All this interaction is defined by the SAML and OIDC specifications. Logout redirects you
back to the application and its up to the application what to do next. We could add a
query param that if it is set, to not do kerberos. This could be in addition to the
"login automatically" flag.
> On 7/23/2015 11:14 AM, Raghu Prabhala wrote:
> Why can't we have two separate authentication mechanisms - one IWA, in which case
the user is logged in automatically and on logout he is taken to a login page where a diff
userid can be entered and two, a login page that allows userid/password? That would
address our use case.
>
>
>
> Sent from my iPhone
>
>> On Jul 23, 2015, at 10:50 AM, Marek Posolda <mposolda(a)redhat.com> wrote:
>>
>> Maybe it can be configurable for the kerberos mechanism? Just the flag
>> "login automatically" . If it's off, another confirmation screen
for the
>> user will be displayed?
>>
>> Marek
>>
>>> On 23.7.2015 16:36, Stian Thorgersen wrote:
>>> "Is this you?"
>>>
>>> ----- Original Message -----
>>>> From: "Bill Burke" <bburke(a)redhat.com>
>>>> To: keycloak-user(a)lists.jboss.org
>>>> Sent: Thursday, 23 July, 2015 4:02:53 PM
>>>> Subject: Re: [keycloak-user] LDAP with Kerberos, login with different
user
>>>>
>>>> With the new flows, we could detect a kerberos login then ask if they
>>>> want to login as that user or another.
>>>>
>>>>> On 7/23/2015 2:26 AM, Marek Posolda wrote:
>>>>> Do you want that for normal users or just for admin users? Just
trying
>>>>> to understand the usecase. Because AFAIK the point of kerberos is,
that
>>>>> you login into the desktop and then you're automatically logged
into
>>>>> integrated web applications without need to deal with any login
screens
>>>>> and username/password. When user has just one keycloak account
>>>>> corresponding to his kerberos ticket, then why he need to login as
>>>>> different user?
>>>>>
>>>>> I can understand the usecase for admin, when you want to login as
>>>>> different user for testing purpose etc. For this, isn't it
possible in
>>>>> windows to do something like "kdestroy" to be able to login
without
>>>>> kerberos?
>>>>>
>>>>> Marek
>>>>>
>>>>>> On 23.7.2015 07:44, Michael Gerber wrote:
>>>>>> Isn't it possible to create a cookie or add an url parameter
after the
>>>>>> logout, so the user is not logged in automatically?
>>>>>>
>>>>>> It's crucial for us to be able to log in as a different
user,
>>>>>> otherwise we can not use kerberos at all :(
>>>>>>
>>>>>> Michael
>>>>>>
>>>>>>> Am 22. Juli 2015 um 23:06 schrieb Marek Posolda
<mposolda(a)redhat.com>:
>>>>>>>
>>>>>>> I don't think it's doable. Kerberos is kind of
desktop login and
>>>>>>> logout from the web application won't destroy the
kerberos ticket -
>>>>>>> similarly like it can't logout your laptop/desktop
session. So when
>>>>>>> you visit the secured application next time, you are
automatically
>>>>>>> logged into Keycloak through SPNEGO due to the Kerberos
ticket.
>>>>>>>
>>>>>>> Hence you need to remove kerberos ticket manually (For
example
>>>>>>> "kdestroy" works on Linux, but I guess you're
using Windows +
>>>>>>> ActiveDirectory? ) and then you will be able to see keycloak
login
>>>>>>> screen and login as different user.
>>>>>>>
>>>>>>> Marek
>>>>>>>
>>>>>>>> On 22.7.2015 15:38, Michael Gerber wrote:
>>>>>>>> Hi all,
>>>>>>>>
>>>>>>>> I use LDAP with Kerberos and would like to logout and
login again
>>>>>>>> with a different user (no kerberos login, just keycloak
username and
>>>>>>>> password dialog).
>>>>>>>> Is that possible?
>>>>>>>>
>>>>>>>> cheers
>>>>>>>> Michael
>>>>>>>>
>>>>>>>>
>>>>>>>> _______________________________________________
>>>>>>>> keycloak-user mailing list
>>>>>>>> keycloak-user(a)lists.jboss.org
>>>>>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>>>
>>>>>
>>>>> _______________________________________________
>>>>> keycloak-user mailing list
>>>>> keycloak-user(a)lists.jboss.org
>>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>> --
>>>> Bill Burke
>>>> JBoss, a division of Red Hat
>>>> http://bill.burkecentral.com
>>>> _______________________________________________
>>>> keycloak-user mailing list
>>>> keycloak-user(a)lists.jboss.org
>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>> _______________________________________________
>>> keycloak-user mailing list
>>> keycloak-user(a)lists.jboss.org
>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user(a)lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
--
Bill Burke
JBoss, a division of Red Hat
http://bill.burkecentral.com
3:49 a.m.
New subject: LDAP with Kerberos, login with different user
Support for prompt=select_account will be cool. Another suggestion for
adding query parameter for skip some mechanisms (like
skipAuthMechanism=cookie,kerberos ) might be good too.
Not sure if we need to support both, but IMO it will be good to have
solution not tightly coupled to Kerberos. I can imagine similar
situation with other login mechanisms as well. For example with
authenticating users by certificate, admin may also want to skip
automatic login with the certificate from his browser and instead login
with username/password form.
Marek
On 23.7.2015 17:43, Raghu Prabhala wrote:
The select account prompt wouldn't work for us as some of our
applications require that the user login only by entering userid/pw but your other
suggestion might work as long as we do the Kerberos authentication using Id/ow
Sent from my iPhone
> On Jul 23, 2015, at 11:28 AM, Bill Burke <bburke(a)redhat.com> wrote:
>
> All this interaction is defined by the SAML and OIDC specifications. Logout redirects
you back to the application and its up to the application what to do next. We could add a
query param that if it is set, to not do kerberos. This could be in addition to the
"login automatically" flag.
>
>
>> On 7/23/2015 11:14 AM, Raghu Prabhala wrote:
>> Why can't we have two separate authentication mechanisms - one IWA, in which
case the user is logged in automatically and on logout he is taken to a login page where a
diff userid can be entered and two, a login page that allows userid/password? That would
address our use case.
>>
>>
>>
>> Sent from my iPhone
>>
>>> On Jul 23, 2015, at 10:50 AM, Marek Posolda <mposolda(a)redhat.com>
wrote:
>>>
>>> Maybe it can be configurable for the kerberos mechanism? Just the flag
>>> "login automatically" . If it's off, another confirmation
screen for the
>>> user will be displayed?
>>>
>>> Marek
>>>
>>>> On 23.7.2015 16:36, Stian Thorgersen wrote:
>>>> "Is this you?"
>>>>
>>>> ----- Original Message -----
>>>>> From: "Bill Burke" <bburke(a)redhat.com>
>>>>> To: keycloak-user(a)lists.jboss.org
>>>>> Sent: Thursday, 23 July, 2015 4:02:53 PM
>>>>> Subject: Re: [keycloak-user] LDAP with Kerberos, login with different
user
>>>>>
>>>>> With the new flows, we could detect a kerberos login then ask if
they
>>>>> want to login as that user or another.
>>>>>
>>>>>> On 7/23/2015 2:26 AM, Marek Posolda wrote:
>>>>>> Do you want that for normal users or just for admin users? Just
trying
>>>>>> to understand the usecase. Because AFAIK the point of kerberos
is, that
>>>>>> you login into the desktop and then you're automatically
logged into
>>>>>> integrated web applications without need to deal with any login
screens
>>>>>> and username/password. When user has just one keycloak account
>>>>>> corresponding to his kerberos ticket, then why he need to login
as
>>>>>> different user?
>>>>>>
>>>>>> I can understand the usecase for admin, when you want to login
as
>>>>>> different user for testing purpose etc. For this, isn't it
possible in
>>>>>> windows to do something like "kdestroy" to be able to
login without
>>>>>> kerberos?
>>>>>>
>>>>>> Marek
>>>>>>
>>>>>>> On 23.7.2015 07:44, Michael Gerber wrote:
>>>>>>> Isn't it possible to create a cookie or add an url
parameter after the
>>>>>>> logout, so the user is not logged in automatically?
>>>>>>>
>>>>>>> It's crucial for us to be able to log in as a different
user,
>>>>>>> otherwise we can not use kerberos at all :(
>>>>>>>
>>>>>>> Michael
>>>>>>>
>>>>>>>> Am 22. Juli 2015 um 23:06 schrieb Marek Posolda
<mposolda(a)redhat.com>:
>>>>>>>>
>>>>>>>> I don't think it's doable. Kerberos is kind of
desktop login and
>>>>>>>> logout from the web application won't destroy the
kerberos ticket -
>>>>>>>> similarly like it can't logout your laptop/desktop
session. So when
>>>>>>>> you visit the secured application next time, you are
automatically
>>>>>>>> logged into Keycloak through SPNEGO due to the Kerberos
ticket.
>>>>>>>>
>>>>>>>> Hence you need to remove kerberos ticket manually (For
example
>>>>>>>> "kdestroy" works on Linux, but I guess
you're using Windows +
>>>>>>>> ActiveDirectory? ) and then you will be able to see
keycloak login
>>>>>>>> screen and login as different user.
>>>>>>>>
>>>>>>>> Marek
>>>>>>>>
>>>>>>>>> On 22.7.2015 15:38, Michael Gerber wrote:
>>>>>>>>> Hi all,
>>>>>>>>>
>>>>>>>>> I use LDAP with Kerberos and would like to logout and
login again
>>>>>>>>> with a different user (no kerberos login, just
keycloak username and
>>>>>>>>> password dialog).
>>>>>>>>> Is that possible?
>>>>>>>>>
>>>>>>>>> cheers
>>>>>>>>> Michael
>>>>>>>>>
>>>>>>>>>
>>>>>>>>> _______________________________________________
>>>>>>>>> keycloak-user mailing list
>>>>>>>>> keycloak-user(a)lists.jboss.org
>>>>>>>>>
https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>>>>
>>>>>> _______________________________________________
>>>>>> keycloak-user mailing list
>>>>>> keycloak-user(a)lists.jboss.org
>>>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>>> --
>>>>> Bill Burke
>>>>> JBoss, a division of Red Hat
>>>>> http://bill.burkecentral.com
>>>>> _______________________________________________
>>>>> keycloak-user mailing list
>>>>> keycloak-user(a)lists.jboss.org
>>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>> _______________________________________________
>>>> keycloak-user mailing list
>>>> keycloak-user(a)lists.jboss.org
>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>> _______________________________________________
>>> keycloak-user mailing list
>>> keycloak-user(a)lists.jboss.org
>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
> --
> Bill Burke
> JBoss, a division of Red Hat
> http://bill.burkecentral.com
3:55 a.m.
New subject: LDAP with Kerberos, login with different user
----- Original Message -----
From: "Marek Posolda" <mposolda(a)redhat.com>
To: "Raghu Prabhala" <prabhalar(a)yahoo.com>, "Bill Burke"
<bburke(a)redhat.com>
Cc: "Stian Thorgersen" <stian(a)redhat.com>, keycloak-user(a)lists.jboss.org
Sent: Friday, 24 July, 2015 9:49:45 AM
Subject: Re: [keycloak-user] LDAP with Kerberos, login with different user
Support for prompt=select_account will be cool. Another suggestion for
adding query parameter for skip some mechanisms (like
skipAuthMechanism=cookie,kerberos ) might be good too.
That'll only make sense if we also add support to allow multiple accounts, which could
be fairly easy on the server-side, but much harder to support in adapters.
Not sure if we need to support both, but IMO it will be good to have
solution not tightly coupled to Kerberos. I can imagine similar
situation with other login mechanisms as well. For example with
authenticating users by certificate, admin may also want to skip
automatic login with the certificate from his browser and instead login
with username/password form.
Marek
On 23.7.2015 17:43, Raghu Prabhala wrote:
> The select account prompt wouldn't work for us as some of our applications
> require that the user login only by entering userid/pw but your other
> suggestion might work as long as we do the Kerberos authentication using
> Id/ow
>
> Sent from my iPhone
>
>> On Jul 23, 2015, at 11:28 AM, Bill Burke <bburke(a)redhat.com> wrote:
>>
>> All this interaction is defined by the SAML and OIDC specifications.
>> Logout redirects you back to the application and its up to the
>> application what to do next. We could add a query param that if it is
>> set, to not do kerberos. This could be in addition to the "login
>> automatically" flag.
>>
>>
>>> On 7/23/2015 11:14 AM, Raghu Prabhala wrote:
>>> Why can't we have two separate authentication mechanisms - one IWA, in
>>> which case the user is logged in automatically and on logout he is taken
>>> to a login page where a diff userid can be entered and two, a login page
>>> that allows userid/password? That would address our use case.
>>>
>>>
>>>
>>> Sent from my iPhone
>>>
>>>> On Jul 23, 2015, at 10:50 AM, Marek Posolda <mposolda(a)redhat.com>
wrote:
>>>>
>>>> Maybe it can be configurable for the kerberos mechanism? Just the flag
>>>> "login automatically" . If it's off, another confirmation
screen for the
>>>> user will be displayed?
>>>>
>>>> Marek
>>>>
>>>>> On 23.7.2015 16:36, Stian Thorgersen wrote:
>>>>> "Is this you?"
>>>>>
>>>>> ----- Original Message -----
>>>>>> From: "Bill Burke" <bburke(a)redhat.com>
>>>>>> To: keycloak-user(a)lists.jboss.org
>>>>>> Sent: Thursday, 23 July, 2015 4:02:53 PM
>>>>>> Subject: Re: [keycloak-user] LDAP with Kerberos, login with
different
>>>>>> user
>>>>>>
>>>>>> With the new flows, we could detect a kerberos login then ask if
they
>>>>>> want to login as that user or another.
>>>>>>
>>>>>>> On 7/23/2015 2:26 AM, Marek Posolda wrote:
>>>>>>> Do you want that for normal users or just for admin users?
Just
>>>>>>> trying
>>>>>>> to understand the usecase. Because AFAIK the point of
kerberos is,
>>>>>>> that
>>>>>>> you login into the desktop and then you're automatically
logged into
>>>>>>> integrated web applications without need to deal with any
login
>>>>>>> screens
>>>>>>> and username/password. When user has just one keycloak
account
>>>>>>> corresponding to his kerberos ticket, then why he need to
login as
>>>>>>> different user?
>>>>>>>
>>>>>>> I can understand the usecase for admin, when you want to
login as
>>>>>>> different user for testing purpose etc. For this, isn't
it possible
>>>>>>> in
>>>>>>> windows to do something like "kdestroy" to be able
to login without
>>>>>>> kerberos?
>>>>>>>
>>>>>>> Marek
>>>>>>>
>>>>>>>> On 23.7.2015 07:44, Michael Gerber wrote:
>>>>>>>> Isn't it possible to create a cookie or add an url
parameter after
>>>>>>>> the
>>>>>>>> logout, so the user is not logged in automatically?
>>>>>>>>
>>>>>>>> It's crucial for us to be able to log in as a
different user,
>>>>>>>> otherwise we can not use kerberos at all :(
>>>>>>>>
>>>>>>>> Michael
>>>>>>>>
>>>>>>>>> Am 22. Juli 2015 um 23:06 schrieb Marek Posolda
>>>>>>>>> <mposolda(a)redhat.com>:
>>>>>>>>>
>>>>>>>>> I don't think it's doable. Kerberos is kind
of desktop login and
>>>>>>>>> logout from the web application won't destroy
the kerberos ticket -
>>>>>>>>> similarly like it can't logout your
laptop/desktop session. So when
>>>>>>>>> you visit the secured application next time, you are
automatically
>>>>>>>>> logged into Keycloak through SPNEGO due to the
Kerberos ticket.
>>>>>>>>>
>>>>>>>>> Hence you need to remove kerberos ticket manually
(For example
>>>>>>>>> "kdestroy" works on Linux, but I guess
you're using Windows +
>>>>>>>>> ActiveDirectory? ) and then you will be able to see
keycloak login
>>>>>>>>> screen and login as different user.
>>>>>>>>>
>>>>>>>>> Marek
>>>>>>>>>
>>>>>>>>>> On 22.7.2015 15:38, Michael Gerber wrote:
>>>>>>>>>> Hi all,
>>>>>>>>>>
>>>>>>>>>> I use LDAP with Kerberos and would like to
logout and login again
>>>>>>>>>> with a different user (no kerberos login, just
keycloak username
>>>>>>>>>> and
>>>>>>>>>> password dialog).
>>>>>>>>>> Is that possible?
>>>>>>>>>>
>>>>>>>>>> cheers
>>>>>>>>>> Michael
>>>>>>>>>>
>>>>>>>>>>
>>>>>>>>>> _______________________________________________
>>>>>>>>>> keycloak-user mailing list
>>>>>>>>>> keycloak-user(a)lists.jboss.org
>>>>>>>>>>
https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>>>>>
>>>>>>> _______________________________________________
>>>>>>> keycloak-user mailing list
>>>>>>> keycloak-user(a)lists.jboss.org
>>>>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>>>> --
>>>>>> Bill Burke
>>>>>> JBoss, a division of Red Hat
>>>>>> http://bill.burkecentral.com
>>>>>> _______________________________________________
>>>>>> keycloak-user mailing list
>>>>>> keycloak-user(a)lists.jboss.org
>>>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>>> _______________________________________________
>>>>> keycloak-user mailing list
>>>>> keycloak-user(a)lists.jboss.org
>>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>> _______________________________________________
>>>> keycloak-user mailing list
>>>> keycloak-user(a)lists.jboss.org
>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>> --
>> Bill Burke
>> JBoss, a division of Red Hat
>> http://bill.burkecentral.com
3196
days inactive
3197
days old
13 comments
5 participants
participants (5)
-
Bill Burke -
Marek Posolda -
Michael Gerber -
Raghu Prabhala -
Stian Thorgersen